diff --git a/.github/workflows/packaging-lint.yml b/.github/workflows/packaging-lint.yml
index 1d110e28f2..6848088d37 100644
--- a/.github/workflows/packaging-lint.yml
+++ b/.github/workflows/packaging-lint.yml
@@ -29,3 +29,27 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: bash packaging/linux/verified-download-test.sh
+
+  windows-install-policy:
+    timeout-minutes: 10
+    name: Windows installation policy (no app build)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install the pinned packaging toolchain
+        shell: pwsh
+        run: |
+          $tools = Join-Path $env:RUNNER_TEMP 'craft-install-policy-wix'
+          dotnet tool install --tool-path $tools wix --version 5.0.2
+          if ($LASTEXITCODE -ne 0) { throw 'WiX installation failed.' }
+          $tools >> $env:GITHUB_PATH
+          $policy = Get-Content -Raw -LiteralPath packaging/windows/install-policy.json | ConvertFrom-Json
+          foreach ($extension in @($policy.extensions)) {
+            & (Join-Path $tools 'wix.exe') extension add -g "WixToolset.$extension.wixext/5.0.2"
+            if ($LASTEXITCODE -ne 0) { throw "WiX extension $extension installation failed." }
+          }
+      - name: Build and check non-executable installer fixtures
+        shell: pwsh
+        run: ./packaging/windows/test-install-policy.ps1 -OutputDirectory (Join-Path $env:RUNNER_TEMP 'craft-install-policy-tests')
diff --git a/.github/workflows/perf-nightly.yml b/.github/workflows/perf-nightly.yml
index 64592d9cf0..71afc03e14 100644
--- a/.github/workflows/perf-nightly.yml
+++ b/.github/workflows/perf-nightly.yml
@@ -4,10 +4,13 @@ name: Perf (nightly)
 # Metal), every night and on demand. It never runs on pull requests, so it can't block one.
 # It fails when an enforced budget in perf/budgets.toml breaks or a scenario's p50 regresses
 # more than 15 % against perf/baseline.json from the same machine class (other classes are
-# never compared). The table goes to the job summary; results.json is uploaded as an artifact.
+# never compared; a baseline built from several runs is judged against its highest p50). The
+# table goes to the job summary; results.json is uploaded as the `perf-results` artifact.
 #
-# To give this runner class its own baseline: run it by hand with "update_baseline", download
-# the `perf-baseline` artifact and commit it as perf/baseline.json in a PR.
+# To give this runner class its own baseline: download the `perf-results` artifact of the last
+# five or more nightly runs (`gh run download <run id> -n perf-results -D runs/<run id>`), run
+# `cargo xtask perf --update-baseline --from runs/<id>/results.json ... --allow-contended` (this
+# runner is never idle) and commit perf/baseline.json and docs/scorecard.md in a PR.
 
 on:
   schedule:
@@ -58,7 +61,8 @@ jobs:
         run: |
           args=()
           if [ "$QUICK" = "true" ]; then args+=(--quick); fi
-          if [ "$UPDATE" = "true" ]; then args+=(--update-baseline); fi
+          # This runner is never idle: a baseline from it is recorded labelled as contended.
+          if [ "$UPDATE" = "true" ]; then args+=(--update-baseline --allow-contended); fi
           cargo xtask perf "${args[@]}"
 
       - name: Job summary
diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml
index 1022c54215..27111f3b94 100644
--- a/.github/workflows/windows-arm64.yml
+++ b/.github/workflows/windows-arm64.yml
@@ -26,8 +26,10 @@ permissions:
 
 jobs:
   windows-arm64:
-    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
-    uses: storytold/craft-common-actions/.github/workflows/windows-arm64.yml@main
+    # Immutable supporting workflow revision until the new install contract lands upstream.
+    uses: storytold/craft-common-actions/.github/workflows/windows-arm64.yml@8bb4e5ab95443171104ad88113fe1ef9b0e5ce3f
     with:
       app-name: photocraft
       app-dir: PhotoCraft
+      install-relative-path: Programs/ArtCraft/PhotoCraft
+      install-scope: perUser
diff --git a/AGENTS.md b/AGENTS.md
index 172bc7bd70..e1ffe55928 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -58,7 +58,7 @@ People trust PhotoCraft with their work, and a crash loses it. A malformed file,
 - **Don't cascade.** Handle lock poisoning (`lock().unwrap_or_else(PoisonError::into_inner)`) and treat thread joins as `Result`s.
 - **Last-resort guard.** The app shell must catch an escaped panic around command dispatch and file import/export, reports it as an error and keeps the document. It's a safety net, not a licence to panic. Keep `panic = "unwind"`.
 - **Prove it.** Every crash fix comes with a small synthetic regression test that panicked before the fix.
-- **Enforced by clippy.** `clippy.toml` allows `unwrap`/`expect`/`panic`/indexing in tests only. Clean crates carry `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`; new crates start with it.
+- **Enforced by clippy.** `clippy.toml` allows `unwrap`/`expect`/`panic` in tests only. Clean production crate roots carry `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`; every new workspace crate must also include `[lints] workspace = true` in `Cargo.toml` to inherit `[workspace.lints]`.
 
 1. **Everything is a command.** New user-visible behaviour = a command in the engine (`crates/engine/src/*_cmds.rs`, registered in `commands.rs`) with id, label, menu path, shortcut, params doc, `enabled` and `run`, plus tests. The UI, CLI, control channel and MCP all dispatch commands by id. Use the **exact id from `crates/ui-egui/src/menu_catalog.rs`** and the menu item goes live automatically. Only pure view/window state (zoom, panels, screen mode) belongs to the shell (`menus.rs` `UI_COMMANDS`).
 2. **No format or colour assumptions.** Bit depth (8/16/32f) and colour model (RGB/Gray/CMYK/Lab…) are runtime data. Never introduce a `u8`-only pixel path in public APIs. Never assume sRGB: colour conversions go through `photocraft-cms` (`Transform`, `transform::cached`). Test at several depths.
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index fdec613767..83c583649f 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -29,11 +29,12 @@ next to them.
 | `epaint_default_fonts::EGUI_ICONS` (build input; deflated into `OUT_DIR/egui_fonts/egui-icons.ttf.deflate`, registered by `crates/ui-egui/src/egui_fonts.rs`) | egui-icons, five-glyph subset of emoji-icon-font | John Slegers | [egui fork at 6d518fc](https://github.com/storytold/egui/tree/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts), [original](https://github.com/jslegers/emoji-icon-font); egui subset, unmodified here | MIT; Copyright (c) 2014 John Slegers; full upstream notice in [NOTICE](NOTICE) |
 | `assets/fonts/Inter-Regular.ttf`, `Inter-Medium.ttf`, `Inter-SemiBold.ttf` | Inter 4.001 (UI font) | The Inter Project Authors (Rasmus Andersson) | <https://github.com/rsms/inter> | SIL OFL 1.1, [`assets/fonts/OFL-Inter.txt`](assets/fonts/OFL-Inter.txt) |
 | `assets/fonts/JetBrainsMono-Regular.ttf` | JetBrains Mono 2.305 (numeric font) | The JetBrains Mono Project Authors | <https://github.com/JetBrains/JetBrainsMono> | SIL OFL 1.1, [`assets/fonts/OFL-JetBrainsMono.txt`](assets/fonts/OFL-JetBrainsMono.txt) |
-| `assets/icons/*.svg` except `slice-knife.svg`, `slice-select.svg`, `sampler.svg`, `artboard.svg`, `perspective-crop.svg`, `frame-placeholder.svg`, `ellipse-dashed.svg`, `gradient.svg`, `type-mask.svg`, `type-mask-vertical.svg`, `text-warp.svg`, `clip-below.svg`, `clip-release.svg`, `layer-mask.svg`, `adjustment-layer.svg`, `brush-replace.svg`, `quick-selection.svg`, `eraser-background.svg`, `eraser-magic.svg`, `lasso-magnetic.svg`, `direct-select.svg`, `convert-point.svg`, `pen-add-anchor.svg`, `pen-delete-anchor.svg`, `pen-freeform.svg`, `pen-curvature.svg`, `bandage-sparkle.svg`, `painting-symmetry.svg`, `symmetry-*.svg` and `marquee-{row,column}.svg`, `align-edge-*.svg` and `distribute-*.svg` (113 files; `star-filled.svg` is `star.svg` with a solid fill) | Lucide icons | Lucide Icons and Contributors | <https://github.com/lucide-icons/lucide> (`icons/<name>.svg`; `align-*` are now named `text-align-*` upstream) | ISC, [`assets/icons/LICENSE-lucide.txt`](assets/icons/LICENSE-lucide.txt) |
+| `assets/icons/*.svg` except `slice-knife.svg`, `slice-select.svg`, `font-similar.svg`, `font-variable.svg`, `sampler.svg`, `artboard.svg`, `perspective-crop.svg`, `frame-placeholder.svg`, `ellipse-dashed.svg`, `gradient.svg`, `type-mask.svg`, `type-mask-vertical.svg`, `text-warp.svg`, `clip-below.svg`, `clip-release.svg`, `layer-mask.svg`, `adjustment-layer.svg`, `brush-replace.svg`, `quick-selection.svg`, `eraser-background.svg`, `eraser-magic.svg`, `lasso-magnetic.svg`, `direct-select.svg`, `convert-point.svg`, `pen-add-anchor.svg`, `pen-delete-anchor.svg`, `pen-freeform.svg`, `pen-curvature.svg`, `bandage-sparkle.svg`, `painting-symmetry.svg`, `symmetry-*.svg` and `marquee-{row,column}.svg`, `align-edge-*.svg` and `distribute-*.svg` (113 files; `star-filled.svg` is `star.svg` with a solid fill) | Lucide icons | Lucide Icons and Contributors | <https://github.com/lucide-icons/lucide> (`icons/<name>.svg`; `align-*` are now named `text-align-*` upstream) | ISC, [`assets/icons/LICENSE-lucide.txt`](assets/icons/LICENSE-lucide.txt) |
 | `assets/icons/{check,chevron-down,chevron-left,chevron-right,chevron-up,chevrons-left,chevrons-right,circle,clock,compass,info,link,link-2,lock,minus,monitor,moon,move,navigation,plus,search,square,trash,triangle,type,x,zoom-in}.svg` | Lucide icons derived from Feather (subset of the row above) | Cole Bemis (Feather), Lucide Contributors | <https://github.com/feathericons/feather> via Lucide | MIT (Feather) and ISC (Lucide), [`assets/icons/LICENSE-lucide.txt`](assets/icons/LICENSE-lucide.txt) |
 | `assets/icons/slice-knife.svg` | Slice tool glyph | PhotoCraft contributors | Original work | MIT OR Apache-2.0 |
 | `assets/icons/slice-select.svg` | Slice Select tool glyph | PhotoCraft contributors | Original work | MIT OR Apache-2.0 |
 | `assets/icons/sampler.svg` | Color Sampler tool glyph: a target reticle marking a sampled pixel | PhotoCraft contributors | Original work | MIT OR Apache-2.0 |
+| `assets/icons/font-similar.svg`, `assets/icons/font-variable.svg` | Font menu filter glyphs: two waves (Show Similar Fonts) and a T over a slider (Show Variable Fonts), drawn on the 24 px icon grid | PhotoCraft contributors | Original work | MIT OR Apache-2.0 |
 | `assets/icons/convert-point.svg` | Convert Point tool glyph: an angle with a square anchor on its apex, drawn on Lucide's 24 px grid and stroke | PhotoCraft contributors | Original work | MIT OR Apache-2.0 |
 | `assets/icons/artboard.svg` | Artboard tool glyph: a board with a tick at each end of its edges | PhotoCraft contributors | Original work | MIT OR Apache-2.0 |
 | `assets/icons/perspective-crop.svg` | Perspective Crop tool glyph: a crop frame in perspective with its grid and crop-mark ticks | PhotoCraft contributors | Original work | MIT OR Apache-2.0 |
diff --git a/Cargo.lock b/Cargo.lock
index b0e27d86c2..a7fa1b483f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1163,6 +1163,15 @@ dependencies = [
  "x509-cert",
 ]
 
+[[package]]
+name = "cobs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
+dependencies = [
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "codespan-reporting"
 version = "0.13.1"
@@ -1341,12 +1350,40 @@ dependencies = [
 [[package]]
 name = "craft-docpath"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=495e5971bc024aa96e6ed318cb6e7cd3a0103184#495e5971bc024aa96e6ed318cb6e7cd3a0103184"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+
+[[package]]
+name = "craft-fonts-build"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+
+[[package]]
+name = "craft-i18n"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+dependencies = [
+ "fixed_decimal",
+ "icu_decimal",
+ "icu_locale_core",
+ "icu_locale_fallback",
+ "icu_normalizer",
+ "icu_plurals",
+ "icu_properties",
+ "icu_provider",
+ "icu_provider_adapters",
+ "icu_provider_blob",
+ "log",
+ "objc2-foundation 0.3.2",
+ "sys-locale",
+ "unicode-bidi",
+ "windows-registry",
+ "writeable",
+]
 
 [[package]]
 name = "craft-jpeg"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=495e5971bc024aa96e6ed318cb6e7cd3a0103184#495e5971bc024aa96e6ed318cb6e7cd3a0103184"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
  "thiserror 2.0.21",
 ]
@@ -1354,11 +1391,11 @@ dependencies = [
 [[package]]
 name = "craft-print"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=495e5971bc024aa96e6ed318cb6e7cd3a0103184#495e5971bc024aa96e6ed318cb6e7cd3a0103184"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
  "craft-winprint-gdi",
- "miniz_oxide 0.8.9",
- "roxmltree 0.20.0",
+ "miniz_oxide 0.9.1",
+ "roxmltree 0.21.1",
  "tempfile",
  "winprint",
  "winsafe",
@@ -1367,20 +1404,28 @@ dependencies = [
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=495e5971bc024aa96e6ed318cb6e7cd3a0103184#495e5971bc024aa96e6ed318cb6e7cd3a0103184"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
+ "craft-fonts-build",
+ "craft-i18n",
  "egui",
+ "epaint",
+ "js-sys",
  "log",
  "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "serde",
+ "skrifa",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
 ]
 
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=495e5971bc024aa96e6ed318cb6e7cd3a0103184#495e5971bc024aa96e6ed318cb6e7cd3a0103184"
+source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
 dependencies = [
  "chrono",
  "dunce",
@@ -2175,6 +2220,17 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
+[[package]]
+name = "fixed_decimal"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2214fb00f669ee96bee5bb29dfb1ddabe058b2bc426817efc79afa03c9bc55ae"
+dependencies = [
+ "displaydoc",
+ "smallvec",
+ "writeable",
+]
+
 [[package]]
 name = "fixedbitset"
 version = "0.5.7"
@@ -2956,6 +3012,23 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "icu_decimal"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9eb8f655bba2d0c0459e43a5b0e6cd3cd388109898fb3d85d048165e8b0abd08"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_locale_core",
+ "icu_pattern",
+ "icu_plurals",
+ "icu_provider",
+ "serde",
+ "writeable",
+ "zerovec",
+]
+
 [[package]]
 name = "icu_locale_core"
 version = "2.3.0"
@@ -3001,6 +3074,9 @@ dependencies = [
  "icu_properties",
  "icu_provider",
  "smallvec",
+ "utf16_iter",
+ "utf8_iter",
+ "write16",
  "zerovec",
 ]
 
@@ -3010,6 +3086,32 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
 
+[[package]]
+name = "icu_pattern"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b3db611446bd92c246b03e4aa0bafa71ddb194af431ddbb42b9d70e4bfce1a0"
+dependencies = [
+ "displaydoc",
+ "either",
+ "serde",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_plurals"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e475e6766ef87b1d3c1f97be6363995b0bfaeddbc789671615df598a97ff0593"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_provider",
+ "serde",
+ "zerovec",
+]
+
 [[package]]
 name = "icu_properties"
 version = "2.3.0"
@@ -3039,6 +3141,7 @@ checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
+ "postcard",
  "serde",
  "stable_deref_trait",
  "writeable",
@@ -3048,6 +3151,30 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "icu_provider_adapters"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df887bc4f55dbc773c7c45a0c7dfa75be886f7b7812830a71ab7271cc1801820"
+dependencies = [
+ "icu_locale_fallback",
+ "icu_provider",
+]
+
+[[package]]
+name = "icu_provider_blob"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5916b44fac319d3f58e4d8d805a627df19e27937b582cd99fcde3bb6b7ce1b0e"
+dependencies = [
+ "icu_provider",
+ "postcard",
+ "serde",
+ "writeable",
+ "zerotrie",
+ "zerovec",
+]
+
 [[package]]
 name = "icu_segmenter"
 version = "2.3.0"
@@ -3720,6 +3847,9 @@ name = "litemap"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+dependencies = [
+ "serde_core",
+]
 
 [[package]]
 name = "litrs"
@@ -4918,6 +5048,7 @@ dependencies = [
  "photocraft-engine",
  "photocraft-format",
  "photocraft-io",
+ "photocraft-raster",
  "photocraft-raw",
  "rmcp",
  "rustix 1.1.5",
@@ -5118,6 +5249,7 @@ dependencies = [
  "craft-docpath",
  "crc32fast",
  "flate2",
+ "miniz_oxide 0.9.1",
  "photocraft-affinity",
  "photocraft-algo",
  "photocraft-cms",
@@ -5514,6 +5646,16 @@ dependencies = [
  "portable-atomic",
 ]
 
+[[package]]
+name = "postcard"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
+dependencies = [
+ "cobs",
+ "serde",
+]
+
 [[package]]
 name = "potential_utf"
 version = "0.1.6"
@@ -7176,7 +7318,10 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8eab9a99a024a169fe8a903cf9d4a3b3601109bcc13bd9e3c6fff259138626c4"
 dependencies = [
+ "js-sys",
  "libc",
+ "wasm-bindgen",
+ "web-sys",
 ]
 
 [[package]]
@@ -7825,6 +7970,12 @@ dependencies = [
  "xmlwriter",
 ]
 
+[[package]]
+name = "utf16_iter"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
+
 [[package]]
 name = "utf8-zero"
 version = "0.8.1"
@@ -8864,11 +9015,20 @@ dependencies = [
  "wayland-protocols-wlr",
 ]
 
+[[package]]
+name = "write16"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
+
 [[package]]
 name = "writeable"
 version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+dependencies = [
+ "either",
+]
 
 [[package]]
 name = "x11-dl"
@@ -9246,6 +9406,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
 dependencies = [
  "displaydoc",
+ "litemap",
+ "serde_core",
  "yoke",
  "zerofrom",
  "zerovec",
diff --git a/Cargo.toml b/Cargo.toml
index a3b0ca4b36..e7a70d55b3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,7 +10,7 @@ license = "MIT OR Apache-2.0"
 rust-version = "1.95"
 
 [workspace.dependencies]
-craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "495e5971bc024aa96e6ed318cb6e7cd3a0103184", features = ["serde"] }
+craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", features = ["serde"] }
 # internal
 photocraft-geom = { path = "crates/geom" }
 photocraft-color = { path = "crates/color" }
@@ -39,10 +39,10 @@ photocraft-tablet = { path = "crates/tablet" }
 photocraft-ipp = { path = "crates/ipp" }
 
 # external
-craft-print = { git = "https://github.com/storytold/craft-libs", rev = "495e5971bc024aa96e6ed318cb6e7cd3a0103184" }
-craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "495e5971bc024aa96e6ed318cb6e7cd3a0103184" }
-craft-jpeg = { git = "https://github.com/storytold/craft-libs", rev = "495e5971bc024aa96e6ed318cb6e7cd3a0103184" }
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "495e5971bc024aa96e6ed318cb6e7cd3a0103184", features = ["egui"] }
+craft-print = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
+craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
+craft-jpeg = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0" }
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", features = ["egui"] }
 thiserror = "2"
 serde = { version = "1", features = ["derive", "rc"] }
 serde_json = "1"
@@ -51,7 +51,7 @@ clap_complete = "4.6.11"
 clap_mangen = { version = "0.3.3", features = ["env"] }
 arc-swap = "1"
 bytemuck = { version = "1", features = ["derive"] }
-flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
+flate2 = { version = "1.1.10", default-features = false, features = ["zlib-rs", "runtime_detection"] }
 image = { version = "0.25", default-features = false }
 # Baseline-JPEG decode of lossy DNG tiles (compression 34892), shared with zune-jpeg.
 zune-core = "0.5"
@@ -76,6 +76,9 @@ web-time = "1"
 unsafe_code = "forbid"
 
 [workspace.lints.clippy]
+cognitive_complexity = "deny"
+too_many_arguments = "deny"
+wildcard_imports = "deny"
 dbg_macro = "warn"
 todo = "warn"
 
diff --git a/apps/photocraft/src/main.rs b/apps/photocraft/src/main.rs
index a4fe847cda..d1a3b68d3b 100644
--- a/apps/photocraft/src/main.rs
+++ b/apps/photocraft/src/main.rs
@@ -193,6 +193,143 @@ fn at_least_min_size(mut builder: egui::ViewportBuilder) -> egui::ViewportBuilde
     builder
 }
 
+/// Attach the log file under the settings directory. Called after the arguments are parsed, so
+/// `--version` and usage errors leave no file behind. Records logged until now are written first.
+fn attach_log_file(logger: Option<&'static logging::AppLogger>) {
+    if let (Some(logger), Some(dir)) = (logger, services::config_dir()) {
+        match logger.attach_dir(&dir.join("logs")) {
+            Ok(path) => log::info!("PhotoCraft {}, log file {}", photocraft_engine::build_info::long_version(), path.display()),
+            // Standard error only by now (`attach_dir` gave up on the file); unlike `eprintln!`, never panics.
+            Err(e) => log::warn!("no log file: {e}"),
+        }
+    }
+}
+
+/// One PhotoCraft per user (#3708). Only with the per-user settings folder (a portable copy's may
+/// be shared between users), and not for automation, `--new-instance` or per-process options.
+/// `Break` when the files were handed to the running PhotoCraft and this launch is done.
+#[cfg(not(target_os = "macos"))]
+fn claim_single_instance(
+    files: &[String],
+    new_instance: bool,
+    control: bool,
+    unreadable_paths: bool,
+    mut launch_options: Vec<launch_args::PerProcess>,
+) -> std::ops::ControlFlow<(), Option<single_instance::Primary>> {
+    use std::ops::ControlFlow::{Break, Continue};
+    let new_instance_env = std::env::var("PHOTOCRAFT_NEW_INSTANCE").ok();
+    // A variable documented as the equivalent of a per-launch flag counts as that flag: a
+    // launch that sets only `PHOTOCRAFT_PRESENT_MODE` (say) has per-process options too, so it
+    // keeps its own process instead of handing its files over and being ignored.
+    launch_options.extend_from_slice(&single_instance::env_launch_options());
+    let context = single_instance::LaunchContext {
+        per_user_settings: app_dirs::current().mode == app_dirs::Mode::Platform,
+        new_instance_flag: new_instance,
+        new_instance_env: new_instance_env.as_deref(),
+        control,
+        unreadable_paths,
+        launch_options: &launch_options,
+    };
+    match (single_instance::skip_reason(&context), services::config_dir()) {
+        (Some(reason), _) => {
+            log::info!("running as a separate PhotoCraft: {reason}");
+            Continue(None)
+        }
+        (None, None) => Continue(None),
+        (None, Some(dir)) => {
+            let paths: Vec<String> = files.iter().map(|f| single_instance::absolute(f)).collect();
+            match single_instance::claim(&dir, &paths) {
+                single_instance::Launch::Forwarded => {
+                    log::info!("handed {} file(s) to the running PhotoCraft", paths.len());
+                    Break(())
+                }
+                single_instance::Launch::Primary(primary) => Continue(Some(primary)),
+                single_instance::Launch::Standalone(reason) => {
+                    log::warn!("starting a separate PhotoCraft: {reason}");
+                    Continue(None)
+                }
+            }
+        }
+    }
+}
+
+/// The display server to open the window on: Xwayland for a pen on Wayland, which gives this app
+/// no pen input (#639). Exits with the package to install when its libraries are missing.
+#[cfg(target_os = "linux")]
+fn linux_display_session() -> linux_libs::DisplaySession {
+    let session = tablet::display_session();
+    // Preferences › Performance › Linux display server = X11: Xwayland on a Wayland session too,
+    // where native file drops work (winit 0.30 has none on Wayland, #386). Only when Xwayland can
+    // run the window ($DISPLAY set, X11 libraries installed); otherwise the session's own.
+    let session = if session == linux_libs::DisplaySession::Wayland
+        && gpu_startup::read_display_server(services::prefs_file().as_deref()) == photocraft_engine::prefs::LinuxDisplayServer::X11
+        && std::env::var_os("DISPLAY").is_some_and(|d| !d.is_empty())
+        && linux_libs::available(linux_libs::DisplaySession::X11)
+    {
+        eprintln!("photocraft: opening the window through Xwayland (Preferences › Performance › Linux display server)");
+        linux_libs::DisplaySession::X11
+    } else {
+        session
+    };
+    // winit and wgpu dlopen the windowing and GPU libraries, and some of those crates panic when
+    // one is missing (issue #201). Name the package to install and exit instead.
+    if let Err(message) = linux_libs::preflight(session) {
+        eprint!("{message}");
+        std::process::exit(1);
+    }
+    session
+}
+
+/// The control server's port, token and workspace, when it is on (exits 2 on a bad configuration).
+fn control_setup(
+    cli_port: Option<u16>,
+    auth: photocraft_automation::args::ControlArgs,
+    automation: &photocraft_automation::args::AutomationArgs,
+) -> Option<(u16, String, photocraft_automation::workspace::AuthorizedWorkspace)> {
+    let (port, warning) = control_port_for(cli_port, &integrations(services::prefs_file().as_deref()));
+    if let Some(warning) = &warning {
+        eprint!("{warning}");
+    }
+    let port = port?;
+    let (supplied, token_file) = (auth.control_token, auth.control_token_file);
+    let token = match photocraft_automation::security::server_token(supplied.as_deref(), token_file.as_deref()) {
+        Ok(token) => token,
+        Err(e) => {
+            eprintln!("photocraft: cannot configure control authentication: {e}");
+            std::process::exit(2);
+        }
+    };
+    if let Some(path) = token_file {
+        eprintln!("photocraft: control token file: {}", path.display());
+    } else if supplied.is_none() {
+        eprintln!("photocraft: control token: {token}");
+    } else {
+        eprintln!("photocraft: using supplied control token");
+    }
+    let workspace = match automation.workspace() {
+        Ok(workspace) => workspace,
+        Err(error) => {
+            eprintln!("photocraft: cannot configure automation workspace: {error}");
+            std::process::exit(2);
+        }
+    };
+    Some((port, token, workspace))
+}
+
+/// Record this start's backend in the GPU startup marker, if the marker is locked.
+fn write_start_marker(sentinel: &gpu_startup::SharedSentinel, plan: &gpu_startup::Plan) {
+    if let Some(s) = sentinel.lock().unwrap_or_else(std::sync::PoisonError::into_inner).as_mut() {
+        let backend = match &plan.env {
+            Some(v) => format!("env:{v}"),
+            None => plan.backend.name().to_string(),
+        };
+        let marker = gpu_startup::Marker { backend, version: photocraft_engine::build_info::long_version().to_string(), ..Default::default() };
+        if let Err(e) = s.write(marker) {
+            log::warn!("GPU startup marker: {e}");
+        }
+    }
+}
+
 fn main() -> eframe::Result {
     // First, so the panic hook and every start-up warning are recorded (`logging`).
     let logger = logging::install();
@@ -228,15 +365,7 @@ fn main() -> eframe::Result {
         mut launch_options,
     } = launch;
 
-    // The log file lives under the settings directory; opened after the arguments, so `--version`
-    // and usage errors leave no file behind. Records logged until now are written to it first.
-    if let (Some(logger), Some(dir)) = (logger, services::config_dir()) {
-        match logger.attach_dir(&dir.join("logs")) {
-            Ok(path) => log::info!("PhotoCraft {}, log file {}", photocraft_engine::build_info::long_version(), path.display()),
-            // Standard error only by now (`attach_dir` gave up on the file); unlike `eprintln!`, never panics.
-            Err(e) => log::warn!("no log file: {e}"),
-        }
-    }
+    attach_log_file(logger);
 
     // An adapter named in the environment is chosen at startup, which a forwarded launch never reaches.
     let rendering_mode = gpu_startup::read_rendering_prefs(services::prefs_file().as_deref()).1;
@@ -244,114 +373,24 @@ fn main() -> eframe::Result {
         launch_options.push(launch_args::PerProcess::GpuAdapterEnv);
     }
     // One PhotoCraft per user (#3708): files opened from Explorer or a file manager while it runs
-    // become tabs in its window. Only with the per-user settings folder (a portable copy's may be
-    // shared between users), and not for automation, `--new-instance` or per-process options.
+    // become tabs in its window. Lives until the event loop returns, then `shutdown` lets the next
+    // launch become the primary.
     #[cfg(not(target_os = "macos"))]
-    let single_instance = {
-        let new_instance_env = std::env::var("PHOTOCRAFT_NEW_INSTANCE").ok();
-        // A variable documented as the equivalent of a per-launch flag counts as that flag: a
-        // launch that sets only `PHOTOCRAFT_PRESENT_MODE` (say) has per-process options too, so it
-        // keeps its own process instead of handing its files over and being ignored.
-        // Folded in here, inside the block that only non-macOS builds compile, so the binding
-        // above keeps its `mut` off macOS, where nothing is folded in.
-        let mut launch_options = launch_options;
-        launch_options.extend_from_slice(&single_instance::env_launch_options());
-        let context = single_instance::LaunchContext {
-            per_user_settings: app_dirs::current().mode == app_dirs::Mode::Platform,
-            new_instance_flag: new_instance,
-            new_instance_env: new_instance_env.as_deref(),
-            control: control_port.is_some(),
-            unreadable_paths: !unreadable_paths.is_empty(),
-            launch_options: &launch_options,
-        };
-        match (single_instance::skip_reason(&context), services::config_dir()) {
-            (Some(reason), _) => {
-                log::info!("running as a separate PhotoCraft: {reason}");
-                None
-            }
-            (None, None) => None,
-            (None, Some(dir)) => {
-                let paths: Vec<String> = files.iter().map(|f| single_instance::absolute(f)).collect();
-                match single_instance::claim(&dir, &paths) {
-                    single_instance::Launch::Forwarded => {
-                        log::info!("handed {} file(s) to the running PhotoCraft", paths.len());
-                        return Ok(());
-                    }
-                    single_instance::Launch::Primary(primary) => Some(primary),
-                    single_instance::Launch::Standalone(reason) => {
-                        log::warn!("starting a separate PhotoCraft: {reason}");
-                        None
-                    }
-                }
-            }
-        }
+    let single_instance = match claim_single_instance(&files, new_instance, control_port.is_some(), !unreadable_paths.is_empty(), launch_options) {
+        std::ops::ControlFlow::Break(()) => return Ok(()),
+        std::ops::ControlFlow::Continue(primary) => primary,
     };
-    // Lives until the event loop returns, then `shutdown` lets the next launch become the primary.
     #[cfg(not(target_os = "macos"))]
     let single_instance = &single_instance;
     #[cfg(target_os = "macos")]
     let _ = (new_instance, &launch_options);
 
-    // The display server to open the window on: Xwayland for a pen on Wayland, which gives this
-    // app no pen input (#639).
     #[cfg(target_os = "linux")]
     let native_session = linux_libs::session_from_env(|name| std::env::var(name).ok());
     #[cfg(target_os = "linux")]
-    let session = tablet::display_session();
-    // Preferences › Performance › Linux display server = X11: Xwayland on a Wayland session too,
-    // where native file drops work (winit 0.30 has none on Wayland, #386). Only when Xwayland can
-    // run the window ($DISPLAY set, X11 libraries installed); otherwise the session's own.
-    #[cfg(target_os = "linux")]
-    let session = if session == linux_libs::DisplaySession::Wayland
-        && gpu_startup::read_display_server(services::prefs_file().as_deref()) == photocraft_engine::prefs::LinuxDisplayServer::X11
-        && std::env::var_os("DISPLAY").is_some_and(|d| !d.is_empty())
-        && linux_libs::available(linux_libs::DisplaySession::X11)
-    {
-        eprintln!("photocraft: opening the window through Xwayland (Preferences › Performance › Linux display server)");
-        linux_libs::DisplaySession::X11
-    } else {
-        session
-    };
+    let session = linux_display_session();
 
-    // winit and wgpu dlopen the windowing and GPU libraries, and some of those crates panic when
-    // one is missing (issue #201). Name the package to install and exit instead.
-    #[cfg(target_os = "linux")]
-    if let Err(message) = linux_libs::preflight(session) {
-        eprint!("{message}");
-        std::process::exit(1);
-    }
-
-    let (control_port, control_pref_warning) = control_port_for(control_port, &integrations(services::prefs_file().as_deref()));
-    if let Some(warning) = &control_pref_warning {
-        eprint!("{warning}");
-    }
-    let control = if let Some(port) = control_port {
-        let (supplied, token_file) = (auth.control_token, auth.control_token_file);
-        let token = match photocraft_automation::security::server_token(supplied.as_deref(), token_file.as_deref()) {
-            Ok(token) => token,
-            Err(e) => {
-                eprintln!("photocraft: cannot configure control authentication: {e}");
-                std::process::exit(2);
-            }
-        };
-        if let Some(path) = token_file {
-            eprintln!("photocraft: control token file: {}", path.display());
-        } else if supplied.is_none() {
-            eprintln!("photocraft: control token: {token}");
-        } else {
-            eprintln!("photocraft: using supplied control token");
-        }
-        let workspace = match automation.workspace() {
-            Ok(workspace) => workspace,
-            Err(error) => {
-                eprintln!("photocraft: cannot configure automation workspace: {error}");
-                std::process::exit(2);
-            }
-        };
-        Some((port, token, workspace))
-    } else {
-        None
-    };
+    let control = control_setup(control_port, auth, &automation);
     // Finder / Dock / Open With deliver files as Apple events, not arguments; catch the one that
     // launched us as well as later ones. Lives until the event loop returns.
     #[cfg(target_os = "macos")]
@@ -409,16 +448,7 @@ fn main() -> eframe::Result {
         log::warn!("the previous start didn't finish (GPU backend {}, adapter {:?}); {}", m.backend, m.adapter, plan.reason.as_deref().unwrap_or(""));
     }
     let sentinel: gpu_startup::SharedSentinel = std::sync::Arc::new(std::sync::Mutex::new(sentinel));
-    if let Some(s) = sentinel.lock().unwrap_or_else(std::sync::PoisonError::into_inner).as_mut() {
-        let backend = match &plan.env {
-            Some(v) => format!("env:{v}"),
-            None => plan.backend.name().to_string(),
-        };
-        let marker = gpu_startup::Marker { backend, version: photocraft_engine::build_info::long_version().to_string(), ..Default::default() };
-        if let Err(e) = s.write(marker) {
-            log::warn!("GPU startup marker: {e}");
-        }
-    }
+    write_start_marker(&sentinel, &plan);
     let gpu_note: std::sync::Arc<std::sync::Mutex<Option<String>>> = Default::default();
     // The adapter's real texture limits (egui asks for 8192 px), so big documents stay on the GPU.
     let wanted_adapter =
diff --git a/apps/photocraft/src/services.rs b/apps/photocraft/src/services.rs
index 47b4bbd34a..48d78aa922 100644
--- a/apps/photocraft/src/services.rs
+++ b/apps/photocraft/src/services.rs
@@ -18,10 +18,10 @@ mod recovery_tests;
 /// Photoshop brushes (.abr), gradients (.grd), layer styles (.asl), swatches (.aco, .act, .ase) and keyboard shortcut sets
 /// (.kys), which go to the preset libraries and Edit › Keyboard Shortcuts.
 const OPEN_EXTS: &[&str] = &[
-    "pcraft", "pdn", "ora", "xcf", "xcfgz", "gz", "kra", "krz", "psd", "psb", "psdt", "png", "jpg", "jpeg", "tif", "tiff", "webp", "gif", "bmp", "tga", "ico",
-    "qoi", "exr", "hdr", "pbm", "pgm", "ppm", "pam", "pfm", "pcx", "dds", "xpm", "fits", "fit", "fts", "dpx", "cin", "dcm", "dicom", "dc3", "iff", "lbm",
-    "ilbm", "heic", "heif", "hif", "dng", "cr2", "cr3", "nef", "nrw", "arw", "pef", "orf", "rw2", "raf", "abr", "grd", "asl", "svg", "svgz", "aco", "act",
-    "ase", "kys", "af", "afdesign", "afphoto", "afpub",
+    "pcraft", "pdn", "ora", "xcf", "xcfgz", "gz", "kra", "krz", "psd", "psb", "psdt", "png", "jpg", "jpeg", "tif", "tiff", "webp", "gif", "bmp", "dib", "tga",
+    "ico", "qoi", "exr", "hdr", "pbm", "pgm", "ppm", "pnm", "pam", "pfm", "pcx", "dds", "xpm", "fits", "fit", "fts", "dpx", "cin", "dcm", "dicom", "dc3",
+    "iff", "lbm", "ilbm", "heic", "heif", "hif", "dng", "cr2", "cr3", "nef", "nrw", "arw", "pef", "orf", "rw2", "raf", "abr", "grd", "asl", "svg", "svgz",
+    "aco", "act", "ase", "kys", "af", "afdesign", "afphoto", "afpub",
 ];
 const SVG_EXTS: &[&str] = &["svg", "svgz"];
 
@@ -54,14 +54,14 @@ const OPEN_FILTERS: &[(&str, &[&str])] = &[
     ("TIFF", &["tif", "tiff"]),
     ("WebP", &["webp"]),
     ("GIF", &["gif"]),
-    ("BMP", &["bmp"]),
+    ("BMP", &["bmp", "dib"]),
     ("Targa", &["tga"]),
     ("ICO", &["ico"]),
     ("QOI", &["qoi"]),
     ("PCX", &["pcx"]),
     ("DDS", &["dds"]),
     ("XPM", &["xpm"]),
-    ("Portable Bitmap", &["pbm", "pgm", "ppm", "pam", "pfm"]),
+    ("Portable Bitmap", &["pbm", "pgm", "ppm", "pnm", "pam", "pfm"]),
     ("OpenEXR", &["exr"]),
     ("Radiance HDR", &["hdr"]),
     ("FITS", &["fits", "fit", "fts"]),
@@ -91,15 +91,19 @@ const SAVE_FILTERS: &[(&str, &[&str])] = &[
     ("PhotoCraft", &["pcraft"]),
     ("OpenRaster", &["ora"]),
     ("PNG", &["png"]),
-    ("JPEG", &["jpg"]),
+    ("JPEG", &["jpg", "jpeg"]),
     ("WebP", &["webp"]),
-    ("TIFF", &["tif"]),
+    ("TIFF", &["tif", "tiff"]),
     ("Targa", &["tga"]),
     // Also in Photoshop's Save As list; ICO is PhotoCraft's own (#4357): up to 256×256, with alpha.
-    ("BMP", &["bmp"]),
+    ("BMP", &["bmp", "dib"]),
     ("GIF", &["gif"]),
     ("ICO", &["ico"]),
     ("OpenEXR", &["exr"]),
+    // The encoder picks P5, P6, P7 or PFM from the image, not from the name, so only the neutral
+    // .pnm is offered: a .pbm or .pgm name would hold pixmap data (CodeRabbit on #9775).
+    ("Netpbm", &["pnm"]),
+    ("Radiance HDR", &["hdr"]),
     ("FITS", &["fits", "fit"]),
     ("DPX", &["dpx"]),
     // Game and 3D textures; DDS Options asks for the compression and mipmaps (#1327).
@@ -112,9 +116,21 @@ const SAVE_FILTERS: &[(&str, &[&str])] = &[
 /// never swaps their extension for a document format's.
 const OTHER_SAVE_FILTERS: &[(&str, &[&str])] = &[("Color Swatches", &["aco"]), ("Color Table", &["act"]), ("Swatch Exchange", &["ase"])];
 
+/// `suggested` with a Netpbm subtype's extension (an opened .pgm) as the neutral .pnm, the name
+/// every save dialog starts from: the encoder picks P5, P6, P7 or PFM from the image, so the old
+/// suffix could name other data, and macOS and rfd keep the suggested name as it is.
+fn netpbm_as_pnm(suggested: &str) -> String {
+    let path = Path::new(suggested);
+    let subtype = path.extension().map(|e| e.to_string_lossy().to_ascii_lowercase()).is_some_and(|e| ["pbm", "pgm", "ppm", "pam", "pfm"].contains(&e.as_str()));
+    if subtype { path.with_extension("pnm").to_string_lossy().into_owned() } else { suggested.to_string() }
+}
+
 /// Lists the save dialog's file types with the `suggested` type first (added if unlisted), so the dialog keeps that extension instead of .psd.
 fn save_filters(suggested: &str) -> Vec<(String, Vec<String>)> {
     let ext = Path::new(suggested).extension().map(|e| e.to_string_lossy().to_ascii_lowercase()).unwrap_or_default();
+    // A Netpbm subtype's name (an opened .pgm) starts on the Netpbm type as .pnm: the encoder picks
+    // the subtype from the image, so the old name could describe other data (CodeRabbit on #9775).
+    let ext = if ["pbm", "pgm", "ppm", "pam", "pfm"].contains(&ext.as_str()) { "pnm".to_string() } else { ext };
     if let Some((name, exts)) = OTHER_SAVE_FILTERS.iter().find(|(_, exts)| exts.contains(&ext.as_str())) {
         return vec![(name.to_string(), exts.iter().map(|e| e.to_string()).collect())];
     }
@@ -216,6 +232,7 @@ fn show_file_dialog(request: FileDialogRequest, parent: Option<&eframe::Frame>,
             Box::pin(async move { picked.await.map(|folder| answer_one(folder.path(), true, FileDialogAnswer::FolderTo)) })
         }
         FileDialogRequest::Save { suggested } => {
+            let suggested = netpbm_as_pnm(&suggested);
             let filters = save_filters(&suggested);
             let name = dialog_file_name(&suggested, cfg!(windows));
             let dir = Path::new(&suggested).parent().filter(|p| !p.as_os_str().is_empty()).map(Path::to_path_buf);
@@ -543,6 +560,61 @@ fn image_from_offers(offers: &[String], mut fetch: impl FnMut(&str) -> Option<Ve
     })
 }
 
+/// Largest SVG markup a paste reads from clipboard text (128 MiB, the size an `.svgz` may inflate
+/// to).
+const MAX_CLIPBOARD_SVG_BYTES: u64 = photocraft_io::svg::MAX_INFLATED_BYTES;
+
+/// The pixels of a drawing copied as SVG markup (on macOS and Linux, VectorCraft's Copy leaves
+/// only the markup, as text): one pixel per SVG unit, scaled down to the SVG import's pixel limit,
+/// as RGBA8. `None` for text that isn't SVG, markup longer than [`MAX_CLIPBOARD_SVG_BYTES`], and
+/// markup that doesn't parse.
+fn image_from_svg_text(text: &str) -> Option<(u32, u32, Vec<u8>)> {
+    if u64::try_from(text.len()).ok()? > MAX_CLIPBOARD_SVG_BYTES || !text.trim_start_matches('\u{feff}').trim_start().starts_with('<') {
+        return None;
+    }
+    crate::crash_guard::guard("Paste", || photocraft_io::svg::rasterize_rgba8(text.as_bytes()).map_err(|e| e.to_string())).ok()
+}
+
+/// What a paste reads from the OS clipboard, in this order: the first copied file that is an
+/// image (Finder also puts the file's icon on the clipboard as an image, which would otherwise
+/// paste instead of the file), the clipboard's image, then a drawing copied as SVG markup. Each
+/// read runs only when the ones before it found nothing. A read that fails, such as one of a busy
+/// clipboard, returns its error, and the reads after it don't run.
+fn clipboard_image<C>(
+    clipboard: &mut C,
+    files: impl FnOnce(&mut C) -> Result<Option<Vec<PathBuf>>, String>,
+    image: impl FnOnce(&mut C) -> Result<Option<(u32, u32, Vec<u8>)>, String>,
+    text: impl FnOnce(&mut C) -> Result<Option<String>, String>,
+) -> Result<Option<(u32, u32, Vec<u8>)>, String> {
+    if let Some(img) = files(clipboard)?.and_then(|paths| image_from_files(&paths)) {
+        return Ok(Some(img));
+    }
+    if let Some(img) = image(clipboard)? {
+        return Ok(Some(img));
+    }
+    Ok(text(clipboard)?.and_then(|text| image_from_svg_text(&text)))
+}
+
+/// One OS clipboard read as [`clipboard_image`] takes it: no content in the format asked for is
+/// `None`, and any other failure, such as a busy clipboard or a broken pipe on Wayland, is the
+/// read's error.
+fn clipboard_read<T>(read: Result<T, arboard::Error>) -> Result<Option<T>, String> {
+    match read {
+        Ok(value) => Ok(Some(value)),
+        Err(arboard::Error::ContentNotAvailable) => Ok(None),
+        Err(error) => Err(error.to_string()),
+    }
+}
+
+/// Clipboard text as [`clipboard_image`] takes it: like [`clipboard_read`], except that text that
+/// isn't UTF-8 is `None`, like other text that isn't SVG markup.
+fn clipboard_text(read: Result<String, arboard::Error>) -> Result<Option<String>, String> {
+    match read {
+        Err(arboard::Error::ConversionFailure) => Ok(None),
+        read => clipboard_read(read),
+    }
+}
+
 /// The shell command that starts this install under XWayland, where winit delivers file drops
 /// (winit 0.30 has none on Wayland, #386). A Flatpak gets the X11 socket only without the Wayland
 /// one, an AppImage relaunches by its own path, and anything else is `photocraft` on the PATH.
@@ -660,30 +732,24 @@ pub fn native(automation: Option<photocraft_automation::AuthorizedWorkspace>) ->
                         slot.insert(opened.map_err(|e| e.to_string())?)
                     }
                 };
-                // Copied files first: Finder also puts the file's icon on the clipboard as an
-                // image, which would otherwise paste instead of the file.
-                match cb.get().file_list() {
-                    Ok(paths) => {
-                        if let Some(img) = image_from_files(&paths) {
-                            return Ok(Some(img));
+                clipboard_image(
+                    cb,
+                    |cb| clipboard_read(cb.get().file_list()),
+                    |cb| match cb.get_image() {
+                        Ok(img) => Ok(Some((img.width as u32, img.height as u32, img.bytes.into_owned()))),
+                        Err(error) => {
+                            #[cfg(target_os = "linux")]
+                            if let Some(image) = wayland_clipboard_image() {
+                                return Ok(Some(image));
+                            }
+                            match error {
+                                arboard::Error::ContentNotAvailable => Ok(None),
+                                _ => Err(error.to_string()),
+                            }
                         }
-                    }
-                    Err(error @ arboard::Error::ClipboardOccupied) => return Err(error.to_string()),
-                    Err(_) => {}
-                }
-                match cb.get_image() {
-                    Ok(img) => Ok(Some((img.width as u32, img.height as u32, img.bytes.into_owned()))),
-                    Err(error) => {
-                        #[cfg(target_os = "linux")]
-                        if let Some(image) = wayland_clipboard_image() {
-                            return Ok(Some(image));
-                        }
-                        match error {
-                            arboard::Error::ContentNotAvailable => Ok(None),
-                            _ => Err(error.to_string()),
-                        }
-                    }
-                }
+                    },
+                    |cb| clipboard_text(cb.get_text()),
+                )
             })
         }),
         clipboard_unreadable: Some(Box::new(move || clip_unreadable.get())),
diff --git a/apps/photocraft/src/services/tests.rs b/apps/photocraft/src/services/tests.rs
index f9bce2a367..c71074572e 100644
--- a/apps/photocraft/src/services/tests.rs
+++ b/apps/photocraft/src/services/tests.rs
@@ -294,9 +294,33 @@ fn save_as_offers_only_writable_formats_including_ico() {
             assert!(format.caps().write, "{name}: .{ext} can't be written");
         }
     }
-    for ext in ["ico", "gif", "bmp", "dds"] {
+    for ext in ["ico", "gif", "bmp", "dds", "pnm", "hdr", "dib", "jpeg", "tiff"] {
         assert!(save_filters("Untitled-1.psd").iter().any(|(_, exts)| exts.iter().any(|e| e == ext)), ".{ext} is offered");
     }
+    // The codec writes P5/P6/P7/PF from the image, never from the name, so Netpbm offers only the
+    // neutral .pnm (#3609; CodeRabbit on #9775): a .pbm, .pgm or .pfm name would hold other data.
+    let netpbm = save_filters("Untitled").into_iter().find(|(name, _)| name == "Netpbm").map(|(_, exts)| exts);
+    assert_eq!(netpbm, Some(vec!["pnm".to_string()]));
+    // The suggested name itself becomes .pnm, as macOS and rfd keep it (CodeRabbit on #9775).
+    assert_eq!(netpbm_as_pnm("scans/image.pgm"), Path::new("scans/image.pnm").to_string_lossy());
+    assert_eq!(netpbm_as_pnm("image.PFM"), "image.pnm");
+    assert_eq!(netpbm_as_pnm("image.png"), "image.png");
+    assert_eq!(netpbm_as_pnm("Untitled-1"), "Untitled-1");
+    // Also when Save As starts from a subtype's name: no filter offers that subtype again.
+    for name in ["image.pbm", "image.pgm", "image.ppm", "image.pam", "image.pfm"] {
+        let filters = save_filters(name);
+        assert_eq!(filters[0], ("Netpbm".to_string(), vec!["pnm".to_string()]), "{name}");
+        let subtype = name.rsplit('.').next().unwrap_or_default();
+        assert!(!filters.iter().any(|(_, exts)| exts.iter().any(|e| e == subtype)), "{name}: .{subtype} is offered");
+    }
+    // File › Open lists every file Save As writes, also in that format's own type (PDF is written
+    // but not read yet).
+    for (name, exts) in SAVE_FILTERS {
+        for ext in exts.iter().filter(|e| **e != "pdf") {
+            assert!(OPEN_EXTS.contains(ext), "{name}: Open's All Formats lacks .{ext}");
+            assert!(OPEN_FILTERS.iter().any(|(_, open)| open.contains(ext)), "{name}: no Open type lists .{ext}");
+        }
+    }
     assert_eq!(save_filters("icon.ico")[0].0, "ICO", "an .ico name leads with its own type");
     // What Save As writes there: an icon up to 256×256, and a clear error past that.
     let doc = |side: u32| {
@@ -307,6 +331,11 @@ fn save_as_offers_only_writable_formats_including_ico() {
     let opts = export_options(&photocraft_ui_egui::ExportSettings::default());
     let icon = photocraft_io::export(&doc(256), "icon.ico", &opts).unwrap();
     assert_eq!(icon.bytes[..4], [0, 0, 1, 0], "an ICO header");
+    // And what the Netpbm and Radiance rows write.
+    let pnm = photocraft_io::export(&doc(4), "x.pnm", &opts).unwrap();
+    assert_eq!(pnm.bytes[..2], *b"P6", "an RGB document saves as a binary pixmap");
+    let hdr = photocraft_io::export(&doc(4), "x.hdr", &opts).unwrap();
+    assert!(hdr.bytes.starts_with(b"#?RADIANCE"), "a Radiance header");
     let err = photocraft_io::export(&doc(300), "icon.ico", &opts).map(|_| ()).unwrap_err().to_string();
     assert!(err.contains("256"), "{err}");
 }
@@ -660,6 +689,175 @@ fn tga_is_trusted_only_with_its_extension() {
     assert!(image_from_files(&[bin]).is_none());
 }
 
+/// A 121 × 81 white rectangle with a 1-unit black stroke, written as markup the way a vector
+/// app's Copy puts it on the clipboard as text.
+const COPIED_RECTANGLE: &str = r##"<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="121" height="81" viewBox="0 0 121 81">
+  <g><path d="M0.5 0.5 L120.5 0.5 L120.5 80.5 L0.5 80.5 Z" fill="#ffffff" stroke="#000000"/></g>
+</svg>
+"##;
+
+/// A 40 × 20 drawing whose left half is a red square; the right half has no art.
+const HALF_RED: &str = r##"<svg xmlns="http://www.w3.org/2000/svg" width="40" height="20"><rect width="20" height="20" fill="#ff0000"/></svg>"##;
+
+/// The clipboard as `clipboard_image` reads it when it holds only `text`.
+fn from_text(text: &str) -> Option<(u32, u32, Vec<u8>)> {
+    clipboard_image(&mut (), |_| Ok(None), |_| Ok(None), |_| Ok(Some(text.to_string()))).expect("no read fails")
+}
+
+fn pixel(img: &(u32, u32, Vec<u8>), x: u32, y: u32) -> [u8; 4] {
+    let at = ((y * img.0 + x) * 4) as usize;
+    img.2[at..at + 4].try_into().unwrap()
+}
+
+#[test]
+fn svg_markup_copied_as_text_pastes_its_pixels() {
+    let img = from_text(COPIED_RECTANGLE).expect("the drawing's pixels");
+    assert_eq!((img.0, img.1, img.2.len()), (121, 81, 121 * 81 * 4), "one pixel per SVG unit");
+    assert_eq!(pixel(&img, 60, 40), [255, 255, 255, 255], "the white fill");
+    for (x, y) in [(0, 40), (120, 40), (60, 0), (60, 80)] {
+        let [r, g, b, a] = pixel(&img, x, y);
+        assert!(a == 255 && r < 8 && g < 8 && b < 8, "the black stroke at {x},{y}: {:?}", [r, g, b, a]);
+    }
+    let img = from_text(HALF_RED).expect("the drawing's pixels");
+    assert_eq!((img.0, img.1), (40, 20));
+    assert_eq!(pixel(&img, 5, 10), [255, 0, 0, 255]);
+    assert_eq!(pixel(&img, 30, 10), [0, 0, 0, 0], "transparent where there is no art");
+}
+
+#[test]
+fn text_that_is_not_a_drawing_pastes_nothing() {
+    for text in ["", "hello", "<p>not a drawing</p>", "<?xml version=\"1.0\"?><x:xmpmeta xmlns:x=\"adobe:ns:meta/\"/>"] {
+        assert!(from_text(text).is_none(), "{text:?}");
+    }
+    // Markup that doesn't parse, and markup past the read limit, paste nothing either.
+    assert!(from_text("<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"8\" height=\"8\"><rect").is_none());
+    assert!(from_text("<svg width=\"8\" height=\"8\"><g></svg>").is_none());
+    let mut huge = String::from("<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"8\" height=\"8\">");
+    huge.push_str(&" ".repeat(usize::try_from(MAX_CLIPBOARD_SVG_BYTES).unwrap()));
+    huge.push_str("</svg>");
+    assert!(from_text(&huge).is_none(), "markup past the limit isn't parsed");
+}
+
+#[test]
+fn svg_clipboard_text_accepts_a_long_xml_preamble() {
+    let padding = "x".repeat(8192);
+    for prefix in [format!("<!--{padding}-->"), format!("<?xml version=\"1.0\"?>\n<!--{padding}-->"), format!("<?drawing {padding}?>")] {
+        let text = format!("{prefix}{HALF_RED}");
+        let img = from_text(&text).expect("SVG after the XML preamble");
+        assert_eq!((img.0, img.1), (40, 20));
+        assert_eq!(pixel(&img, 5, 10), [255, 0, 0, 255]);
+        assert_eq!(pixel(&img, 30, 10), [0, 0, 0, 0]);
+    }
+    assert!(from_text(&format!("<!--{padding}<svg/>--><not-svg/>")).is_none());
+    assert!(from_text(&format!("<!--{padding}--><svg><g></svg>")).is_none());
+}
+
+#[test]
+fn a_drawing_past_the_pixel_limit_pastes_scaled_down() {
+    let wide = r##"<svg xmlns="http://www.w3.org/2000/svg" width="20000" height="10000"><rect width="20000" height="10000" fill="#0000ff"/></svg>"##;
+    let img = from_text(wide).expect("scaled down, not dropped");
+    let pixels = u64::from(img.0) * u64::from(img.1);
+    assert!(pixels <= 24_000_000 && pixels > 12_000_000, "{} × {}", img.0, img.1);
+    assert!(img.0.abs_diff(img.1 * 2) <= 2, "the proportions are kept: {} × {}", img.0, img.1);
+    assert_eq!(pixel(&img, img.0 / 2, img.1 / 2), [0, 0, 255, 255]);
+}
+
+/// Copied files and an image come before SVG text, which is read only when neither is there.
+#[test]
+fn copied_files_and_images_come_before_svg_text() {
+    let dir = temp("svg-order");
+    let png = dir.join("red.png");
+    std::fs::write(&png, red_png(3, 2)).unwrap();
+    let blue = (2, 2, [0u8, 0, 255, 255].repeat(4));
+    let mut text_read = false;
+    let svg_text = |read: &mut bool| {
+        *read = true;
+        Ok(Some(COPIED_RECTANGLE.to_string()))
+    };
+    let got = clipboard_image(&mut text_read, |_| Ok(Some(vec![png.clone()])), |_| Ok(Some(blue.clone())), svg_text);
+    assert_eq!(got.unwrap().map(|(w, h, _)| (w, h)), Some((3, 2)), "the copied file");
+    let got = clipboard_image(&mut text_read, |_| Ok(None), |_| Ok(Some(blue.clone())), svg_text);
+    assert_eq!(got.unwrap().map(|(w, h, _)| (w, h)), Some((2, 2)), "the image, not the SVG text");
+    assert!(!text_read, "the text isn't read while there is a file or an image");
+    // A copied file that isn't an image (an .svg) falls through to the image, then the text.
+    let svg = dir.join("drawing.svg");
+    std::fs::write(&svg, COPIED_RECTANGLE).unwrap();
+    let got = clipboard_image(&mut (), |_| Ok(Some(vec![svg.clone()])), |_| Ok(None), |_| Ok(Some(COPIED_RECTANGLE.to_string())));
+    assert_eq!(got.unwrap().map(|(w, h, _)| (w, h)), Some((121, 81)));
+}
+
+/// A failed read, such as one of a busy clipboard, is the paste's error: the reads after it,
+/// the SVG text included, don't run.
+#[test]
+fn a_failed_clipboard_read_is_an_error_and_the_text_is_not_read() {
+    fn busy<T>() -> Result<T, String> {
+        Err("the clipboard is busy".to_string())
+    }
+    let mut text_read = false;
+    let svg_text = |read: &mut bool| {
+        *read = true;
+        Ok(Some(COPIED_RECTANGLE.to_string()))
+    };
+    let got = clipboard_image(&mut text_read, |_| busy(), |_| Ok(None), svg_text);
+    assert_eq!(got, Err("the clipboard is busy".to_string()), "the file list's error");
+    let got = clipboard_image(&mut text_read, |_| Ok(None), |_| busy(), svg_text);
+    assert_eq!(got, Err("the clipboard is busy".to_string()), "the image's error");
+    assert!(!text_read, "the text isn't read after a failed read");
+    let got = clipboard_image(&mut (), |_| Ok(None), |_| Ok(None), |_| busy());
+    assert_eq!(got, Err("the clipboard is busy".to_string()), "the text's error");
+}
+
+/// Only a clipboard with nothing in the format asked for reads as nothing to paste. A read
+/// that fails in any other way, such as a broken pipe on Wayland, is the paste's error, for
+/// the copied files and the text alike. Text that isn't UTF-8 reads as no SVG markup.
+#[test]
+fn only_missing_content_reads_as_nothing_to_paste() {
+    use arboard::Error;
+    let failures = || [Error::ClipboardOccupied, Error::ClipboardNotSupported, Error::Unknown { description: "broken pipe".to_string() }];
+    assert_eq!(clipboard_read(Ok::<_, Error>(vec![PathBuf::from("a.png")])), Ok(Some(vec![PathBuf::from("a.png")])));
+    assert_eq!(clipboard_read::<Vec<PathBuf>>(Err(Error::ContentNotAvailable)), Ok(None));
+    for error in failures().into_iter().chain([Error::ConversionFailure]) {
+        let message = error.to_string();
+        assert_eq!(clipboard_read::<Vec<PathBuf>>(Err(error)), Err(message.clone()), "{message}");
+    }
+    assert_eq!(clipboard_text(Ok("words".to_string())), Ok(Some("words".to_string())));
+    assert_eq!(clipboard_text(Err(Error::ContentNotAvailable)), Ok(None));
+    assert_eq!(clipboard_text(Err(Error::ConversionFailure)), Ok(None), "text that isn't UTF-8");
+    for error in failures() {
+        let message = error.to_string();
+        assert_eq!(clipboard_text(Err(error)), Err(message.clone()), "{message}");
+    }
+}
+
+/// Edit › Paste with SVG markup as the clipboard's only content adds a new layer that holds the
+/// drawing's art; other text is still a quiet "nothing to paste".
+#[test]
+fn paste_turns_svg_text_on_the_clipboard_into_a_layer() {
+    let text: Rc<RefCell<String>> = Rc::new(RefCell::new(HALF_RED.to_string()));
+    let clip = text.clone();
+    let services = Services {
+        clipboard_get_image: Some(Box::new(move || clipboard_image(&mut (), |_| Ok(None), |_| Ok(None), |_| Ok(Some(clip.borrow().clone()))))),
+        ..Default::default()
+    };
+    let mut app = PhotocraftApp::new(Session::new(), services);
+    let ctx = egui::Context::default();
+    app.run("file.new", json!({"width": 300, "height": 200})).unwrap();
+    let layers = app.session.active().unwrap().doc.layers.len();
+    let r = photocraft_ui_egui::menus::invoke(&mut app, &ctx, "edit.paste", json!({})).unwrap();
+    assert_ne!(r["pasted"], json!(false), "{r}");
+    let st = app.session.active().unwrap();
+    assert_eq!(st.doc.layers.len(), layers + 1);
+    let surface = st.doc.layer(st.active_layer.unwrap()).unwrap().surface().unwrap();
+    let bounds = surface.content_bounds();
+    assert_eq!((bounds.width(), bounds.height()), (20, 20), "the red half; the transparent half adds nothing");
+    *text.borrow_mut() = "just words".to_string();
+    let r = photocraft_ui_egui::menus::invoke(&mut app, &ctx, "edit.paste", json!({})).unwrap();
+    assert_eq!(r["pasted"], json!(false));
+    assert_eq!(app.ui.status, "Nothing to paste: the clipboard holds no image");
+    assert_eq!(app.session.active().unwrap().doc.layers.len(), layers + 1);
+}
+
 /// #7582: a panic while reading the OS clipboard (in arboard, or decoding a copied file) is
 /// the paste's error in the status bar, not a crash: the document stays and the next paste
 /// works. The same for a panic while writing it.
diff --git a/assets/icons/font-similar.svg b/assets/icons/font-similar.svg
new file mode 100644
index 0000000000..e2399f7ab0
--- /dev/null
+++ b/assets/icons/font-similar.svg
@@ -0,0 +1,14 @@
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <path d="M4 9.5c2.7-2 5.3-2 8 0s5.3 2 8 0" />
+  <path d="M4 15.5c2.7-2 5.3-2 8 0s5.3 2 8 0" />
+</svg>
diff --git a/assets/icons/font-variable.svg b/assets/icons/font-variable.svg
new file mode 100644
index 0000000000..4415bcd32a
--- /dev/null
+++ b/assets/icons/font-variable.svg
@@ -0,0 +1,16 @@
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <path d="M3 4h10M8 4v10" />
+  <path d="M14 8h7M17.5 8v6" />
+  <path d="M3 19h18" />
+  <circle cx="9" cy="19" r="2" fill="currentColor" />
+</svg>
diff --git a/book/src/automation/mcp.md b/book/src/automation/mcp.md
index e9e9521ea6..11ce2f4549 100644
--- a/book/src/automation/mcp.md
+++ b/book/src/automation/mcp.md
@@ -38,13 +38,13 @@ The release packages ship `photocraft-cli` alongside the desktop app, so no buil
 
 | Install | CLI |
 |---|---|
-| Windows (MSI) | `C:\Program Files\PhotoCraft\photocraft-cli.exe` by default (wherever you installed it otherwise), not on `PATH` |
+| Windows (MSI) | `%LOCALAPPDATA%\Programs\ArtCraft\PhotoCraft\photocraft-cli.exe` by default (`C:\Program Files\ArtCraft\PhotoCraft\photocraft-cli.exe` for an all-users install, under `Program Files (x86)` instead for the 32-bit build, or wherever you installed it otherwise), not on `PATH` |
 | Linux (deb, rpm) | `/usr/bin/photocraft-cli` |
 | macOS | the separate `photocraft-cli-<version>-macos-<arch>.zip` release asset (the `.app` holds only the desktop app) |
 
 ```sh
-# Windows, default install folder
-claude mcp add photocraft -- "C:\Program Files\PhotoCraft\photocraft-cli.exe" mcp --automation-read-root <dir> --automation-write-root <dir>
+# Windows (PowerShell), default install folder
+claude mcp add photocraft -- "$env:LOCALAPPDATA\Programs\ArtCraft\PhotoCraft\photocraft-cli.exe" mcp --automation-read-root <dir> --automation-write-root <dir>
 # Linux, or macOS with the CLI unzipped onto PATH
 claude mcp add photocraft -- photocraft-cli mcp --automation-read-root <dir> --automation-write-root <dir>
 ```
diff --git a/clippy.toml b/clippy.toml
index 4b6c79f555..3522a15b69 100644
--- a/clippy.toml
+++ b/clippy.toml
@@ -2,3 +2,7 @@ allow-unwrap-in-tests = true
 allow-expect-in-tests = true
 allow-panic-in-tests = true
 allow-indexing-slicing-in-tests = true
+disallowed-types = [
+    { path = "egui::ComboBox", reason = "use craft_ui::ComboBox: egui's combo box menu can't grow back while open (egui#5225)" },
+]
+cognitive-complexity-threshold = 30
diff --git a/crates/affinity/src/container.rs b/crates/affinity/src/container.rs
index 76ffb69f7d..96fdbd706c 100644
--- a/crates/affinity/src/container.rs
+++ b/crates/affinity/src/container.rs
@@ -332,7 +332,7 @@ fn read_bounded(mut r: impl Read, size: usize) -> Result<Vec<u8>, Error> {
 }
 
 fn inflate(data: &[u8], size: usize) -> Result<Vec<u8>, Error> {
-    read_bounded(flate2::read::ZlibDecoder::new(data), size)
+    read_bounded(flate2::bufread::ZlibDecoder::new(data), size)
 }
 
 fn unzstd(data: &[u8], size: usize) -> Result<Vec<u8>, Error> {
diff --git a/crates/algo/examples/bench_filters2.rs b/crates/algo/examples/bench_filters2.rs
index f6b34aca28..3b9aacae24 100644
--- a/crates/algo/examples/bench_filters2.rs
+++ b/crates/algo/examples/bench_filters2.rs
@@ -4,7 +4,10 @@
 //!
 //! `--json` writes the report `cargo xtask perf` reads: `{"rows": [{"name", "samples_ms"}]}`.
 //! `--quick` runs the list on a 1500×1000 layer instead, for `cargo xtask perf --quick`.
-use photocraft_algo::*;
+use photocraft_algo::{
+    BlurPath, BlurQuality, BlurShape, DepthSource, Distribution, FieldPin, FilterParams, IrisPin, Light, SmartBlurMode, SpinPin, TextureChannel, apply,
+    output_area,
+};
 use photocraft_color::PixelFormat;
 use photocraft_geom::Rect;
 use photocraft_raster::Surface;
diff --git a/crates/algo/src/artistic_fx.rs b/crates/algo/src/artistic_fx.rs
index 1cca6c9468..ca346a1f05 100644
--- a/crates/algo/src/artistic_fx.rs
+++ b/crates/algo/src/artistic_fx.rs
@@ -555,13 +555,20 @@ pub(crate) fn run(effects: &[GalleryEffect], src: &Image, out: Rect, ctx: &Ctx)
     res
 }
 
-/// Applies one gallery effect to the working window in place.
+/// Applies one gallery effect to the working window in place. Each category handles its own
+/// filters and reports whether the effect was one of them.
 fn apply(e: &GalleryEffect, win: &mut Win, ctx: &Ctx) {
+    let handled =
+        apply_artistic(e, win) || apply_brush_strokes(e, win) || apply_distort(e, win) || apply_sketch(e, win, ctx) || apply_stylize_texture(e, win, ctx);
+    debug_assert!(handled, "every gallery filter belongs to a category");
+}
+
+/// Artistic filters: the painterly looks of the gallery.
+fn apply_artistic(e: &GalleryEffect, win: &mut Win) -> bool {
     let g = |k: &str| e.get(k);
     let (w, h) = (win.w, win.h);
     let (fg, bg) = (rgb(e.foreground), rgb(e.background));
     match e.filter {
-        // ---------------- Artistic ----------------
         F::ColoredPencil => {
             let pw = g("pencilWidth");
             let pressure = g("strokePressure") / 15.0;
@@ -745,7 +752,16 @@ fn apply(e: &GalleryEffect, win: &mut Win, ctx: &Ctx) {
                 win.c[i] = map(saturate(win.c[i], 1.2), |v| clamp01(v * k + n).powf(1.1 + sh * 0.6));
             }
         }
-        // ---------------- Brush Strokes ----------------
+        _ => return false,
+    }
+    true
+}
+
+/// Brush Strokes filters.
+fn apply_brush_strokes(e: &GalleryEffect, win: &mut Win) -> bool {
+    let g = |k: &str| e.get(k);
+    let (w, h) = (win.w, win.h);
+    match e.filter {
         F::AccentedEdges => {
             let mut l = win.lum();
             blur1(&mut l, w, h, 0.4 + g("smoothness") * 0.3);
@@ -859,7 +875,17 @@ fn apply(e: &GalleryEffect, win: &mut Win, ctx: &Ctx) {
                 *p = map(*p, |v| clamp01((v - 0.5) * (1.0 + con) + 0.5) * (1.0 - ink * 0.9 * (0.5 + con)));
             }
         }
-        // ---------------- Distort ----------------
+        _ => return false,
+    }
+    true
+}
+
+/// Distort filters.
+fn apply_distort(e: &GalleryEffect, win: &mut Win) -> bool {
+    let g = |k: &str| e.get(k);
+    let (w, h) = (win.w, win.h);
+    let bg = rgb(e.background);
+    match e.filter {
         F::DiffuseGlow => {
             let (gr, ga, ca) = (g("graininess") / 10.0, g("glowAmount") / 20.0, g("clearAmount") / 20.0);
             let thr = 0.2 + ca * 0.7;
@@ -903,7 +929,17 @@ fn apply(e: &GalleryEffect, win: &mut Win, ctx: &Ctx) {
                 win.c[i] = src.sample(x as f32 + 0.5 + dx, y as f32 + 0.5 + dy);
             }
         }
-        // ---------------- Sketch ----------------
+        _ => return false,
+    }
+    true
+}
+
+/// Sketch filters (foreground is ink, background is paper).
+fn apply_sketch(e: &GalleryEffect, win: &mut Win, ctx: &Ctx) -> bool {
+    let g = |k: &str| e.get(k);
+    let (w, h) = (win.w, win.h);
+    let (fg, bg) = (rgb(e.foreground), rgb(e.background));
+    match e.filter {
         F::BasRelief => {
             let mut l = win.lum();
             let orig = l.clone();
@@ -1107,7 +1143,17 @@ fn apply(e: &GalleryEffect, win: &mut Win, ctx: &Ctx) {
                 win.c[i] = map(win.c[i], |v| (v * (0.85 + 0.25 * fib) - 0.5) * (co * 1.6 + 0.2) + 0.5 + (br - 0.5) * 0.8);
             }
         }
-        // ---------------- Stylize ----------------
+        _ => return false,
+    }
+    true
+}
+
+/// Stylize and Texture filters.
+fn apply_stylize_texture(e: &GalleryEffect, win: &mut Win, ctx: &Ctx) -> bool {
+    let g = |k: &str| e.get(k);
+    let (w, h) = (win.w, win.h);
+    let (fg, bg) = (rgb(e.foreground), rgb(e.background));
+    match e.filter {
         F::GlowingEdges => {
             blur3(&mut win.c, w, h, 0.3 + g("smoothness") * 0.25);
             let mut e3 = vec![[0.0f32; 3]; win.c.len()];
@@ -1123,7 +1169,6 @@ fn apply(e: &GalleryEffect, win: &mut Win, ctx: &Ctx) {
                 *p = map(*q, |v| clamp01(v * k));
             }
         }
-        // ---------------- Texture ----------------
         F::Craquelure => {
             let (sp, dep, bri) = (g("crackSpacing"), g("crackDepth") / 10.0, g("crackBrightness") / 10.0);
             let cell = sp * 1.3 + 1.0;
@@ -1239,7 +1284,9 @@ fn apply(e: &GalleryEffect, win: &mut Win, ctx: &Ctx) {
             }
         }
         F::Texturizer => texturize(win, e.choice("texture"), g("scaling"), g("relief"), e.choice("light"), e.flag("invert")),
+        _ => return false,
     }
+    true
 }
 
 fn normalize3(v: [f32; 3]) -> [f32; 3] {
diff --git a/crates/algo/src/blur/motion_fft.rs b/crates/algo/src/blur/motion_fft.rs
index 9da1b1a1b7..a0bf9dce6a 100644
--- a/crates/algo/src/blur/motion_fft.rs
+++ b/crates/algo/src/blur/motion_fft.rs
@@ -361,23 +361,7 @@ impl Plan {
         {
             return None;
         }
-        let mut scales = [0.0f64; 5];
-        for (i, pixel) in src.data.chunks_exact(src.ch).enumerate() {
-            if i % 4096 == 0 && ctl.cancelled() {
-                return None;
-            }
-            if pixel.iter().any(|value| !value.is_finite() || value.abs() > MAX_SAMPLE)
-                || (alpha && !pixel.last().is_some_and(|value| (0.0..=1.0).contains(value)))
-            {
-                return None;
-            }
-            let a = if alpha { *pixel.last()? } else { 1.0 };
-            for (c, &value) in pixel.iter().enumerate() {
-                let value = if alpha && c + 1 < src.ch { value * a } else { value };
-                let scale = scales.get_mut(c)?;
-                *scale = scale.max(f64::from(value.abs()));
-            }
-        }
+        let scales = channel_scales(src, alpha, ctl)?;
         let mut result = buffer(ow.checked_mul(oh)?.checked_mul(src.ch)?, 0.0f64)?;
         let read = self.read_rect(out)?;
         let used = read.intersect(&src.rect);
@@ -393,81 +377,18 @@ impl Plan {
             if ctl.cancelled() {
                 return None;
             }
+            let pair = ChannelPair { src, alpha, scales: &scales, channel };
             data.fill(Number::default());
-            for y in used.y0..used.y1 {
-                if (y - used.y0) % 8 == 0 && ctl.cancelled() {
-                    return None;
-                }
-                let source_start =
-                    usize::try_from(y - src.rect.y0).ok()?.checked_mul(sw)?.checked_add(usize::try_from(used.x0 - src.rect.x0).ok()?)?.checked_mul(src.ch)?;
-                let source_len = usize::try_from(used.x1 - used.x0).ok()?.checked_mul(src.ch)?;
-                let row = src.data.get(source_start..source_start.checked_add(source_len)?)?;
-                let start = usize::try_from(y - read.y0).ok()?.checked_mul(self.width)?.checked_add(usize::try_from(used.x0 - read.x0).ok()?)?;
-                let dst = data.get_mut(start..start.checked_add(source_len / src.ch)?)?;
-                for (pixel, dst) in row.chunks_exact(src.ch).zip(dst) {
-                    let a = if alpha { *pixel.last()? } else { 1.0 };
-                    // Normalize each channel separately before packing a pair.
-                    // Otherwise a bright HDR colour's FFT residual could swamp
-                    // a small alpha channel sharing the imaginary component.
-                    let sample = |c: usize| -> f64 {
-                        match (pixel.get(c), scales.get(c)) {
-                            (Some(&value), Some(&scale)) if scale > 0.0 => f64::from(if alpha && c + 1 < src.ch { value * a } else { value }) / scale,
-                            _ => 0.0,
-                        }
-                    };
-                    *dst = Number::new(sample(channel), sample(channel + 1));
-                }
-            }
+            self.pack_channel_pair(&pair, used, read, &mut data, ctl)?;
             self.transform(&mut data, &mut transposed, &mut scratch, false, ctl)?;
             for (value, kernel) in data.iter_mut().zip(&self.kernel) {
                 *value *= kernel;
             }
             self.transform(&mut data, &mut transposed, &mut scratch, true, ctl)?;
-            let x0 = usize::try_from(-self.min_x).ok()?;
-            let y0 = usize::try_from(-self.min_y).ok()?;
-            for (y, dst) in result.chunks_exact_mut(ow * src.ch).enumerate() {
-                let start = y.checked_add(y0)?.checked_mul(self.width)?.checked_add(x0)?;
-                let values = data.get(start..start.checked_add(ow)?)?;
-                for (pixel, value) in dst.chunks_exact_mut(src.ch).zip(values) {
-                    *pixel.get_mut(channel)? = value.re * norm * scales.get(channel)?;
-                    if let Some(next) = pixel.get_mut(channel + 1) {
-                        *next = value.im * norm * scales.get(channel + 1)?;
-                    }
-                }
-            }
+            self.unpack_channel_pair(&pair, &data, &mut result, ow, norm)?;
         }
         if alpha {
-            // The row kernel accumulates in f32. Recompute very small alpha
-            // near its cutoff so a different summation order cannot expose colour.
-            let uncertainty = f64::from(self.distance.abs().ceil()) * f64::from(f32::EPSILON) * scales.get(src.ch - 1)?;
-            for (i, pixel) in result.chunks_exact_mut(src.ch).enumerate() {
-                if i % 16 == 0 && ctl.cancelled() {
-                    return None;
-                }
-                let a = pixel.last_mut()?;
-                // Valid alpha is nonnegative. Remove transform roundoff at
-                // zero to keep fully transparent regions empty.
-                if a.abs() < 1e-14 * scales.get(src.ch - 1)? {
-                    *a = 0.0;
-                }
-                *a = a.clamp(0.0, 1.0);
-                let a = *a;
-                // The row kernel's f32 sum can straddle the cutoff at long distances.
-                // Keep its branch and straight colour exactly for that narrow
-                // range, rather than amplifying a tiny alpha difference.
-                if a > 0.0 && (a <= 1.01e-7 + uncertainty || (0.99e-7..=1.01e-7).contains(&(a as f32))) {
-                    let x = out.x0.checked_add(i32::try_from(i % ow).ok()?)?;
-                    let y = out.y0.checked_add(i32::try_from(i / ow).ok()?)?;
-                    let original = sample_row_point(src, x, y, alpha, &self.taps, ctl)?;
-                    for (dst, value) in pixel.iter_mut().zip(original) {
-                        *dst = f64::from(value);
-                    }
-                    continue;
-                }
-                for value in pixel.iter_mut().take(src.ch - 1) {
-                    *value = if a as f32 > 1e-7 { *value / a } else { 0.0 };
-                }
-            }
+            self.restore_small_alpha(src, out, ow, &scales, &mut result, ctl)?;
         }
         let mut output = buffer(result.len(), 0.0f32)?;
         for (dst, value) in output.iter_mut().zip(result) {
@@ -475,6 +396,125 @@ impl Plan {
         }
         Some(output)
     }
+
+    /// Packs the pair of channels into the real and imaginary parts of `data`, over the source
+    /// rows that fall inside the transform tile, each channel normalised by its own scale.
+    fn pack_channel_pair(&self, pair: &ChannelPair, used: Rect, read: Rect, data: &mut [Number], ctl: &Interrupt) -> Option<()> {
+        let ChannelPair { src, alpha, scales, channel } = *pair;
+        let (sw, _) = dimensions(src.rect)?;
+        for y in used.y0..used.y1 {
+            if (y - used.y0) % 8 == 0 && ctl.cancelled() {
+                return None;
+            }
+            let source_start =
+                usize::try_from(y - src.rect.y0).ok()?.checked_mul(sw)?.checked_add(usize::try_from(used.x0 - src.rect.x0).ok()?)?.checked_mul(src.ch)?;
+            let source_len = usize::try_from(used.x1 - used.x0).ok()?.checked_mul(src.ch)?;
+            let row = src.data.get(source_start..source_start.checked_add(source_len)?)?;
+            let start = usize::try_from(y - read.y0).ok()?.checked_mul(self.width)?.checked_add(usize::try_from(used.x0 - read.x0).ok()?)?;
+            let dst = data.get_mut(start..start.checked_add(source_len / src.ch)?)?;
+            for (pixel, dst) in row.chunks_exact(src.ch).zip(dst) {
+                let a = if alpha { *pixel.last()? } else { 1.0 };
+                // Normalize each channel separately before packing a pair.
+                // Otherwise a bright HDR colour's FFT residual could swamp
+                // a small alpha channel sharing the imaginary component.
+                let sample = |c: usize| -> f64 {
+                    match (pixel.get(c), scales.get(c)) {
+                        (Some(&value), Some(&scale)) if scale > 0.0 => f64::from(if alpha && c + 1 < src.ch { value * a } else { value }) / scale,
+                        _ => 0.0,
+                    }
+                };
+                *dst = Number::new(sample(channel), sample(channel + 1));
+            }
+        }
+        Some(())
+    }
+
+    /// Writes the filtered pair of channels from `data` into the output pixels, undoing the
+    /// per-channel normalisation.
+    fn unpack_channel_pair(&self, pair: &ChannelPair, data: &[Number], result: &mut [f64], ow: usize, norm: f64) -> Option<()> {
+        let ChannelPair { src, scales, channel, .. } = *pair;
+        let x0 = usize::try_from(-self.min_x).ok()?;
+        let y0 = usize::try_from(-self.min_y).ok()?;
+        for (y, dst) in result.chunks_exact_mut(ow * src.ch).enumerate() {
+            let start = y.checked_add(y0)?.checked_mul(self.width)?.checked_add(x0)?;
+            let values = data.get(start..start.checked_add(ow)?)?;
+            for (pixel, value) in dst.chunks_exact_mut(src.ch).zip(values) {
+                *pixel.get_mut(channel)? = value.re * norm * scales.get(channel)?;
+                if let Some(next) = pixel.get_mut(channel + 1) {
+                    *next = value.im * norm * scales.get(channel + 1)?;
+                }
+            }
+        }
+        Some(())
+    }
+
+    /// Straightens the colour of the filtered pixels by their alpha, taking care of the pixels
+    /// whose alpha is at the cutoff.
+    fn restore_small_alpha(&self, src: &Image, out: Rect, ow: usize, scales: &[f64; 5], result: &mut [f64], ctl: &Interrupt) -> Option<()> {
+        // The row kernel accumulates in f32. Recompute very small alpha
+        // near its cutoff so a different summation order cannot expose colour.
+        let uncertainty = f64::from(self.distance.abs().ceil()) * f64::from(f32::EPSILON) * scales.get(src.ch - 1)?;
+        for (i, pixel) in result.chunks_exact_mut(src.ch).enumerate() {
+            if i % 16 == 0 && ctl.cancelled() {
+                return None;
+            }
+            let a = pixel.last_mut()?;
+            // Valid alpha is nonnegative. Remove transform roundoff at
+            // zero to keep fully transparent regions empty.
+            if a.abs() < 1e-14 * scales.get(src.ch - 1)? {
+                *a = 0.0;
+            }
+            *a = a.clamp(0.0, 1.0);
+            let a = *a;
+            // The row kernel's f32 sum can straddle the cutoff at long distances.
+            // Keep its branch and straight colour exactly for that narrow
+            // range, rather than amplifying a tiny alpha difference.
+            if a > 0.0 && (a <= 1.01e-7 + uncertainty || (0.99e-7..=1.01e-7).contains(&(a as f32))) {
+                let x = out.x0.checked_add(i32::try_from(i % ow).ok()?)?;
+                let y = out.y0.checked_add(i32::try_from(i / ow).ok()?)?;
+                let original = sample_row_point(src, x, y, true, &self.taps, ctl)?;
+                for (dst, value) in pixel.iter_mut().zip(original) {
+                    *dst = f64::from(value);
+                }
+                continue;
+            }
+            for value in pixel.iter_mut().take(src.ch - 1) {
+                *value = if a as f32 > 1e-7 { *value / a } else { 0.0 };
+            }
+        }
+        Some(())
+    }
+}
+
+/// One pair of channels (packed as real and imaginary parts) of a filter call.
+#[derive(Clone, Copy)]
+struct ChannelPair<'a> {
+    src: &'a Image,
+    alpha: bool,
+    scales: &'a [f64; 5],
+    channel: usize,
+}
+
+/// Per-channel peak magnitude of the (alpha-premultiplied) samples. `None` when a sample is not
+/// finite, is too large, or its alpha is outside 0..=1, and when cancelled.
+fn channel_scales(src: &Image, alpha: bool, ctl: &Interrupt) -> Option<[f64; 5]> {
+    let mut scales = [0.0f64; 5];
+    for (i, pixel) in src.data.chunks_exact(src.ch).enumerate() {
+        if i % 4096 == 0 && ctl.cancelled() {
+            return None;
+        }
+        if pixel.iter().any(|value| !value.is_finite() || value.abs() > MAX_SAMPLE) || (alpha && !pixel.last().is_some_and(|value| (0.0..=1.0).contains(value)))
+        {
+            return None;
+        }
+        let a = if alpha { *pixel.last()? } else { 1.0 };
+        for (c, &value) in pixel.iter().enumerate() {
+            let value = if alpha && c + 1 < src.ch { value * a } else { value };
+            let scale = scales.get_mut(c)?;
+            *scale = scale.max(f64::from(value.abs()));
+        }
+    }
+    Some(scales)
 }
 
 #[cfg(test)]
diff --git a/crates/algo/src/inpaint.rs b/crates/algo/src/inpaint.rs
index 87b8407a95..c781140ac3 100644
--- a/crates/algo/src/inpaint.rs
+++ b/crates/algo/src/inpaint.rs
@@ -167,29 +167,7 @@ fn complete_cow<'a>(
     }
     let r = p.patch_radius.max(1);
     let psz = 2 * r + 1;
-    // Pyramid: shrink until the hole is about four patches across (a deeper pyramid decides the
-    // structure where the texture has averaged out, and fills flat). A thin hole stops while it
-    // is still about two patches thick: through it, not along it, is what counts (#1366).
-    let mut levels = vec![Level { w, h, img, px: Cow::Borrowed(px) }];
-    let mut boxes = vec![hb0];
-    let mut ext = hb0.width().max(hb0.height());
-    let thickness = hole_thickness(w, hb0, px);
-    let thin = thickness.saturating_mul(THIN_RATIO) <= ext;
-    if thin {
-        ext = thickness;
-    }
-    let mut exts = vec![ext];
-    while let Some(l) = levels.last() {
-        ctl.check()?;
-        if ext <= if thin { 2 * psz } else { 4 * psz } || l.w / 2 < 3 * psz || l.h / 2 < 3 * psz {
-            break;
-        }
-        let d = downsample(l, ch);
-        levels.push(d);
-        boxes.push(boxes[boxes.len() - 1].half());
-        ext = ext.div_ceil(2);
-        exts.push(ext);
-    }
+    let Pyramid { mut levels, boxes, exts, thin } = build_pyramid(Level { w, h, img, px: Cow::Borrowed(px) }, ch, hb0, psz, ctl)?;
     let nlev = levels.len();
     // The coarser level's result.
     let mut prev: Option<Coarser> = None;
@@ -209,15 +187,7 @@ fn complete_cow<'a>(
             return Ok(Err(limg));
         }
         // The level's own pixels to fill (at level 0 the caller's, or a copy made in parallel).
-        let mut limg = match limg {
-            Cow::Owned(v) => v,
-            Cow::Borrowed(b) => {
-                const CHUNK: usize = 1 << 16;
-                let mut v = vec![0.0f32; b.len()];
-                par::chunks_mut(&mut v, CHUNK, true, |i, d| d.copy_from_slice(&b[i * CHUNK..i * CHUNK + d.len()]));
-                v
-            }
-        };
+        let mut limg = into_owned_pixels(limg);
         let targets = targets_around(lw, r, &lpx, hb, tb);
         ctl.check()?;
         // Initialise the hole: at the coarsest level peeled from its edge inwards (or a membrane
@@ -225,40 +195,13 @@ fn complete_cow<'a>(
         // its scaled-up matches.
         let coarser = prev.take();
         match &coarser {
-            Some(c) => {
-                let (pw, ph) = (c.w, c.h);
-                for y in hb.y0..hb.y1 {
-                    for x in hb.x0..hb.x1 {
-                        if lpx[y * lw + x] == Px::Hole {
-                            let (sx, sy) = ((x / 2).min(pw - 1), (y / 2).min(ph - 1));
-                            let (d, s) = ((y * lw + x) * ch, (sy * pw + sx) * ch);
-                            limg[d..d + ch].copy_from_slice(&c.img[s..s + ch]);
-                        }
-                    }
-                }
-            }
+            Some(c) => copy_up_coarser(&mut limg, &lpx, lw, ch, hb, c),
             // A thin hole, when peeling it would take too long, takes the membrane below: a few
             // patches thick here, a membrane across it is its surroundings.
             None if sources.len() > 0 && (!thin || peel_affordable(lw, &lpx, hb, sources.len())) => {
                 onion_peel(lw, lh, ch, ri, &mut limg, &lpx, hb, &sources.all(&valid, lw), ctl)?
             }
-            None => {
-                let mut unknown: Vec<bool> = lpx.iter().map(|k| matches!(k, Px::Hole | Px::Void)).collect();
-                // Across a thin hole the membrane starts a patch radius out, past the
-                // anti-aliased fringe or halo that a selection drawn close to the object leaves.
-                if thin {
-                    let hole: Vec<bool> = lpx.iter().map(|k| *k == Px::Hole).collect();
-                    for (u, d) in unknown.iter_mut().zip(crate::selection::edt(&hole, lw, lh)) {
-                        *u |= d <= r as f32;
-                    }
-                }
-                let m = membrane_fill(lw, lh, ch, &limg, &unknown);
-                for (i, k) in lpx.iter().enumerate() {
-                    if *k == Px::Hole {
-                        limg[i * ch..(i + 1) * ch].copy_from_slice(&m[i * ch..(i + 1) * ch]);
-                    }
-                }
-            }
+            None => fill_hole_with_membrane(&mut limg, &lpx, (lw, lh, ch), r, thin),
         }
         if sources.len() == 0 {
             prev = Some(Coarser { w: lw, h: lh, img: limg, field: Vec::new(), tbox: tb });
@@ -290,36 +233,7 @@ fn complete_cow<'a>(
         // NNF init: the coarser level's matches scaled up where they land on a valid source,
         // random otherwise.
         let mut rng = Rng::new(p.seed ^ (li as u64) << 20);
-        let tw = tb.width();
-        let mut nnf = vec![(0i32, 0i32); tb.area()];
-        let mut upsampled = false;
-        for y in tb.y0..tb.y1 {
-            if y % 32 == 0 {
-                ctl.check()?;
-            }
-            for x in tb.x0..tb.x1 {
-                let k = (y - tb.y0) * tw + (x - tb.x0);
-                if !solver.targets[k] {
-                    continue;
-                }
-                let mut cand = None;
-                if let Some(c) = &coarser
-                    && !c.field.is_empty()
-                {
-                    let (cx, cy) = ((x / 2).min(c.w - 1), (y / 2).min(c.h - 1));
-                    let (sx, sy) = c.field_at(cx, cy);
-                    if sx != i32::MIN {
-                        // The same displacement, twice as long.
-                        let c = (x as i32 + 2 * (sx - cx as i32), y as i32 + 2 * (sy - cy as i32));
-                        if solver.is_valid(c.0, c.1) {
-                            cand = Some(c);
-                        }
-                    }
-                }
-                upsampled |= cand.is_some();
-                nnf[k] = cand.unwrap_or_else(|| sources.nth((rng.next() % sources.len() as u64) as usize, &solver.valid, lw));
-            }
-        }
+        let (mut nnf, upsampled) = seed_matches(&solver, coarser.as_ref(), &sources, &mut rng, lw, tb, ctl)?;
         // The coarser level has given all it had.
         drop(coarser);
         let mut cost = vec![f32::INFINITY; tb.area()];
@@ -370,5 +284,138 @@ fn complete_cow<'a>(
     Ok(prev.map(|c| c.img).ok_or(Cow::Owned(Vec::new())))
 }
 
+/// The levels of the completion, finest first, with the hole's bounds and extent at each.
+struct Pyramid<'a> {
+    levels: Vec<Level<'a>>,
+    boxes: Vec<common::Bounds>,
+    exts: Vec<usize>,
+    /// The hole is a thin one: its thickness, not its length, decides how deep to go.
+    thin: bool,
+}
+
+/// Shrinks the image until the hole is about four patches across (a deeper pyramid decides the
+/// structure where the texture has averaged out, and fills flat). A thin hole stops while it is
+/// still about two patches thick: through it, not along it, is what counts (#1366).
+fn build_pyramid<'a>(
+    first: Level<'a>,
+    ch: usize,
+    hb0: common::Bounds,
+    psz: usize,
+    ctl: &photocraft_raster::Interrupt,
+) -> Result<Pyramid<'a>, photocraft_raster::Cancelled> {
+    let thickness = hole_thickness(first.w, hb0, &first.px);
+    let mut levels = vec![first];
+    let mut boxes = vec![hb0];
+    let mut ext = hb0.width().max(hb0.height());
+    let thin = thickness.saturating_mul(THIN_RATIO) <= ext;
+    if thin {
+        ext = thickness;
+    }
+    let mut exts = vec![ext];
+    while let Some(l) = levels.last() {
+        ctl.check()?;
+        if ext <= if thin { 2 * psz } else { 4 * psz } || l.w / 2 < 3 * psz || l.h / 2 < 3 * psz {
+            break;
+        }
+        let d = downsample(l, ch);
+        levels.push(d);
+        boxes.push(boxes[boxes.len() - 1].half());
+        ext = ext.div_ceil(2);
+        exts.push(ext);
+    }
+    Ok(Pyramid { levels, boxes, exts, thin })
+}
+
+/// The level's own pixels to fill: the caller's, or a copy made in parallel.
+fn into_owned_pixels(img: Cow<'_, [f32]>) -> Vec<f32> {
+    match img {
+        Cow::Owned(v) => v,
+        Cow::Borrowed(b) => {
+            const CHUNK: usize = 1 << 16;
+            let mut v = vec![0.0f32; b.len()];
+            par::chunks_mut(&mut v, CHUNK, true, |i, d| d.copy_from_slice(&b[i * CHUNK..i * CHUNK + d.len()]));
+            v
+        }
+    }
+}
+
+/// Starts the hole from the coarser level's pixels, scaled up.
+fn copy_up_coarser(img: &mut [f32], px: &[Px], w: usize, ch: usize, hb: common::Bounds, c: &Coarser) {
+    let (pw, ph) = (c.w, c.h);
+    for y in hb.y0..hb.y1 {
+        for x in hb.x0..hb.x1 {
+            if px[y * w + x] == Px::Hole {
+                let (sx, sy) = ((x / 2).min(pw - 1), (y / 2).min(ph - 1));
+                let (d, s) = ((y * w + x) * ch, (sy * pw + sx) * ch);
+                img[d..d + ch].copy_from_slice(&c.img[s..s + ch]);
+            }
+        }
+    }
+}
+
+/// Starts the hole as a membrane over its surroundings, for where nothing can be copied. `dims`
+/// is the level's width, height and channel count.
+fn fill_hole_with_membrane(img: &mut [f32], px: &[Px], dims: (usize, usize, usize), r: usize, thin: bool) {
+    let (w, h, ch) = dims;
+    let mut unknown: Vec<bool> = px.iter().map(|k| matches!(k, Px::Hole | Px::Void)).collect();
+    // Across a thin hole the membrane starts a patch radius out, past the
+    // anti-aliased fringe or halo that a selection drawn close to the object leaves.
+    if thin {
+        let hole: Vec<bool> = px.iter().map(|k| *k == Px::Hole).collect();
+        for (u, d) in unknown.iter_mut().zip(crate::selection::edt(&hole, w, h)) {
+            *u |= d <= r as f32;
+        }
+    }
+    let m = membrane_fill(w, h, ch, img, &unknown);
+    for (i, k) in px.iter().enumerate() {
+        if *k == Px::Hole {
+            img[i * ch..(i + 1) * ch].copy_from_slice(&m[i * ch..(i + 1) * ch]);
+        }
+    }
+}
+
+/// The coarser level's match for `(x, y)`, scaled up, where it lands on a valid source.
+fn upscaled_match(solver: &Solver, c: &Coarser, x: usize, y: usize) -> Option<(i32, i32)> {
+    let (cx, cy) = ((x / 2).min(c.w - 1), (y / 2).min(c.h - 1));
+    let (sx, sy) = c.field_at(cx, cy);
+    if sx == i32::MIN {
+        return None;
+    }
+    // The same displacement, twice as long.
+    let m = (x as i32 + 2 * (sx - cx as i32), y as i32 + 2 * (sy - cy as i32));
+    solver.is_valid(m.0, m.1).then_some(m)
+}
+
+/// NNF init: the coarser level's matches scaled up where they land on a valid source, random
+/// otherwise. Also says whether any came from the coarser level.
+fn seed_matches(
+    solver: &Solver,
+    coarser: Option<&Coarser>,
+    sources: &Sources,
+    rng: &mut Rng,
+    lw: usize,
+    tb: common::Bounds,
+    ctl: &photocraft_raster::Interrupt,
+) -> Result<(Vec<(i32, i32)>, bool), photocraft_raster::Cancelled> {
+    let tw = tb.width();
+    let mut nnf = vec![(0i32, 0i32); tb.area()];
+    let mut upsampled = false;
+    for y in tb.y0..tb.y1 {
+        if y % 32 == 0 {
+            ctl.check()?;
+        }
+        for x in tb.x0..tb.x1 {
+            let k = (y - tb.y0) * tw + (x - tb.x0);
+            if !solver.targets[k] {
+                continue;
+            }
+            let cand = coarser.filter(|c| !c.field.is_empty()).and_then(|c| upscaled_match(solver, c, x, y));
+            upsampled |= cand.is_some();
+            nnf[k] = cand.unwrap_or_else(|| sources.nth((rng.next() % sources.len() as u64) as usize, &solver.valid, lw));
+        }
+    }
+    Ok((nnf, upsampled))
+}
+
 #[cfg(test)]
 mod tests;
diff --git a/crates/algo/src/inpaint/common.rs b/crates/algo/src/inpaint/common.rs
index bbbcc8df26..16989a6079 100644
--- a/crates/algo/src/inpaint/common.rs
+++ b/crates/algo/src/inpaint/common.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::Cow;
 
 /// Below this many cells a pass runs on the calling thread (thread hand-off costs more than it
 /// saves). Every pass gives the same result either way.
diff --git a/crates/algo/src/inpaint/solver.rs b/crates/algo/src/inpaint/solver.rs
index b5cc82915d..67e0e2645e 100644
--- a/crates/algo/src/inpaint/solver.rs
+++ b/crates/algo/src/inpaint/solver.rs
@@ -1,5 +1,5 @@
 use super::common::{Adapt, Bounds, PAR_MIN_PATCHES, Px, Rng};
-use super::*;
+use super::par;
 
 /// Most channels whose moments the colour adaptation fits (the rest are copied as they are).
 const MOM_CH: usize = 8;
diff --git a/crates/algo/src/inpaint/sources.rs b/crates/algo/src/inpaint/sources.rs
index a3f390cfc3..fcc255e49a 100644
--- a/crates/algo/src/inpaint/sources.rs
+++ b/crates/algo/src/inpaint/sources.rs
@@ -1,5 +1,5 @@
 use super::common::{Bounds, Level, PAR_MIN, Px};
-use super::*;
+use super::{Cow, par};
 
 /// Half-size level: a cell is a hole if any of its pixels is; else it averages its non-void
 /// pixels, and may be copied from only if all of them may.
diff --git a/crates/algo/src/inpaint/synthesis.rs b/crates/algo/src/inpaint/synthesis.rs
index 0c3bf9c375..cd0452ab4c 100644
--- a/crates/algo/src/inpaint/synthesis.rs
+++ b/crates/algo/src/inpaint/synthesis.rs
@@ -1,7 +1,7 @@
 use super::common::{Bounds, Px, Rng};
 use super::solver::{Best, LANES, known_sse, known_sse_any, known_sse_lanes, least_sum};
 use super::sources::{hole_bbox, integral, window_count};
-use super::*;
+use super::{HoleIntegral, membrane_fill, par};
 
 /// Fill the hole from its edge inwards, one ring at a time: each pixel takes the centre of the
 /// source patch that best matches what is already known around it (the first in `sources` of
diff --git a/crates/algo/src/panorama/blend.rs b/crates/algo/src/panorama/blend.rs
index 1aaa821c14..034e5ed96d 100644
--- a/crates/algo/src/panorama/blend.rs
+++ b/crates/algo/src/panorama/blend.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Normal, Placement, par_map, par_rows};
 
 // ---------- photometric ----------
 
diff --git a/crates/algo/src/pixelate/cells.rs b/crates/algo/src/pixelate/cells.rs
index ebf326fbde..0d88fbc77e 100644
--- a/crates/algo/src/pixelate/cells.rs
+++ b/crates/algo/src/pixelate/cells.rs
@@ -1,6 +1,6 @@
 //! Reuse the jittered lattice in cell space. Raster work stays in the original
 //! row/candidate order, including f32 ties and boundary-cell average additions.
-use super::*;
+use super::{Ctx, Image, MAXC, Rect, cell_point, hash01, native, ncol, subtractive};
 
 #[derive(Clone, Copy)]
 struct Site {
@@ -348,76 +348,101 @@ fn pointillize_grid(src: &Image, out: Rect, ctx: &Ctx, cell: f32, background: [f
     let mut owners = vec![u32::MAX; width];
     for (row, pixels) in result.chunks_exact_mut(stride).enumerate() {
         let y = out.y0.checked_add(i32::try_from(row).ok()?)?;
-        let fy = y as f32 + 0.5;
         let cy = key(y, origin.1, cell);
         depths.fill(-0.5);
         owners.fill(u32::MAX);
         if cell >= 32.0 && out.width() <= 2048 {
-            for &(cx, x0, x1) in &base_runs {
-                let ids = grid.neighbours(cx, cy)?;
-                let start = usize::try_from(x0.checked_sub(out.x0)?).ok()?;
-                let end = usize::try_from(x1.checked_sub(out.x0)?).ok()?;
-                certified_span::<true>(grid, &ids, x0, y, owners.get_mut(start..end)?, depths.get_mut(start..end)?)?;
-            }
+            certified_row(grid, &base_runs, out, cy, y, &mut owners, &mut depths)?;
         } else {
-            for gy in cy.checked_sub(1)?..=cy.checked_add(1)? {
-                let row = usize::try_from(gy.checked_sub(grid.y0)?).ok()?.checked_mul(grid.width)?;
-                // Global gy/gx order is the original dy/dx tie order at every pixel.
-                for (column, &(x0, x1)) in columns.iter().enumerate() {
-                    if x0 >= x1 {
-                        continue;
-                    }
-                    let i = row.checked_add(column)?;
-                    let site = grid.sites.get(i)?;
-                    let dy2 = (site.point.1 - fy).powi(2);
-                    let reach = f64::from(site.radius) + 1.5;
-                    let square = reach * reach - f64::from(dy2);
-                    if square < 0.0 {
-                        continue;
-                    }
-                    // The extra pixel covers subtraction/square/sqrt rounding for
-                    // the bounded coordinates/radii above. The exact old depth
-                    // comparison still decides every candidate that survives.
-                    let reach_x = square.max(0.0).sqrt() + 1.0;
-                    let lo = ((f64::from(site.point.0) - 0.5 - reach_x).floor() as i32).max(x0);
-                    let hi = ((f64::from(site.point.0) - 0.5 + reach_x).ceil() as i32).min(x1);
-                    if lo >= hi {
-                        continue;
-                    }
-                    let start = usize::try_from(lo.checked_sub(out.x0)?).ok()?;
-                    let end = usize::try_from(hi.checked_sub(out.x0)?).ok()?;
-                    for (offset, (depth, owner)) in depths.get_mut(start..end)?.iter_mut().zip(owners.get_mut(start..end)?).enumerate() {
-                        let fx = (lo + offset as i32) as f32 + 0.5;
-                        let d = ((site.point.0 - fx).powi(2) + dy2).sqrt();
-                        let candidate = site.radius - d;
-                        if candidate > *depth {
-                            *depth = candidate;
-                            *owner = i as u32;
-                        }
-                    }
-                }
-            }
-        }
-        for ((pixel, &depth), &owner) in pixels.chunks_exact_mut(n).zip(&depths).zip(&owners) {
-            let a_orig = if ctx.alpha { *pixel.get(n - 1)? } else { 1.0 };
-            let mut canvas = bg;
-            if ctx.alpha {
-                *canvas.get_mut(n - 1)? = a_orig.max(bg.get(n - 1)?.min(1.0));
-            }
-            if owner != u32::MAX {
-                let i = owner as usize;
-                let k = (depth + 0.5).clamp(0.0, 1.0);
-                let dot = grid.sites.get(i)?;
-                for (c, value) in canvas.iter_mut().enumerate().take(n) {
-                    *value += (*dot.color.get(c)? - *value) * k;
-                }
-            }
-            pixel.copy_from_slice(canvas.get(..n)?);
+            scan_row(grid, &columns, out, cy, y, &mut owners, &mut depths)?;
         }
+        composite_row(pixels, &depths, &owners, grid, ctx, bg)?;
     }
     Some(result)
 }
 
+/// Resolve one output row's dot owners through the certified run spans.
+fn certified_row(grid: &Grid, base_runs: &[(i32, i32, i32)], out: Rect, cy: i32, y: i32, owners: &mut [u32], depths: &mut [f32]) -> Option<()> {
+    for &(cx, x0, x1) in base_runs {
+        let ids = grid.neighbours(cx, cy)?;
+        let start = usize::try_from(x0.checked_sub(out.x0)?).ok()?;
+        let end = usize::try_from(x1.checked_sub(out.x0)?).ok()?;
+        certified_span::<true>(grid, &ids, x0, y, owners.get_mut(start..end)?, depths.get_mut(start..end)?)?;
+    }
+    Some(())
+}
+
+/// Resolve one output row's dot owners by scanning the 3x3 neighbouring cells.
+fn scan_row(grid: &Grid, columns: &[(i32, i32)], out: Rect, cy: i32, y: i32, owners: &mut [u32], depths: &mut [f32]) -> Option<()> {
+    let fy = y as f32 + 0.5;
+    for gy in cy.checked_sub(1)?..=cy.checked_add(1)? {
+        let row = usize::try_from(gy.checked_sub(grid.y0)?).ok()?.checked_mul(grid.width)?;
+        // Global gy/gx order is the original dy/dx tie order at every pixel.
+        for (column, &span) in columns.iter().enumerate() {
+            if span.0 >= span.1 {
+                continue;
+            }
+            let i = row.checked_add(column)?;
+            scan_site(grid, i, fy, span, out, owners, depths)?;
+        }
+    }
+    Some(())
+}
+
+/// Let one site claim the pixels of the current row it reaches within `[x0, x1)`.
+fn scan_site(grid: &Grid, i: usize, fy: f32, (x0, x1): (i32, i32), out: Rect, owners: &mut [u32], depths: &mut [f32]) -> Option<()> {
+    let site = grid.sites.get(i)?;
+    let dy2 = (site.point.1 - fy).powi(2);
+    let reach = f64::from(site.radius) + 1.5;
+    let square = reach * reach - f64::from(dy2);
+    if square < 0.0 {
+        return Some(());
+    }
+    // The extra pixel covers subtraction/square/sqrt rounding for
+    // the bounded coordinates/radii above. The exact old depth
+    // comparison still decides every candidate that survives.
+    let reach_x = square.max(0.0).sqrt() + 1.0;
+    let lo = ((f64::from(site.point.0) - 0.5 - reach_x).floor() as i32).max(x0);
+    let hi = ((f64::from(site.point.0) - 0.5 + reach_x).ceil() as i32).min(x1);
+    if lo >= hi {
+        return Some(());
+    }
+    let start = usize::try_from(lo.checked_sub(out.x0)?).ok()?;
+    let end = usize::try_from(hi.checked_sub(out.x0)?).ok()?;
+    for (offset, (depth, owner)) in depths.get_mut(start..end)?.iter_mut().zip(owners.get_mut(start..end)?).enumerate() {
+        let fx = (lo + offset as i32) as f32 + 0.5;
+        let d = ((site.point.0 - fx).powi(2) + dy2).sqrt();
+        let candidate = site.radius - d;
+        if candidate > *depth {
+            *depth = candidate;
+            *owner = i as u32;
+        }
+    }
+    Some(())
+}
+
+/// Blend each pixel of a row with the background and its owning dot colour.
+fn composite_row(pixels: &mut [f32], depths: &[f32], owners: &[u32], grid: &Grid, ctx: &Ctx, bg: [f32; 8]) -> Option<()> {
+    let n = pixels.len() / depths.len().max(1);
+    for ((pixel, &depth), &owner) in pixels.chunks_exact_mut(n).zip(depths).zip(owners) {
+        let a_orig = if ctx.alpha { *pixel.get(n - 1)? } else { 1.0 };
+        let mut canvas = bg;
+        if ctx.alpha {
+            *canvas.get_mut(n - 1)? = a_orig.max(bg.get(n - 1)?.min(1.0));
+        }
+        if owner != u32::MAX {
+            let i = owner as usize;
+            let k = (depth + 0.5).clamp(0.0, 1.0);
+            let dot = grid.sites.get(i)?;
+            for (c, value) in canvas.iter_mut().enumerate().take(n) {
+                *value += (*dot.color.get(c)? - *value) * k;
+            }
+        }
+        pixel.copy_from_slice(canvas.get(..n)?);
+    }
+    Some(())
+}
+
 /// The filters sample cell centres, not a dense neighbourhood. On ordinary
 /// tiles read those sparse samples directly; keep only the original output
 /// pixels for alpha and selection mixing. Crystallize boundary tiles still
diff --git a/crates/algo/src/render2.rs b/crates/algo/src/render2.rs
index 19a4b8218d..cf1585115c 100644
--- a/crates/algo/src/render2.rs
+++ b/crates/algo/src/render2.rs
@@ -1236,256 +1236,320 @@ fn star(out: &mut Vec<Prim>, c: (f32, f32), r: f32, points: usize, col: [f32; 4]
     }
 }
 
-/// Builds picture-frame primitives inside `canvas`.
-pub fn picture_frame(spec: &FrameSpec, canvas: Rect) -> Vec<Prim> {
-    let mut out = Vec::new();
-    let short = (canvas.width().min(canvas.height()) as f32).max(8.0);
-    let margin = short * spec.margin.clamp(0.0, 30.0) / 100.0;
-    let unit = short * (0.008 + spec.size.clamp(1.0, 100.0) / 100.0 * 0.05);
-    let thick = (unit * 0.04 + short * 0.00012 * spec.thickness.clamp(1.0, 100.0)).max(0.6);
-    let spacing = unit * (4.0 - 3.2 * spec.arrangement.clamp(1.0, 100.0) / 100.0);
-    let inset = margin + unit;
-    let b = Border {
-        x0: canvas.x0 as f32 + inset,
-        y0: canvas.y0 as f32 + inset,
-        w: (canvas.width() as f32 - 2.0 * inset).max(1.0),
-        h: (canvas.height() as f32 - 2.0 * inset).max(1.0),
-    };
-    let total = b.len();
-    let count = (total / spacing).round().max(4.0) as usize;
-    let step = total / count as f32;
-    let mut rng = Rng::new(spec.seed, 0xF8A3E + spec.frame as u64);
-    let (vine, fl, lf) = (spec.vine_color, spec.flower_color, spec.leaf_color);
-    let style = FRAME_STYLES[(spec.frame.clamp(1, FRAME_STYLES.len() as u32) - 1) as usize];
-    let lines = spec.lines.clamp(1, 5) as usize;
-    let white = [1.0, 1.0, 1.0, 1.0];
-    let yellow = [0.98, 0.82, 0.2, 1.0];
-    // A wavy vine along the border.
-    let vine_path = |out: &mut Vec<Prim>, amp: f32, wl: f32, col: [f32; 4], r: f32| {
-        let n = (total / 3.0).ceil().max(8.0) as usize;
+/// Resolved geometry and palette shared by every picture-frame style.
+struct FrameLayout {
+    b: Border,
+    unit: f32,
+    thick: f32,
+    spacing: f32,
+    total: f32,
+    count: usize,
+    step: f32,
+    lines: usize,
+    vine: [f32; 4],
+    fl: [f32; 4],
+    lf: [f32; 4],
+    style: &'static str,
+}
+
+const FRAME_WHITE: [f32; 4] = [1.0, 1.0, 1.0, 1.0];
+const FRAME_YELLOW: [f32; 4] = [0.98, 0.82, 0.2, 1.0];
+
+fn wave_off(s: f32, amp: f32, wl: f32) -> f32 {
+    amp * (s / wl * std::f32::consts::TAU).sin()
+}
+
+impl FrameLayout {
+    fn new(spec: &FrameSpec, canvas: Rect) -> Self {
+        let short = (canvas.width().min(canvas.height()) as f32).max(8.0);
+        let margin = short * spec.margin.clamp(0.0, 30.0) / 100.0;
+        let unit = short * (0.008 + spec.size.clamp(1.0, 100.0) / 100.0 * 0.05);
+        let thick = (unit * 0.04 + short * 0.00012 * spec.thickness.clamp(1.0, 100.0)).max(0.6);
+        let spacing = unit * (4.0 - 3.2 * spec.arrangement.clamp(1.0, 100.0) / 100.0);
+        let inset = margin + unit;
+        let b = Border {
+            x0: canvas.x0 as f32 + inset,
+            y0: canvas.y0 as f32 + inset,
+            w: (canvas.width() as f32 - 2.0 * inset).max(1.0),
+            h: (canvas.height() as f32 - 2.0 * inset).max(1.0),
+        };
+        let total = b.len();
+        let count = (total / spacing).round().max(4.0) as usize;
+        Self {
+            b,
+            unit,
+            thick,
+            spacing,
+            total,
+            count,
+            step: total / count as f32,
+            lines: spec.lines.clamp(1, 5) as usize,
+            vine: spec.vine_color,
+            fl: spec.flower_color,
+            lf: spec.leaf_color,
+            style: FRAME_STYLES[(spec.frame.clamp(1, FRAME_STYLES.len() as u32) - 1) as usize],
+        }
+    }
+
+    /// A wavy vine along the border.
+    fn vine_path(&self, out: &mut Vec<Prim>, amp: f32, wl: f32, col: [f32; 4], r: f32) {
+        let n = (self.total / 3.0).ceil().max(8.0) as usize;
         let mut prev: Option<(f32, f32)> = None;
         for k in 0..=n {
-            let s = k as f32 / n as f32 * total;
-            let (p, _, nn) = b.at(s);
-            let o = amp * (s / wl * std::f32::consts::TAU).sin();
+            let s = k as f32 / n as f32 * self.total;
+            let (p, _, nn) = self.b.at(s);
+            let o = wave_off(s, amp, wl);
             let q = (p.0 + nn.0 * o, p.1 + nn.1 * o);
             if let Some(pp) = prev {
                 out.push(Prim::capsule(pp, q, r, r, col, col));
             }
             prev = Some(q);
         }
-    };
-    let wave_off = |s: f32, amp: f32, wl: f32| amp * (s / wl * std::f32::consts::TAU).sin();
-    match style {
-        "vineWithFlowers" | "vineWithLeaves" | "ivy" | "roses" | "daisies" | "berries" => {
-            let amp = unit * 0.5;
-            let wl = step * 2.0;
-            vine_path(&mut out, amp, wl, vine, thick);
-            for k in 0..count {
-                let s = k as f32 * step + step * 0.5;
-                let (p, t, nn) = b.at(s);
-                let o = wave_off(s, amp, wl);
-                let q = (p.0 + nn.0 * o, p.1 + nn.1 * o);
-                let side = if k % 2 == 0 { 1.0 } else { -1.0 };
-                let ta = t.1.atan2(t.0);
-                let la = ta + side * 0.9 + rng.sym() * 0.3;
-                let ll = unit * rng.range(0.9, 1.2);
-                match style {
-                    "vineWithFlowers" => {
-                        leaf(&mut out, q, la, ll, lf);
-                        if k % 2 == 0 {
-                            let c = (q.0 + nn.0 * unit * 0.7 * side, q.1 + nn.1 * unit * 0.7 * side);
-                            flower(&mut out, c, unit * 0.65, 5, fl, yellow, rng.f() * 6.3);
-                        }
-                    }
-                    "vineWithLeaves" => {
-                        leaf(&mut out, q, la, ll, lf);
-                        leaf(&mut out, q, ta - side * 0.9, ll * 0.8, lf);
-                    }
-                    "ivy" => {
-                        for j in 0..3 {
-                            let a = la + (j as f32 - 1.0) * 0.7;
-                            leaf(&mut out, q, a, ll * 0.75, shade([lf[0], lf[1], lf[2]], 0.75 + 0.15 * j as f32));
-                        }
-                    }
-                    "roses" => {
-                        leaf(&mut out, q, la, ll, lf);
-                        if k % 3 == 0 {
-                            let r = unit * 0.7;
-                            for (j, f) in [1.0f32, 0.75, 0.5, 0.28].iter().enumerate() {
-                                let c = shade([fl[0], fl[1], fl[2]], 0.75 + 0.1 * j as f32);
-                                out.push(Prim::ellipse(q, r * f, r * f * 0.9, rng.f() * 3.0, c, shade([fl[0], fl[1], fl[2]], 0.55)));
-                            }
-                        }
-                    }
-                    "daisies" => {
-                        leaf(&mut out, q, la, ll * 0.8, lf);
-                        if k % 2 == 1 {
-                            flower(&mut out, q, unit * 0.6, 12, white, yellow, rng.f());
-                        }
-                    }
-                    _ => {
-                        leaf(&mut out, q, la, ll, lf);
-                        for _ in 0..3 {
-                            let c = (q.0 + rng.sym() * unit * 0.4, q.1 + rng.sym() * unit * 0.4);
-                            out.push(Prim::ellipse(c, unit * 0.2, unit * 0.2, 0.0, shade([fl[0], fl[1], fl[2]], 1.2), shade([fl[0], fl[1], fl[2]], 0.6)));
-                        }
-                    }
-                }
-            }
-        }
-        "bamboo" => {
-            for edge in 0..4 {
-                let (s0, l) = match edge {
-                    0 => (0.0, b.w),
-                    1 => (b.w, b.h),
-                    2 => (b.w + b.h, b.w),
-                    _ => (2.0 * b.w + b.h, b.h),
-                };
-                let (a, _, _) = b.at(s0 + 0.01);
-                let (z, _, _) = b.at(s0 + l - 0.01);
-                let joints = (l / (spacing * 2.0)).round().max(1.0) as usize;
-                for j in 0..joints {
-                    let f0 = j as f32 / joints as f32;
-                    let f1 = (j + 1) as f32 / joints as f32;
-                    let p0 = (a.0 + (z.0 - a.0) * f0, a.1 + (z.1 - a.1) * f0);
-                    let p1 = (a.0 + (z.0 - a.0) * f1, a.1 + (z.1 - a.1) * f1);
-                    out.push(Prim::capsule(p0, p1, unit * 0.35, unit * 0.35, vine, shade([vine[0], vine[1], vine[2]], 0.8)));
-                    out.push(Prim::disc(p1, unit * 0.4, shade([vine[0], vine[1], vine[2]], 0.7)));
-                }
-                // A few leaves per edge.
-                for _ in 0..(joints / 2).max(1) {
-                    let f = rng.f();
-                    let p = (a.0 + (z.0 - a.0) * f, a.1 + (z.1 - a.1) * f);
-                    leaf(&mut out, p, rng.f() * 6.3, unit * 1.4, lf);
-                }
-            }
-        }
-        "waves" | "zigzag" | "doubleLine" | "rope" => {
-            for li in 0..lines {
-                let off = (li as f32 - (lines - 1) as f32 / 2.0) * thick * 4.0;
-                let n = (total / 2.0).ceil().max(8.0) as usize;
-                let mut prev: Option<(f32, f32)> = None;
-                for k in 0..=n {
-                    let s = k as f32 / n as f32 * total;
-                    let (p, _, nn) = b.at(s);
-                    let o = off
-                        + match style {
-                            "waves" => wave_off(s + li as f32 * step * 0.25, unit * 0.4, step),
-                            "zigzag" => {
-                                let ph = (s / step).fract();
-                                unit * 0.4 * (4.0 * (ph - 0.5).abs() - 1.0)
-                            }
-                            _ => 0.0,
-                        };
-                    let q = (p.0 + nn.0 * o, p.1 + nn.1 * o);
-                    if style == "rope" {
-                        if k % 2 == 0 {
-                            let (_, t, _) = b.at(s);
-                            out.push(Prim::ellipse(
-                                q,
-                                unit * 0.45,
-                                unit * 0.2,
-                                t.1.atan2(t.0) + 0.7,
-                                shade([vine[0], vine[1], vine[2]], 1.1),
-                                shade([vine[0], vine[1], vine[2]], 0.65),
-                            ));
-                        }
-                    } else if let Some(pp) = prev {
-                        out.push(Prim::capsule(pp, q, thick, thick, vine, vine));
-                    }
-                    prev = Some(q);
-                }
-                if style == "doubleLine" {
-                    // A second rule inside each line and corner squares.
-                    let inner = Border {
-                        x0: b.x0 + unit * 0.6 + off,
-                        y0: b.y0 + unit * 0.6 + off,
-                        w: b.w - 2.0 * (unit * 0.6 + off),
-                        h: b.h - 2.0 * (unit * 0.6 + off),
-                    };
-                    for e in 0..4 {
-                        let (p, _, _) = inner.at([0.0, inner.w, inner.w + inner.h, 2.0 * inner.w + inner.h][e]);
-                        let (q, _, _) = inner.at([inner.w, inner.w + inner.h, 2.0 * inner.w + inner.h, inner.len() - 0.001][e]);
-                        out.push(Prim::capsule(p, q, thick * 0.6, thick * 0.6, vine, vine));
-                    }
-                }
-            }
-            if style == "doubleLine" {
-                for e in 0..4 {
-                    let (p, _, _) = b.at([0.0, b.w, b.w + b.h, 2.0 * b.w + b.h][e]);
-                    out.push(Prim::ellipse(p, unit * 0.45, unit * 0.45, std::f32::consts::FRAC_PI_4, fl, fl));
-                }
-            }
-        }
-        "dots" | "scallops" | "snowflakes" | "stars" | "hearts" => {
-            for k in 0..count {
-                let s = k as f32 * step;
-                let (p, t, nn) = b.at(s);
-                let ta = t.1.atan2(t.0);
-                match style {
-                    "dots" => {
-                        let r = unit * if k % 2 == 0 { 0.4 } else { 0.22 };
-                        out.push(Prim::ellipse(p, r, r, 0.0, shade([fl[0], fl[1], fl[2]], 1.15), shade([fl[0], fl[1], fl[2]], 0.75)));
-                    }
-                    "scallops" => {
-                        let (c0, _, _) = b.at(s - step * 0.5);
-                        let mid = ((c0.0 + p.0) / 2.0, (c0.1 + p.1) / 2.0);
-                        let n = 8;
-                        for j in 0..n {
-                            let a0 = std::f32::consts::PI * j as f32 / n as f32;
-                            let a1 = std::f32::consts::PI * (j + 1) as f32 / n as f32;
-                            let r = step * 0.5;
-                            let pt = |a: f32| (mid.0 - t.0 * r * a.cos() - nn.0 * r * a.sin(), mid.1 - t.1 * r * a.cos() - nn.1 * r * a.sin());
-                            out.push(Prim::capsule(pt(a0), pt(a1), thick, thick, vine, vine));
-                        }
-                    }
-                    "snowflakes" => {
-                        let r = unit * 0.6;
-                        let c = [0.85, 0.92, 1.0, 1.0];
-                        for j in 0..6 {
-                            let a = ta + j as f32 * std::f32::consts::FRAC_PI_3;
-                            let e = (p.0 + a.cos() * r, p.1 + a.sin() * r);
-                            out.push(Prim::capsule(p, e, (thick * 0.6).max(0.6), (thick * 0.4).max(0.5), c, c));
-                            let m = (p.0 + a.cos() * r * 0.6, p.1 + a.sin() * r * 0.6);
-                            for sd in [-0.7f32, 0.7] {
-                                let b2 = (m.0 + (a + sd).cos() * r * 0.3, m.1 + (a + sd).sin() * r * 0.3);
-                                out.push(Prim::capsule(m, b2, (thick * 0.4).max(0.5), 0.4, c, c));
-                            }
-                        }
-                    }
-                    "stars" => star(&mut out, p, unit * 0.55, 5, if k % 2 == 0 { yellow } else { fl }, ta - std::f32::consts::FRAC_PI_2),
-                    _ => {
-                        // Heart: two lobes and a point towards the inside.
-                        let r = unit * 0.3;
-                        let (tx, ty) = t;
-                        let l = (p.0 - tx * r * 0.8 - nn.0 * r * 0.3, p.1 - ty * r * 0.8 - nn.1 * r * 0.3);
-                        let rr = (p.0 + tx * r * 0.8 - nn.0 * r * 0.3, p.1 + ty * r * 0.8 - nn.1 * r * 0.3);
-                        let tip = (p.0 + nn.0 * r * 1.6, p.1 + nn.1 * r * 1.6);
-                        out.push(Prim::capsule(l, tip, r, 0.6, fl, fl));
-                        out.push(Prim::capsule(rr, tip, r, 0.6, fl, fl));
-                    }
-                }
-            }
-        }
-        _ => {}
     }
-    // Fade: lower the opacity of ornaments that reach further inside.
-    let fade = spec.fade.clamp(0.0, 100.0) / 100.0;
-    if fade > 0.0 {
+
+    /// Vine styles: a wavy stem with a leaf cluster or bloom at each step.
+    fn vine_styles(&self, out: &mut Vec<Prim>, rng: &mut Rng) {
+        let (unit, step, fl, lf) = (self.unit, self.step, self.fl, self.lf);
+        let amp = unit * 0.5;
+        let wl = step * 2.0;
+        self.vine_path(out, amp, wl, self.vine, self.thick);
+        for k in 0..self.count {
+            let s = k as f32 * step + step * 0.5;
+            let (p, t, nn) = self.b.at(s);
+            let o = wave_off(s, amp, wl);
+            let q = (p.0 + nn.0 * o, p.1 + nn.1 * o);
+            let side = if k % 2 == 0 { 1.0 } else { -1.0 };
+            let ta = t.1.atan2(t.0);
+            let la = ta + side * 0.9 + rng.sym() * 0.3;
+            let ll = unit * rng.range(0.9, 1.2);
+            match self.style {
+                "vineWithFlowers" => {
+                    leaf(out, q, la, ll, lf);
+                    if k % 2 == 0 {
+                        let c = (q.0 + nn.0 * unit * 0.7 * side, q.1 + nn.1 * unit * 0.7 * side);
+                        flower(out, c, unit * 0.65, 5, fl, FRAME_YELLOW, rng.f() * 6.3);
+                    }
+                }
+                "vineWithLeaves" => {
+                    leaf(out, q, la, ll, lf);
+                    leaf(out, q, ta - side * 0.9, ll * 0.8, lf);
+                }
+                "ivy" => {
+                    for j in 0..3 {
+                        let a = la + (j as f32 - 1.0) * 0.7;
+                        leaf(out, q, a, ll * 0.75, shade([lf[0], lf[1], lf[2]], 0.75 + 0.15 * j as f32));
+                    }
+                }
+                "roses" => {
+                    leaf(out, q, la, ll, lf);
+                    if k % 3 == 0 {
+                        let r = unit * 0.7;
+                        for (j, f) in [1.0f32, 0.75, 0.5, 0.28].iter().enumerate() {
+                            let c = shade([fl[0], fl[1], fl[2]], 0.75 + 0.1 * j as f32);
+                            out.push(Prim::ellipse(q, r * f, r * f * 0.9, rng.f() * 3.0, c, shade([fl[0], fl[1], fl[2]], 0.55)));
+                        }
+                    }
+                }
+                "daisies" => {
+                    leaf(out, q, la, ll * 0.8, lf);
+                    if k % 2 == 1 {
+                        flower(out, q, unit * 0.6, 12, FRAME_WHITE, FRAME_YELLOW, rng.f());
+                    }
+                }
+                _ => {
+                    leaf(out, q, la, ll, lf);
+                    for _ in 0..3 {
+                        let c = (q.0 + rng.sym() * unit * 0.4, q.1 + rng.sym() * unit * 0.4);
+                        out.push(Prim::ellipse(c, unit * 0.2, unit * 0.2, 0.0, shade([fl[0], fl[1], fl[2]], 1.2), shade([fl[0], fl[1], fl[2]], 0.6)));
+                    }
+                }
+            }
+        }
+    }
+
+    /// Bamboo: jointed canes along each edge with a few leaves.
+    fn bamboo(&self, out: &mut Vec<Prim>, rng: &mut Rng) {
+        let (b, unit, vine) = (&self.b, self.unit, self.vine);
+        for edge in 0..4 {
+            let (s0, l) = match edge {
+                0 => (0.0, b.w),
+                1 => (b.w, b.h),
+                2 => (b.w + b.h, b.w),
+                _ => (2.0 * b.w + b.h, b.h),
+            };
+            let (a, _, _) = b.at(s0 + 0.01);
+            let (z, _, _) = b.at(s0 + l - 0.01);
+            let joints = (l / (self.spacing * 2.0)).round().max(1.0) as usize;
+            for j in 0..joints {
+                let f0 = j as f32 / joints as f32;
+                let f1 = (j + 1) as f32 / joints as f32;
+                let p0 = (a.0 + (z.0 - a.0) * f0, a.1 + (z.1 - a.1) * f0);
+                let p1 = (a.0 + (z.0 - a.0) * f1, a.1 + (z.1 - a.1) * f1);
+                out.push(Prim::capsule(p0, p1, unit * 0.35, unit * 0.35, vine, shade([vine[0], vine[1], vine[2]], 0.8)));
+                out.push(Prim::disc(p1, unit * 0.4, shade([vine[0], vine[1], vine[2]], 0.7)));
+            }
+            // A few leaves per edge.
+            for _ in 0..(joints / 2).max(1) {
+                let f = rng.f();
+                let p = (a.0 + (z.0 - a.0) * f, a.1 + (z.1 - a.1) * f);
+                leaf(out, p, rng.f() * 6.3, unit * 1.4, self.lf);
+            }
+        }
+    }
+
+    /// Continuous rule styles: waves, zigzag, double line and rope.
+    fn rule_styles(&self, out: &mut Vec<Prim>) {
+        let (b, unit, thick, step, vine) = (&self.b, self.unit, self.thick, self.step, self.vine);
+        for li in 0..self.lines {
+            let off = (li as f32 - (self.lines - 1) as f32 / 2.0) * thick * 4.0;
+            let n = (self.total / 2.0).ceil().max(8.0) as usize;
+            let mut prev: Option<(f32, f32)> = None;
+            for k in 0..=n {
+                let s = k as f32 / n as f32 * self.total;
+                let (p, _, nn) = b.at(s);
+                let o = off
+                    + match self.style {
+                        "waves" => wave_off(s + li as f32 * step * 0.25, unit * 0.4, step),
+                        "zigzag" => {
+                            let ph = (s / step).fract();
+                            unit * 0.4 * (4.0 * (ph - 0.5).abs() - 1.0)
+                        }
+                        _ => 0.0,
+                    };
+                let q = (p.0 + nn.0 * o, p.1 + nn.1 * o);
+                if self.style == "rope" {
+                    if k % 2 == 0 {
+                        let (_, t, _) = b.at(s);
+                        out.push(Prim::ellipse(
+                            q,
+                            unit * 0.45,
+                            unit * 0.2,
+                            t.1.atan2(t.0) + 0.7,
+                            shade([vine[0], vine[1], vine[2]], 1.1),
+                            shade([vine[0], vine[1], vine[2]], 0.65),
+                        ));
+                    }
+                } else if let Some(pp) = prev {
+                    out.push(Prim::capsule(pp, q, thick, thick, vine, vine));
+                }
+                prev = Some(q);
+            }
+            if self.style == "doubleLine" {
+                self.inner_rule(out, off);
+            }
+        }
+        if self.style == "doubleLine" {
+            for e in 0..4 {
+                let (p, _, _) = b.at([0.0, b.w, b.w + b.h, 2.0 * b.w + b.h][e]);
+                out.push(Prim::ellipse(p, unit * 0.45, unit * 0.45, std::f32::consts::FRAC_PI_4, self.fl, self.fl));
+            }
+        }
+    }
+
+    /// A second rule inside each double line.
+    fn inner_rule(&self, out: &mut Vec<Prim>, off: f32) {
+        let (b, unit) = (&self.b, self.unit);
+        let inner = Border { x0: b.x0 + unit * 0.6 + off, y0: b.y0 + unit * 0.6 + off, w: b.w - 2.0 * (unit * 0.6 + off), h: b.h - 2.0 * (unit * 0.6 + off) };
+        for e in 0..4 {
+            let (p, _, _) = inner.at([0.0, inner.w, inner.w + inner.h, 2.0 * inner.w + inner.h][e]);
+            let (q, _, _) = inner.at([inner.w, inner.w + inner.h, 2.0 * inner.w + inner.h, inner.len() - 0.001][e]);
+            out.push(Prim::capsule(p, q, self.thick * 0.6, self.thick * 0.6, self.vine, self.vine));
+        }
+    }
+
+    /// Evenly spaced motif styles: dots, scallops, snowflakes, stars and hearts.
+    fn motif_styles(&self, out: &mut Vec<Prim>) {
+        let (unit, fl) = (self.unit, self.fl);
+        for k in 0..self.count {
+            let s = k as f32 * self.step;
+            let (p, t, nn) = self.b.at(s);
+            let ta = t.1.atan2(t.0);
+            match self.style {
+                "dots" => {
+                    let r = unit * if k % 2 == 0 { 0.4 } else { 0.22 };
+                    out.push(Prim::ellipse(p, r, r, 0.0, shade([fl[0], fl[1], fl[2]], 1.15), shade([fl[0], fl[1], fl[2]], 0.75)));
+                }
+                "scallops" => self.scallop(out, s, p, t, nn),
+                "snowflakes" => self.snowflake(out, p, ta),
+                "stars" => star(out, p, unit * 0.55, 5, if k % 2 == 0 { FRAME_YELLOW } else { fl }, ta - std::f32::consts::FRAC_PI_2),
+                _ => self.heart(out, p, t, nn),
+            }
+        }
+    }
+
+    fn scallop(&self, out: &mut Vec<Prim>, s: f32, p: (f32, f32), t: (f32, f32), nn: (f32, f32)) {
+        let (c0, _, _) = self.b.at(s - self.step * 0.5);
+        let mid = ((c0.0 + p.0) / 2.0, (c0.1 + p.1) / 2.0);
+        let n = 8;
+        for j in 0..n {
+            let a0 = std::f32::consts::PI * j as f32 / n as f32;
+            let a1 = std::f32::consts::PI * (j + 1) as f32 / n as f32;
+            let r = self.step * 0.5;
+            let pt = |a: f32| (mid.0 - t.0 * r * a.cos() - nn.0 * r * a.sin(), mid.1 - t.1 * r * a.cos() - nn.1 * r * a.sin());
+            out.push(Prim::capsule(pt(a0), pt(a1), self.thick, self.thick, self.vine, self.vine));
+        }
+    }
+
+    fn snowflake(&self, out: &mut Vec<Prim>, p: (f32, f32), ta: f32) {
+        let thick = self.thick;
+        let r = self.unit * 0.6;
+        let c = [0.85, 0.92, 1.0, 1.0];
+        for j in 0..6 {
+            let a = ta + j as f32 * std::f32::consts::FRAC_PI_3;
+            let e = (p.0 + a.cos() * r, p.1 + a.sin() * r);
+            out.push(Prim::capsule(p, e, (thick * 0.6).max(0.6), (thick * 0.4).max(0.5), c, c));
+            let m = (p.0 + a.cos() * r * 0.6, p.1 + a.sin() * r * 0.6);
+            for sd in [-0.7f32, 0.7] {
+                let b2 = (m.0 + (a + sd).cos() * r * 0.3, m.1 + (a + sd).sin() * r * 0.3);
+                out.push(Prim::capsule(m, b2, (thick * 0.4).max(0.5), 0.4, c, c));
+            }
+        }
+    }
+
+    /// Heart: two lobes and a point towards the inside.
+    fn heart(&self, out: &mut Vec<Prim>, p: (f32, f32), t: (f32, f32), nn: (f32, f32)) {
+        let r = self.unit * 0.3;
+        let (tx, ty) = t;
+        let l = (p.0 - tx * r * 0.8 - nn.0 * r * 0.3, p.1 - ty * r * 0.8 - nn.1 * r * 0.3);
+        let rr = (p.0 + tx * r * 0.8 - nn.0 * r * 0.3, p.1 + ty * r * 0.8 - nn.1 * r * 0.3);
+        let tip = (p.0 + nn.0 * r * 1.6, p.1 + nn.1 * r * 1.6);
+        out.push(Prim::capsule(l, tip, r, 0.6, self.fl, self.fl));
+        out.push(Prim::capsule(rr, tip, r, 0.6, self.fl, self.fl));
+    }
+
+    /// Fade: lower the opacity of ornaments that reach further inside.
+    fn apply_fade(&self, out: &mut [Prim], fade: f32, canvas: Rect) {
         let cx = canvas.x0 as f32 + canvas.width() as f32 / 2.0;
         let cy = canvas.y0 as f32 + canvas.height() as f32 / 2.0;
-        for p in &mut out {
+        for p in out {
             let c = match p.shape {
                 Shape::Capsule { a, .. } => a,
                 Shape::Ellipse { c, .. } => c,
             };
-            let edge = ((c.0 - cx).abs() / (b.w / 2.0)).max((c.1 - cy).abs() / (b.h / 2.0)).clamp(0.0, 1.0);
+            let edge = ((c.0 - cx).abs() / (self.b.w / 2.0)).max((c.1 - cy).abs() / (self.b.h / 2.0)).clamp(0.0, 1.0);
             let k = 1.0 - fade * (1.0 - edge) * 8.0;
             p.c0[3] *= k.clamp(0.0, 1.0);
             p.c1[3] *= k.clamp(0.0, 1.0);
         }
     }
+}
+
+/// Builds picture-frame primitives inside `canvas`.
+pub fn picture_frame(spec: &FrameSpec, canvas: Rect) -> Vec<Prim> {
+    let mut out = Vec::new();
+    let layout = FrameLayout::new(spec, canvas);
+    let mut rng = Rng::new(spec.seed, 0xF8A3E + spec.frame as u64);
+    match layout.style {
+        "vineWithFlowers" | "vineWithLeaves" | "ivy" | "roses" | "daisies" | "berries" => layout.vine_styles(&mut out, &mut rng),
+        "bamboo" => layout.bamboo(&mut out, &mut rng),
+        "waves" | "zigzag" | "doubleLine" | "rope" => layout.rule_styles(&mut out),
+        "dots" | "scallops" | "snowflakes" | "stars" | "hearts" => layout.motif_styles(&mut out),
+        _ => {}
+    }
+    let fade = spec.fade.clamp(0.0, 100.0) / 100.0;
+    if fade > 0.0 {
+        layout.apply_fade(&mut out, fade, canvas);
+    }
     out
 }
 
diff --git a/crates/algo/src/shape_blur.rs b/crates/algo/src/shape_blur.rs
index 26e9ad15bc..5b262afdcb 100644
--- a/crates/algo/src/shape_blur.rs
+++ b/crates/algo/src/shape_blur.rs
@@ -51,63 +51,14 @@ impl Prepared {
         if prefix_len > MAX_SAMPLES || output_len > MAX_SAMPLES {
             return None;
         }
-        let mut prefix = Vec::new();
-        prefix.try_reserve_exact(prefix_len).ok()?;
-        prefix.resize(prefix_len, 0.0f64);
-        if input_row != 0 {
-            for (s, d) in src.data.chunks_exact(input_row).zip(prefix.chunks_exact_mut(stride)) {
-                let mut sum = [0.0f64; crate::fxutil::MAXC];
-                for (px, dst) in s.chunks_exact(n).zip(d.get_mut(n..)?.chunks_exact_mut(n)) {
-                    let alpha = if ctx.alpha { *px.last()? } else { 1.0 };
-                    for (c, ((v, sum), dst)) in px.iter().zip(sum.iter_mut()).zip(dst).enumerate() {
-                        // Multiplication stays f32, exactly as premul_window.
-                        let v = if ctx.alpha && c + 1 < n { *v * alpha } else { *v };
-                        *sum += f64::from(v);
-                        *dst = *sum;
-                    }
-                }
-            }
-        }
+        let prefix = Prefix::build(src, ctx, n, stride, prefix_len)?;
         let mut result = Vec::new();
         result.try_reserve_exact(output_len).ok()?;
         let mut acc = Vec::new();
         acc.try_reserve_exact(row_len).ok()?;
         acc.resize(row_len, 0.0f64);
-        let x = i64::from(out.x0) - i64::from(src.rect.x0);
         for y in out.y0..out.y1 {
-            acc.fill(0.0);
-            for &(dy, a, b) in &self.spans.rows {
-                let yy = i64::from(y) - i64::from(src.rect.y0) + i64::from(dy);
-                let Ok(yy) = usize::try_from(yy) else {
-                    continue;
-                };
-                if yy >= h {
-                    continue;
-                }
-                let row = prefix.get(yy.checked_mul(stride)?..yy.checked_add(1)?.checked_mul(stride)?)?;
-                let lo = x + i64::from(a);
-                let hi = x + i64::from(b) + 1;
-                let end = out.width() as i64;
-                if lo >= 0 && hi + end <= w as i64 {
-                    let start_lo = usize::try_from(lo).ok()?.checked_mul(n)?;
-                    let start_hi = usize::try_from(hi).ok()?.checked_mul(n)?;
-                    let low = row.get(start_lo..start_lo.checked_add(row_len)?)?;
-                    let high = row.get(start_hi..start_hi.checked_add(row_len)?)?;
-                    for ((acc, hi), lo) in acc.iter_mut().zip(high).zip(low) {
-                        *acc += hi - lo;
-                    }
-                } else {
-                    // Direct kernel callers may omit the halo or request pixels outside src.
-                    // Retain the scalar kernel's zero extension and fixed normalization.
-                    for (i, px) in acc.chunks_exact_mut(n).enumerate() {
-                        let low = (lo + i as i64).clamp(0, w as i64) as usize * n;
-                        let high = (hi + i as i64).clamp(0, w as i64) as usize * n;
-                        for ((acc, hi), lo) in px.iter_mut().zip(row.get(high..high + n)?).zip(row.get(low..low + n)?) {
-                            *acc += hi - lo;
-                        }
-                    }
-                }
-            }
+            self.accumulate_row(&prefix, src, out, y, &mut acc)?;
             for px in acc.chunks_exact(n) {
                 let mut sample = [0.0f32; crate::fxutil::MAXC];
                 let sample = sample.get_mut(..n)?;
@@ -120,4 +71,88 @@ impl Prepared {
         }
         Some(result)
     }
+
+    /// Sum every kernel row's window for output row `y` into `acc`.
+    fn accumulate_row(&self, prefix: &Prefix, src: &Image, out: Rect, y: i32, acc: &mut [f64]) -> Option<()> {
+        let x = i64::from(out.x0) - i64::from(src.rect.x0);
+        acc.fill(0.0);
+        for &(dy, a, b) in &self.spans.rows {
+            let yy = i64::from(y) - i64::from(src.rect.y0) + i64::from(dy);
+            let Ok(yy) = usize::try_from(yy) else {
+                continue;
+            };
+            if yy >= prefix.h {
+                continue;
+            }
+            let row = prefix.row(yy)?;
+            prefix.add_window(row, acc, x + i64::from(a), x + i64::from(b) + 1, out.width() as i64)?;
+        }
+        Some(())
+    }
+}
+
+/// Per-row running channel sums (premultiplied when alpha is present), one
+/// extra leading column per row so any window is a difference of two entries.
+struct Prefix {
+    data: Vec<f64>,
+    stride: usize,
+    n: usize,
+    w: usize,
+    h: usize,
+}
+
+impl Prefix {
+    fn build(src: &Image, ctx: &Ctx, n: usize, stride: usize, len: usize) -> Option<Self> {
+        let w = src.rect.width() as usize;
+        let h = src.rect.height() as usize;
+        let input_row = w.checked_mul(n)?;
+        let mut data = Vec::new();
+        data.try_reserve_exact(len).ok()?;
+        data.resize(len, 0.0f64);
+        if input_row != 0 {
+            for (s, d) in src.data.chunks_exact(input_row).zip(data.chunks_exact_mut(stride)) {
+                let mut sum = [0.0f64; crate::fxutil::MAXC];
+                for (px, dst) in s.chunks_exact(n).zip(d.get_mut(n..)?.chunks_exact_mut(n)) {
+                    let alpha = if ctx.alpha { *px.last()? } else { 1.0 };
+                    for (c, ((v, sum), dst)) in px.iter().zip(sum.iter_mut()).zip(dst).enumerate() {
+                        // Multiplication stays f32, exactly as premul_window.
+                        let v = if ctx.alpha && c + 1 < n { *v * alpha } else { *v };
+                        *sum += f64::from(v);
+                        *dst = *sum;
+                    }
+                }
+            }
+        }
+        Some(Self { data, stride, n, w, h })
+    }
+
+    fn row(&self, y: usize) -> Option<&[f64]> {
+        self.data.get(y.checked_mul(self.stride)?..y.checked_add(1)?.checked_mul(self.stride)?)
+    }
+
+    /// Add the `[lo, hi)` window difference of `row` for `acc.len() / n` output pixels.
+    fn add_window(&self, row: &[f64], acc: &mut [f64], lo: i64, hi: i64, end: i64) -> Option<()> {
+        let (n, w) = (self.n, self.w);
+        let row_len = acc.len();
+        if lo >= 0 && hi + end <= w as i64 {
+            let start_lo = usize::try_from(lo).ok()?.checked_mul(n)?;
+            let start_hi = usize::try_from(hi).ok()?.checked_mul(n)?;
+            let low = row.get(start_lo..start_lo.checked_add(row_len)?)?;
+            let high = row.get(start_hi..start_hi.checked_add(row_len)?)?;
+            for ((acc, hi), lo) in acc.iter_mut().zip(high).zip(low) {
+                *acc += hi - lo;
+            }
+        } else {
+            // Direct kernel callers may omit the halo or request pixels outside src.
+            // Retain the scalar kernel's zero extension and fixed normalization.
+            for (i, px) in acc.chunks_exact_mut(n).enumerate() {
+                let low = (lo + i as i64).clamp(0, w as i64) as usize * n;
+                let high = (hi + i as i64).clamp(0, w as i64) as usize * n;
+                for ((acc, hi), lo) in px.iter_mut().zip(row.get(high..high + n)?).zip(row.get(low..low + n)?) {
+                    *acc += hi - lo;
+                }
+            }
+        }
+        Some(())
+    }
 }
diff --git a/crates/algo/src/sharpen/exact.rs b/crates/algo/src/sharpen/exact.rs
index 7d74bc538f..07ecba08bc 100644
--- a/crates/algo/src/sharpen/exact.rs
+++ b/crates/algo/src/sharpen/exact.rs
@@ -77,58 +77,94 @@ pub(crate) fn run(src: &Image, out: Rect, ctx: &Ctx, amount: f32, radius: f32, t
     let row_len = ow.checked_mul(n)?;
     let th = oh.checked_add(2 * r)?;
     let ww = ow.checked_add(2 * r)?;
-    let (x0, x1, y0) = (out.x0.checked_sub(r as i32)?, out.x1.checked_add(r as i32)?, out.y0.checked_sub(r as i32)?);
+    let pass = Pass { src, out, ctx, kernel: &kernel, ctl, n, row_len };
     let mut row = zeros(ww.checked_mul(n)?)?;
     let mut tmp = zeros(row_len.checked_mul(th)?)?;
     let mut result = zeros(row_len.checked_mul(oh)?)?;
-    for (y, dst) in tmp.chunks_exact_mut(row_len).enumerate() {
-        if ctl.cancelled() {
-            return None;
-        }
-        read_row(src, x0, x1, y0.checked_add(y as i32)?, &mut row)?;
-        premultiply(&mut row, n, ctx.alpha);
-        // Tap-major traversal exposes contiguous independent samples to LLVM. No
-        // reduction, tap merging, symmetry or fused multiply-add changes the sums.
-        for (i, weight) in kernel.iter().enumerate() {
-            let start = i.checked_mul(n)?;
-            let samples = row.get(start..start.checked_add(row_len)?)?;
-            for (d, s) in dst.iter_mut().zip(samples) {
-                *d += s * weight;
+    pass.horizontal(&mut row, &mut tmp)?;
+    pass.vertical(&tmp, &mut row, &mut result, amount / 100.0, threshold / 255.0)?;
+    Some(result)
+}
+
+/// The shared inputs of the two separable blur passes.
+struct Pass<'a> {
+    src: &'a Image,
+    out: Rect,
+    ctx: &'a Ctx,
+    kernel: &'a [f32],
+    ctl: &'a Interrupt<'a>,
+    n: usize,
+    row_len: usize,
+}
+
+impl Pass<'_> {
+    /// Blur horizontally every source row the output (plus kernel halo) needs.
+    fn horizontal(&self, row: &mut [f32], tmp: &mut [f32]) -> Option<()> {
+        let (n, row_len) = (self.n, self.row_len);
+        let r = self.kernel.len() / 2;
+        let (x0, x1, y0) = (self.out.x0.checked_sub(r as i32)?, self.out.x1.checked_add(r as i32)?, self.out.y0.checked_sub(r as i32)?);
+        for (y, dst) in tmp.chunks_exact_mut(row_len).enumerate() {
+            if self.ctl.cancelled() {
+                return None;
+            }
+            read_row(self.src, x0, x1, y0.checked_add(y as i32)?, row)?;
+            premultiply(row, n, self.ctx.alpha);
+            // Tap-major traversal exposes contiguous independent samples to LLVM. No
+            // reduction, tap merging, symmetry or fused multiply-add changes the sums.
+            for (i, weight) in self.kernel.iter().enumerate() {
+                let start = i.checked_mul(n)?;
+                let samples = row.get(start..start.checked_add(row_len)?)?;
+                for (d, s) in dst.iter_mut().zip(samples) {
+                    *d += s * weight;
+                }
             }
         }
+        Some(())
     }
-    let (amount, threshold) = (amount / 100.0, threshold / 255.0);
-    let cc = n - usize::from(ctx.alpha);
-    for (y, dst) in result.chunks_exact_mut(row_len).enumerate() {
-        if ctl.cancelled() {
-            return None;
-        }
-        for (i, weight) in kernel.iter().enumerate() {
-            let start = y.checked_add(i)?.checked_mul(row_len)?;
-            let samples = tmp.get(start..start.checked_add(row_len)?)?;
-            for (d, s) in dst.iter_mut().zip(samples) {
-                *d += s * weight;
+
+    /// Blur vertically and blend each output row against its original pixels.
+    /// `originals` is scratch space reused for the source row being compared.
+    fn vertical(&self, tmp: &[f32], originals: &mut [f32], result: &mut [f32], amount: f32, threshold: f32) -> Option<()> {
+        let row_len = self.row_len;
+        for (y, dst) in result.chunks_exact_mut(row_len).enumerate() {
+            if self.ctl.cancelled() {
+                return None;
             }
+            for (i, weight) in self.kernel.iter().enumerate() {
+                let start = y.checked_add(i)?.checked_mul(row_len)?;
+                let samples = tmp.get(start..start.checked_add(row_len)?)?;
+                for (d, s) in dst.iter_mut().zip(samples) {
+                    *d += s * weight;
+                }
+            }
+            let originals = originals.get_mut(..row_len)?;
+            read_row(self.src, self.out.x0, self.out.x1, self.out.y0.checked_add(y as i32)?, originals)?;
+            self.sharpen_row(dst, originals, amount, threshold)?;
         }
-        let originals = row.get_mut(..row_len)?;
-        read_row(src, out.x0, out.x1, out.y0.checked_add(y as i32)?, originals)?;
-        for (blurred, original) in dst.chunks_exact_mut(n).zip(originals.chunks_exact(n)) {
-            if ctx.alpha && *original.last()? <= 0.0 {
+        Some(())
+    }
+
+    /// Replace each blurred pixel by the thresholded unsharp-mask value.
+    fn sharpen_row(&self, blurred_row: &mut [f32], originals: &[f32], amount: f32, threshold: f32) -> Option<()> {
+        let (n, alpha) = (self.n, self.ctx.alpha);
+        let cc = n - usize::from(alpha);
+        for (blurred, original) in blurred_row.chunks_exact_mut(n).zip(originals.chunks_exact(n)) {
+            if alpha && *original.last()? <= 0.0 {
                 blurred.copy_from_slice(original);
                 continue;
             }
-            let a = if ctx.alpha { *blurred.last()? } else { 1.0 };
+            let a = if alpha { *blurred.last()? } else { 1.0 };
             for (b, o) in blurred.iter_mut().zip(original).take(cc) {
                 // Keep the original unpremultiply cut-off and division, followed by
                 // the threshold epsilon and inclusive comparison, at every depth.
-                let b_value = if ctx.alpha { if a > 1e-7 { *b / a } else { 0.0 } } else { *b };
+                let b_value = if alpha { if a > 1e-7 { *b / a } else { 0.0 } } else { *b };
                 let d = o - b_value;
                 *b = if d.abs() + 1e-6 >= threshold { o + amount * d } else { *o };
             }
-            if ctx.alpha {
+            if alpha {
                 *blurred.last_mut()? = *original.last()?;
             }
         }
+        Some(())
     }
-    Some(result)
 }
diff --git a/crates/algo/src/sharpen/fft.rs b/crates/algo/src/sharpen/fft.rs
index 6fdf18c8b0..57758b06d2 100644
--- a/crates/algo/src/sharpen/fft.rs
+++ b/crates/algo/src/sharpen/fft.rs
@@ -128,9 +128,9 @@ fn run(surface: &Surface, area: Rect, amount: f32, radius: f32, selection: Optio
     let resident = samples.checked_mul(4)?;
     let mut planner = FftPlanner::<f64>::new();
     let horizontal = Plan::new(w.checked_add(2 * r)?, &kernel, &mut planner)?;
-    let vertical = Plan::new(h.checked_add(2 * r)?, &kernel, &mut planner)?;
+    let vertical_plan = Plan::new(h.checked_add(2 * r)?, &kernel, &mut planner)?;
     // A conservative allowance includes FFT plans/twiddles in addition to spectra.
-    let plans = horizontal.size.checked_add(vertical.size)?.checked_mul(256)?;
+    let plans = horizontal.size.checked_add(vertical_plan.size)?.checked_mul(256)?;
     let resident = resident.checked_add(plans)?;
     let workers = rayon::current_num_threads().max(1);
     let horizontal_worker = read_width.checked_mul(n)?.checked_mul(4)?.checked_add(horizontal.size.checked_add(horizontal.scratch)?.checked_mul(16)?)?;
@@ -139,7 +139,7 @@ fn run(surface: &Surface, area: Rect, amount: f32, radius: f32, selection: Optio
         .checked_mul(n)?
         .checked_mul(4)?
         .checked_add(STRIPE.checked_mul(h)?.checked_mul(n)?.checked_mul(12)?)?
-        .checked_add(vertical.size.checked_add(vertical.scratch)?.checked_mul(16)?)?;
+        .checked_add(vertical_plan.size.checked_add(vertical_plan.scratch)?.checked_mul(16)?)?;
     let group = group_size(resident, horizontal_worker.max(vertical_worker), w.div_ceil(STRIPE), workers)?;
     let mut tmp = buffer(samples, 0.0f32)?;
     let finished = AtomicUsize::new(0);
@@ -210,98 +210,29 @@ fn run(surface: &Surface, area: Rect, amount: f32, radius: f32, selection: Optio
     }
     let mut out = surface.clone();
     let count = w.div_ceil(STRIPE);
+    let vertical = VerticalPass {
+        surface,
+        selection,
+        tmp: &tmp,
+        plan: &vertical_plan,
+        ctl,
+        area,
+        n,
+        w,
+        h,
+        rows,
+        row_len,
+        r,
+        y0,
+        read_y0,
+        read_y1,
+        alpha,
+        amount,
+        kernel_len: kernel.len(),
+    };
     for first in (0..count).step_by(group) {
         let end = first.checked_add(group)?.min(count);
-        let results: Option<Vec<_>> = (first..end)
-            .into_par_iter()
-            .map(|index| {
-                if ctl.cancelled() {
-                    return None;
-                }
-                let x = index.checked_mul(STRIPE)?;
-                let width = STRIPE.min(w.checked_sub(x)?);
-                let mut columns = buffer(width.checked_mul(rows)?.checked_mul(n)?, 0.0f32)?;
-                for (y, row) in tmp.chunks_exact(row_len).enumerate() {
-                    if y % 64 == 0 && ctl.cancelled() {
-                        return None;
-                    }
-                    for (c, px) in row.get(x * n..(x + width) * n)?.chunks_exact(n).enumerate() {
-                        let start = (c * rows + y) * n;
-                        columns.get_mut(start..start + n)?.copy_from_slice(px);
-                    }
-                }
-                let rect = Rect::new(area.x0.checked_add(x as i32)?, area.y0, area.x0.checked_add((x + width) as i32)?, area.y1);
-                let len = width.checked_mul(h)?.checked_mul(n)?;
-                let mut result = buffer(len, 0.0f32)?;
-                let mut original = buffer(len, 0.0f32)?;
-                surface.read_region_into(rect, &mut original);
-                let (mut data, mut scratch) = vertical.work()?;
-                for (c, samples) in columns.chunks_exact(rows * n).enumerate() {
-                    if ctl.cancelled() {
-                        return None;
-                    }
-                    let mut scales = [0.0f64; crate::fxutil::MAXC];
-                    for px in samples.chunks_exact(n) {
-                        for (s, v) in scales.iter_mut().zip(px) {
-                            *s = s.max(f64::from(v.abs()));
-                        }
-                    }
-                    for channel in (0..n).step_by(2) {
-                        if ctl.cancelled() {
-                            return None;
-                        }
-                        data.fill(Number::default());
-                        for (i, d) in data.iter_mut().take(h + 2 * r).enumerate() {
-                            let sy = y0.checked_add(i as i32)?.clamp(read_y0, read_y1.checked_sub(1)?);
-                            let start = usize::try_from(sy - read_y0).ok()?.checked_mul(n)?;
-                            let px = samples.get(start..start + n)?;
-                            let sample = |c: usize| -> f64 {
-                                match (px.get(c), scales.get(c)) {
-                                    (Some(v), Some(s)) if *s > 0.0 => f64::from(*v) / s,
-                                    _ => 0.0,
-                                }
-                            };
-                            *d = Number::new(sample(channel), sample(channel + 1));
-                        }
-                        vertical.convolve(&mut data, &mut scratch)?;
-                        for (y, d) in data.get(2 * r..2 * r + h)?.iter().enumerate() {
-                            let start = (y * width + c) * n;
-                            *result.get_mut(start + channel)? = (d.re * scales.get(channel)?) as f32;
-                            if let Some(v) = result.get_mut(start + channel + 1).filter(|_| channel + 1 < n) {
-                                *v = (d.im * scales.get(channel + 1)?) as f32;
-                            }
-                        }
-                    }
-                }
-                for (px, o) in result.chunks_exact_mut(n).zip(original.chunks_exact(n)) {
-                    if alpha && *o.last()? <= 0.0 {
-                        px.copy_from_slice(o);
-                        continue;
-                    }
-                    let a = if alpha { *px.last()? } else { 1.0 };
-                    // Near the original unpremultiply cutoff, cancellation/FFT noise
-                    // or f32 sum order can expose colour. Decline the whole fast path.
-                    let uncertainty = 4.0 * kernel.len() as f32 * f32::EPSILON;
-                    if alpha && a <= 1e-7 + uncertainty {
-                        return None;
-                    }
-                    for (v, o) in px.iter_mut().zip(o).take(n - usize::from(alpha)) {
-                        let b = if alpha { *v / a } else { *v };
-                        *v = o + amount / 100.0 * (o - b);
-                        if !v.is_finite() {
-                            return None;
-                        }
-                    }
-                    if alpha {
-                        *px.last_mut()? = *o.last()?;
-                    }
-                }
-                if let Some(sel) = selection {
-                    crate::mix_selection(&mut result, rect, sel, &Image { rect, ch: n, data: original }, alpha);
-                }
-                Some((rect, result))
-            })
-            .collect();
+        let results: Option<Vec<_>> = (first..end).into_par_iter().map(|index| vertical.stripe(index)).collect();
         for (rect, data) in results? {
             if ctl.cancelled() {
                 return None;
@@ -321,5 +252,145 @@ fn run(surface: &Surface, area: Rect, amount: f32, radius: f32, selection: Optio
     Some(out)
 }
 
+/// Everything the vertical pass needs to turn one stripe of horizontally
+/// convolved columns into finished, sharpened output pixels.
+struct VerticalPass<'a> {
+    surface: &'a Surface,
+    selection: Option<&'a Surface>,
+    tmp: &'a [f32],
+    plan: &'a Plan,
+    ctl: &'a Interrupt<'a>,
+    area: Rect,
+    n: usize,
+    w: usize,
+    h: usize,
+    rows: usize,
+    row_len: usize,
+    r: usize,
+    y0: i32,
+    read_y0: i32,
+    read_y1: i32,
+    alpha: bool,
+    amount: f32,
+    kernel_len: usize,
+}
+
+/// Channel `c` of `px` scaled into [-1, 1], or zero when the column is all zero.
+fn normalized(px: &[f32], scales: &[f64], c: usize) -> f64 {
+    match (px.get(c), scales.get(c)) {
+        (Some(v), Some(s)) if *s > 0.0 => f64::from(*v) / s,
+        _ => 0.0,
+    }
+}
+
+impl VerticalPass<'_> {
+    /// Process the `index`th stripe of columns, returning its rect and pixels.
+    fn stripe(&self, index: usize) -> Option<(Rect, Vec<f32>)> {
+        let (ctl, n, h) = (self.ctl, self.n, self.h);
+        if ctl.cancelled() {
+            return None;
+        }
+        let x = index.checked_mul(STRIPE)?;
+        let width = STRIPE.min(self.w.checked_sub(x)?);
+        let columns = self.gather_columns(x, width)?;
+        let rect = Rect::new(self.area.x0.checked_add(x as i32)?, self.area.y0, self.area.x0.checked_add((x + width) as i32)?, self.area.y1);
+        let len = width.checked_mul(h)?.checked_mul(n)?;
+        let mut result = buffer(len, 0.0f32)?;
+        let mut original = buffer(len, 0.0f32)?;
+        self.surface.read_region_into(rect, &mut original);
+        let (mut data, mut scratch) = self.plan.work()?;
+        for (c, samples) in columns.chunks_exact(self.rows * n).enumerate() {
+            if ctl.cancelled() {
+                return None;
+            }
+            self.convolve_column(samples, c, width, (&mut data, &mut scratch), &mut result)?;
+        }
+        self.sharpen(&mut result, &original)?;
+        if let Some(sel) = self.selection {
+            crate::mix_selection(&mut result, rect, sel, &Image { rect, ch: n, data: original }, self.alpha);
+        }
+        Some((rect, result))
+    }
+
+    /// Transpose the stripe at `x` of the horizontal results into column-major order.
+    fn gather_columns(&self, x: usize, width: usize) -> Option<Vec<f32>> {
+        let (n, rows) = (self.n, self.rows);
+        let mut columns = buffer(width.checked_mul(rows)?.checked_mul(n)?, 0.0f32)?;
+        for (y, row) in self.tmp.chunks_exact(self.row_len).enumerate() {
+            if y % 64 == 0 && self.ctl.cancelled() {
+                return None;
+            }
+            for (c, px) in row.get(x * n..(x + width) * n)?.chunks_exact(n).enumerate() {
+                let start = (c * rows + y) * n;
+                columns.get_mut(start..start + n)?.copy_from_slice(px);
+            }
+        }
+        Some(columns)
+    }
+
+    /// Convolve one gathered column, two channels per complex FFT, into `result`.
+    fn convolve_column(&self, samples: &[f32], c: usize, width: usize, work: (&mut [Number], &mut [Number]), result: &mut [f32]) -> Option<()> {
+        let (n, h, r) = (self.n, self.h, self.r);
+        let (data, scratch) = work;
+        let mut scales = [0.0f64; crate::fxutil::MAXC];
+        for px in samples.chunks_exact(n) {
+            for (s, v) in scales.iter_mut().zip(px) {
+                *s = s.max(f64::from(v.abs()));
+            }
+        }
+        for channel in (0..n).step_by(2) {
+            if self.ctl.cancelled() {
+                return None;
+            }
+            data.fill(Number::default());
+            for (i, d) in data.iter_mut().take(h + 2 * r).enumerate() {
+                let sy = self.y0.checked_add(i as i32)?.clamp(self.read_y0, self.read_y1.checked_sub(1)?);
+                let start = usize::try_from(sy - self.read_y0).ok()?.checked_mul(n)?;
+                let px = samples.get(start..start + n)?;
+                *d = Number::new(normalized(px, &scales, channel), normalized(px, &scales, channel + 1));
+            }
+            self.plan.convolve(data, scratch)?;
+            for (y, d) in data.get(2 * r..2 * r + h)?.iter().enumerate() {
+                let start = (y * width + c) * n;
+                *result.get_mut(start + channel)? = (d.re * scales.get(channel)?) as f32;
+                if let Some(v) = result.get_mut(start + channel + 1).filter(|_| channel + 1 < n) {
+                    *v = (d.im * scales.get(channel + 1)?) as f32;
+                }
+            }
+        }
+        Some(())
+    }
+
+    /// Turn the blurred stripe into the unsharp-masked result against `original`.
+    /// Declines (`None`) wherever the fast path cannot match the exact kernel.
+    fn sharpen(&self, result: &mut [f32], original: &[f32]) -> Option<()> {
+        let (n, alpha) = (self.n, self.alpha);
+        for (px, o) in result.chunks_exact_mut(n).zip(original.chunks_exact(n)) {
+            if alpha && *o.last()? <= 0.0 {
+                px.copy_from_slice(o);
+                continue;
+            }
+            let a = if alpha { *px.last()? } else { 1.0 };
+            // Near the original unpremultiply cutoff, cancellation/FFT noise
+            // or f32 sum order can expose colour. Decline the whole fast path.
+            let uncertainty = 4.0 * self.kernel_len as f32 * f32::EPSILON;
+            if alpha && a <= 1e-7 + uncertainty {
+                return None;
+            }
+            for (v, o) in px.iter_mut().zip(o).take(n - usize::from(alpha)) {
+                let b = if alpha { *v / a } else { *v };
+                *v = o + self.amount / 100.0 * (o - b);
+                if !v.is_finite() {
+                    return None;
+                }
+            }
+            if alpha {
+                *px.last_mut()? = *o.last()?;
+            }
+        }
+        Some(())
+    }
+}
+
 #[cfg(test)]
 mod tests;
diff --git a/crates/algo/src/stylize2/extrude.rs b/crates/algo/src/stylize2/extrude.rs
index 78a3df273b..ae70351c09 100644
--- a/crates/algo/src/stylize2/extrude.rs
+++ b/crates/algo/src/stylize2/extrude.rs
@@ -20,7 +20,6 @@ pub(super) fn blocks(src: &Image, out: Rect, ctx: &Ctx, spec: &ExtrudeSpec) -> O
     if [b.x0, b.y0, b.x1, b.y1, out.x0, out.y0, out.x1, out.y1].iter().any(|v| v.unsigned_abs() > MAX_COORD as u32) {
         return None;
     }
-    let n = src.ch;
     let w = out.width() as usize;
     let count = w.checked_mul(out.height() as usize)?;
     if count > MAX_PIXELS {
@@ -44,111 +43,190 @@ pub(super) fn blocks(src: &Image, out: Rect, ctx: &Ctx, spec: &ExtrudeSpec) -> O
     if i64::from(cx1 - cx0 + 1).checked_mul(i64::from(cy1 - cy0 + 1))? > MAX_CELLS {
         return None;
     }
-    let (bcx, bcy) = ((b.x0 + b.x1) as f32 / 2.0, (b.y0 + b.y1) as f32 / 2.0);
-    let half_diag = ((b.width() as f32).hypot(b.height() as f32) / 2.0).max(1.0);
-    let half = cs as f32 / 2.0;
-    let cc = ncol(ctx, n);
-    let sub = subtractive(ctx);
+    let pass = BlockPass {
+        src,
+        out,
+        ctx,
+        spec,
+        b,
+        area,
+        cs,
+        k,
+        reach,
+        centre: ((b.x0 + b.x1) as f32 / 2.0, (b.y0 + b.y1) as f32 / 2.0),
+        half_diag: ((b.width() as f32).hypot(b.height() as f32) / 2.0).max(1.0),
+        half: cs as f32 / 2.0,
+    };
     // Ascending gy, then gx, is the tie order of every pixel's old candidate search.
     for cy in cy0..=cy1 {
         for cx in cx0..=cx1 {
-            let r = Rect::new(b.x0 + cx * cs, b.y0 + cy * cs, b.x0 + (cx + 1) * cs, b.y0 + (cy + 1) * cs);
-            let clipped = r.intersect(&b);
-            if spec.mask_incomplete && clipped != r {
-                continue;
-            }
-            let mut col = [0.0f32; MAXC];
-            let mut cnt = 0.0;
-            let step = (cs / 8).max(1) as usize;
-            for yy in (clipped.y0..clipped.y1).step_by(step) {
-                for xx in (clipped.x0..clipped.x1).step_by(step) {
-                    let a = if ctx.alpha { src.get(xx, yy, n - 1) } else { 1.0 };
-                    for (c, v) in col.iter_mut().enumerate().take(n) {
-                        let s = src.get(xx, yy, c);
-                        *v += if ctx.alpha && c < n - 1 { s * a } else { s };
-                    }
-                    cnt += 1.0;
-                }
-            }
-            if cnt > 0.0 {
-                for v in col.iter_mut().take(n) {
-                    *v /= cnt;
-                }
-            }
-            unpremul_px(&mut col[..n], ctx.alpha);
-            let h = if spec.level_based { luma(ctx, &col[..n]).clamp(0.0, 1.0) } else { hash01(cx, cy, 21, spec.seed) };
-            if !h.is_finite() {
-                return None;
-            }
-            let (mx, my) = (r.x0 as f32 + half, r.y0 as f32 + half);
-            let off = reach * h / half_diag;
-            let (ox, oy) = ((mx - bcx) * off, (my - bcy) * off);
-            // Two extra pixels conservatively cover rounding in the unchanged interval test.
-            let sweep = Rect::new(
-                (mx.min(mx + ox) - half).floor() as i32 - 2,
-                (my.min(my + oy) - half).floor() as i32 - 2,
-                (mx.max(mx + ox) + half).ceil() as i32 + 2,
-                (my.max(my + oy) + half).ceil() as i32 + 2,
-            )
-            .intersect(&area);
-            for y in sweep.y0..sweep.y1 {
-                let gy = (y - b.y0).div_euclid(cs);
-                if (cy - gy).abs() > k {
-                    continue;
-                }
-                let fy = y as f32 + 0.5;
-                let Some(iy) = interval(fy, my, oy, half) else { continue };
-                for x in sweep.x0..sweep.x1 {
-                    if (cx - (x - b.x0).div_euclid(cs)).abs() > k {
-                        continue;
-                    }
-                    let i = (y - out.y0) as usize * w + (x - out.x0) as usize;
-                    let height = heights.get_mut(i)?;
-                    if *height >= h {
-                        continue;
-                    }
-                    let fx = x as f32 + 0.5;
-                    let Some(ix) = interval(fx, mx, ox, half) else { continue };
-                    let (lo, hi) = (ix.0.max(iy.0), ix.1.min(iy.1));
-                    if lo > hi {
-                        continue;
-                    }
-                    *height = h;
-                    let face = if hi >= 1.0 {
-                        0
-                    } else if ix.1 < iy.1 {
-                        if ox > 0.0 { 1 } else { 2 }
-                    } else if oy > 0.0 {
-                        3
-                    } else {
-                        4
-                    };
-                    let px = res.get_mut(i * n..(i + 1) * n)?;
-                    if face == 0 && !spec.solid_front {
-                        let (sx, sy) = ((fx - (mx - bcx) * off).floor() as i32, (fy - (my - bcy) * off).floor() as i32);
-                        read_px(src, sx.clamp(r.x0, r.x1 - 1), sy.clamp(r.y0, r.y1 - 1), px);
-                    } else {
-                        let shade = match face {
-                            0 => 1.0,
-                            1 => 0.85,
-                            2 => 0.55,
-                            3 => 0.95,
-                            _ => 0.45,
-                        };
-                        for (v, c) in px.iter_mut().zip(&col).take(cc) {
-                            *v = if sub { 1.0 - (1.0 - *c) * shade } else { *c * shade }.clamp(0.0, 1.0);
-                        }
-                        if ctx.alpha {
-                            *px.last_mut()? = col.get(n - 1).copied()?;
-                        }
-                    }
-                }
-            }
+            pass.paint_cell(cx, cy, &mut heights, &mut res)?;
         }
     }
     Some(res)
 }
 
+/// The constants shared by every swept block of one `blocks` call.
+struct BlockPass<'a> {
+    src: &'a Image,
+    out: Rect,
+    ctx: &'a Ctx,
+    spec: &'a ExtrudeSpec,
+    b: Rect,
+    area: Rect,
+    cs: i32,
+    k: i32,
+    reach: f32,
+    centre: (f32, f32),
+    half_diag: f32,
+    half: f32,
+}
+
+/// One cell's flat colour and where its extruded block sweeps to.
+struct Block {
+    r: Rect,
+    cx: i32,
+    m: (f32, f32),
+    o: (f32, f32),
+    off: f32,
+    h: f32,
+    col: [f32; MAXC],
+}
+
+impl BlockPass<'_> {
+    /// Average the (premultiplied) source over `clipped`, sampling every `step` pixels.
+    fn cell_colour(&self, clipped: Rect) -> [f32; MAXC] {
+        let (src, ctx, n) = (self.src, self.ctx, self.src.ch);
+        let mut col = [0.0f32; MAXC];
+        let mut cnt = 0.0;
+        let step = (self.cs / 8).max(1) as usize;
+        for yy in (clipped.y0..clipped.y1).step_by(step) {
+            for xx in (clipped.x0..clipped.x1).step_by(step) {
+                let a = if ctx.alpha { src.get(xx, yy, n - 1) } else { 1.0 };
+                for (c, v) in col.iter_mut().enumerate().take(n) {
+                    let s = src.get(xx, yy, c);
+                    *v += if ctx.alpha && c < n - 1 { s * a } else { s };
+                }
+                cnt += 1.0;
+            }
+        }
+        if cnt > 0.0 {
+            for v in col.iter_mut().take(n) {
+                *v /= cnt;
+            }
+        }
+        unpremul_px(&mut col[..n], ctx.alpha);
+        col
+    }
+
+    /// Rasterize the block of grid cell (`cx`, `cy`) over the pixels it can hit.
+    fn paint_cell(&self, cx: i32, cy: i32, heights: &mut [f32], res: &mut [f32]) -> Option<()> {
+        let (b, cs, half) = (self.b, self.cs, self.half);
+        let r = Rect::new(b.x0 + cx * cs, b.y0 + cy * cs, b.x0 + (cx + 1) * cs, b.y0 + (cy + 1) * cs);
+        let clipped = r.intersect(&b);
+        if self.spec.mask_incomplete && clipped != r {
+            return Some(());
+        }
+        let col = self.cell_colour(clipped);
+        let n = self.src.ch;
+        let h = if self.spec.level_based { luma(self.ctx, &col[..n]).clamp(0.0, 1.0) } else { hash01(cx, cy, 21, self.spec.seed) };
+        if !h.is_finite() {
+            return None;
+        }
+        let (mx, my) = (r.x0 as f32 + half, r.y0 as f32 + half);
+        let off = self.reach * h / self.half_diag;
+        let o = ((mx - self.centre.0) * off, (my - self.centre.1) * off);
+        // Two extra pixels conservatively cover rounding in the unchanged interval test.
+        let sweep = Rect::new(
+            (mx.min(mx + o.0) - half).floor() as i32 - 2,
+            (my.min(my + o.1) - half).floor() as i32 - 2,
+            (mx.max(mx + o.0) + half).ceil() as i32 + 2,
+            (my.max(my + o.1) + half).ceil() as i32 + 2,
+        )
+        .intersect(&self.area);
+        let block = Block { r, cx, m: (mx, my), o, off, h, col };
+        for y in sweep.y0..sweep.y1 {
+            let gy = (y - b.y0).div_euclid(cs);
+            if (cy - gy).abs() > self.k {
+                continue;
+            }
+            for x in sweep.x0..sweep.x1 {
+                self.paint_pixel(&block, x, y, heights, res)?;
+            }
+        }
+        Some(())
+    }
+
+    /// Paint pixel (`x`, `y`) if `block` covers it and is taller than what is there.
+    fn paint_pixel(&self, block: &Block, x: i32, y: i32, heights: &mut [f32], res: &mut [f32]) -> Option<()> {
+        let (b, cs, half, n) = (self.b, self.cs, self.half, self.src.ch);
+        let (mx, my) = block.m;
+        let (ox, oy) = block.o;
+        if (block.cx - (x - b.x0).div_euclid(cs)).abs() > self.k {
+            return Some(());
+        }
+        let (fx, fy) = (x as f32 + 0.5, y as f32 + 0.5);
+        let i = (y - self.out.y0) as usize * self.out.width() as usize + (x - self.out.x0) as usize;
+        let height = heights.get_mut(i)?;
+        if *height >= block.h {
+            return Some(());
+        }
+        let Some(iy) = interval(fy, my, oy, half) else { return Some(()) };
+        let Some(ix) = interval(fx, mx, ox, half) else { return Some(()) };
+        let (lo, hi) = (ix.0.max(iy.0), ix.1.min(iy.1));
+        if lo > hi {
+            return Some(());
+        }
+        *height = block.h;
+        let face = block_face(hi, ix.1 < iy.1, ox, oy);
+        let px = res.get_mut(i * n..(i + 1) * n)?;
+        self.write_face(block, face, (fx, fy), px)
+    }
+
+    /// Write `face` of `block` into pixel `px` centred at `(fx, fy)`: the front
+    /// face shows the shifted source, every face can instead be flat-shaded.
+    fn write_face(&self, block: &Block, face: u8, (fx, fy): (f32, f32), px: &mut [f32]) -> Option<()> {
+        let n = self.src.ch;
+        if face == 0 && !self.spec.solid_front {
+            let (sx, sy) = ((fx - (block.m.0 - self.centre.0) * block.off).floor() as i32, (fy - (block.m.1 - self.centre.1) * block.off).floor() as i32);
+            read_px(self.src, sx.clamp(block.r.x0, block.r.x1 - 1), sy.clamp(block.r.y0, block.r.y1 - 1), px);
+        } else {
+            let shade = face_shade(face);
+            let sub = subtractive(self.ctx);
+            for (v, c) in px.iter_mut().zip(&block.col).take(ncol(self.ctx, n)) {
+                *v = if sub { 1.0 - (1.0 - *c) * shade } else { *c * shade }.clamp(0.0, 1.0);
+            }
+            if self.ctx.alpha {
+                *px.last_mut()? = block.col.get(n - 1).copied()?;
+            }
+        }
+        Some(())
+    }
+}
+
+/// Which face of the swept block a pixel shows: 0 front, 1/2 right/left, 3/4 bottom/top.
+fn block_face(hi: f32, x_exits_first: bool, ox: f32, oy: f32) -> u8 {
+    if hi >= 1.0 {
+        0
+    } else if x_exits_first {
+        if ox > 0.0 { 1 } else { 2 }
+    } else if oy > 0.0 {
+        3
+    } else {
+        4
+    }
+}
+
+fn face_shade(face: u8) -> f32 {
+    match face {
+        0 => 1.0,
+        1 => 0.85,
+        2 => 0.55,
+        3 => 0.95,
+        _ => 0.45,
+    }
+}
+
 fn interval(p: f32, m: f32, o: f32, half: f32) -> Option<(f32, f32)> {
     if o.abs() < 1e-6 {
         return ((p - m).abs() <= half).then_some((0.0, 1.0));
diff --git a/crates/automation/Cargo.toml b/crates/automation/Cargo.toml
index 13ab9c527b..ba073af2ff 100644
--- a/crates/automation/Cargo.toml
+++ b/crates/automation/Cargo.toml
@@ -11,6 +11,7 @@ workspace = true
 
 [dependencies]
 photocraft-doc = { workspace = true }
+photocraft-raster = { workspace = true }
 photocraft-compose = { workspace = true }
 photocraft-codecs = { workspace = true }
 photocraft-io = { workspace = true }
diff --git a/crates/automation/src/files.rs b/crates/automation/src/files.rs
index fc4526eedb..0b8ff103aa 100644
--- a/crates/automation/src/files.rs
+++ b/crates/automation/src/files.rs
@@ -33,9 +33,23 @@ pub fn open(path: &Path) -> Result<Opened, AutomationError> {
         let document = photocraft_format::load_path(path)?;
         return Ok(Opened { warnings: photocraft_io::open_warnings(&document), document, source_read_only: false });
     }
-    let bytes = photocraft_format::read_file(path).map_err(|e| AutomationError::Io(format!("{}: {e}", path.display())))?;
     let name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
-    open_bytes(&name, &bytes)
+    // A PSD/PSB is parsed from the open file (channel data read as it is decoded), so a CLI
+    // convert or info of a 2 GB file does not hold the file in memory next to the document.
+    #[cfg(any(unix, windows))]
+    {
+        let r =
+            photocraft_io::import_file(&name, path, &photocraft_io::ImportOptions::default(), &photocraft_raster::Interrupt::NONE).map_err(|e| match e {
+                photocraft_io::IoError::Read(msg) => AutomationError::Io(msg),
+                e => e.into(),
+            })?;
+        Ok(Opened { document: r.document, warnings: r.warnings, source_read_only: r.source_read_only })
+    }
+    #[cfg(not(any(unix, windows)))]
+    {
+        let bytes = photocraft_format::read_file(path).map_err(|e| AutomationError::Io(format!("{}: {e}", path.display())))?;
+        open_bytes(&name, &bytes)
+    }
 }
 
 /// Previews for a `.pcraft` bundle.
diff --git a/crates/automation/src/rpc/tests.rs b/crates/automation/src/rpc/tests.rs
index b7e22b3ffa..5136b0363b 100644
--- a/crates/automation/src/rpc/tests.rs
+++ b/crates/automation/src/rpc/tests.rs
@@ -377,6 +377,44 @@ fn doc_place_reads_through_the_read_root_and_never_outside_it() {
     std::fs::remove_dir_all(base).unwrap();
 }
 
+/// A save or render never turns a file PhotoCraft doesn't write (source, settings, notes)
+/// into image bytes, whatever `format` says; images and new files are written as before (#9439).
+#[test]
+fn workspace_writes_refuse_to_replace_a_file_that_is_not_an_image() {
+    let root = std::env::temp_dir().join(format!("pc-no-replace-foreign-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&root);
+    std::fs::create_dir_all(root.join("src")).unwrap();
+    let foreign = [("src/main.rs", "fn main() {}\n"), ("Cargo.toml", "[package]\n"), (".env", "TOKEN=x\n"), ("Makefile", "all:\n")];
+    for (name, text) in foreign {
+        std::fs::write(root.join(name), text).unwrap();
+    }
+    std::fs::write(root.join("old.png"), b"not yet a png").unwrap();
+    let mut h = Headless::with_workspace(crate::AuthorizedWorkspace::new(Some(&root), Some(&root)).unwrap());
+    h.handle("doc.new", json!({"width": 8, "height": 8, "background": "white"})).unwrap();
+    for (name, text) in foreign {
+        let saved = h.handle("doc.save", json!({"path": name, "format": "png"})).unwrap_err().to_string();
+        assert!(saved.contains("already exists"), "doc.save over {name}: {saved}");
+        let rendered = h.handle("doc.render", json!({"path": name})).unwrap_err().to_string();
+        assert!(rendered.contains("already exists"), "doc.render over {name}: {rendered}");
+        assert_eq!(std::fs::read_to_string(root.join(name)).unwrap(), text, "{name} is untouched");
+    }
+    // An existing image is replaced, and a new file of any name is created.
+    h.handle("doc.save", json!({"path": "old.png"})).unwrap();
+    assert!(std::fs::read(root.join("old.png")).unwrap().starts_with(b"\x89PNG"));
+    h.handle("doc.save", json!({"path": "fresh.txt", "format": "png"})).unwrap();
+    assert!(std::fs::read(root.join("fresh.txt")).unwrap().starts_with(b"\x89PNG"));
+    h.handle("doc.render", json!({"path": "old.png"})).unwrap();
+    std::fs::write(root.join("OLD.TIF"), b"x").unwrap();
+    h.handle("doc.save", json!({"path": "OLD.TIF"})).unwrap();
+    // An image saved under a name without an image extension is recognised by its bytes.
+    h.handle("doc.save", json!({"path": "out", "format": "png"})).unwrap();
+    h.handle("doc.save", json!({"path": "out", "format": "png"})).unwrap();
+    h.handle("doc.render", json!({"path": "fresh.txt"})).unwrap();
+    // Release directory capabilities before cleanup on Windows.
+    drop(h);
+    std::fs::remove_dir_all(root).unwrap();
+}
+
 #[test]
 fn doc_replace_smart_object_reads_through_the_read_root_and_never_outside_it() {
     let base = std::env::temp_dir().join(format!("pc-doc-replace-so-{}", std::process::id()));
diff --git a/crates/automation/src/server/conventions.rs b/crates/automation/src/server/conventions.rs
index 6e2740041d..b48c41db87 100644
--- a/crates/automation/src/server/conventions.rs
+++ b/crates/automation/src/server/conventions.rs
@@ -1,7 +1,10 @@
 //! Catalog metadata, strict tool envelopes and live resources.
-use super::*;
+use super::{Arc, Backend, BatchParams, DocIndex, ListParams, McpError, Parameters, PhotocraftMcp, RunParams, ServerHandler, Value, json};
 use rmcp::RoleServer;
-use rmcp::model::*;
+use rmcp::model::{
+    CallToolRequestParams, CallToolResponse, Implementation, ListResourcesResult, ListToolsResult, PaginatedRequestParams, ReadResourceRequestParams,
+    ReadResourceResponse, ReadResourceResult, ServerCapabilities, ServerConfig, Tool, ToolAnnotations,
+};
 use rmcp::service::RequestContext;
 
 const DOCUMENT: &str = "photocraft://document";
diff --git a/crates/automation/src/server/progress.rs b/crates/automation/src/server/progress.rs
index 4182743083..1844203f8e 100644
--- a/crates/automation/src/server/progress.rs
+++ b/crates/automation/src/server/progress.rs
@@ -1,5 +1,5 @@
 //! Render Video runs on the existing blocking worker; rmcp remains available for ping/cancel.
-use super::*;
+use super::{CallToolResult, PhotocraftMcp, Value, fail, no_backend, ok_json};
 use rmcp::RoleServer;
 use rmcp::model::ProgressNotificationParam;
 use rmcp::service::RequestContext;
diff --git a/crates/automation/src/server/transport.rs b/crates/automation/src/server/transport.rs
index 82e96b13c3..87a98e0305 100644
--- a/crates/automation/src/server/transport.rs
+++ b/crates/automation/src/server/transport.rs
@@ -1,5 +1,5 @@
 //! Recover malformed JSON lines before passing valid messages to rmcp.
-use super::*;
+use super::{AutomationError, PhotocraftMcp, ServiceExt, Value, json};
 use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
 
 use crate::security::MAX_REQUEST_BYTES;
diff --git a/crates/automation/src/workspace.rs b/crates/automation/src/workspace.rs
index 13cbbb2169..4dd1a5df05 100644
--- a/crates/automation/src/workspace.rs
+++ b/crates/automation/src/workspace.rs
@@ -88,6 +88,22 @@ impl AuthorizedWorkspace {
         let relative = request_path(path, self.write.as_ref())?;
         let root = self.write.as_ref().ok_or_else(|| AutomationError::BadRequest(format!("{DENIED}: write authority is absent")))?;
         let leaf = relative.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+        // The bytes are an image or document whatever the name says (`format` picks them), so
+        // only a file of a kind PhotoCraft writes is replaced: never source, settings or notes
+        // that share the root (`src/main.rs`, `.env`; #9439). A new file may have any name, and
+        // an image saved under one (`out` with `format: png`) can be saved over again.
+        let exists = root.dir.symlink_metadata(&relative).is_ok();
+        // Only a regular file is ever opened below (its head here, its attributes on Unix): a
+        // FIFO would block that open until a writer appears, and with it every other request.
+        // Links are followed for this check; a dangling one falls through to the name rule.
+        if exists && root.dir.metadata(&relative).is_ok_and(|m| !m.is_file()) {
+            return Err(AutomationError::BadRequest(format!("automation write refused: `{path}` already exists and is not a regular file")));
+        }
+        if exists && !written_kind(&leaf) && !holds_image(&root.dir, &relative) {
+            return Err(AutomationError::BadRequest(format!(
+                "automation write refused: `{path}` already exists and is not an image or document file PhotoCraft writes; save to a new name"
+            )));
+        }
         let parent = relative.parent().map(Path::to_path_buf).unwrap_or_default();
         let tmp = parent.join(photocraft_format::atomic::temp_name(&leaf));
         let mut options = OpenOptions::new();
@@ -124,6 +140,23 @@ impl AuthorizedWorkspace {
     }
 }
 
+/// Whether `name`'s extension is one of the formats PhotoCraft saves or exports.
+fn written_kind(name: &str) -> bool {
+    let Some((_, ext)) = name.rsplit_once('.') else { return false };
+    let ext = ext.to_ascii_lowercase();
+    ["psd", "psb", "ora", "pdf", photocraft_format::EXTENSION].contains(&ext.as_str()) || photocraft_codecs::from_extension(&ext).is_some()
+}
+
+/// Whether the file at `relative` starts like an image PhotoCraft reads (PSD/PSB or a codec's
+/// magic). Containers that also hold other things (zip, PDF) are judged by name only.
+fn holds_image(dir: &Dir, relative: &Path) -> bool {
+    let mut head = [0u8; 64];
+    let Ok(mut file) = dir.open(relative) else { return false };
+    let Ok(n) = file.read(&mut head) else { return false };
+    let head = &head[..n];
+    head.starts_with(b"8BPS") || photocraft_codecs::detect(head).is_some()
+}
+
 fn read_to_observed_length(reader: &mut impl Read, observed_length: u64) -> Result<Vec<u8>, AutomationError> {
     // Do not reserve from a potentially stale or attacker-controlled metadata length. Read in
     // chunks, and reject growth beyond the length observed on the opened file before appending.
@@ -221,11 +254,14 @@ fn relative_path(raw: &str) -> Result<PathBuf, AutomationError> {
     Ok(PathBuf::from(raw))
 }
 
+/// At least every name cap-std refuses to open on Windows (`COM0`–`COM9`, `COM¹`–`COM³`, the same
+/// for `LPT`, spaces before the extension ignored), so nothing written is unreadable (#9424).
 fn is_windows_device_name(component: &str) -> bool {
-    let stem = component.split('.').next().unwrap_or(component).to_ascii_uppercase();
+    let stem = component.split('.').next().unwrap_or(component).trim_end().to_ascii_uppercase();
+    let port = |n: &str| matches!(n, "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9" | "¹" | "²" | "³");
     matches!(stem.as_str(), "CON" | "PRN" | "AUX" | "NUL" | "CLOCK$" | "CONIN$" | "CONOUT$")
-        || stem.strip_prefix("COM").is_some_and(|n| matches!(n, "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9"))
-        || stem.strip_prefix("LPT").is_some_and(|n| matches!(n, "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9"))
+        || stem.strip_prefix("COM").is_some_and(port)
+        || stem.strip_prefix("LPT").is_some_and(port)
 }
 
 fn path_error(path: &str, reason: &str) -> AutomationError {
diff --git a/crates/automation/src/workspace/tests.rs b/crates/automation/src/workspace/tests.rs
index 2a94de15f2..ad5138ef12 100644
--- a/crates/automation/src/workspace/tests.rs
+++ b/crates/automation/src/workspace/tests.rs
@@ -122,6 +122,46 @@ fn write_replaces_atomically_and_leaves_no_temp_file() {
     assert!(temp_files(&inside).is_empty());
 }
 
+/// A directory at the target is refused before anything is opened, even under an image name.
+#[test]
+fn write_refuses_a_directory_target_before_opening_it() {
+    let (inside, _, workspace) = roots("dir-target");
+    for name in ["adir", "adir.png"] {
+        std::fs::create_dir_all(inside.join(name)).unwrap();
+        let error = workspace.write(name, b"x").unwrap_err().to_string();
+        assert!(error.contains("is not a regular file"), "{name}: {error}");
+        assert!(inside.join(name).is_dir());
+    }
+    assert!(temp_files(&inside).is_empty());
+}
+
+/// A FIFO at the target is refused at once: opening it to sniff its head or copy its
+/// attributes would block until a writer appears, stalling every other request.
+#[cfg(unix)]
+#[test]
+fn write_refuses_a_fifo_target_without_blocking() {
+    let (inside, _, workspace) = roots("fifo-target");
+    for name in ["pipe", "out.png"] {
+        let made = std::process::Command::new("mkfifo").arg(inside.join(name)).status();
+        if !made.is_ok_and(|s| s.success()) {
+            return; // no mkfifo on this system: nothing to assert
+        }
+    }
+    std::os::unix::fs::symlink("pipe", inside.join("link")).unwrap();
+    let (tx, rx) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        for name in ["pipe", "out.png", "link"] {
+            let _ = tx.send((name, workspace.write(name, b"x").map_err(|e| e.to_string())));
+        }
+    });
+    for _ in 0..3 {
+        let (name, result) = rx.recv_timeout(std::time::Duration::from_secs(5)).expect("write blocked on a FIFO");
+        let error = result.unwrap_err();
+        assert!(error.contains("is not a regular file"), "{name}: {error}");
+    }
+    assert!(temp_files(&inside).is_empty());
+}
+
 /// #7095: replacing a file through the automation path keeps the old file's extended
 /// attributes, the same as a save through `atomic_write` does.
 #[cfg(any(target_os = "linux", target_os = "android", target_vendor = "apple"))]
@@ -177,6 +217,32 @@ fn rejects_absolute_traversal_mixed_prefix_and_malformed_paths_without_panicking
     }
 }
 
+#[test]
+fn every_device_name_cap_std_refuses_to_open_is_refused_before_any_write() {
+    // cap-std refuses these when it opens a file on Windows, so a file written under one of
+    // them could not be read back (#9424).
+    let (inside, _, workspace) = roots("devices");
+    std::fs::create_dir(inside.join("sub")).unwrap();
+    for path in ["COM0.txt", "LPT0", "COM¹.png", "com².png", "COM³", "LPT¹.txt", "LPT².txt", "lpt³", "NUL .png", "Aux  .txt", "sub/CON .psd", "COM¹/frame.png"]
+    {
+        let error = workspace.write(path, b"x").unwrap_err().to_string();
+        assert!(error.contains("reserved device names"), "write {path:?}: {error}");
+        let error = workspace.read(path).unwrap_err().to_string();
+        assert!(error.contains("reserved device names"), "read {path:?}: {error}");
+    }
+    for dir in ["COM¹", "LPT0", "sub/PRN .x"] {
+        let error = workspace.export_sequence(dir).err().map(|e| e.to_string()).unwrap_or_default();
+        assert!(error.contains("reserved device names"), "export {dir:?}: {error}");
+    }
+    assert_eq!(std::fs::read_dir(&inside).unwrap().count(), 1, "only `sub` may exist");
+    assert_eq!(std::fs::read_dir(inside.join("sub")).unwrap().count(), 0);
+    // Look-alikes are ordinary names.
+    for path in ["COM10.txt", "COM¹0.txt", "LPT00", "console.txt", "NULL.txt", "nul_.txt", " NUL.txt"] {
+        workspace.write(path, b"x").unwrap_or_else(|e| panic!("write {path:?}: {e}"));
+        assert_eq!(workspace.read(path).unwrap(), b"x", "{path:?}");
+    }
+}
+
 #[test]
 fn read_and_write_authority_are_separate() {
     let (inside, _, _) = roots("separate");
@@ -272,6 +338,10 @@ fn filesystem_commands_fail_closed() {
     for id in ["layer.smartObjects.editContents", "layer.smartObjects.convertToLayers"] {
         assert!(authorize_engine_command(id, &serde_json::json!({"path": "/outside/source.psb"})).is_err(), "{id}");
     }
+}
+
+#[test]
+fn filesystem_command_paths_and_profiles_fail_closed() {
     // The UI-level examples in docs/control-protocol.md.
     for id in ["view.zoomIn", "window.theme.pro", "edit.search"] {
         assert!(authorize_desktop_engine_command(id, &serde_json::json!({})).is_ok(), "{id}");
diff --git a/crates/cms/src/lutfile.rs b/crates/cms/src/lutfile.rs
index 6a85f53908..3feeb3a97d 100644
--- a/crates/cms/src/lutfile.rs
+++ b/crates/cms/src/lutfile.rs
@@ -87,16 +87,50 @@ impl LutFile {
     }
 }
 
+/// A LUT file format.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Format {
+    Cube,
+    ThreeDl,
+    Look,
+}
+
+impl Format {
+    /// The format [`parse`] reads `bytes` as: from `file_name`'s extension, else sniffed
+    /// (XML is `.look`, anything else `.cube`).
+    pub fn detect(file_name: &str, bytes: &[u8]) -> Self {
+        let lower = file_name.to_ascii_lowercase();
+        if lower.ends_with(".3dl") {
+            Format::ThreeDl
+        } else if lower.ends_with(".look") || decode_text(bytes).trim_start().starts_with('<') {
+            Format::Look
+        } else {
+            Format::Cube
+        }
+    }
+
+    /// The file extension, without the dot.
+    pub fn extension(self) -> &'static str {
+        match self {
+            Format::Cube => "cube",
+            Format::ThreeDl => "3dl",
+            Format::Look => "look",
+        }
+    }
+}
+
 /// Parses a LUT, picking the format from `file_name`'s extension (falls back to sniffing).
 pub fn parse(file_name: &str, bytes: &[u8]) -> Result<LutFile, LutError> {
-    let lower = file_name.to_ascii_lowercase();
+    parse_as(Format::detect(file_name, bytes), bytes)
+}
+
+/// Parses a LUT in a known format.
+pub fn parse_as(format: Format, bytes: &[u8]) -> Result<LutFile, LutError> {
     let text = decode_text(bytes);
-    if lower.ends_with(".3dl") {
-        parse_3dl(&text)
-    } else if lower.ends_with(".look") || text.trim_start().starts_with('<') {
-        parse_look(&text)
-    } else {
-        parse_cube(&text)
+    match format {
+        Format::Cube => parse_cube(&text),
+        Format::ThreeDl => parse_3dl(&text),
+        Format::Look => parse_look(&text),
     }
 }
 
@@ -518,6 +552,9 @@ DOMAIN_MAX 0.5 1 1
         let be: Vec<u8> = [0xFE, 0xFF].into_iter().chain(xml.encode_utf16().flat_map(u16::to_be_bytes)).collect();
         assert_eq!(parse("a.look", &le).unwrap().data, id.data);
         assert_eq!(parse("a.look", &be).unwrap().data, id.data);
+        // Sniffed as XML through the byte-order mark too, so the recorded format is the one parsed.
+        assert_eq!(Format::detect("a.lut", &le), Format::Look);
+        assert_eq!(parse_as(Format::Look, &be).unwrap().data, id.data);
     }
 
     #[test]
@@ -570,6 +607,17 @@ DOMAIN_MAX 0.5 1 1
         assert!(parse_look(&text).is_err());
     }
 
+    #[test]
+    fn format_detection_matches_parse() {
+        assert_eq!(Format::detect("a.3DL", b"<look>"), Format::ThreeDl);
+        assert_eq!(Format::detect("a.Look", b""), Format::Look);
+        assert_eq!(Format::detect("a.cube", b"  <look>"), Format::Look, "XML is sniffed as .look");
+        assert_eq!(Format::detect("a.txt", b"LUT_3D_SIZE 2"), Format::Cube);
+        assert_eq!(Format::ThreeDl.extension(), "3dl");
+        let text = write_cube(&LutFile::identity(2));
+        assert_eq!(parse_as(Format::Cube, text.as_bytes()), parse("a.cube", text.as_bytes()));
+    }
+
     #[test]
     fn malformed_rejected() {
         assert!(parse_cube("LUT_3D_SIZE 2\n0 0 0\n").is_err());
diff --git a/crates/codecs/src/codecs/deep_exr.rs b/crates/codecs/src/codecs/deep_exr.rs
index 4fe9def532..0652112bf1 100644
--- a/crates/codecs/src/codecs/deep_exr.rs
+++ b/crates/codecs/src/codecs/deep_exr.rs
@@ -187,7 +187,7 @@ fn decompress(compression: Compression, packed: &[u8], expected: usize, what: &s
             // `read_to_end`, whose doubling reserves past `expected`. Once `expected` bytes are
             // in, a one-byte read checks that the stream ends there.
             let malformed = || err(format!("{what}: zlib data is malformed"));
-            let mut zlib = flate2::read::ZlibDecoder::new(packed);
+            let mut zlib = flate2::bufread::ZlibDecoder::new(packed);
             let mut out = Vec::new();
             let mut filled = 0;
             while filled < expected {
@@ -756,6 +756,7 @@ mod tests {
             let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::fast());
             z.write_all(&p).expect("write to a Vec");
             let zips = z.finish().expect("finish a Vec");
+            assert!(decompress(Compression::ZIP1, &zips[..zips.len() - 1], n, "the table").is_err());
             // RLE: the first byte as a literal, then runs of up to 128 copies of the next.
             let mut rle = vec![0xFF, p[0]];
             for run in p[1..].chunks(128) {
diff --git a/crates/codecs/src/codecs/exr.rs b/crates/codecs/src/codecs/exr.rs
index 2b32a2b7c4..e179b13044 100644
--- a/crates/codecs/src/codecs/exr.rs
+++ b/crates/codecs/src/codecs/exr.rs
@@ -39,16 +39,30 @@ pub(super) fn read_meta(bytes: &[u8], limits: &Limits) -> Result<MetaData, Codec
     let meta = MetaData::read_from_buffered(Cursor::new(bytes), false).map_err(err)?;
     // Flat decoding reads every part at once, so the parts' sizes are also capped together.
     let mut total: u64 = 0;
+    // DWAA/DWAB parts are counted apart: they go past 2^16:1 (a flat 8192x4320 frame with 12
+    // alpha-scheme mattes is about 30 KB, over 75000:1).
+    let mut dwa: u64 = 0;
     for header in meta.headers.iter() {
         let size = header.layer_size;
         let (w, h) = (u32::try_from(size.0).unwrap_or(u32::MAX), u32::try_from(size.1).unwrap_or(u32::MAX));
         let bpp = header.channels.list.len().max(1) as u64 * 4;
         limits.check_bytes(w, h, bpp)?;
-        total = total.saturating_add(u64::from(w).saturating_mul(u64::from(h)).saturating_mul(bpp));
+        let bytes = u64::from(w).saturating_mul(u64::from(h)).saturating_mul(bpp);
+        total = total.saturating_add(bytes);
+        if matches!(header.compression, Compression::DWAA(_) | Compression::DWAB(_)) {
+            dwa = dwa.saturating_add(bytes);
+        }
     }
     if total > limits.max_alloc {
         return Err(CodecError::LimitExceeded(format!("{total} bytes across {} parts exceed max_alloc {}", meta.headers.len(), limits.max_alloc)));
     }
+    // The `exr` crate allocates a flat part's samples before reading its chunks, so the file
+    // must be able to hold them (#8597). The other compressions stay far below 2^16:1 even
+    // against this f32 budget. DWA's run-length channels are zlib-packed on top and reach about
+    // 132000:1, so DWA parts get 2^18:1. Deep parts size their samples from the file's own counts.
+    if !meta.requirements.has_deep_data {
+        Limits::check_plausible(total.saturating_sub(dwa).saturating_add(dwa / 4), bytes.len(), 1 << 16)?;
+    }
     Ok(meta)
 }
 
diff --git a/crates/codecs/src/codecs/jpeg.rs b/crates/codecs/src/codecs/jpeg.rs
index 3e533ccd08..f2c4d4b9ee 100644
--- a/crates/codecs/src/codecs/jpeg.rs
+++ b/crates/codecs/src/codecs/jpeg.rs
@@ -150,8 +150,13 @@ fn data_end(b: &[u8]) -> (DataEnd, u64) {
     loop {
         let Some(&byte) = b.get(i) else { return cut(scan_data, scanned) };
         if byte != 0xFF {
-            // Not where a marker should be: too odd to judge.
-            return (DataEnd::Complete, scanned);
+            // Not where a marker should be: skip to the next one, as a lenient decoder does, so
+            // segments after the stray bytes (padding among them) are still recognised. Stray
+            // bytes are not scan data, so they never count (junk would buy budget as padding
+            // did); with no marker left, the image data ends here.
+            let Some(p) = b.get(i..).and_then(|r| r.iter().position(|&v| v == 0xFF)) else { return cut(scan_data, scanned) };
+            i += p;
+            continue;
         }
         let Some(&code) = b.get(i + 1) else { return cut(scan_data, scanned) };
         match code {
@@ -232,9 +237,10 @@ fn decode_craft_jpeg(bytes: &[u8], limits: &Limits, adobe_transform: Option<u8>)
     Ok((img, d.damaged))
 }
 
-/// Most pixels one byte of truncated scan data may account for. Even a flat image costs a few
-/// bits per 8×8 block, and truncated photographs are far above this.
-const MAX_TRUNCATED_PIXELS_PER_BYTE: u64 = 2048;
+/// Most pixels one byte of a JPEG may account for. Every 8×8 block of a frame needs at least a
+/// one-bit DC code (512 pixels a byte for a flat image under ideal Huffman tables), and real files,
+/// truncated or not, are far above this.
+const MAX_PIXELS_PER_BYTE: u64 = 2048;
 
 pub(crate) fn decode(bytes: &[u8], limits: &Limits) -> Result<Image, CodecError> {
     let (end, scan_bytes) = data_end(bytes);
@@ -252,7 +258,9 @@ pub(crate) fn decode(bytes: &[u8], limits: &Limits) -> Result<Image, CodecError>
         }
         if let Some((w, h, _)) = meta.frame
             && end == DataEnd::Truncated
-            && u64::from(w) * u64::from(h) / MAX_TRUNCATED_PIXELS_PER_BYTE > scan_bytes
+            // Only truncated scans: arithmetic coding (SOF9–SOF11) can spend well under a bit on
+            // a flat block, so a complete scan may be shorter than this bound.
+            && u64::from(w) * u64::from(h) / MAX_PIXELS_PER_BYTE > scan_bytes
         {
             return Err(err("the truncated scan is too short for the frame it declares"));
         }
@@ -277,12 +285,14 @@ pub(crate) fn decode(bytes: &[u8], limits: &Limits) -> Result<Image, CodecError>
         _ => (ColorSpace::RGB, ChannelLayout::Rgb),
     };
     limits.check(w, h, layout, SampleType::U8)?;
-    // The backend fills whatever the scan no longer describes, so a short scan under a large
-    // frame is a gigabyte of synthesized output from a few kilobytes of file. The budget is
-    // measured on the scan data itself: APP padding can inflate `bytes.len()` arbitrarily
-    // without describing one more pixel.
-    if end == DataEnd::Truncated && u64::from(w) * u64::from(h) / MAX_TRUNCATED_PIXELS_PER_BYTE > scan_bytes {
-        return Err(err("the truncated scan is too short for the frame it declares"));
+    // The backend fills whatever the scan no longer describes, and allocates the whole output
+    // once a scan holds a byte, so a short scan under a large frame is a gigabyte of synthesized
+    // output from a few kilobytes of file (#8597), truncated or not. The budget is the scan data
+    // itself, not `bytes.len()`, which APP padding can inflate without describing one more pixel;
+    // where the walk stops early on an odd layout, what it couldn't read counts as scan data.
+    if u64::from(w) * u64::from(h) / MAX_PIXELS_PER_BYTE > scan_bytes {
+        let what = if end == DataEnd::Truncated { "the truncated scan" } else { "the scan data" };
+        return Err(err(format!("{what} is too short for the frame it declares")));
     }
     dec.set_options(dec.options().jpeg_set_out_colorspace(out_cs));
     let mut px = dec.decode().map_err(err)?;
@@ -552,7 +562,7 @@ mod tests {
         assert_eq!(data_end(&padded).0, DataEnd::Truncated);
         // Well above the frame's pixels / budget, yet far above the scan data: the old
         // file-length bound admitted this frame.
-        assert!(padded.len() > (u64::from(20_000u32) * u64::from(20_000u32) / MAX_TRUNCATED_PIXELS_PER_BYTE) as usize, "padding too small");
+        assert!(padded.len() > (u64::from(20_000u32) * u64::from(20_000u32) / MAX_PIXELS_PER_BYTE) as usize, "padding too small");
         assert!(crate::decode_as(Format::Jpeg, &padded).is_ok());
         let sof = padded.windows(2).position(|w| w == [0xFF, 0xC0] || w == [0xFF, 0xC2]).unwrap();
         let mut huge = padded.clone();
@@ -561,6 +571,57 @@ mod tests {
         assert!(e.to_string().contains("too short"), "{e}");
     }
 
+    /// A complete file is measured on its scan data too: padding can't admit an oversized frame.
+    /// The same padded file at its real size decodes, and so does an odd layout whose unread tail
+    /// counts as scan data.
+    #[test]
+    fn app_padding_cannot_admit_an_oversized_complete_frame() {
+        let img = Image::from_raw(16, 16, ChannelLayout::Rgb, SampleType::U8, vec![128; 16 * 16 * 3]).unwrap();
+        let full = crate::encode(&img, Format::Jpeg, &EncodeOptions::default()).unwrap();
+        let fill = [b'p'; 65533];
+        let mut padded = full[..2].to_vec();
+        for _ in 0..4 {
+            padded.extend_from_slice(&[0xFF, 0xFE]);
+            padded.extend_from_slice(&0xFFFFu16.to_be_bytes());
+            padded.extend_from_slice(&fill);
+        }
+        padded.extend_from_slice(&full[2..]);
+        let (end, scanned) = data_end(&padded);
+        assert_eq!(end, DataEnd::Complete);
+        assert!(scanned < 1024, "the padding isn't scan data: {scanned}");
+        assert!(padded.len() as u64 > u64::from(20_000u32) * 20_000 / MAX_PIXELS_PER_BYTE, "padding too small");
+        assert!(crate::decode_as(Format::Jpeg, &padded).is_ok());
+        let sof = padded.windows(2).position(|w| w == [0xFF, 0xC0] || w == [0xFF, 0xC2]).unwrap();
+        let mut huge = padded.clone();
+        huge[sof + 5..sof + 9].copy_from_slice(&[0x4E, 0x20, 0x4E, 0x20]);
+        let e = crate::decode_as(Format::Jpeg, &huge).unwrap_err();
+        assert!(e.to_string().contains("too short"), "{e}");
+        // A stray byte where a marker should be, before the padding: the walk skips it and still
+        // recognises the padding, so an oversized frame is refused there too.
+        let mut odd = huge.clone();
+        odd.insert(2, 0x00);
+        let (end, scanned) = data_end(&odd);
+        assert_eq!(end, DataEnd::Complete);
+        assert!(scanned < 1024, "the padding after a stray byte isn't scan data: {scanned}");
+        let e = crate::decode_as(Format::Jpeg, &odd).unwrap_err();
+        assert!(e.to_string().contains("too short"), "{e}");
+        // Stray bytes never count: 256 KiB of junk where a marker should be (the decoder skips
+        // it), then the oversized frame's segments, is refused. (Bytes after a scan starts are
+        // entropy-coded data, any value, and count as such.)
+        let mut junk = huge[..2].to_vec();
+        junk.extend(std::iter::repeat_n(0x00u8, 4 * 65536));
+        junk.extend_from_slice(&huge[2..]);
+        let (end, scanned) = data_end(&junk);
+        assert_eq!(end, DataEnd::Complete);
+        assert!(scanned < 1024, "junk isn't scan data: {scanned}");
+        let e = crate::decode_as(Format::Jpeg, &junk).unwrap_err();
+        assert!(e.to_string().contains("too short"), "{e}");
+        // Junk with no marker after it: no image data at all.
+        let mut tail = vec![0xFF, 0xD8];
+        tail.extend(std::iter::repeat_n(0x00u8, 4096));
+        assert_eq!(data_end(&tail), (DataEnd::Empty, 0));
+    }
+
     /// CMYK JPEG output must omit JFIF while retaining Adobe's CMYK marker.
     #[test]
     fn cmyk_jpeg_omits_jfif_but_keeps_adobe_cmyk_marker() {
diff --git a/crates/codecs/src/codecs/png.rs b/crates/codecs/src/codecs/png.rs
index 7fbbbc69db..e09115416c 100644
--- a/crates/codecs/src/codecs/png.rs
+++ b/crates/codecs/src/codecs/png.rs
@@ -419,7 +419,7 @@ fn adam7_idat(data: &[u8], w: usize, h: usize, bpp: usize, level: PngCompression
     }
     let lvl = match level {
         PngCompression::None => flate2::Compression::none(),
-        PngCompression::Fast => flate2::Compression::fast(),
+        PngCompression::Fast => FAST,
         PngCompression::Default => flate2::Compression::default(),
         PngCompression::Best => flate2::Compression::best(),
     };
@@ -428,6 +428,11 @@ fn adam7_idat(data: &[u8], w: usize, h: usize, bpp: usize, level: PngCompression
     z.finish().map_err(|e| CodecError::encode(F, e))
 }
 
+/// The deflate level of [`PngCompression::Fast`]: zlib-rs level 1 writes static Huffman blocks
+/// only (20-30% bigger on filtered photos); level 3 is the lowest that is never bigger than
+/// miniz's level 1 was, at about twice its time.
+const FAST: flate2::Compression = flate2::Compression::new(3);
+
 /// Images at least this large (bytes) are filtered and deflated on all cores.
 const PARALLEL_MIN_BYTES: usize = 4 << 20;
 
@@ -456,7 +461,7 @@ fn banded_idat(data: &[u8], w: usize, h: usize, bpp: usize, level: PngCompressio
     let band_rows = (BAND_BYTES / stride.saturating_add(1)).max(1);
     let bands: Vec<(usize, usize)> = (0..h).step_by(band_rows).map(|y| (y, (y + band_rows).min(h))).collect();
     let lvl = match level {
-        PngCompression::Fast => flate2::Compression::fast(),
+        PngCompression::Fast => FAST,
         PngCompression::Best => flate2::Compression::best(),
         _ => flate2::Compression::default(),
     };
@@ -494,7 +499,7 @@ fn banded_idat(data: &[u8], w: usize, h: usize, bpp: usize, level: PngCompressio
     let mut out = Vec::with_capacity(parts.iter().map(|p| p.1.len()).sum::<usize>() + 6);
     // zlib header: deflate, 32 K window; FLEVEL only advertises the effort.
     out.extend_from_slice(match level {
-        PngCompression::Fast => &[0x78, 0x01],
+        PngCompression::Fast => &[0x78, 0x5E],
         PngCompression::Best => &[0x78, 0xDA],
         _ => &[0x78, 0x9C],
     });
@@ -509,7 +514,7 @@ fn banded_idat(data: &[u8], w: usize, h: usize, bpp: usize, level: PngCompressio
 
 /// Raw deflate of one band: ends on a sync flush, or finishes the stream for the `last` band.
 /// The output buffer is sized past deflate's worst case so that one call takes the whole band
-/// and completes the flush: when a sync flush fills the buffer, miniz_oxide (flate2's Rust
+/// and completes the flush: when a sync flush fills the buffer, miniz_oxide (flate2's former Rust
 /// backend) can return before compressing the last lookahead bytes, and the next call only
 /// drains the pending output, so a resumed flush silently drops data. `None` (the caller then
 /// uses the serial encoder) if the single call did not finish.
diff --git a/crates/codecs/src/codecs/tiff.rs b/crates/codecs/src/codecs/tiff.rs
index 1db3b0c44c..e3ccfbc952 100644
--- a/crates/codecs/src/codecs/tiff.rs
+++ b/crates/codecs/src/codecs/tiff.rs
@@ -27,7 +27,7 @@
 //! (see [`writes_little_endian`]), which the layer data must match.
 
 use std::borrow::Cow;
-use std::io::{self, Cursor, Read, Seek, SeekFrom};
+use std::io::{self, Read, Seek, SeekFrom};
 
 use half::f16;
 use tiff::decoder::{ChunkType, Decoder};
diff --git a/crates/codecs/src/codecs/tiff/bands.rs b/crates/codecs/src/codecs/tiff/bands.rs
index fe35cc98d2..8eaeadf8a6 100644
--- a/crates/codecs/src/codecs/tiff/bands.rs
+++ b/crates/codecs/src/codecs/tiff/bands.rs
@@ -1,5 +1,5 @@
 use super::decode::{Layout, Patched, Src, is_eof};
-use super::*;
+use super::{CodecError, Decoder, SampleType, err, f16, map_err};
 
 /// The a* and b* samples (1 and 2 of every pixel) of a Lab image between the file's encoding and
 /// PhotoCraft's (8 bits: `a + 128`; 16 bits: `(a + 128) · 257`). In the file, CIELab holds them
diff --git a/crates/codecs/src/codecs/tiff/decode.rs b/crates/codecs/src/codecs/tiff/decode.rs
index 4b5d38cb59..0872739f3e 100644
--- a/crates/codecs/src/codecs/tiff/decode.rs
+++ b/crates/codecs/src/codecs/tiff/decode.rs
@@ -1,6 +1,9 @@
 use super::bands::{convert_ab, decode_bands, extra_sample_indices, split_extra_samples, zeroed};
 use super::tags::{F, TAG_IMAGE_SOURCE_DATA, TAG_PHOTOSHOP, TAG_XMP, TEXT_TAGS, photoshop_tags};
-use super::*;
+use super::{
+    ChannelLayout, ChunkType, CodecError, DecodeWarning, Decoder, ExifDirs, File, Ifd, Image, Limits, Metadata, Read, SampleType, Seek, SeekFrom, Tag,
+    camera_raw, err, ifd, io, map_err, tiff_exif,
+};
 
 /// Decodes the page Photoshop would open: the first full-resolution directory.
 pub(crate) fn decode(bytes: &[u8], limits: &Limits) -> Result<Image, CodecError> {
@@ -235,6 +238,112 @@ pub(super) fn is_eof(e: &tiff::TiffError) -> bool {
     matches!(e, tiff::TiffError::IoError(io) if io.kind() == io::ErrorKind::UnexpectedEof)
 }
 
+/// The sample type of a (SampleFormat, BitsPerSample) pair.
+fn sample_src(format: u64, bits: u64) -> Result<Src, CodecError> {
+    Ok(match (format, bits) {
+        (1, 1 | 2 | 4) => Src::Bits(bits as u8),
+        (1, 8) => Src::U8,
+        (1, 16) => Src::U16,
+        (1, 32) => Src::U32,
+        (1, 64) => Src::U64,
+        (3, 16) => Src::F16,
+        (3, 32) => Src::F32,
+        (3, 64) => Src::F64,
+        (2, _) => return Err(CodecError::unsupported(F, "signed integer samples")),
+        _ => return Err(CodecError::unsupported(F, format!("{bits}-bit samples (sample format {format})"))),
+    })
+}
+
+/// The ColorMap of a palette image as RGB entries.
+fn read_palette(f: &File<'_>, dir: &Ifd, spp: u64, bits: u64, src: Src) -> Result<Vec<[u16; 3]>, CodecError> {
+    if spp != 1 || !matches!(src, Src::Bits(_) | Src::U8 | Src::U16) {
+        return Err(CodecError::unsupported(F, format!("palette image with {spp} samples of {bits} bits")));
+    }
+    let n = 1u64 << bits;
+    let map = dir.get(ifd::TAG_COLOR_MAP).filter(|e| e.ty == 3 && e.count == 3 * n).ok_or_else(|| err("palette image without a valid ColorMap"))?;
+    let at = |i: u64| f.uint(map, i).and_then(|v| u16::try_from(v).ok());
+    let table: Option<Vec<[u16; 3]>> = (0..n).map(|i| Some([at(i)?, at(n + i)?, at(2 * n + i)?])).collect();
+    table.ok_or_else(|| err("palette ColorMap cut off"))
+}
+
+/// The layout of a multiband read that was asked for every sample.
+fn multiband_layout(photometric: u64, has_alpha: bool, gray_alpha: bool) -> ChannelLayout {
+    match (photometric, has_alpha) {
+        (2 | 8 | 9, true) => ChannelLayout::Rgba,
+        (2 | 8 | 9, false) => ChannelLayout::Rgb,
+        (5, true) => ChannelLayout::CmykA,
+        (5, false) => ChannelLayout::Cmyk,
+        _ if gray_alpha => ChannelLayout::GrayA,
+        _ => ChannelLayout::Gray,
+    }
+}
+
+/// The chunk tables must match the geometry. Checked in 64 bits, before the `tiff` crate does
+/// the same arithmetic in narrower types.
+fn check_chunk_tables(f: &File<'_>, dir: &Ifd, (w, h): (u32, u32), spp: u64, planar: bool, tiled: bool) -> Result<(u64, u64), CodecError> {
+    let need = |tag: u16, name: &str| f.tag_uint(dir, tag).ok_or_else(|| err(format!("missing or unreadable {name}")));
+    let (cw, ch) = if tiled {
+        let tw = need(ifd::TAG_TILE_WIDTH, "TileWidth")?;
+        let tl = need(ifd::TAG_TILE_LENGTH, "TileLength")?;
+        (tw, tl)
+    } else {
+        (u64::from(w), f.tag_uint(dir, ifd::TAG_ROWS_PER_STRIP).unwrap_or(u64::from(h)).min(u64::from(h)))
+    };
+    if cw == 0 || ch == 0 {
+        return Err(err("zero tile or strip size"));
+    }
+    // The chunk tables must match the geometry. Checked here, in 64 bits, before the `tiff`
+    // crate does the same arithmetic in narrower types.
+    let planes_in_file = if planar { spp } else { 1 };
+    let expected = u64::from(w)
+        .div_ceil(cw)
+        .checked_mul(u64::from(h).div_ceil(ch))
+        .and_then(|n| n.checked_mul(planes_in_file))
+        .filter(|&n| n <= u64::from(u32::MAX))
+        .ok_or_else(|| err("too many strips or tiles"))?;
+    let (offsets_tag, counts_tag) = if tiled { (324, 325) } else { (273, 279) };
+    let counts = (dir.get(offsets_tag).map(|e| e.count), dir.get(counts_tag).map(|e| e.count));
+    if counts != (Some(expected), Some(expected)) {
+        return Err(err(format!("{expected} strips or tiles expected, the tables list {counts:?}")));
+    }
+    Ok((cw, ch))
+}
+
+/// Byte patches the `tiff` crate reads through: the directory is seen as the last of its chain,
+/// and PhotometricInterpretation is handed over as black-is-zero (or RGB for Lab) when asked to.
+fn header_patches(
+    f: &File<'_>,
+    dir: &Ifd,
+    photometric_entry: Option<ifd::Entry>,
+    patch_photometric: bool,
+    lab_only: bool,
+) -> Result<Vec<(u64, Vec<u8>)>, CodecError> {
+    let mut patches: Vec<(u64, Vec<u8>)> = Vec::new();
+    let encode_u = |v: u64, len: usize| -> Vec<u8> {
+        let b = if f.le { v.to_le_bytes() } else { v.to_be_bytes() };
+        if f.le { b.get(..len).map(<[u8]>::to_vec).unwrap_or_default() } else { b.get(8 - len..).map(<[u8]>::to_vec).unwrap_or_default() }
+    };
+    if f.big {
+        patches.push((8, encode_u(dir.at, 8)));
+    } else {
+        let at = u32::try_from(dir.at).map_err(|_| err("directory offset out of range"))?;
+        patches.push((4, encode_u(u64::from(at), 4)));
+    }
+    // The directory is seen as the last of its chain: the chain was walked already, and a
+    // cycle through it must not fail this page.
+    patches.push((dir.next_at, vec![0; if f.big { 8 } else { 4 }]));
+    if patch_photometric {
+        let e = photometric_entry.ok_or_else(|| err("missing PhotometricInterpretation"))?;
+        let len = match e.ty {
+            3 if e.count == 1 => 2,
+            4 if e.count == 1 => 4,
+            _ => return Err(err("malformed PhotometricInterpretation")),
+        };
+        patches.push((e.value_at, encode_u(if lab_only { 2 } else { 1 }, len)));
+    }
+    Ok(patches)
+}
+
 /// Decodes the pixels of one directory.
 fn decode_ifd(f: &File<'_>, dir: &Ifd, limits: &Limits) -> Result<Image, CodecError> {
     // The values the `tiff` crate reads must exist: a count past the end of the file is
@@ -263,59 +372,13 @@ fn decode_ifd(f: &File<'_>, dir: &Ifd, limits: &Limits) -> Result<Image, CodecEr
     let planar = f.tag_uint(dir, ifd::TAG_PLANAR) == Some(2);
     let extra = f.tag_uints(dir, ifd::TAG_EXTRA_SAMPLES, 64).unwrap_or_default();
     let tiled = dir.get(ifd::TAG_TILE_OFFSETS).is_some();
-    let (cw, ch) = if tiled {
-        let tw = need(ifd::TAG_TILE_WIDTH, "TileWidth")?;
-        let tl = need(ifd::TAG_TILE_LENGTH, "TileLength")?;
-        (tw, tl)
-    } else {
-        (u64::from(w), f.tag_uint(dir, ifd::TAG_ROWS_PER_STRIP).unwrap_or(u64::from(h)).min(u64::from(h)))
-    };
-    if cw == 0 || ch == 0 {
-        return Err(err("zero tile or strip size"));
-    }
-    // The chunk tables must match the geometry. Checked here, in 64 bits, before the `tiff`
-    // crate does the same arithmetic in narrower types.
-    let planes_in_file = if planar { spp } else { 1 };
-    let expected = u64::from(w)
-        .div_ceil(cw)
-        .checked_mul(u64::from(h).div_ceil(ch))
-        .and_then(|n| n.checked_mul(planes_in_file))
-        .filter(|&n| n <= u64::from(u32::MAX))
-        .ok_or_else(|| err("too many strips or tiles"))?;
-    let (offsets_tag, counts_tag) = if tiled { (324, 325) } else { (273, 279) };
-    let counts = (dir.get(offsets_tag).map(|e| e.count), dir.get(counts_tag).map(|e| e.count));
-    if counts != (Some(expected), Some(expected)) {
-        return Err(err(format!("{expected} strips or tiles expected, the tables list {counts:?}")));
-    }
-    let src = match (format, bits) {
-        (1, 1 | 2 | 4) => Src::Bits(bits as u8),
-        (1, 8) => Src::U8,
-        (1, 16) => Src::U16,
-        (1, 32) => Src::U32,
-        (1, 64) => Src::U64,
-        (3, 16) => Src::F16,
-        (3, 32) => Src::F32,
-        (3, 64) => Src::F64,
-        (2, _) => return Err(CodecError::unsupported(F, "signed integer samples")),
-        _ => return Err(CodecError::unsupported(F, format!("{bits}-bit samples (sample format {format})"))),
-    };
-
+    let (cw, ch) = check_chunk_tables(f, dir, (w, h), spp, planar, tiled)?;
+    let src = sample_src(format, bits)?;
     // WhiteIsZero and palette images are handed to the `tiff` crate as BlackIsZero: it then
     // returns the stored samples, and the interpretation is applied here (for every depth and
     // with alpha, which the crate's own inversion does not cover).
     let invert = photometric == 0;
-    let palette = if photometric == 3 {
-        if spp != 1 || !matches!(src, Src::Bits(_) | Src::U8 | Src::U16) {
-            return Err(CodecError::unsupported(F, format!("palette image with {spp} samples of {bits} bits")));
-        }
-        let n = 1u64 << bits;
-        let map = dir.get(ifd::TAG_COLOR_MAP).filter(|e| e.ty == 3 && e.count == 3 * n).ok_or_else(|| err("palette image without a valid ColorMap"))?;
-        let at = |i: u64| f.uint(map, i).and_then(|v| u16::try_from(v).ok());
-        let table: Option<Vec<[u16; 3]>> = (0..n).map(|i| Some([at(i)?, at(n + i)?, at(2 * n + i)?])).collect();
-        Some(table.ok_or_else(|| err("palette ColorMap cut off"))?)
-    } else {
-        None
-    };
+    let palette = if photometric == 3 { Some(read_palette(f, dir, spp, bits, src)?) } else { None };
     // CIE L*a*b*: CIELab (8; a* and b* signed) and ICCLab (9; a* and b* offset) are handed to the
     // `tiff` crate as RGB, then labelled Lab with a* and b* in PhotoCraft's encoding
     // (`convert_ab`).
@@ -337,29 +400,7 @@ fn decode_ifd(f: &File<'_>, dir: &Ifd, limits: &Limits) -> Result<Image, CodecEr
     // asked (photometric patched to black-is-zero below); gray already comes back as multiband.
     let unused = !extra.is_empty() && (spp as usize) > color.saturating_add(usize::from(alpha_at.is_some()));
     let all_samples = palette.is_none() && matches!(photometric, 2 | 5 | 8 | 9) && (alpha_at.is_some_and(|a| a > 0) || (!planar && unused));
-    let mut patches: Vec<(u64, Vec<u8>)> = Vec::new();
-    let encode_u = |v: u64, len: usize| -> Vec<u8> {
-        let b = if f.le { v.to_le_bytes() } else { v.to_be_bytes() };
-        if f.le { b.get(..len).map(<[u8]>::to_vec).unwrap_or_default() } else { b.get(8 - len..).map(<[u8]>::to_vec).unwrap_or_default() }
-    };
-    if f.big {
-        patches.push((8, encode_u(dir.at, 8)));
-    } else {
-        let at = u32::try_from(dir.at).map_err(|_| err("directory offset out of range"))?;
-        patches.push((4, encode_u(u64::from(at), 4)));
-    }
-    // The directory is seen as the last of its chain: the chain was walked already, and a
-    // cycle through it must not fail this page.
-    patches.push((dir.next_at, vec![0; if f.big { 8 } else { 4 }]));
-    if invert || palette.is_some() || all_samples || lab {
-        let e = photometric_entry.ok_or_else(|| err("missing PhotometricInterpretation"))?;
-        let len = match e.ty {
-            3 if e.count == 1 => 2,
-            4 if e.count == 1 => 4,
-            _ => return Err(err("malformed PhotometricInterpretation")),
-        };
-        patches.push((e.value_at, encode_u(if lab && !all_samples { 2 } else { 1 }, len)));
-    }
+    let patches = header_patches(f, dir, photometric_entry, invert || palette.is_some() || all_samples || lab, lab && !all_samples)?;
 
     let tl = {
         let mut l = tiff::decoder::Limits::default();
@@ -380,29 +421,7 @@ fn decode_ifd(f: &File<'_>, dir: &Ifd, limits: &Limits) -> Result<Image, CodecEr
         tiff::ColorType::Gray(_) => (ChannelLayout::Gray, 1),
         tiff::ColorType::Multiband { num_samples, .. } if all_samples => {
             // Lab reads as RGB here and is relabelled below.
-            let layout = match photometric {
-                2 | 8 | 9 => {
-                    if alpha_at.is_some() {
-                        ChannelLayout::Rgba
-                    } else {
-                        ChannelLayout::Rgb
-                    }
-                }
-                5 => {
-                    if alpha_at.is_some() {
-                        ChannelLayout::CmykA
-                    } else {
-                        ChannelLayout::Cmyk
-                    }
-                }
-                _ => {
-                    if gray_alpha {
-                        ChannelLayout::GrayA
-                    } else {
-                        ChannelLayout::Gray
-                    }
-                }
-            };
+            let layout = multiband_layout(photometric, alpha_at.is_some(), gray_alpha);
             (layout, usize::from(num_samples))
         }
         tiff::ColorType::Multiband { num_samples, .. } if photometric <= 1 => {
diff --git a/crates/codecs/src/codecs/tiff/encode.rs b/crates/codecs/src/codecs/tiff/encode.rs
index d71c32efde..a0b7539b86 100644
--- a/crates/codecs/src/codecs/tiff/encode.rs
+++ b/crates/codecs/src/codecs/tiff/encode.rs
@@ -1,6 +1,11 @@
 use super::bands::convert_ab;
 use super::tags::{F, TAG_IMAGE_SOURCE_DATA, TAG_PHOTOSHOP, TAG_XMP, TEXT_TAGS};
-use super::*;
+use super::{
+    ChannelLayout, CmykA16, CmykA32F, CodecError, Cow, EncodeOptions, ExifDirs, GrayA8, GrayA16, GrayA32F, Image, Lab8, Lab16, LabA8, LabA16,
+    PhotometricInterpretation, Plan, Rational, ResolutionUnit, SampleFormat, SampleType, Tag, TiffColorType, TiffCompression, TiffEncoder, TiffKind,
+    TiffKindBig, TiffKindStandard, TiffValue, Type, colortype, io, tiff_exif,
+};
+use std::io::Cursor;
 
 // ---------------------------------------------------------------------------
 // Encoding
diff --git a/crates/codecs/src/codecs/tiff/tags.rs b/crates/codecs/src/codecs/tiff/tags.rs
index df110f777a..a41b154137 100644
--- a/crates/codecs/src/codecs/tiff/tags.rs
+++ b/crates/codecs/src/codecs/tiff/tags.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Format, Tag};
 
 pub(super) const F: Format = Format::Tiff;
 
diff --git a/crates/codecs/src/codecs/via_image.rs b/crates/codecs/src/codecs/via_image.rs
index 81f4a369ca..0cb0bd4202 100644
--- a/crates/codecs/src/codecs/via_image.rs
+++ b/crates/codecs/src/codecs/via_image.rs
@@ -93,7 +93,25 @@ fn open<'a>(f: Format, bytes: &'a [u8], limits: &Limits) -> Result<impl ImageDec
     reader.limits(il);
     let dec = reader.into_decoder().map_err(|e| map_err(f, e))?;
     let (w, h) = dec.dimensions();
-    limits.check_bytes(w, h, dec.color_type().bytes_per_pixel() as u64)?;
+    let bpp = dec.color_type().bytes_per_pixel() as u64;
+    limits.check_bytes(w, h, bpp)?;
+    // `DynamicImage::from_decoder` allocates the whole image before reading a pixel, so a
+    // header-only file must not be able to ask for gigabytes (#8597). GIF's LZW tops out near
+    // 11000:1 of RGBA output and TGA's and QOI's runs far below; AVIF has already decoded by now.
+    // Radiance HDR's old-style RLE repeat markers multiply their counts by 256 each in a row, and
+    // a BMP's RLE escapes (end of line, end of bitmap, delta) leave pixels unwritten, so no ratio
+    // bounds a valid file: only the allocation limit above applies to them.
+    let declared = u64::from(w).saturating_mul(u64::from(h)).saturating_mul(bpp);
+    // A GIF's first frame is what the file must hold: the logical screen around it needs no
+    // data, so up to 256 MiB of screen (8192x8192) is free and only the rest must be backed.
+    let frame = if f == Format::Gif { gif_first_frame(bytes) } else { None };
+    let declared = match frame {
+        Some((fw, fh)) => u64::from(fw).saturating_mul(u64::from(fh)).saturating_mul(bpp).max(declared.saturating_sub(1 << 28)),
+        _ => declared,
+    };
+    if !matches!(f, Format::Avif | Format::Hdr) && !(f == Format::Bmp && bmp_is_rle(bytes)) {
+        Limits::check_plausible(declared, bytes.len(), 1 << 14)?;
+    }
     Ok(dec)
 }
 
@@ -123,9 +141,36 @@ pub(crate) fn probe(f: Format, bytes: &[u8], limits: &Limits) -> Result<(u32, u3
     Ok((w, h, dec.exif_metadata().ok().flatten()))
 }
 
+/// Whether a BMP's `biCompression` is RLE8 or RLE4 (only headers of 40 bytes or more have one).
+fn bmp_is_rle(b: &[u8]) -> bool {
+    let u32_at = |at: usize| b.get(at..at + 4).and_then(|b| b.try_into().ok()).map(u32::from_le_bytes);
+    u32_at(14).is_some_and(|n| n >= 40) && matches!(u32_at(30), Some(1 | 2))
+}
+
+/// The width and height of a GIF's first image descriptor, if the blocks reach one.
+fn gif_first_frame(b: &[u8]) -> Option<(u32, u32)> {
+    let mut at = None;
+    gif_walk(b, |i| {
+        at = Some(i);
+        false
+    });
+    let u16_at = |at: usize| b.get(at..at + 2).and_then(|b| b.try_into().ok()).map(u16::from_le_bytes);
+    // Descriptor: separator, left, top, width, height (little-endian u16s), packed fields.
+    let i = at?;
+    Some((u32::from(u16_at(i + 5)?), u32::from(u16_at(i + 7)?)))
+}
+
 /// Counts a GIF's frames (image descriptors) by walking its blocks, without decompressing any.
 /// The total is unknown when the blocks end before the trailer or break off.
 fn gif_more_frames(b: &[u8]) -> Option<DecodeWarning> {
+    let (frames, total) = gif_walk(b, |_| true);
+    (frames > 1).then_some(DecodeWarning::MoreFrames { total })
+}
+
+/// Walks a GIF's blocks without decompressing any, handing `frame` the offset of each image
+/// descriptor until it returns false. Gives the descriptors seen, and the frame count if the
+/// blocks reached the trailer.
+fn gif_walk(b: &[u8], mut frame: impl FnMut(usize) -> bool) -> (u32, Option<u32>) {
     // Size of the colour table a packed-fields byte announces.
     let table = |flags: u8| if flags & 0x80 != 0 { 3usize << ((flags & 7) + 1) } else { 0 };
     // Skips the data sub-blocks starting at `i` (each length-prefixed, ended by a zero length).
@@ -139,7 +184,10 @@ fn gif_more_frames(b: &[u8]) -> Option<DecodeWarning> {
         }
     };
     // Header (6 bytes), logical screen descriptor (7) and the global colour table.
-    let mut i = 13 + table(*b.get(10)?);
+    let Some(&flags) = b.get(10) else {
+        return (0, None);
+    };
+    let mut i = 13 + table(flags);
     let mut frames = 0u32;
     let total = loop {
         let next = match b.get(i) {
@@ -147,6 +195,9 @@ fn gif_more_frames(b: &[u8]) -> Option<DecodeWarning> {
             Some(0x21) => skip(i + 2),
             Some(0x2C) => {
                 frames = frames.saturating_add(1);
+                if !frame(i) {
+                    break None;
+                }
                 // Descriptor (10 bytes, packed fields last), local colour table, LZW code size.
                 b.get(i + 9).and_then(|&flags| skip(i + 11 + table(flags)))
             }
@@ -157,7 +208,7 @@ fn gif_more_frames(b: &[u8]) -> Option<DecodeWarning> {
             None => break None,
         }
     };
-    (frames > 1).then_some(DecodeWarning::MoreFrames { total })
+    (frames, total)
 }
 
 pub(crate) fn from_dynamic(f: Format, d: DynamicImage) -> Result<Image, CodecError> {
diff --git a/crates/codecs/src/codecs/vp8.rs b/crates/codecs/src/codecs/vp8.rs
index ba75bdd3e9..a24fb727cc 100644
--- a/crates/codecs/src/codecs/vp8.rs
+++ b/crates/codecs/src/codecs/vp8.rs
@@ -19,7 +19,11 @@ mod transform;
 
 use bool_encoder::BoolEncoder;
 use predict::{Plane, SubEdges, predict_block, predict_sub};
-use tables::*;
+use tables::{
+    AC_QLOOKUP, B_DC_PRED, B_HE_PRED, B_PRED, B_TM_PRED, B_VE_PRED, BMODE_TREE, CAT_BASE, COEFF_BANDS, COEFF_TREE, COEFF_UPDATE_PROBS, DC_PRED, DC_QLOOKUP,
+    DCT_0, DCT_1, DCT_2, DCT_3, DCT_4, DCT_CAT1, DCT_CAT2, DCT_CAT3, DCT_CAT4, DCT_CAT5, DCT_CAT6, DCT_EOB, DEFAULT_COEFF_PROBS, H_PRED, KF_BMODE_PROBS,
+    KF_UV_MODE_PROB, KF_YMODE_PROB, KF_YMODE_TREE, PCAT, TM_PRED, UV_MODE_TREE, V_PRED, ZIGZAG,
+};
 use transform::{fdct, fwht, idct, iwht};
 
 /// The largest dimension a VP8 frame header can hold (14 bits).
@@ -353,6 +357,65 @@ impl<'a> Encoder<'a> {
             .sum()
     }
 
+    /// Chroma of one macroblock: one mode for both planes; returns it with the U and V blocks.
+    fn encode_chroma(&mut self, mbx: usize, mby: usize) -> (u8, Vec<Block>, Vec<Block>) {
+        let (cx0, cy0) = (mbx * 8, mby * 8);
+        let mut src_u = [0i32; 64];
+        let mut src_v = [0i32; 64];
+        for r in 0..8 {
+            for c in 0..8 {
+                src_u[r * 8 + c] = self.src_c(&self.src.u, cx0 + c, cy0 + r);
+                src_v[r * 8 + c] = self.src_c(&self.src.v, cx0 + c, cy0 + r);
+            }
+        }
+        let mut uv_mode = DC_PRED;
+        let mut uv_best = u64::MAX;
+        let mut pred_u = [0u8; 64];
+        let mut pred_v = [0u8; 64];
+        let mut pu = [0u8; 64];
+        let mut pv = [0u8; 64];
+        for mode in [DC_PRED, V_PRED, H_PRED, TM_PRED] {
+            predict_block(&self.rec_u, cx0, cy0, 8, mode, &mut pu);
+            predict_block(&self.rec_v, cx0, cy0, 8, mode, &mut pv);
+            let e = Self::sse(&pu, &src_u) + Self::sse(&pv, &src_v);
+            if e < uv_best {
+                uv_best = e;
+                uv_mode = mode;
+                pred_u = pu;
+                pred_v = pv;
+            }
+        }
+        let mut u_blocks = Vec::with_capacity(4);
+        let mut v_blocks = Vec::with_capacity(4);
+        for (plane_src, pred, blocks, is_u) in [(&src_u, &pred_u, &mut u_blocks, true), (&src_v, &pred_v, &mut v_blocks, false)] {
+            for b in 0..4 {
+                let mut residual = [0i32; 16];
+                for r in 0..4 {
+                    for c in 0..4 {
+                        let i = ((b >> 1) * 4 + r) * 8 + (b & 1) * 4 + c;
+                        residual[r * 4 + c] = plane_src[i] - i32::from(pred[i]);
+                    }
+                }
+                let (quantized, dequantized) = Self::code_block(&residual, self.q.uv_dc, self.q.uv_ac, true);
+                let recon = idct(&dequantized);
+                let (bx, by) = (cx0 + (b & 1) * 4, cy0 + (b >> 1) * 4);
+                for r in 0..4 {
+                    for c in 0..4 {
+                        let i = ((b >> 1) * 4 + r) * 8 + (b & 1) * 4 + c;
+                        let value = (i32::from(pred[i]) + recon[r * 4 + c]).clamp(0, 255) as u8;
+                        if is_u {
+                            self.rec_u.set(bx + c, by + r, value);
+                        } else {
+                            self.rec_v.set(bx + c, by + r, value);
+                        }
+                    }
+                }
+                blocks.push(Block::from_raster(&quantized, 0));
+            }
+        }
+        (uv_mode, u_blocks, v_blocks)
+    }
+
     // Sub-block indices address several arrays by geometry; ranges read better than iterators here.
     #[allow(clippy::needless_range_loop)]
     fn encode_macroblock(&mut self, mbx: usize, mby: usize) {
@@ -476,61 +539,7 @@ impl<'a> Encoder<'a> {
             (best_mode, Some(Block::from_raster(&y2_q, 0)), blocks)
         };
 
-        // Chroma: one mode for both planes.
-        let (cx0, cy0) = (mbx * 8, mby * 8);
-        let mut src_u = [0i32; 64];
-        let mut src_v = [0i32; 64];
-        for r in 0..8 {
-            for c in 0..8 {
-                src_u[r * 8 + c] = self.src_c(&self.src.u, cx0 + c, cy0 + r);
-                src_v[r * 8 + c] = self.src_c(&self.src.v, cx0 + c, cy0 + r);
-            }
-        }
-        let mut uv_mode = DC_PRED;
-        let mut uv_best = u64::MAX;
-        let mut pred_u = [0u8; 64];
-        let mut pred_v = [0u8; 64];
-        let mut pu = [0u8; 64];
-        let mut pv = [0u8; 64];
-        for mode in [DC_PRED, V_PRED, H_PRED, TM_PRED] {
-            predict_block(&self.rec_u, cx0, cy0, 8, mode, &mut pu);
-            predict_block(&self.rec_v, cx0, cy0, 8, mode, &mut pv);
-            let e = Self::sse(&pu, &src_u) + Self::sse(&pv, &src_v);
-            if e < uv_best {
-                uv_best = e;
-                uv_mode = mode;
-                pred_u = pu;
-                pred_v = pv;
-            }
-        }
-        let mut u_blocks = Vec::with_capacity(4);
-        let mut v_blocks = Vec::with_capacity(4);
-        for (plane_src, pred, blocks, is_u) in [(&src_u, &pred_u, &mut u_blocks, true), (&src_v, &pred_v, &mut v_blocks, false)] {
-            for b in 0..4 {
-                let mut residual = [0i32; 16];
-                for r in 0..4 {
-                    for c in 0..4 {
-                        let i = ((b >> 1) * 4 + r) * 8 + (b & 1) * 4 + c;
-                        residual[r * 4 + c] = plane_src[i] - i32::from(pred[i]);
-                    }
-                }
-                let (quantized, dequantized) = Self::code_block(&residual, self.q.uv_dc, self.q.uv_ac, true);
-                let recon = idct(&dequantized);
-                let (bx, by) = (cx0 + (b & 1) * 4, cy0 + (b >> 1) * 4);
-                for r in 0..4 {
-                    for c in 0..4 {
-                        let i = ((b >> 1) * 4 + r) * 8 + (b & 1) * 4 + c;
-                        let value = (i32::from(pred[i]) + recon[r * 4 + c]).clamp(0, 255) as u8;
-                        if is_u {
-                            self.rec_u.set(bx + c, by + r, value);
-                        } else {
-                            self.rec_v.set(bx + c, by + r, value);
-                        }
-                    }
-                }
-                blocks.push(Block::from_raster(&quantized, 0));
-            }
-        }
+        let (uv_mode, u_blocks, v_blocks) = self.encode_chroma(mbx, mby);
 
         let skip = y2.as_ref().is_none_or(|b| !b.has_coeffs())
             && y_blocks.iter().all(|b| !b.has_coeffs())
diff --git a/crates/codecs/src/codecs/vp8/predict.rs b/crates/codecs/src/codecs/vp8/predict.rs
index 47319fdd7a..7ddea04238 100644
--- a/crates/codecs/src/codecs/vp8/predict.rs
+++ b/crates/codecs/src/codecs/vp8/predict.rs
@@ -2,7 +2,9 @@
 //! sub-block modes. Predictions read the frame's *unfiltered* reconstruction, which is what the
 //! decoder predicts from too (the loop filter runs on the finished frame).
 
-use super::tables::*;
+#[cfg(test)]
+use super::tables::{B_DC_PRED, DC_PRED};
+use super::tables::{B_HD_PRED, B_HE_PRED, B_HU_PRED, B_LD_PRED, B_RD_PRED, B_TM_PRED, B_VE_PRED, B_VL_PRED, B_VR_PRED, H_PRED, TM_PRED, V_PRED};
 
 /// A plane of the reconstruction with the virtual border VP8 defines: the row above the frame
 /// reads as 127, the column left of it as 129, and the pixel above-left of the frame as 127.
diff --git a/crates/codecs/tests/it/limits.rs b/crates/codecs/tests/it/limits.rs
index c1873771f6..536e303039 100644
--- a/crates/codecs/tests/it/limits.rs
+++ b/crates/codecs/tests/it/limits.rs
@@ -398,6 +398,12 @@ fn pnm_header_alone_reserves_nothing_without_limits() {
     }
 }
 
+#[test]
+fn hdr_header_sizes_that_overflow_u64_are_errors_without_limits() {
+    let b = b"#?RADIANCE\nFORMAT=32-bit_rle_rgbe\n\n-Y 2147483648 +X 2147483648\n";
+    assert!(decode_with(b, &opts(Limits::none())).is_err());
+}
+
 #[test]
 fn pnm_header_sizes_that_overflow_usize_are_errors_without_limits() {
     let m = u32::MAX;
@@ -456,3 +462,179 @@ fn limits_check_api() {
     assert!(l.check(10, 10, ChannelLayout::Rgba, SampleType::U8).is_err());
     assert!(l.check(10, 10, ChannelLayout::Rgb, SampleType::U8).is_ok());
 }
+
+/// #8597: a small file whose header declares about 3 GB, inside the default limits, is refused
+/// by the size-against-file check before the decoder allocates its output.
+fn refused_as_implausible(f: Format, b: &[u8]) {
+    match decode(b) {
+        Err(CodecError::LimitExceeded(m)) => assert!(m.contains("cannot hold"), "{f:?}: {m}"),
+        other => panic!("{f:?}: expected an implausible-size refusal, got {:?}", other.map(|i| (i.width(), i.height()))),
+    }
+}
+
+fn find(b: &[u8], needle: &[u8]) -> usize {
+    b.windows(needle.len()).position(|w| w == needle).unwrap()
+}
+
+#[test]
+fn jpeg_header_declaring_gigabytes_needs_a_plausible_file_size() {
+    let mut b = encoded(Format::Jpeg);
+    // SOF0: marker, length, precision, then height and width (big-endian).
+    let sof = find(&b, &[0xFF, 0xC0]);
+    b[sof + 5..sof + 7].copy_from_slice(&16000u16.to_be_bytes());
+    b[sof + 7..sof + 9].copy_from_slice(&65000u16.to_be_bytes());
+    // The decoder's own scan-size guard refuses it (one refusal path for truncated and complete
+    // files alike), before the backend allocates the frame.
+    match decode(&b) {
+        Err(e) => assert!(e.to_string().contains("too short for the frame"), "{e}"),
+        Ok(i) => panic!("decoded a {}×{} frame from {} bytes", i.width(), i.height(), b.len()),
+    }
+}
+
+#[test]
+fn image_crate_headers_declaring_gigabytes_need_a_plausible_file_size() {
+    let side = 30000u32;
+    let mut bmp = encoded(Format::Bmp);
+    bmp[18..22].copy_from_slice(&(side as i32).to_le_bytes());
+    bmp[22..26].copy_from_slice(&(side as i32).to_le_bytes());
+    refused_as_implausible(Format::Bmp, &bmp);
+    let mut qoi = encoded(Format::Qoi);
+    // The qoi crate refuses more than 400 M pixels itself, so 20000 x 20000 (1.6 GB).
+    qoi[4..8].copy_from_slice(&20000u32.to_be_bytes());
+    qoi[8..12].copy_from_slice(&20000u32.to_be_bytes());
+    refused_as_implausible(Format::Qoi, &qoi);
+    let mut gif = encoded(Format::Gif);
+    gif[6..8].copy_from_slice(&(side as u16).to_le_bytes());
+    gif[8..10].copy_from_slice(&(side as u16).to_le_bytes());
+    refused_as_implausible(Format::Gif, &gif);
+    // The frame too. Descriptor: separator, left, top, width, height.
+    let frame = find(&gif, &[0x2C, 0, 0, 0, 0, 64, 0, 48, 0]);
+    gif[frame + 5..frame + 7].copy_from_slice(&(side as u16).to_le_bytes());
+    gif[frame + 7..frame + 9].copy_from_slice(&(side as u16).to_le_bytes());
+    refused_as_implausible(Format::Gif, &gif);
+}
+
+/// GIF89a with a two-colour global table and one frame at the top left holding no pixels or
+/// one pixel (LZW minimum code size 2: clear, index 0, end of information).
+fn tiny_gif(screen: (u16, u16), frame: (u16, u16)) -> Vec<u8> {
+    let mut b = b"GIF89a".to_vec();
+    for v in [screen.0, screen.1] {
+        b.extend_from_slice(&v.to_le_bytes());
+    }
+    b.extend_from_slice(&[0x80, 0, 0, 0, 0, 0, 255, 255, 255, 0x2C, 0, 0, 0, 0]);
+    for v in [frame.0, frame.1] {
+        b.extend_from_slice(&v.to_le_bytes());
+    }
+    b.extend_from_slice(&[0, 2, 2, 0x44, 0x01, 0, 0x3B]);
+    b
+}
+
+#[test]
+fn a_gif_frame_much_smaller_than_its_screen_still_decodes() {
+    let img = decode(&tiny_gif((4000, 4000), (1, 1))).unwrap();
+    assert_eq!((img.width(), img.height()), (4000, 4000));
+}
+
+#[test]
+fn a_tiny_gif_frame_does_not_admit_a_gigabyte_screen() {
+    refused_as_implausible(Format::Gif, &tiny_gif((30000, 30000), (1, 1)));
+    // 324 MB of screen: past the 256 MiB that needs no data.
+    refused_as_implausible(Format::Gif, &tiny_gif((9000, 9000), (1, 1)));
+    refused_as_implausible(Format::Gif, &tiny_gif((30000, 30000), (0, 0)));
+    // A frame bigger than its screen is decoded at its own size.
+    refused_as_implausible(Format::Gif, &tiny_gif((100, 100), (40000, 40000)));
+}
+
+#[test]
+fn an_rle_bmp_ending_early_still_decodes() {
+    // 4000x4000 RLE8 whose only data is the end-of-bitmap escape: every pixel is left at index 0.
+    let data = 14 + 40 + 1024;
+    let mut b = b"BM".to_vec();
+    for v in [data + 2, 0, data, 40, 4000, 4000] {
+        b.extend_from_slice(&(v as u32).to_le_bytes());
+    }
+    b.extend_from_slice(&1u16.to_le_bytes());
+    b.extend_from_slice(&8u16.to_le_bytes());
+    for v in [1, 2, 0, 0, 0, 0] {
+        b.extend_from_slice(&(v as u32).to_le_bytes());
+    }
+    b.resize(data, 0);
+    b.extend_from_slice(&[0, 1]);
+    let img = decode(&b).unwrap();
+    assert_eq!((img.width(), img.height()), (4000, 4000));
+}
+
+#[test]
+fn pcx_header_declaring_gigabytes_needs_a_plausible_file_size() {
+    // 24-bit (three 8-bit planes) 65535 x 16384, with one row of data.
+    let mut b = vec![0u8; 128];
+    b[0] = 0x0a;
+    b[1] = 5;
+    b[2] = 1;
+    b[3] = 8;
+    b[8..10].copy_from_slice(&65534u16.to_le_bytes());
+    b[10..12].copy_from_slice(&16383u16.to_le_bytes());
+    b[65] = 3;
+    b[66..68].copy_from_slice(&65535u16.to_le_bytes());
+    b[68..70].copy_from_slice(&1u16.to_le_bytes());
+    b.extend_from_slice(&[0xff, 0]);
+    // PCX's own minimum-packet check refuses it before the output is allocated.
+    match decode(&b) {
+        Err(CodecError::Malformed { message, .. }) => assert!(message.contains("too short"), "{message}"),
+        other => panic!("expected a too-short refusal, got {:?}", other.map(|i| (i.width(), i.height()))),
+    }
+}
+
+#[test]
+fn xpm_rows_shorter_than_the_header_declares_are_refused_before_allocating() {
+    let b = b"/* XPM */\nstatic char *x[] = {\n\"30000 30000 1 1\",\n\". c #000000\",\n\".\",\n};\n".to_vec();
+    match decode(&b) {
+        Err(CodecError::Malformed { .. }) => {}
+        other => panic!("expected a malformed-row error, got {:?}", other.map(|i| (i.width(), i.height()))),
+    }
+}
+
+#[test]
+fn exr_header_declaring_gigabytes_needs_a_plausible_file_size() {
+    let mut b = encoded(Format::OpenExr);
+    // dataWindow: name, type, size, then xMin, yMin, xMax, yMax (little-endian i32).
+    let at = find(&b, b"dataWindow\0box2i\0") + b"dataWindow\0box2i\0".len() + 4;
+    b[at + 8..at + 12].copy_from_slice(&15999i32.to_le_bytes());
+    b[at + 12..at + 16].copy_from_slice(&15999i32.to_le_bytes());
+    refused_as_implausible(Format::OpenExr, &b);
+}
+
+#[test]
+fn a_dwab_exr_gets_a_looser_file_size_bound() {
+    // DWA passes 2^16:1 (a flat 8K frame with 12 alpha-scheme mattes is about 30 KB), so a DWAB
+    // part may declare 4 times more than a ZIP part from the same file, and no more.
+    let img = synth(1, 1, ChannelLayout::Rgba, SampleType::U8, 1, 0.1);
+    let mut b = encode(&img, Format::OpenExr, &EncodeOptions::default()).unwrap();
+    let at = find(&b, b"dataWindow\0box2i\0") + b"dataWindow\0box2i\0".len() + 4;
+    let c = find(&b, b"compression\0compression\0") + b"compression\0compression\0".len() + 4;
+    // RGBA as f32: 16 bytes a pixel against a file of a few hundred bytes.
+    let size = |b: &mut Vec<u8>, side: i32| {
+        b[at + 8..at + 12].copy_from_slice(&(side - 1).to_le_bytes());
+        b[at + 12..at + 16].copy_from_slice(&(side - 1).to_le_bytes());
+    };
+    let refused = |b: &[u8]| matches!(exr_info(b, &Limits::default()), Err(CodecError::LimitExceeded(m)) if m.contains("cannot hold"));
+    size(&mut b, 2048);
+    b[c] = 3; // ZIP
+    assert!(refused(&b), "{} bytes", b.len());
+    for dwa in [8, 9] {
+        b[c] = dwa; // DWAA, DWAB
+        let parts = exr_info(&b, &Limits::default()).unwrap();
+        assert_eq!((parts[0].width, parts[0].height), (2048, 2048));
+    }
+    size(&mut b, 4096);
+    assert!(refused(&b), "{} bytes", b.len());
+}
+
+#[test]
+fn highly_compressible_jpeg_and_gif_still_decode() {
+    let img = Image::from_u8(3000, 3000, ChannelLayout::Rgba, vec![255u8; 3000 * 3000 * 4]).unwrap();
+    for f in [Format::Jpeg, Format::Gif, Format::Qoi, Format::OpenExr] {
+        let b = encode(&img, f, &EncodeOptions::default()).unwrap();
+        assert_eq!(decode(&b).unwrap().width(), 3000, "{f:?}");
+    }
+}
diff --git a/crates/compose/proptest-regressions/cmyk_tests.txt b/crates/compose/proptest-regressions/cmyk_tests.txt
index 2f3a9c3fb8..2498f3013c 100644
--- a/crates/compose/proptest-regressions/cmyk_tests.txt
+++ b/crates/compose/proptest-regressions/cmyk_tests.txt
@@ -7,3 +7,4 @@
 cc a795914e4492bef1e662315563d48d54f09030c48e046df95329465c86dde4b4 # shrinks to s = Spec { w: 4, h: 6, layers: [Group { children: [Pixels { kind: Raster, blend: Normal, fills: [(Rect { x0: 0, y0: 0, x1: 1, y1: 1 }, [1.0, 0.0, 0.0, 0.0, 1.0])], opacity: 1.0, fill: 1.0, clipped: false, visible: true, mask: None }], pass_through: false, blend: Normal, opacity: 1.0, fill: 1.0, mask: None }, Pixels { kind: Adjust(Levels { channel: 0, levels: [0.0, 0.6, 1.0105422, 0.0, 0.7] }), blend: Normal, fills: [(Rect { x0: 0, y0: 0, x1: 1, y1: 1 }, [0.0, 0.0, 0.0, 0.0, 0.0])], opacity: 0.0, fill: 0.0, clipped: false, visible: true, mask: None }] }
 cc e14b02709a87770da2637c28678c4fa761b5628f402e0c6d60fe66f1aa4d4bfa # shrinks to s = Spec { w: 3, h: 2, layers: [Group { children: [Pixels { kind: Raster, blend: Normal, fills: [(Rect { x0: 0, y0: 0, x1: 1, y1: 1 }, [0.0, 0.0, 0.0, 0.0, 1.0])], opacity: 1.0, fill: 1.0, clipped: false, visible: true, mask: None }], pass_through: false, blend: Normal, opacity: 1.0, fill: 1.0, mask: None }, Group { children: [Pixels { kind: Adjust(Levels { channel: 0, levels: [0.0, 0.6, 0.3, 0.0, 0.7] }), blend: Dissolve, fills: [(Rect { x0: 0, y0: 0, x1: 1, y1: 1 }, [0.0, 0.0, 0.0, 0.0, 0.0])], opacity: 0.8972109, fill: 1.0, clipped: false, visible: true, mask: None }], pass_through: true, blend: Normal, opacity: 1.0, fill: 1.0, mask: None }] }
 cc 4eeba1f8db987228717b932b82d043d61e82fd897a33ea9e2ce68d6c61d7f491 # shrinks to s = Spec { w: 3, h: 5, layers: [Group { children: [Pixels { kind: Raster, blend: Normal, fills: [(Rect { x0: 0, y0: 0, x1: 1, y1: 1 }, [0.0, 0.0, 0.0, 0.0, 1.0])], opacity: 1.0, fill: 0.026626235, clipped: false, visible: true, mask: None }, Pixels { kind: Adjust(Invert), blend: Normal, fills: [(Rect { x0: 0, y0: 0, x1: 1, y1: 1 }, [0.0, 0.0, 0.0, 0.0, 0.0])], opacity: 0.0, fill: 0.0, clipped: false, visible: true, mask: None }], pass_through: true, blend: Normal, opacity: 1.0, fill: 1.0, mask: None }] }
+cc 33fb5c528e97f31669a82a4634930230f903c97e58ce59fc88fd733ac097089c # shrinks to s = Spec { w: 6, h: 4, layers: [Group { children: [Pixels { kind: Raster, blend: Normal, fills: [(Rect { x0: 0, y0: 0, x1: 5, y1: 3 }, [0.0, 1.0, 0.0, 0.0, 1.0])], opacity: 1.0, fill: 1.0, clipped: false, visible: true, mask: None }, Group { children: [Pixels { kind: Solid, blend: Normal, fills: [(Rect { x0: 0, y0: 0, x1: 1, y1: 1 }, [0.0, 1.0, 0.0, 0.0, 1.0])], opacity: 1.0, fill: 1.0, clipped: false, visible: true, mask: None }], pass_through: false, blend: VividLight, opacity: 1.0, fill: 1.0, mask: None }, Pixels { kind: Text, blend: Normal, fills: [(Rect { x0: 0, y0: 0, x1: 1, y1: 1 }, [0.0, 0.0, 0.0, 0.0, 1.0])], opacity: 1.0, fill: 1.0, clipped: true, visible: true, mask: None }], pass_through: false, blend: Normal, opacity: 1.0, fill: 1.0, mask: None }] }
diff --git a/crates/compose/src/adjust/channels.rs b/crates/compose/src/adjust/channels.rs
index 4b7d42b92a..2371754077 100644
--- a/crates/compose/src/adjust/channels.rs
+++ b/crates/compose/src/adjust/channels.rs
@@ -1,6 +1,6 @@
 use super::color::{bayer4, gradient};
 use super::tone::{LUT_SIZE, lut, map_rgb, modern_brightness, modern_contrast, modern_lut, posterize_in, tone_luts_depth};
-use super::*;
+use super::{Adjustment, Buffer, ColorMode, LEGACY_PIVOT, SampleType, ToneSpace, Transfer, apply_depth, lab_to_srgb, rgb_to_gray, srgb_to_lab};
 
 /// Legacy Brightness/Contrast on a 32-bit document's samples: unclipped, with contrast pivoting at
 /// 127 of 255 (photoshop corpus rgb32 and gray32 brightness-contrast-legacy.psd: every pixel
diff --git a/crates/compose/src/adjust/color.rs b/crates/compose/src/adjust/color.rs
index f47d1154f0..94a57717ce 100644
--- a/crates/compose/src/adjust/color.rs
+++ b/crates/compose/src/adjust/color.rs
@@ -1,5 +1,5 @@
 use super::tone::LUT_SIZE;
-use super::*;
+use super::{D50, HueRange, SRGB_TO_XYZ_D50, SampleType, Transfer, XYZ_D50_TO_SRGB, mat3_mul, srgb_to_linear};
 
 /// Hue/Saturation's range edits as three hue-indexed tables (hue shift in degrees, saturation and
 /// lightness as fractions), sampled at hue `k / (len - 1)` turns. Ranges add up where they overlap.
diff --git a/crates/compose/src/adjust/tone.rs b/crates/compose/src/adjust/tone.rs
index 3659748392..5debc98a83 100644
--- a/crates/compose/src/adjust/tone.rs
+++ b/crates/compose/src/adjust/tone.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Adjustment, Buffer, ColorMode, CurvePoint, LevelsChannel, SampleType, ToneSpace, lab_to_srgb, srgb_to_lab};
 
 /// Float RGB curve channels with no edit must preserve samples outside the LUT domain; edited
 /// ones extend past it (see [`float_tone_extrapolates`]).
diff --git a/crates/compose/src/adjust/tone_tests.rs b/crates/compose/src/adjust/tone_tests.rs
index fbd91bf14b..7134d5288f 100644
--- a/crates/compose/src/adjust/tone_tests.rs
+++ b/crates/compose/src/adjust/tone_tests.rs
@@ -198,7 +198,8 @@ fn color_lookup_with_an_overflowing_stored_size_is_the_identity() {
     // A stored document's size is untrusted: (2²²)³ × 3 overflows, which once wrapped past
     // the table-length guard and indexed out of bounds.
     for size in [1 << 22, u32::MAX] {
-        let a = Adjustment::ColorLookup { name: "x".into(), lut: Some(std::sync::Arc::new(vec![0.5; 24])), size, tetrahedral: false, dither: false };
+        let a =
+            Adjustment::ColorLookup { name: "x".into(), lut: Some(std::sync::Arc::new(vec![0.5; 24])), size, tetrahedral: false, dither: false, source: None };
         let mut b = ramp();
         apply(&a, &mut b);
         assert_eq!(b.px, ramp().px, "size {size}");
diff --git a/crates/compose/src/advanced.rs b/crates/compose/src/advanced.rs
index 6809c9e865..8ea5a86c6d 100644
--- a/crates/compose/src/advanced.rs
+++ b/crates/compose/src/advanced.rs
@@ -12,7 +12,9 @@
 //!   composites onto the result in its own mode, kept inside the base's shape (its alpha with
 //!   masks, times its opacity).
 //! - **Transparency Shapes Layer off.** The layer's effects and knockout cover the whole layer
-//!   (its masks still apply) instead of following its transparency.
+//!   (its masks still apply) instead of following its transparency. In the special eight
+//!   ([`crate::psblend::fill_is_special`]) the layer's own transparency then blends as Fill does
+//!   (`blend_layer_into` in `composite.rs`; measured in Photoshop, #5692).
 //! - **Layer / Vector Mask Hides Effects.** The effects are built from the layer without that
 //!   mask, and the mask is applied to the finished layer and effects.
 //!
@@ -75,7 +77,13 @@ pub fn advanced_active(layer: &Layer, clipped: &[Layer]) -> bool {
         return false;
     }
     let fx = effects::has_effects(layer);
-    a.knockout != Knockout::None || clips_individually(layer, clipped) || (a.blend_interior && fx) || (!a.transparency_shapes && fx) || hides_effects(layer)
+    // Transparency Shapes Layer off changes the special eight's blend itself (#5692).
+    let shapeless_blend = crate::psblend::fill_is_special(layer.blend) && !matches!(layer.content, LayerContent::Adjustment(_));
+    a.knockout != Knockout::None
+        || clips_individually(layer, clipped)
+        || (a.blend_interior && fx)
+        || (!a.transparency_shapes && (fx || shapeless_blend))
+        || hides_effects(layer)
 }
 
 /// Whether the layer's effects (or knockout) cover the whole layer: Transparency Shapes Layer
diff --git a/crates/compose/src/advanced_tests.rs b/crates/compose/src/advanced_tests.rs
index a0fdf52cb0..608c6188e2 100644
--- a/crates/compose/src/advanced_tests.rs
+++ b/crates/compose/src/advanced_tests.rs
@@ -555,3 +555,157 @@ fn deep_knockout_reveals_a_localized_background() {
         check(&d, 2, 2, [0.0; 4], "an unlocked layer named Background");
     }
 }
+
+/// Transparency Shapes Layer off in the special eight: the layer's own transparency blends as
+/// Fill does (#5692). Measured in Photoshop: Background (90, 110, 130), a layer (200, 150, 80) at
+/// alpha 30 % (77) and 70 % (179) in columns 0–5 and 6–11, read from the flattened 8-bit PNG.
+#[test]
+fn transparency_shapes_off_blends_alpha_as_fill() {
+    const A30: f32 = 77.0 / 255.0;
+    const A70: f32 = 179.0 / 255.0;
+    let c8 = |c: [u8; 3]| [f32::from(c[0]) / 255.0, f32::from(c[1]) / 255.0, f32::from(c[2]) / 255.0];
+    let px = |c: [u8; 3], a: f32| {
+        let c = c8(c);
+        [c[0], c[1], c[2], a]
+    };
+    let make = |depth: SampleType, mode: BlendMode, opacity: f32, fill: f32, tsl: bool| {
+        let b = c8([90, 110, 130]);
+        let mut d = Document::with_background("t", Size::new(12, 8), ColorMode::Rgb, depth, Color::rgb(b[0], b[1], b[2]));
+        let mut l = solid(&d, "a30", Rect::new(0, 0, 6, 8), px([200, 150, 80], A30));
+        l.surface_mut().unwrap().fill_rect(Rect::new(6, 0, 12, 8), &photocraft_raster::from_rgba(&d.pixel_format(), px([200, 150, 80], A70)));
+        l.blend = mode;
+        l.opacity = opacity;
+        l.fill_opacity = fill;
+        l.advanced.transparency_shapes = tsl;
+        d.layers.push(l);
+        d
+    };
+    let (o53, f50) = (135.0 / 255.0, 128.0 / 255.0);
+    // (mode, opacity, fill, off at 30 %, off at 70 %, on at 30 %, on at 70 %)
+    type Rgb = [u8; 3];
+    let measured: [(BlendMode, f32, f32, Rgb, Rgb, Rgb, Rgb); 7] = [
+        (BlendMode::ColorDodge, o53, 1.0, [105, 123, 137], [148, 151, 150], [117, 133, 139], [151, 164, 152]),
+        (BlendMode::ColorBurn, o53, 1.0, [84, 99, 113], [74, 79, 69], [83, 94, 109], [73, 72, 82]),
+        (BlendMode::LinearDodge, o53, 1.0, [122, 134, 143], [164, 166, 160], [117, 133, 143], [151, 164, 160]),
+        (BlendMode::HardMix, o53, 1.0, [98, 111, 119], [133, 117, 75], [117, 133, 109], [151, 164, 82]),
+        (BlendMode::Difference, o53, 1.0, [58, 86, 117], [69, 54, 100], [93, 99, 117], [97, 84, 100]),
+        (BlendMode::ColorDodge, 1.0, f50, [102, 121, 136], [125, 139, 146], [108, 124, 137], [131, 142, 147]),
+        (BlendMode::Difference, 1.0, f50, [59, 87, 118], [19, 57, 102], [66, 87, 118], [34, 57, 102]),
+    ];
+    for depth in DEPTHS {
+        for (mode, opacity, fill, off30, off70, on30, on70) in measured {
+            // A 32-bit document's Linear Dodge doesn't clip at 1 (psblend::HDR).
+            if depth == SampleType::F32 && mode == BlendMode::LinearDodge {
+                continue;
+            }
+            let what = format!("{mode:?} opacity {opacity} fill {fill}");
+            let off = make(depth, mode, opacity, fill, false);
+            check(&off, 2, 4, px(off30, 1.0), &format!("{what}, off, alpha 30 %"));
+            check(&off, 9, 4, px(off70, 1.0), &format!("{what}, off, alpha 70 %"));
+            let on = make(depth, mode, opacity, fill, true);
+            check(&on, 2, 4, px(on30, 1.0), &format!("{what}, on, alpha 30 %"));
+            check(&on, 9, 4, px(on70, 1.0), &format!("{what}, on, alpha 70 %"));
+            assert!(advanced_active(&off.layers[1], &[]), "{what}: the GPU leaves it to the CPU");
+        }
+        // Modes outside the special eight look the same either way, and stay on the plain path.
+        for mode in [BlendMode::Normal, BlendMode::Multiply, BlendMode::Screen, BlendMode::Overlay] {
+            let (off, on) = (make(depth, mode, o53, f50, false), make(depth, mode, o53, f50, true));
+            assert_eq!(render(&off, off.bounds()).px, render(&on, on.bounds()).px, "{mode:?}");
+            assert!(!advanced_active(&off.layers[1], &[]), "{mode:?}");
+        }
+    }
+}
+
+/// A mask is not the layer's transparency: Photoshop draws an opaque layer under a 30 % mask the
+/// same with the option on or off (measured: Color Dodge, Hard Mix, Difference and the rest of
+/// the special eight, every Opacity and Fill tried). Over a half-transparent backdrop and for an
+/// isolated group the alpha still blends as Fill (measured: Color Dodge at 53 %).
+#[test]
+fn transparency_shapes_off_ignores_masks_and_reaches_groups() {
+    let c8 = |c: [u8; 3]| [f32::from(c[0]) / 255.0, f32::from(c[1]) / 255.0, f32::from(c[2]) / 255.0];
+    let px = |c: [u8; 3], a: f32| {
+        let c = c8(c);
+        [c[0], c[1], c[2], a]
+    };
+    let o53 = 135.0 / 255.0;
+    for depth in DEPTHS {
+        for mode in [BlendMode::ColorDodge, BlendMode::HardMix, BlendMode::Difference] {
+            let render_with = |tsl: bool| {
+                let b = c8([90, 110, 130]);
+                let mut d = Document::with_background("t", Size::new(12, 8), ColorMode::Rgb, depth, Color::rgb(b[0], b[1], b[2]));
+                let mut l = solid(&d, "l", full(&d), px([200, 150, 80], 1.0));
+                l.blend = mode;
+                l.opacity = o53;
+                l.mask = Some(LayerMask { surface: photocraft_raster::Surface::with_default(PixelFormat::GRAY8, &[77.0 / 255.0]), ..LayerMask::reveal_all() });
+                l.advanced.transparency_shapes = tsl;
+                d.layers.push(l);
+                render(&d, d.bounds()).px
+            };
+            let (off, on) = (render_with(false), render_with(true));
+            assert!(off.iter().zip(&on).all(|(a, b)| close(*a, *b)), "{mode:?} ({depth:?}): a mask isn't the layer's transparency");
+        }
+        // Color Dodge at 53 % over a backdrop of alpha 50 % (128): (118, 127, 129, 148) at
+        // alpha 30 %, (162, 151, 131, 175) at 70 %.
+        let mut d = doc(depth, false);
+        d.layers.push(solid(&d, "under", full(&d), px([90, 110, 130], 128.0 / 255.0)));
+        let mut l = solid(&d, "a30", Rect::new(0, 0, 6, 8), px([200, 150, 80], 77.0 / 255.0));
+        l.surface_mut().unwrap().fill_rect(Rect::new(6, 0, 12, 8), &photocraft_raster::from_rgba(&d.pixel_format(), px([200, 150, 80], 179.0 / 255.0)));
+        l.blend = BlendMode::ColorDodge;
+        l.opacity = o53;
+        l.advanced.transparency_shapes = false;
+        d.layers.push(l.clone());
+        check(&d, 2, 4, px([118, 127, 129], 148.0 / 255.0), "half-transparent backdrop, alpha 30 %");
+        check(&d, 9, 4, px([162, 151, 131], 175.0 / 255.0), "half-transparent backdrop, alpha 70 %");
+        // An isolated Color Dodge group at 53 % holding the Normal layer: the group's alpha blends
+        // as Fill, as a layer's does.
+        let b = c8([90, 110, 130]);
+        let mut d = Document::with_background("t", Size::new(12, 8), ColorMode::Rgb, depth, Color::rgb(b[0], b[1], b[2]));
+        l.blend = BlendMode::Normal;
+        l.opacity = 1.0;
+        l.advanced.transparency_shapes = true;
+        let mut g = Layer::group("g", vec![l]);
+        g.blend = BlendMode::ColorDodge;
+        g.opacity = o53;
+        g.advanced.transparency_shapes = false;
+        d.layers.push(g);
+        check(&d, 2, 4, px([105, 123, 137], 1.0), "group, alpha 30 %");
+        check(&d, 9, 4, px([148, 151, 150], 1.0), "group, alpha 70 %");
+    }
+}
+
+/// A clipped knockout in a Transparency Shapes Layer off base of the special eight: the knockout
+/// stops at the base's own content (Blend Clipped Layers as Group), so it gives back the base's
+/// colour without touching its alpha, and the base's transparency still blends as Fill under a
+/// feathered vector mask. Where the fill-0 knocker covers an earlier clipped layer the composite
+/// is the base's alone.
+#[test]
+fn transparency_shapes_off_keeps_the_base_alpha_under_a_clipped_knockout() {
+    let square = photocraft_doc::vector::Path::new(vec![photocraft_doc::vector::Subpath::polygon(&[(2.0, 1.0), (10.0, 1.0), (10.0, 7.0), (2.0, 7.0)])]);
+    for depth in DEPTHS {
+        for k in [Knockout::Shallow, Knockout::Deep] {
+            let mut d = Document::with_background("t", Size::new(12, 8), ColorMode::Rgb, depth, Color::rgb(90.0 / 255.0, 110.0 / 255.0, 130.0 / 255.0));
+            let mut base = solid(&d, "base", Rect::new(0, 0, 3, 8), [0.78, 0.59, 0.31, 0.3]);
+            base.surface_mut().unwrap().fill_rect(Rect::new(3, 0, 12, 8), &photocraft_raster::from_rgba(&d.pixel_format(), [0.78, 0.59, 0.31, 0.7]));
+            base.blend = BlendMode::ColorDodge;
+            base.opacity = 0.53;
+            base.advanced.transparency_shapes = false;
+            base.vector_mask = Some(photocraft_doc::vector::VectorMask { feather: 1.5, ..photocraft_doc::vector::VectorMask::new(square.clone()) });
+            d.layers.push(base);
+            let alone = render(&d, d.bounds()).px;
+            let mut red = solid(&d, "red", full(&d), [1.0, 0.0, 0.0, 0.5]);
+            red.clipped = true;
+            let mut knock = knocker(&d, k);
+            knock.clipped = true;
+            d.layers.extend([red, knock]);
+            let got = render(&d, d.bounds()).px;
+            let what = format!("{k:?} ({depth:?})");
+            for (i, (g, a)) in got.iter().zip(&alone).enumerate() {
+                if i % 12 < 6 {
+                    assert!(close(*g, *a), "{what}: knocked out at {i}: {g:?}, the base alone {a:?}");
+                }
+            }
+            assert!(!close(got[6 * 12 + 8], alone[6 * 12 + 8]), "{what}: the red shows outside the knocker");
+            check(&d, 4, 3, alone[3 * 12 + 4], &what);
+        }
+    }
+}
diff --git a/crates/compose/src/cmyk/tests.rs b/crates/compose/src/cmyk/tests.rs
index 3e28fccd7e..44b265c8dd 100644
--- a/crates/compose/src/cmyk/tests.rs
+++ b/crates/compose/src/cmyk/tests.rs
@@ -105,8 +105,10 @@ fn over_text(b: Cmyka, s: Cmyka, opacity: f32) -> Cmyka {
     let dec = |v: f32| 1.0 - photocraft_color::convert::linear_to_srgb(v.max(0.0).powf(gamma));
     let mut o = [0.0; 5];
     for i in 0..4 {
-        // Mixing an ink with itself (or with nothing) leaves it exactly as it is.
-        o[i] = if b[4] <= 0.0 || b[i] == s[i] { s[i] } else { dec((1.0 - sa) * b[4] / a * enc(b[i]) + sa / a * enc(s[i])) };
+        // Mixing an ink with itself, with nothing, or over a backdrop it covers fully leaves it
+        // exactly as it is (the round trip through the gamma space can move it by a rounding
+        // step, which a mode that jumps at no ink or full ink turns into a whole ink).
+        o[i] = if b[4] <= 0.0 || sa >= 1.0 || b[i] == s[i] { s[i] } else { dec((1.0 - sa) * b[4] / a * enc(b[i]) + sa / a * enc(s[i])) };
     }
     o[4] = a;
     o
@@ -394,6 +396,64 @@ fn isolated_groups_keep_the_special_fill_rule() {
     }
 }
 
+/// White type clipped onto an isolated Vivid Light group over full magenta (#9688): the glyph
+/// covers its pixel, so the group shows exactly no ink there, and Vivid Light with no ink (full
+/// brightness) gives no ink whatever the backdrop. Mixing the covered pixel through the type
+/// gamma would leave a rounding step of ink, which Vivid Light turns into full magenta.
+#[test]
+fn type_clipped_to_a_vivid_light_group_covers_exactly() {
+    let mut inner = Layer::new("f", LayerContent::Fill(photocraft_doc::Fill::Solid(cmyk_color([0.0, 1.0, 0.0, 0.0], 1.0))));
+    inner.blend = BlendMode::Normal;
+    let mut vivid = Layer::group("vivid", vec![inner]);
+    vivid.blend = BlendMode::VividLight;
+    let mut glyph = text_layer(&[(Rect::new(0, 0, 1, 1), [0.0, 0.0, 0.0, 0.0, 1.0])]);
+    glyph.clipped = true;
+    let outer = Layer::group("outer", vec![layer(&[(Rect::new(0, 0, 5, 3), [0.0, 1.0, 0.0, 0.0, 1.0])]), vivid, glyph]);
+    let mut d = doc(6, 4);
+    d.layers.push(outer);
+    assert!(supports(&d));
+    let got = render_cmyk(&d, d.bounds()).unwrap_or_else(|| panic!("supported"));
+    assert_eq!(got.px[0], [0.0, 0.0, 0.0, 0.0, 1.0], "white glyph in Vivid Light");
+    // Magenta in Vivid Light onto magenta stays magenta.
+    assert_eq!(got.px[1], [0.0, 1.0, 0.0, 0.0, 1.0], "beside the glyph");
+    assert_matches_reference(&d);
+}
+
+/// The same structure in the neighbouring modes, with type or pixels clipped (fully covering and
+/// at a partly covered edge), onto inks that sit at the jumps of the modes that have them.
+#[test]
+fn layers_clipped_to_isolated_groups_match_the_reference_in_every_mode() {
+    use BlendMode as B;
+    for mode in [B::VividLight, B::LinearLight, B::PinLight, B::HardMix, B::ColorDodge, B::ColorBurn, B::Normal, B::Multiply, B::Screen] {
+        for text in [false, true] {
+            for (backdrop, ink) in [([0.0, 1.0, 0.0, 0.0], [0.0; 4]), ([1.0, 0.0, 1.0, 1.0], [1.0; 4]), ([0.0, 1.0, 0.0, 0.0], [0.0, 0.3, 1.0, 0.0])] {
+                let mut inner = Layer::new("f", LayerContent::Fill(photocraft_doc::Fill::Solid(cmyk_color(backdrop, 1.0))));
+                inner.blend = BlendMode::Normal;
+                let mut group = Layer::group("g", vec![inner]);
+                group.blend = mode;
+                let [c, m, y, k] = ink;
+                let rects = [(Rect::new(0, 0, 2, 2), [c, m, y, k, 1.0]), (Rect::new(2, 0, 3, 2), [c, m, y, k, 0.5])];
+                let mut clip = if text { text_layer(&rects) } else { layer(&rects) };
+                clip.clipped = true;
+                let [bc, bm, by, bk] = backdrop;
+                let outer = Layer::group("outer", vec![layer(&[(Rect::new(0, 0, 4, 2), [bc, bm, by, bk, 1.0])]), group, clip]);
+                let mut d = doc(4, 3);
+                d.layers.push(outer);
+                assert!(supports(&d), "{mode:?}");
+                assert_matches_reference(&d);
+            }
+        }
+    }
+    // Onto a pass-through group, clipped layers take the RGB compositor's isolated rendering.
+    let mut pass = Layer::group("pass", vec![layer(&[(Rect::new(0, 0, 2, 2), [0.0, 1.0, 0.0, 0.0, 1.0])])]);
+    pass.blend = BlendMode::PassThrough;
+    let mut clip = text_layer(&[(Rect::new(0, 0, 1, 1), [0.0; 5])]);
+    clip.clipped = true;
+    let mut d = doc(2, 2);
+    d.layers.extend([pass, clip]);
+    assert!(!supports(&d));
+}
+
 #[test]
 fn unsupported_documents_fall_back() {
     let simple = || {
diff --git a/crates/compose/src/composite.rs b/crates/compose/src/composite.rs
index dccaed8c4b..bc0de2ffc2 100644
--- a/crates/compose/src/composite.rs
+++ b/crates/compose/src/composite.rs
@@ -2,7 +2,7 @@ use super::content::{channel_weights, empty_in, recycle_buffer, render_content,
 use super::ctx::Ctx;
 use super::extents::{effects_frame, mask_k, mask_vals, shapeless_stroke_bounds};
 use super::fx_cache::effect_maps;
-use super::*;
+use super::{BlendMode, Buffer, Fill, Layer, LayerContent, Rect, Surface, advanced, blend, effects, psblend, shape_split};
 
 /// Composite an isolated group's sibling list (bottom→top) onto `backdrop` (its own buffer).
 pub(crate) fn composite_stack(layers: &[Layer], backdrop: &mut Buffer, cx: &Ctx) {
@@ -364,6 +364,10 @@ pub(crate) fn composite_layer_plain(layer: &Layer, clipped: &[Layer], backdrop:
                 };
             }
         }
+        // A Frame's stroke over the frame's content, at the group's opacity.
+        if let Some(stroke) = shape_split::frame_stroke(layer, cx.canvas, cx.depth) {
+            blend_into(backdrop, &surface_to_buffer(&stroke, rect), BlendMode::Normal, opacity);
+        }
         // Layers clipped to a pass-through group sit atop the group's
         // isolated rendering; their effect (isolated result with vs. without
         // them, each placed over the original backdrop) is added to the
@@ -443,7 +447,7 @@ pub(crate) fn composite_layer_plain(layer: &Layer, clipped: &[Layer], backdrop:
             *p = psblend::composite(BlendMode::Normal, *p, *s, 1.0);
             p[3] *= mask_k(&mask, i);
         }
-        blend_into_fill(backdrop, &content, layer.blend, layer.opacity, layer.fill_opacity, 1.0);
+        blend_layer_into(backdrop, &content, layer, cx, 1.0);
         return;
     }
     if !matches!(layer.content, LayerContent::Group(_) | LayerContent::Fill(_) | LayerContent::Adjustment(_))
@@ -467,14 +471,17 @@ pub(crate) fn composite_layer_plain(layer: &Layer, clipped: &[Layer], backdrop:
         }
         return;
     }
+    // The row-at-a-time fast path blends like `blend_into_fill`; Transparency Shapes Layer off
+    // with one of the special eight needs `blend_layer_into`'s per-pixel mask split.
     if clipped.is_empty()
+        && (layer.advanced.transparency_shapes || !psblend::fill_is_special(layer.blend))
         && let Some(surf) = pixel_surface(layer)
     {
         return composite_pixel_layer(layer, surf, backdrop, cx);
     }
     let Some(mut content) = render_content(layer, rect, cx) else { return };
     advanced::composite_clipped(clipped, &mut content, cx);
-    blend_into_fill(backdrop, &content, layer.blend, layer.opacity, layer.fill_opacity, text_gamma(layer));
+    blend_layer_into(backdrop, &content, layer, cx, text_gamma(layer));
     recycle_buffer(content);
 }
 
@@ -626,10 +633,34 @@ fn composite_atop_any(layer: &Layer, base: &mut Buffer, cx: &Ctx) {
 }
 
 /// Blend an isolated layer buffer into the backdrop.
-fn blend_into(backdrop: &mut Buffer, src: &Buffer, mode: BlendMode, opacity: f32) {
+pub(crate) fn blend_into(backdrop: &mut Buffer, src: &Buffer, mode: BlendMode, opacity: f32) {
     blend_into_g(backdrop, src, mode, opacity, 1.0);
 }
 
+/// `layer`'s masked content `src` blended into the backdrop with its own mode, Opacity and Fill
+/// ([`blend_into_fill`]). With Transparency Shapes Layer off, the special eight
+/// ([`psblend::fill_is_special`]) take the layer's own transparency (its content's alpha, not its
+/// masks) inside the blend, as Fill: Photoshop composites a pixel of alpha `a` at Fill `f` as
+/// an opaque one at Fill `a × f`, covering the backdrop with Opacity × masks only. Other modes
+/// look the same either way (#5692).
+fn blend_layer_into(backdrop: &mut Buffer, src: &Buffer, layer: &Layer, cx: &Ctx, gamma: f32) {
+    let (mode, opacity, fill) = (layer.blend, layer.opacity, layer.fill_opacity);
+    if layer.advanced.transparency_shapes || !psblend::fill_is_special(mode) {
+        return blend_into_fill(backdrop, src, mode, opacity, fill, gamma);
+    }
+    let mv = mask_vals(layer, backdrop.rect, cx);
+    let fill = fill.clamp(0.0, 1.0);
+    for (i, (b, s)) in backdrop.px.iter_mut().zip(&src.px).enumerate() {
+        // `src` carries alpha × masks; split them again.
+        let m = mv.as_ref().map_or(1.0, |v| v.get(i).copied().unwrap_or(1.0));
+        if s[3] <= 0.0 || m <= 0.0 {
+            continue;
+        }
+        let alpha = (s[3] / m).clamp(0.0, 1.0);
+        *b = psblend::composite_fill(mode, *b, [s[0], s[1], s[2], m], opacity, fill * alpha, gamma);
+    }
+}
+
 /// [`blend_into_g`] for a layer's own `opacity` and `fill`: Fill is part of the blend for
 /// Photoshop's special eight ([`psblend::composite_fill`]), plain coverage otherwise.
 pub(crate) fn blend_into_fill(backdrop: &mut Buffer, src: &Buffer, mode: BlendMode, opacity: f32, fill: f32, gamma: f32) {
diff --git a/crates/compose/src/content.rs b/crates/compose/src/content.rs
index 88ec2751a9..ea868d715e 100644
--- a/crates/compose/src/content.rs
+++ b/crates/compose/src/content.rs
@@ -1,8 +1,8 @@
-use super::composite::{adjustment_quantum, composite_stack};
+use super::composite::{adjustment_quantum, blend_into, composite_stack};
 use super::ctx::Ctx;
 use super::extents::{effect_shape, effect_source_bounds, mask_vals, shapeless_stroke_bounds, transparent_outside};
 use super::fx_cache::effect_maps;
-use super::*;
+use super::{BlendMode, Buffer, Document, Fill, Layer, LayerContent, Pattern, Rect, Surface, bounds, effects, gradient_fill, pattern, shape_split};
 
 /// Tile size for parallel rendering (tile results are independent).
 pub const RENDER_TILE: i32 = 256;
@@ -94,6 +94,10 @@ pub(crate) fn render_content(layer: &Layer, rect: Rect, cx: &Ctx) -> Option<Buff
             p[3] *= k;
         }
     }
+    // A Frame's stroke lies over its masked content; the frame doesn't clip it.
+    if let Some(stroke) = shape_split::frame_stroke(layer, cx.canvas, cx.depth) {
+        blend_into(&mut buf, &surface_to_buffer(&stroke, rect), BlendMode::Normal, 1.0);
+    }
     Some(buf)
 }
 
diff --git a/crates/compose/src/ctx.rs b/crates/compose/src/ctx.rs
index 38c150db55..f54c79865b 100644
--- a/crates/compose/src/ctx.rs
+++ b/crates/compose/src/ctx.rs
@@ -1,6 +1,6 @@
 use super::content::empty_in;
 use super::fx_cache::{effect_maps, fx_over_budget, layer_identity};
-use super::*;
+use super::{Buffer, Document, Layer, LayerContent, Rect, adjust, advanced, effects, pattern};
 
 type VectorMaskSlot = std::sync::Arc<std::sync::OnceLock<photocraft_vector::CompiledVectorMask>>;
 
diff --git a/crates/compose/src/effects/bevel.rs b/crates/compose/src/effects/bevel.rs
index 8b11b94e60..ea07fbd709 100644
--- a/crates/compose/src/effects/bevel.rs
+++ b/crates/compose/src/effects/bevel.rs
@@ -1,7 +1,7 @@
 use super::blur::tent;
 use super::distance::{INSIDE_EPS, bevel_dists, par_fill, par_units};
 use super::paint::{apply_lut, bevel_contour_lut, contour_lut, lut_at, offset, satin_lut};
-use super::*;
+use super::{Bevel, BevelStyle, BevelTechnique, GlobalLight, Map, Pattern, Placement, PreparedPatterns, Rect};
 
 /// Where a bevel's maps paint: inside the shape (with the layer), outside it (onto the
 /// backdrop), or both (emboss styles: maps 0–1 inside, 2–3 outside).
diff --git a/crates/compose/src/effects/blur.rs b/crates/compose/src/effects/blur.rs
index 686870523d..edea7285d2 100644
--- a/crates/compose/src/effects/blur.rs
+++ b/crates/compose/src/effects/blur.rs
@@ -1,5 +1,5 @@
 use super::distance::{Metric, dist_outside_by};
-use super::*;
+use super::{MAX_REACH, Map};
 
 /// The soft falloff of an effect of `size` pixels: two box passes of width `size` (a tent),
 /// as Photoshop does. Fitted on psd-tools layer_effects.psd against the earlier Gaussian
diff --git a/crates/compose/src/effects/composite.rs b/crates/compose/src/effects/composite.rs
index cf6402f1ca..36dcc4a2ed 100644
--- a/crates/compose/src/effects/composite.rs
+++ b/crates/compose/src/effects/composite.rs
@@ -1,7 +1,10 @@
 use super::bevel::{BevelPaint, TextureCtx, bevel_geom, bevel_maps, satin_map};
 use super::distance::{INSIDE_EPS, Metric, dist_inside_by, dist_outside_by, local_coverage, stroke_outside_exact};
 use super::paint::{dissolves_in, glow_map, paint_color, paint_fx, paint_glow, paint_pattern, rgb, shadow_map};
-use super::*;
+use super::{
+    BlendMode, Buffer, Effect, FxMaps, FxPaint, GlobalLight, Layer, MAX_REACH, Map, PREPARED_PATTERN_BYTES, Pattern, Placement, PreparedPatterns, Rect,
+    StrokePosition, psblend,
+};
 
 /// Build every effect map for `layer` from its alpha `shape` over `rect`.
 pub fn build_maps(layer: &Layer, shape: Vec<f32>, rect: Rect, light: &GlobalLight, tex: &TextureCtx) -> FxMaps {
@@ -176,230 +179,355 @@ pub(crate) fn composite_with_effects_prepared(
     patterns: &PreparedPatterns<'_>,
     vstroke: Option<VectorStroke<'_>>,
 ) {
-    let big = content.rect;
-    let (w, h) = (big.width() as usize, big.height() as usize);
-    // The effect shape: the content's alpha (with a split-off vector stroke, `content` is the
-    // unmasked fill and the mask applies to fill ∪ stroke), joined with a filled shape's outline.
-    let kmask = |i: usize| vstroke.as_ref().and_then(|v| v.mask).and_then(|m| m.get(i)).copied().unwrap_or(1.0);
-    let union = |i: usize, a: f32| vstroke.as_ref().and_then(|v| v.stroke.px.get(i)).map_or(a, |s| kmask(i) * (a + s[3] * (1.0 - a)));
-    // Transparency Shapes Layer off: the shape is the whole layer (its masks, as the maps were
-    // built), and the content's own transparency acts like fill opacity within it.
-    let shapeless = !layer.advanced.transparency_shapes;
-    let shape = if shapeless {
-        maps.crop(&maps.shape, big, 0.0)
-    } else if maps.outline {
-        let o = maps.crop(&maps.shape, big, 0.0);
-        Map { w, h, v: o.v.iter().zip(&content.px).enumerate().map(|(i, (o, p))| o.max(union(i, p[3]))).collect() }
-    } else {
-        Map { w, h, v: content.px.iter().enumerate().map(|(i, p)| union(i, p[3])).collect() }
-    };
-    let relative = shapeless || maps.outline || vstroke.is_some();
-    let fx = |i: usize, k: usize| maps.crop(&maps.per[i][k], big, 0.0);
-    // Layer bounds (gradients aligned with the layer use the whole layer,
-    // independent of the render rect).
-    let sb = layer_bounds;
-    // Linked patterns tile from the effects reference point (else the layer's top-left).
-    let anchor = layer.effects.reference.unwrap_or((f64::from(sb.x0), f64::from(sb.y0)));
+    let pass = EffectPass::new(layer, maps, content.rect, layer_bounds, patterns, vstroke.as_ref());
+    let big = pass.big;
+    let shape = pass.effect_shape(content);
     let rect = backdrop.rect;
     let before = backdrop.clone();
     // Exterior effects are painted on a backdrop copy extended to `big`.
     let mut work = Buffer::transparent(big);
     for y in rect.y0.max(big.y0)..rect.y1.min(big.y1) {
         for x in rect.x0.max(big.x0)..rect.x1.min(big.x1) {
-            work.px[((y - big.y0) as usize) * w + (x - big.x0) as usize] = before.get(x, y);
-        }
-    }
-    let items: Vec<&Effect> = layer.effects.items.iter().filter(|e| e.enabled()).collect();
-    let vector_shape = matches!(layer.content, photocraft_doc::LayerContent::Shape(_));
-    // Multiple instances: the first listed is on top, so paint in reverse.
-    let rev = || items.iter().copied().enumerate().rev();
-
-    for (i, e) in rev() {
-        if let Effect::DropShadow(s) = e {
-            let mut m = fx(i, 0);
-            if s.knocks_out {
-                // The layer hides the shadow beneath it where its fill is see-through (at 100 %
-                // fill in a normal mode it covers it anyway; at 0 % the shape shows the bare
-                // backdrop), and wholly in a mode that blends with it ([`shadow_see_through`]).
-                knock_out_exterior(&mut m, &shape, 1.0 - shadow_see_through(layer));
-            }
-            paint_color(&mut work, &m, rgb(&s.color), s.common.blend, s.common.opacity);
-        }
-    }
-    for (i, e) in rev() {
-        if let Effect::OuterGlow(g) = e {
-            let mut m = fx(i, 0);
-            // The glow is behind the shape, not painted across its interior when Fill is 0 %.
-            // Preserve the existing anti-aliased edge when the fill is fully opaque.
-            knock_out_exterior(&mut m, &shape, layer.fill_opacity);
-            paint_glow(&mut work, &m, g, sb, anchor, big, patterns);
+            work.px[((y - big.y0) as usize) * pass.w + (x - big.x0) as usize] = before.get(x, y);
         }
     }
+    pass.paint_exterior(&mut work, &shape);
 
     // The layer: content at fill opacity, then interior effects. Interior effects are painted
     // relative to the layer's shape (alpha = coverage within the shape), then the shape's alpha
     // applies: a colour overlay at 100 % replaces the colour of a half-transparent edge pixel and
     // keeps its alpha, as in Photoshop.
-    let fill = layer.fill_opacity;
-    // Blend Interior Effects as Group: the interior effects (overlays, satin, inner glow) are
-    // combined with the content first, and fill opacity applies to the combination.
-    let interior_group = layer.advanced.blend_interior && fill < 1.0;
-    let content_fill = if interior_group { 1.0 } else { fill };
-    let inside = |a: f32| a > INSIDE_EPS;
-    // Within an outline (or a split-off vector stroke) the content's own transparency (a fading
-    // gradient fill) acts like fill opacity: the effects still cover the whole shape.
-    let lay_alpha = |i: usize, p: &[f32; 4], a: f32| {
-        if !inside(a) {
-            0.0
-        } else if relative {
-            content_fill * (kmask(i) * p[3] / a).min(1.0)
-        } else {
-            content_fill
-        }
-    };
-    let mut lay = Buffer { rect: big, px: content.px.iter().zip(&shape.v).enumerate().map(|(i, (p, a))| [p[0], p[1], p[2], lay_alpha(i, p, *a)]).collect() };
     let gamma = crate::text_gamma(layer);
     let premerge = premerges_layer(layer);
+    let mut lay = pass.layer_pixels(content, &shape);
     if premerge {
         for (lp, wp) in lay.px.iter_mut().zip(&work.px) {
             *lp = psblend::composite_gamma(layer.blend, *wp, *lp, 1.0, gamma);
         }
     }
-    let rel = |m: Map| -> Map {
-        let v = m.v.iter().zip(&shape.v).map(|(m, a)| if inside(*a) { (m / a).min(1.0) } else { 0.0 }).collect();
-        Map { w: m.w, h: m.h, v }
-    };
-    let full = Map { w, h, v: shape.v.iter().map(|a| if inside(*a) { 1.0 } else { 0.0 }).collect() };
-    for (_, e) in rev() {
-        if let Effect::PatternOverlay { common, name, id, scale, angle, link, phase } = e {
-            paint_pattern(&mut lay, &full, patterns, name, id, Placement::anchored(anchor, *link, *phase, *scale, *angle), big, common.blend, common.opacity);
-        }
-    }
-    for (_, e) in rev() {
-        if let Effect::GradientOverlay { common, gradient, .. } = e {
-            paint_fx(&mut lay, &full, &FxPaint::Gradient(gradient.clone()), sb, anchor, big, common.blend, common.opacity, patterns)
-        }
-    }
-    for (_, e) in rev() {
-        if let Effect::ColorOverlay { common, color } = e {
-            paint_color(&mut lay, &full, rgb(color), common.blend, common.opacity);
-        }
-    }
-    for (i, e) in rev() {
-        if let Effect::Satin(s) = e {
-            let m = rel(fx(i, 0));
-            paint_color(&mut lay, &m, rgb(&s.color), s.common.blend, s.common.opacity);
-        }
-    }
-    for (i, e) in rev() {
-        if let Effect::InnerGlow(g) = e {
-            paint_glow(&mut lay, &rel(fx(i, 0)), g, sb, anchor, big, patterns);
-        }
-    }
-    if interior_group {
-        for p in &mut lay.px {
-            p[3] *= fill.max(0.0);
-        }
-    }
-    for (i, e) in rev() {
-        if let Effect::InnerShadow(s) = e {
-            let m = rel(fx(i, 0));
-            paint_color(&mut lay, &m, rgb(&s.color), s.common.blend, s.common.opacity);
-        }
-    }
-    // A stroked shape's vector stroke: Photoshop draws it above the fill's clipped layers and
-    // interior effects, below the stroke effect (psd-tools stroke-composite).
-    if let Some(vs) = &vstroke {
-        for (i, ((p, s), a)) in lay.px.iter_mut().zip(&vs.stroke.px).zip(&shape.v).enumerate() {
-            if s[3] > 0.0 && inside(*a) {
-                *p = psblend::composite(BlendMode::Normal, *p, [s[0], s[1], s[2], fill * (kmask(i) * s[3] / a).min(1.0)], 1.0);
-            }
-        }
-    }
-    // Strokes. Inside parts are painted over the layer (bottom instance first); outside parts
-    // are slid beneath it, so the first listed (top) instance is processed first.
-    let strokes: Vec<&photocraft_doc::StrokeFx> = items.iter().filter_map(|e| if let Effect::Stroke(s) = e { Some(s) } else { None }).collect();
-    let ready = !strokes.is_empty();
-    let din = if ready { maps.din.as_ref().map(|a| maps.crop_vec(a, big, 0.0)).unwrap_or_default() } else { Vec::new() };
-    // A stroke's outer edge picks the chamfer or the exact field by its width
-    // ([`stroke_outside_exact`]); both are cropped here, and only the ones a stroke needs exist.
-    let crop_out = |v: &Option<Vec<f32>>| v.as_ref().map(|b| maps.crop_vec(b, big, FAR));
-    let (dout, dout_exact, vdout, vdout_exact) =
-        if ready { (crop_out(&maps.dout), crop_out(&maps.dout_exact), crop_out(&maps.vdout), crop_out(&maps.vdout_exact)) } else { (None, None, None, None) };
-    let widths = stroke_widths;
-    // A gradient stroke aligned with the layer spans the stroke's own extent.
-    let frame = |st: &photocraft_doc::StrokeFx| maps.stroke_frame(st).unwrap_or(sb);
-    for st in strokes.iter().rev().copied() {
-        let (in_w, _) = widths(st);
-        if in_w <= 0.0 {
-            continue;
-        }
-        let mut m = Map::new(w, h, 0.0);
-        for ((mv, a), dv) in m.v.iter_mut().zip(&shape.v).zip(&din) {
-            *mv = if inside(*a) { (in_w + 0.5 - dv).clamp(0.0, 1.0) } else { 0.0 };
-        }
-        paint_fx(&mut lay, &m, &st.paint, frame(st), anchor, big, st.common.blend, st.common.opacity, patterns);
-    }
-    for (i, e) in rev() {
-        if let Effect::BevelEmboss(b) = e
-            && maps.bevel_paint[i] == BevelPaint::Inner
-        {
-            let (hi, sh) = (rel(fx(i, 0)), rel(fx(i, 1)));
-            paint_color(&mut lay, &hi, rgb(&b.highlight_color), b.highlight.blend, b.highlight.opacity);
-            paint_color(&mut lay, &sh, rgb(&b.shadow_color), b.shadow.blend, b.shadow.opacity);
-        }
-    }
+    let strokes: Vec<&photocraft_doc::StrokeFx> = pass.items.iter().filter_map(|e| if let Effect::Stroke(s) = e { Some(s) } else { None }).collect();
+    let fields = pass.stroke_fields(!strokes.is_empty());
+    pass.paint_interior(&mut lay, &shape);
+    pass.paint_vector_stroke(&mut lay, &shape);
+    pass.paint_inside_strokes(&mut lay, &shape, &strokes, &fields);
+    pass.paint_bevel(&mut lay, BevelPaint::Inner, Some(&shape));
     // The shape's own alpha.
     for (p, a) in lay.px.iter_mut().zip(&shape.v) {
         p[3] *= a.min(1.0);
     }
-    // Shape layers without a filled outline stroke their vector outline, estimated from local
-    // coverage; every other layer strokes its shape. The width then picks the field.
-    let vector_outline = vector_shape && !maps.outline;
-    // Outside parts lie beneath the layer and blend onto the backdrop with their own mode. A
-    // higher stroke covers the ones below it (Photoshop: a Multiply stroke listed above a wider
-    // Normal stroke multiplies the backdrop, not the lower stroke). Each stroke's share is its
-    // coverage × opacity not yet taken by strokes above; for Normal strokes this equals stacking
-    // them top over bottom.
-    if strokes.iter().any(|st| widths(st).1 > 0.0) {
+    pass.paint_outside_strokes(&mut work, &lay, &shape, &strokes, &fields);
+    pass.paint_bevel(&mut work, BevelPaint::Outer, None);
+
+    // Layer (with interior effects) onto the exterior result, in the layer's mode.
+    let mode = if premerge || layer.blend == BlendMode::PassThrough { BlendMode::Normal } else { layer.blend };
+    for (wp, lp) in work.px.iter_mut().zip(&lay.px) {
+        if lp[3] > 0.0 {
+            *wp = psblend::composite_gamma(mode, *wp, *lp, 1.0, gamma);
+        }
+    }
+    // Emboss styles shade the composited layer (their maps cover inside and outside). Painting
+    // them into the layer before its (text-gamma) composite left a type layer's lit top edges up
+    // to 6/255 dark (psd-tools layer_effects Emboss: 7.8 → 5.7/255).
+    pass.paint_bevel(&mut work, BevelPaint::Both, None);
+    pass.write_back(backdrop, &before, &work);
+}
+
+/// `true` where the effect shape covers a pixel enough for interior effects to paint.
+fn inside(a: f32) -> bool {
+    a > INSIDE_EPS
+}
+
+/// An effect map as a fraction of the shape's own coverage.
+fn relative_to_shape(m: Map, shape: &Map) -> Map {
+    let v = m.v.iter().zip(&shape.v).map(|(m, a)| if inside(*a) { (m / a).min(1.0) } else { 0.0 }).collect();
+    Map { w: m.w, h: m.h, v }
+}
+
+/// A stroke's distance fields, cropped to the render region; only the ones a stroke needs exist.
+#[derive(Default)]
+struct StrokeFields {
+    /// Distance inside the shape.
+    din: Vec<f32>,
+    dout: Option<Vec<f32>>,
+    dout_exact: Option<Vec<f32>>,
+    vdout: Option<Vec<f32>>,
+    vdout_exact: Option<Vec<f32>>,
+}
+
+/// What compositing one layer's effects shares between its stages.
+struct EffectPass<'a> {
+    layer: &'a Layer,
+    maps: &'a FxMaps,
+    patterns: &'a PreparedPatterns<'a>,
+    vstroke: Option<&'a VectorStroke<'a>>,
+    /// The region effects are painted over: the content's rect.
+    big: Rect,
+    w: usize,
+    h: usize,
+    /// Layer bounds (gradients aligned with the layer use the whole layer, independent of the
+    /// render rect).
+    sb: Rect,
+    /// Linked patterns tile from the effects reference point (else the layer's top-left).
+    anchor: (f64, f64),
+    /// The enabled effects. Multiple instances: the first listed is on top, so paint in reverse.
+    items: Vec<&'a Effect>,
+}
+
+impl<'a> EffectPass<'a> {
+    fn new(
+        layer: &'a Layer,
+        maps: &'a FxMaps,
+        big: Rect,
+        layer_bounds: Rect,
+        patterns: &'a PreparedPatterns<'a>,
+        vstroke: Option<&'a VectorStroke<'a>>,
+    ) -> Self {
+        let sb = layer_bounds;
+        Self {
+            layer,
+            maps,
+            patterns,
+            vstroke,
+            big,
+            w: big.width() as usize,
+            h: big.height() as usize,
+            sb,
+            anchor: layer.effects.reference.unwrap_or((f64::from(sb.x0), f64::from(sb.y0))),
+            items: layer.effects.items.iter().filter(|e| e.enabled()).collect(),
+        }
+    }
+
+    /// The enabled effects with their indexes, last listed first.
+    fn rev(&self) -> impl Iterator<Item = (usize, &'a Effect)> + '_ {
+        self.items.iter().copied().enumerate().rev()
+    }
+
+    /// Effect `i`'s map `k`, cropped to the region.
+    fn fx(&self, i: usize, k: usize) -> Map {
+        self.maps.crop(&self.maps.per[i][k], self.big, 0.0)
+    }
+
+    /// The vector stroke's layer-mask value at pixel `i` (1 with no mask).
+    fn kmask(&self, i: usize) -> f32 {
+        self.vstroke.and_then(|v| v.mask).and_then(|m| m.get(i)).copied().unwrap_or(1.0)
+    }
+
+    /// Alpha `a` of pixel `i` joined with the vector stroke's.
+    fn union(&self, i: usize, a: f32) -> f32 {
+        self.vstroke.and_then(|v| v.stroke.px.get(i)).map_or(a, |s| self.kmask(i) * (a + s[3] * (1.0 - a)))
+    }
+
+    /// Within an outline (or a split-off vector stroke), or without Transparency Shapes Layer,
+    /// the content's own transparency acts like fill opacity: the effects still cover the whole
+    /// shape.
+    fn relative(&self) -> bool {
+        !self.layer.advanced.transparency_shapes || self.maps.outline || self.vstroke.is_some()
+    }
+
+    /// The effect shape: the content's alpha (with a split-off vector stroke, `content` is the
+    /// unmasked fill and the mask applies to fill ∪ stroke), joined with a filled shape's outline.
+    fn effect_shape(&self, content: &Buffer) -> Map {
+        let (w, h, big) = (self.w, self.h, self.big);
+        // Transparency Shapes Layer off: the shape is the whole layer (its masks, as the maps were
+        // built), and the content's own transparency acts like fill opacity within it.
+        if !self.layer.advanced.transparency_shapes {
+            self.maps.crop(&self.maps.shape, big, 0.0)
+        } else if self.maps.outline {
+            let o = self.maps.crop(&self.maps.shape, big, 0.0);
+            Map { w, h, v: o.v.iter().zip(&content.px).enumerate().map(|(i, (o, p))| o.max(self.union(i, p[3]))).collect() }
+        } else {
+            Map { w, h, v: content.px.iter().enumerate().map(|(i, p)| self.union(i, p[3])).collect() }
+        }
+    }
+
+    /// Paints the effects behind the layer: drop shadows, then outer glows.
+    fn paint_exterior(&self, work: &mut Buffer, shape: &Map) {
+        for (i, e) in self.rev() {
+            if let Effect::DropShadow(s) = e {
+                let mut m = self.fx(i, 0);
+                if s.knocks_out {
+                    // The layer hides the shadow beneath it where its fill is see-through (at 100 %
+                    // fill in a normal mode it covers it anyway; at 0 % the shape shows the bare
+                    // backdrop), and wholly in a mode that blends with it ([`shadow_see_through`]).
+                    knock_out_exterior(&mut m, shape, 1.0 - shadow_see_through(self.layer));
+                }
+                paint_color(work, &m, rgb(&s.color), s.common.blend, s.common.opacity);
+            }
+        }
+        for (i, e) in self.rev() {
+            if let Effect::OuterGlow(g) = e {
+                let mut m = self.fx(i, 0);
+                // The glow is behind the shape, not painted across its interior when Fill is 0 %.
+                // Preserve the existing anti-aliased edge when the fill is fully opaque.
+                knock_out_exterior(&mut m, shape, self.layer.fill_opacity);
+                paint_glow(work, &m, g, self.sb, self.anchor, self.big, self.patterns);
+            }
+        }
+    }
+
+    /// Blend Interior Effects as Group: the interior effects (overlays, satin, inner glow) are
+    /// combined with the content first, and fill opacity applies to the combination.
+    fn interior_group(&self) -> bool {
+        self.layer.advanced.blend_interior && self.layer.fill_opacity < 1.0
+    }
+
+    /// The layer's own pixels at fill opacity, with their alpha made relative to `shape`.
+    fn layer_pixels(&self, content: &Buffer, shape: &Map) -> Buffer {
+        let content_fill = if self.interior_group() { 1.0 } else { self.layer.fill_opacity };
+        let relative = self.relative();
+        let lay_alpha = |i: usize, p: &[f32; 4], a: f32| {
+            if !inside(a) {
+                0.0
+            } else if relative {
+                content_fill * (self.kmask(i) * p[3] / a).min(1.0)
+            } else {
+                content_fill
+            }
+        };
+        Buffer { rect: self.big, px: content.px.iter().zip(&shape.v).enumerate().map(|(i, (p, a))| [p[0], p[1], p[2], lay_alpha(i, p, *a)]).collect() }
+    }
+
+    /// Paints the interior effects other than strokes and bevels: overlays, satin, inner glow
+    /// and inner shadow.
+    fn paint_interior(&self, lay: &mut Buffer, shape: &Map) {
+        let (w, h, big, sb, anchor, patterns) = (self.w, self.h, self.big, self.sb, self.anchor, self.patterns);
+        let full = Map { w, h, v: shape.v.iter().map(|a| if inside(*a) { 1.0 } else { 0.0 }).collect() };
+        for (_, e) in self.rev() {
+            if let Effect::PatternOverlay { common, name, id, scale, angle, link, phase } = e {
+                paint_pattern(lay, &full, patterns, name, id, Placement::anchored(anchor, *link, *phase, *scale, *angle), big, common.blend, common.opacity);
+            }
+        }
+        for (_, e) in self.rev() {
+            if let Effect::GradientOverlay { common, gradient, .. } = e {
+                paint_fx(lay, &full, &FxPaint::Gradient(gradient.clone()), sb, anchor, big, common.blend, common.opacity, patterns)
+            }
+        }
+        for (_, e) in self.rev() {
+            if let Effect::ColorOverlay { common, color } = e {
+                paint_color(lay, &full, rgb(color), common.blend, common.opacity);
+            }
+        }
+        for (i, e) in self.rev() {
+            if let Effect::Satin(s) = e {
+                let m = relative_to_shape(self.fx(i, 0), shape);
+                paint_color(lay, &m, rgb(&s.color), s.common.blend, s.common.opacity);
+            }
+        }
+        for (i, e) in self.rev() {
+            if let Effect::InnerGlow(g) = e {
+                paint_glow(lay, &relative_to_shape(self.fx(i, 0), shape), g, sb, anchor, big, patterns);
+            }
+        }
+        if self.interior_group() {
+            for p in &mut lay.px {
+                p[3] *= self.layer.fill_opacity.max(0.0);
+            }
+        }
+        for (i, e) in self.rev() {
+            if let Effect::InnerShadow(s) = e {
+                let m = relative_to_shape(self.fx(i, 0), shape);
+                paint_color(lay, &m, rgb(&s.color), s.common.blend, s.common.opacity);
+            }
+        }
+    }
+
+    /// A stroked shape's vector stroke: Photoshop draws it above the fill's clipped layers and
+    /// interior effects, below the stroke effect (psd-tools stroke-composite).
+    fn paint_vector_stroke(&self, lay: &mut Buffer, shape: &Map) {
+        let Some(vs) = self.vstroke else {
+            return;
+        };
+        let fill = self.layer.fill_opacity;
+        for (i, ((p, s), a)) in lay.px.iter_mut().zip(&vs.stroke.px).zip(&shape.v).enumerate() {
+            if s[3] > 0.0 && inside(*a) {
+                *p = psblend::composite(BlendMode::Normal, *p, [s[0], s[1], s[2], fill * (self.kmask(i) * s[3] / a).min(1.0)], 1.0);
+            }
+        }
+    }
+
+    /// The distance fields the strokes need, cropped to the region; empty unless `ready` (the
+    /// layer has a stroke).
+    ///
+    /// A stroke's outer edge picks the chamfer or the exact field by its width
+    /// ([`stroke_outside_exact`]); both are cropped here, and only the ones a stroke needs exist.
+    fn stroke_fields(&self, ready: bool) -> StrokeFields {
+        if !ready {
+            return StrokeFields::default();
+        }
+        let (maps, big) = (self.maps, self.big);
+        let crop_out = |v: &Option<Vec<f32>>| v.as_ref().map(|b| maps.crop_vec(b, big, FAR));
+        StrokeFields {
+            din: maps.din.as_ref().map(|a| maps.crop_vec(a, big, 0.0)).unwrap_or_default(),
+            dout: crop_out(&maps.dout),
+            dout_exact: crop_out(&maps.dout_exact),
+            vdout: crop_out(&maps.vdout),
+            vdout_exact: crop_out(&maps.vdout_exact),
+        }
+    }
+
+    /// A gradient stroke aligned with the layer spans the stroke's own extent.
+    fn stroke_frame(&self, st: &photocraft_doc::StrokeFx) -> Rect {
+        self.maps.stroke_frame(st).unwrap_or(self.sb)
+    }
+
+    /// Strokes. Inside parts are painted over the layer (bottom instance first); outside parts
+    /// are slid beneath it, so the first listed (top) instance is processed first.
+    fn paint_inside_strokes(&self, lay: &mut Buffer, shape: &Map, strokes: &[&photocraft_doc::StrokeFx], fields: &StrokeFields) {
+        for st in strokes.iter().rev().copied() {
+            let (in_w, _) = stroke_widths(st);
+            if in_w <= 0.0 {
+                continue;
+            }
+            let mut m = Map::new(self.w, self.h, 0.0);
+            for ((mv, a), dv) in m.v.iter_mut().zip(&shape.v).zip(&fields.din) {
+                *mv = if inside(*a) { (in_w + 0.5 - dv).clamp(0.0, 1.0) } else { 0.0 };
+            }
+            paint_fx(lay, &m, &st.paint, self.stroke_frame(st), self.anchor, self.big, st.common.blend, st.common.opacity, self.patterns);
+        }
+    }
+
+    /// Bevel and emboss effects whose paint is `kind`. Inner ones paint into the layer relative
+    /// to its `shape`; the others paint the maps as they are.
+    fn paint_bevel(&self, target: &mut Buffer, kind: BevelPaint, shape: Option<&Map>) {
+        for (i, e) in self.rev() {
+            if let Effect::BevelEmboss(b) = e
+                && self.maps.bevel_paint[i] == kind
+            {
+                let map = |k: usize| match shape {
+                    Some(shape) => relative_to_shape(self.fx(i, k), shape),
+                    None => self.fx(i, k),
+                };
+                paint_color(target, &map(0), rgb(&b.highlight_color), b.highlight.blend, b.highlight.opacity);
+                paint_color(target, &map(1), rgb(&b.shadow_color), b.shadow.blend, b.shadow.opacity);
+            }
+        }
+    }
+
+    /// The outside parts of the strokes, blended onto the backdrop beneath the layer with their
+    /// own mode. A higher stroke covers the ones below it (Photoshop: a Multiply stroke listed
+    /// above a wider Normal stroke multiplies the backdrop, not the lower stroke). Each stroke's
+    /// share is its coverage × opacity not yet taken by strokes above; for Normal strokes this
+    /// equals stacking them top over bottom.
+    fn paint_outside_strokes(&self, work: &mut Buffer, lay: &Buffer, shape: &Map, strokes: &[&photocraft_doc::StrokeFx], fields: &StrokeFields) {
+        if !strokes.iter().any(|st| stroke_widths(st).1 > 0.0) {
+            return;
+        }
+        let (w, h) = (self.w, self.h);
         let base = work.clone();
         let mut acc = vec![[0.0f32; 4]; w * h]; // premultiplied Σ share·blended
         let mut cover = vec![0.0f32; w * h];
         for st in strokes.iter().copied() {
-            let (_, out_w) = widths(st);
+            let (_, out_w) = stroke_widths(st);
             if out_w <= 0.0 {
                 continue;
             }
-            // Shape layers: Photoshop strokes the vector outline (estimated from local coverage
-            // for unfilled shapes); the stroke never shows through the shape's pixels. Along a
-            // filled shape's outline it covers the part of each edge pixel outside the path.
-            let exact = stroke_outside_exact(out_w);
-            let d: &[f32] = if vector_outline {
-                (if exact { vdout_exact.as_deref() } else { vdout.as_deref() }).unwrap_or_default()
-            } else if exact {
-                dout_exact.as_deref().unwrap_or_default()
-            } else {
-                dout.as_deref().unwrap_or_default()
-            };
-            let mut share = vec![0.0f32; w * h];
-            for (i, sh) in share.iter_mut().enumerate() {
-                let band = (out_w + 0.5 - d[i]).clamp(0.0, 1.0);
-                let k =
-                    if inside(shape.v[i]) { if vector_shape && !maps.outline { 0.0 } else { band * outline_share(shape.v[i], lay.px[i][3]) } } else { band };
-                let mut k = k * st.common.opacity;
-                if st.common.blend == BlendMode::Dissolve {
-                    let (x, y) = (i64::from(big.x0) + (i % w) as i64, i64::from(big.y0) + (i / w) as i64);
-                    k = if k > 0.0 && dissolves_in(x, y, k) { 1.0 } else { 0.0 };
-                }
-                *sh = k * (1.0 - cover[i]);
-                cover[i] += *sh;
-            }
+            let share = self.outside_share(st, out_w, shape, lay, fields, &mut cover);
             // The stroke blended over the backdrop at full coverage.
             let mut blended = base.clone();
             let ones = Map { w, h, v: share.iter().map(|&s| if s > 0.0 { 1.0 } else { 0.0 }).collect() };
             // The share already carries the Dissolve choice, so the paint itself composites as Normal.
             let paint_blend = if st.common.blend == BlendMode::Dissolve { BlendMode::Normal } else { st.common.blend };
-            paint_fx(&mut blended, &ones, &st.paint, frame(st), anchor, big, paint_blend, 1.0, patterns);
+            paint_fx(&mut blended, &ones, &st.paint, self.stroke_frame(st), self.anchor, self.big, paint_blend, 1.0, self.patterns);
             for ((a, b), s) in acc.iter_mut().zip(&blended.px).zip(&share) {
                 if *s > 0.0 {
                     for c in 0..3 {
@@ -420,48 +548,59 @@ pub(crate) fn composite_with_effects_prepared(
             }
         }
     }
-    for (i, e) in rev() {
-        if let Effect::BevelEmboss(b) = e
-            && maps.bevel_paint[i] == BevelPaint::Outer
-        {
-            let (hi, sh) = (fx(i, 0), fx(i, 1));
-            paint_color(&mut work, &hi, rgb(&b.highlight_color), b.highlight.blend, b.highlight.opacity);
-            paint_color(&mut work, &sh, rgb(&b.shadow_color), b.shadow.blend, b.shadow.opacity);
+
+    /// The share of each pixel an outside stroke `st` (outside width `out_w`) takes: its coverage
+    /// × opacity not yet taken by the strokes above, which `cover` accumulates.
+    fn outside_share(&self, st: &photocraft_doc::StrokeFx, out_w: f32, shape: &Map, lay: &Buffer, fields: &StrokeFields, cover: &mut [f32]) -> Vec<f32> {
+        let (w, big) = (self.w, self.big);
+        // Shape layers without a filled outline stroke their vector outline, estimated from local
+        // coverage; every other layer strokes its shape. The width then picks the field.
+        let vector_shape = matches!(self.layer.content, photocraft_doc::LayerContent::Shape(_));
+        let vector_outline = vector_shape && !self.maps.outline;
+        // Shape layers: Photoshop strokes the vector outline (estimated from local coverage
+        // for unfilled shapes); the stroke never shows through the shape's pixels. Along a
+        // filled shape's outline it covers the part of each edge pixel outside the path.
+        let exact = stroke_outside_exact(out_w);
+        let d: &[f32] = match (vector_outline, exact) {
+            (true, true) => fields.vdout_exact.as_deref(),
+            (true, false) => fields.vdout.as_deref(),
+            (false, true) => fields.dout_exact.as_deref(),
+            (false, false) => fields.dout.as_deref(),
         }
+        .unwrap_or_default();
+        let mut share = vec![0.0f32; w * self.h];
+        for (i, sh) in share.iter_mut().enumerate() {
+            let band = (out_w + 0.5 - d[i]).clamp(0.0, 1.0);
+            let k = if inside(shape.v[i]) { if vector_outline { 0.0 } else { band * outline_share(shape.v[i], lay.px[i][3]) } } else { band };
+            let mut k = k * st.common.opacity;
+            if st.common.blend == BlendMode::Dissolve {
+                let (x, y) = (i64::from(big.x0) + (i % w) as i64, i64::from(big.y0) + (i / w) as i64);
+                k = if k > 0.0 && dissolves_in(x, y, k) { 1.0 } else { 0.0 };
+            }
+            *sh = k * (1.0 - cover[i]);
+            cover[i] += *sh;
+        }
+        share
     }
 
-    // Layer (with interior effects) onto the exterior result, in the layer's mode.
-    let mode = if premerge || layer.blend == BlendMode::PassThrough { BlendMode::Normal } else { layer.blend };
-    for (wp, lp) in work.px.iter_mut().zip(&lay.px) {
-        if lp[3] > 0.0 {
-            *wp = psblend::composite_gamma(mode, *wp, *lp, 1.0, gamma);
-        }
-    }
-    // Emboss styles shade the composited layer (their maps cover inside and outside). Painting
-    // them into the layer before its (text-gamma) composite left a type layer's lit top edges up
-    // to 6/255 dark (psd-tools layer_effects Emboss: 7.8 → 5.7/255).
-    for (i, e) in rev() {
-        if let Effect::BevelEmboss(b) = e
-            && maps.bevel_paint[i] == BevelPaint::Both
-        {
-            paint_color(&mut work, &fx(i, 0), rgb(&b.highlight_color), b.highlight.blend, b.highlight.opacity);
-            paint_color(&mut work, &fx(i, 1), rgb(&b.shadow_color), b.shadow.blend, b.shadow.opacity);
-        }
-    }
-    // Layer opacity applies to the whole stack.
-    let op = layer.opacity;
-    for y in rect.y0..rect.y1 {
-        for x in rect.x0..rect.x1 {
-            let i = ((y - rect.y0) as usize) * rect.width() as usize + (x - rect.x0) as usize;
-            let a = before.px[i];
-            let b = if x >= big.x0 && x < big.x1 && y >= big.y0 && y < big.y1 { work.px[((y - big.y0) as usize) * w + (x - big.x0) as usize] } else { a };
-            backdrop.px[i] = if layer.blend == BlendMode::Dissolve {
-                // Dissolve applies layer opacity to the completed interior/exterior effect
-                // stack as pixel coverage, not continuous gray interpolation (#3051).
-                if crate::dissolve_noise(x, y) < op { b } else { a }
-            } else {
-                mix_premul(a, b, op)
-            };
+    /// Writes the finished stack `work` into `backdrop` (over `before`) at layer opacity.
+    fn write_back(&self, backdrop: &mut Buffer, before: &Buffer, work: &Buffer) {
+        let (big, w) = (self.big, self.w);
+        let rect = backdrop.rect;
+        let op = self.layer.opacity;
+        for y in rect.y0..rect.y1 {
+            for x in rect.x0..rect.x1 {
+                let i = ((y - rect.y0) as usize) * rect.width() as usize + (x - rect.x0) as usize;
+                let a = before.px[i];
+                let b = if x >= big.x0 && x < big.x1 && y >= big.y0 && y < big.y1 { work.px[((y - big.y0) as usize) * w + (x - big.x0) as usize] } else { a };
+                backdrop.px[i] = if self.layer.blend == BlendMode::Dissolve {
+                    // Dissolve applies layer opacity to the completed interior/exterior effect
+                    // stack as pixel coverage, not continuous gray interpolation (#3051).
+                    if crate::dissolve_noise(x, y) < op { b } else { a }
+                } else {
+                    mix_premul(a, b, op)
+                };
+            }
         }
     }
 }
diff --git a/crates/compose/src/effects/distance.rs b/crates/compose/src/effects/distance.rs
index 8581e1c821..ed92d9f973 100644
--- a/crates/compose/src/effects/distance.rs
+++ b/crates/compose/src/effects/distance.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::Map;
 
 /// 1D squared distance transform (Felzenszwalb & Huttenlocher).
 fn dt1(f: &[f32], out: &mut [f32], v: &mut [usize], z: &mut [f32], near: &mut [usize]) {
diff --git a/crates/compose/src/effects/paint.rs b/crates/compose/src/effects/paint.rs
index a24e819752..99b0c6aa0b 100644
--- a/crates/compose/src/effects/paint.rs
+++ b/crates/compose/src/effects/paint.rs
@@ -1,6 +1,9 @@
 use super::blur::{blur, dilate};
 use super::distance::{dist_inside, dist_outside};
-use super::*;
+use super::{
+    BlendMode, Buffer, Contour, Effect, FxPaint, GlobalLight, Glow, GlowSource, GlowTechnique, Gradient, GradientStyle, Map, Placement, PreparedPatterns, Rect,
+    Shadow, psblend,
+};
 
 pub(super) fn contour_lut(c: &Contour) -> Option<Vec<f32>> {
     match c {
diff --git a/crates/compose/src/extents.rs b/crates/compose/src/extents.rs
index 77b99bed85..d895f14bc9 100644
--- a/crates/compose/src/extents.rs
+++ b/crates/compose/src/extents.rs
@@ -1,6 +1,6 @@
 use super::content::{render_content, surface_to_buffer};
 use super::ctx::Ctx;
-use super::*;
+use super::{BlendMode, Document, Layer, LayerContent, Rect, advanced, bounds, effects, masks, shape_split};
 
 /// Bounds of a layer's own pixels (union over group children; the canvas
 /// for fill layers; an artboard's board).
@@ -11,7 +11,7 @@ pub fn layer_bounds(layer: &Layer, canvas: Rect) -> Rect {
     }
     match &layer.content {
         LayerContent::Group(g) if g.artboard.is_some() => g.artboard.as_ref().map_or(Rect::EMPTY, |a| a.rect),
-        LayerContent::Group(g) => g.children.iter().filter(|c| c.visible).fold(Rect::EMPTY, |acc, c| {
+        LayerContent::Group(g) => g.children.iter().filter(|c| c.visible).fold(frame_stroke_bounds(layer, canvas), |acc, c| {
             let b = layer_bounds(c, canvas);
             if b.is_empty() {
                 acc
@@ -47,23 +47,36 @@ pub fn layer_bounds(layer: &Layer, canvas: Rect) -> Rect {
     }
 }
 
+/// Where a Photoshop Frame's stroke ([`shape_split::frame_shape`]) draws, within `canvas`; empty
+/// for other layers. Taken from the compiled stroke the renderer draws, not the path grown by the
+/// stroke width: a mitered corner reaches up to `miter_limit` widths past the path, and a frame
+/// has no pixels of its own that would cover it.
+fn frame_stroke_bounds(layer: &Layer, canvas: Rect) -> Rect {
+    shape_split::frame_shape(layer)
+        .and_then(|sh| photocraft_vector::CompiledShape::new(&sh, photocraft_vector::DEFAULT_TOLERANCE, canvas).bounds())
+        .map_or(Rect::EMPTY, |r| r.intersect(&canvas))
+}
+
 /// Where a layer's effects take their shape from: [`layer_bounds`], except that a group's
 /// children count with their own effects (a child's outside stroke shapes the group's drop
 /// shadow and must not be cut off at the child's pixels, #3274).
 pub fn effect_source_bounds(layer: &Layer, canvas: Rect) -> Rect {
     match &layer.content {
-        LayerContent::Group(g) if g.artboard.is_none() && !advanced::shapeless(layer) => g.children.iter().filter(|c| c.visible).fold(Rect::EMPTY, |acc, c| {
-            let m = if effects::has_effects(c) { effects::margin(c) } else { 0 };
-            let b = effect_source_bounds(c, canvas);
-            let b = if b.is_empty() { b } else { b.inflate(m) };
-            if b.is_empty() {
-                acc
-            } else if acc.is_empty() {
-                b
-            } else {
-                acc.union(&b)
-            }
-        }),
+        // A Frame's stroke is part of the group's content its effects are built from.
+        LayerContent::Group(g) if g.artboard.is_none() && !advanced::shapeless(layer) => {
+            g.children.iter().filter(|c| c.visible).fold(frame_stroke_bounds(layer, canvas), |acc, c| {
+                let m = if effects::has_effects(c) { effects::margin(c) } else { 0 };
+                let b = effect_source_bounds(c, canvas);
+                let b = if b.is_empty() { b } else { b.inflate(m) };
+                if b.is_empty() {
+                    acc
+                } else if acc.is_empty() {
+                    b
+                } else {
+                    acc.union(&b)
+                }
+            })
+        }
         _ => layer_bounds(layer, canvas),
     }
 }
@@ -343,7 +356,7 @@ pub fn composite_bounds(layer: &Layer, canvas: Rect) -> Option<Rect> {
     }
     let own = match &layer.content {
         LayerContent::Group(g) if g.artboard.is_none() => {
-            let mut acc = Rect::EMPTY;
+            let mut acc = frame_stroke_bounds(layer, canvas);
             for c in g.children.iter().filter(|c| c.visible) {
                 let b = composite_bounds(c, canvas)?;
                 if !b.is_empty() {
diff --git a/crates/compose/src/fx_cache.rs b/crates/compose/src/fx_cache.rs
index cd08eaff7c..43e524d37f 100644
--- a/crates/compose/src/fx_cache.rs
+++ b/crates/compose/src/fx_cache.rs
@@ -1,7 +1,7 @@
 use super::composite::texture_ctx;
 use super::ctx::{Ctx, PREPARE_DEPTH};
 use super::extents::{effect_shape, effect_source_bounds};
-use super::*;
+use super::{Layer, LayerContent, Rect, Surface, advanced, effects};
 
 // ---------------------------------------------------------------------------------------------
 // Layer-effect map cache
@@ -44,7 +44,7 @@ pub(crate) fn layer_identity(layer: &Layer, h: &mut std::collections::hash_map::
                 format!("{:?}", c.blend).hash(h);
                 layer_identity(c, h, pin);
             }
-            format!("{:?}", g.artboard).hash(h);
+            format!("{:?}{:?}", g.artboard, g.frame_stroke).hash(h);
         }
         LayerContent::Fill(f) => {
             format!("{f:?}").hash(h);
diff --git a/crates/compose/src/reduced.rs b/crates/compose/src/reduced.rs
index 479bf1655f..1249df6437 100644
--- a/crates/compose/src/reduced.rs
+++ b/crates/compose/src/reduced.rs
@@ -1,7 +1,7 @@
 use super::content::RENDER_TILE;
 use super::ctx::Ctx;
 use super::render::{band_rows_for, render, render_bands, render_tiled_with};
-use super::*;
+use super::{Buffer, Document, Rect, Rgba8Image, pattern, proxy, uniform};
 
 /// Documents above this many pixels get thumbnails from a proxy (see [`proxy`]) when that is
 /// faithful; smaller ones are reduced from the exact composite.
diff --git a/crates/compose/src/render.rs b/crates/compose/src/render.rs
index 33b17d25b8..b739d3f42a 100644
--- a/crates/compose/src/render.rs
+++ b/crates/compose/src/render.rs
@@ -1,7 +1,7 @@
 use super::composite::composite_stack_at;
 use super::content::RENDER_TILE;
 use super::ctx::{Ctx, RenderVectorMasks, prepare_effects, prepare_tones};
-use super::*;
+use super::{Buffer, Document, Layer, Rect, Surface, adjust, advanced, cmyk, multichannel, native, native_lab, pattern, psblend};
 
 /// Every layer the compositor draws, groups before their children: hidden layers and everything
 /// inside hidden groups are left out.
diff --git a/crates/compose/src/shape_split.rs b/crates/compose/src/shape_split.rs
index b2fd28116e..c6e76fb0b2 100644
--- a/crates/compose/src/shape_split.rs
+++ b/crates/compose/src/shape_split.rs
@@ -8,6 +8,7 @@ use std::sync::{Mutex, OnceLock};
 
 use photocraft_color::{PixelFormat, SampleType};
 use photocraft_doc::vector::ShapeLayer;
+use photocraft_doc::{Layer, LayerContent};
 use photocraft_geom::{Rect, TileCoord};
 use photocraft_raster::Surface;
 
@@ -97,6 +98,22 @@ pub fn split(sh: &ShapeLayer, canvas: Rect, depth: SampleType) -> Option<(Surfac
     Some(parts)
 }
 
+/// The stroke-only shape a Photoshop Frame's stroke draws: `Group::frame_stroke` along the
+/// group's enabled vector mask (the frame outline). `None` for other layers and for a frame
+/// without a visible stroke or a vector mask.
+pub fn frame_shape(layer: &Layer) -> Option<ShapeLayer> {
+    let LayerContent::Group(g) = &layer.content else { return None };
+    let stroke = g.frame_stroke.as_ref().filter(|s| s.width.is_finite() && s.width > 0.0 && s.opacity > 0.0)?;
+    let vm = layer.vector_mask.as_ref().filter(|m| m.enabled && !m.path.is_empty())?;
+    Some(ShapeLayer { path: vm.path.clone(), fill: None, stroke: Some(stroke.clone()), ..ShapeLayer::default() })
+}
+
+/// A Photoshop Frame's stroke ([`frame_shape`]) rendered over `canvas` in RGBA at `depth`, from
+/// the same cache as the shape strokes. It goes above the frame's (masked) content.
+pub fn frame_stroke(layer: &Layer, canvas: Rect, depth: SampleType) -> Option<Surface> {
+    split(&frame_shape(layer)?, canvas, depth).map(|(_, stroke)| stroke)
+}
+
 /// Fits the stroke part to the shape's own pixels: where they reach past the fill, the stroke
 /// covers what the fill doesn't (`(pixels - fill) / (1 - fill)`), in the pixels' colour where we
 /// drew no stroke, and elsewhere in the colour that, drawn over the fill, gives back the pixels'
diff --git a/crates/compose/src/tests.rs b/crates/compose/src/tests.rs
index 76ba8dc72b..7f939c84a5 100644
--- a/crates/compose/src/tests.rs
+++ b/crates/compose/src/tests.rs
@@ -1358,6 +1358,46 @@ fn group_effects_reach_past_children_effects() {
     assert!(close4(px(&d, 24, 43), [1.0; 4]), "nothing past the shadow: {:?}", px(&d, 24, 43));
 }
 
+/// An empty Photoshop Frame with an outside stroke along `points` (#4381).
+fn stroked_frame(points: &[(f64, f64)], width: f32) -> Layer {
+    use photocraft_doc::vector::{Path, ShapeStroke, StrokeAlign, Subpath, VectorMask};
+    let mut l = Layer::group("Frame 1", vec![]);
+    l.vector_mask = Some(VectorMask::new(Path::new(vec![Subpath::polygon(points)])));
+    if let LayerContent::Group(g) = &mut l.content {
+        g.frame_stroke = Some(ShapeStroke { width, align: StrokeAlign::Outside, paint: Fill::Solid(Color::rgb(0.0, 0.0, 1.0)), ..Default::default() });
+    }
+    l
+}
+
+#[test]
+fn frame_stroke_bounds_hold_its_mitered_corners() {
+    // A flat triangle's sharp corners miter far past the path (Photoshop's miter limit is 100):
+    // more than the stroke width, which is all the path's bounds grow by.
+    let canvas = Rect::new(0, 0, 64, 64);
+    let frame = stroked_frame(&[(20.0, 32.0), (44.0, 32.0), (32.0, 29.0)], 2.0);
+    let drawn = crate::bounds::content_bounds(&shape_split::frame_stroke(&frame, canvas, SampleType::U8).unwrap());
+    assert!(drawn.x0 < 20 - 2 && drawn.x1 > 44 + 2, "the miters reach past the width: {drawn:?}");
+    for b in [layer_bounds(&frame, canvas), composite_bounds(&frame, canvas).unwrap(), effect_source_bounds(&frame, canvas)] {
+        assert_eq!(b.union(&drawn), b, "{b:?} holds the stroke {drawn:?}");
+    }
+}
+
+#[test]
+fn an_empty_frames_effects_follow_its_stroke() {
+    // No children: the frame's drop shadow is shaped by its stroke alone.
+    let mut d = doc_white(48, 48);
+    let mut frame = stroked_frame(&[(14.0, 14.0), (34.0, 14.0), (34.0, 34.0), (14.0, 34.0)], 4.0);
+    frame.effects.items = vec![Effect::DropShadow(shadow(3.0, 90.0))];
+    d.layers.push(frame);
+    let canvas = d.bounds();
+    let drawn = crate::bounds::content_bounds(&shape_split::frame_stroke(&d.layers[1], canvas, SampleType::U8).unwrap());
+    let b = effect_source_bounds(&d.layers[1], canvas);
+    assert!(!drawn.is_empty() && b.union(&drawn) == b, "{b:?} holds the stroke {drawn:?}");
+    assert!(close4(px(&d, 24, 36), [0.0, 0.0, 1.0, 1.0]), "stroke below the frame: {:?}", px(&d, 24, 36));
+    assert!(close4(px(&d, 24, 39), [0.0, 0.0, 0.0, 1.0]), "shadow below the stroke: {:?}", px(&d, 24, 39));
+    assert!(close4(px(&d, 24, 24), [1.0; 4]), "the frame's inside is empty: {:?}", px(&d, 24, 24));
+}
+
 #[test]
 fn drop_shadow_uses_global_light_and_knockout() {
     let mut d = fx_doc(vec![Effect::DropShadow(Shadow { use_global_light: true, ..shadow(5.0, 0.0) })]);
@@ -3291,23 +3331,28 @@ fn effect_maps_with_nested_rayon_work_do_not_deadlock() {
     // #276: a tile building a layer's effect maps inside a once-init ran Rayon work; waiting on
     // it, its worker stole another tile of the same layer, which then blocked on the init held
     // further up its own stack. Eight threads (two rarely steal across that wait) and 64 tiles make that stealing likely; the cache is
-    // purged every round so the maps are rebuilt. A watchdog turns a hang into a failure.
+    // purged every round so the maps are rebuilt. A watchdog turns a hang into a failure: it
+    // fails when 120 s pass without a render finishing, however long all 101 renders take.
+    const ROUNDS: usize = 100;
     let (tx, rx) = std::sync::mpsc::channel();
     std::thread::spawn(move || {
         let Ok(pool) = rayon::ThreadPoolBuilder::new().num_threads(8).build() else { return };
         let d = nested_parallel_fx_doc();
         let first = pool.install(|| render_tiled(&d, d.bounds(), 64));
-        for _ in 0..100 {
+        let _ = tx.send(());
+        for _ in 0..ROUNDS {
             purge_effect_cache();
             let out = pool.install(|| render_tiled(&d, d.bounds(), 64));
             assert!(out.px == first.px, "renders differ between rounds");
+            let _ = tx.send(());
         }
-        let _ = tx.send(());
     });
-    match rx.recv_timeout(std::time::Duration::from_secs(120)) {
-        Ok(()) => {}
-        Err(std::sync::mpsc::RecvTimeoutError::Timeout) => panic!("effect-map rendering deadlocked (#276)"),
-        Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => panic!("render thread panicked"),
+    for _ in 0..=ROUNDS {
+        match rx.recv_timeout(std::time::Duration::from_secs(120)) {
+            Ok(()) => {}
+            Err(std::sync::mpsc::RecvTimeoutError::Timeout) => panic!("effect-map rendering deadlocked (#276)"),
+            Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => panic!("render thread panicked"),
+        }
     }
 }
 
diff --git a/crates/doc/src/adjust.rs b/crates/doc/src/adjust.rs
index e197236a4a..056235ed42 100644
--- a/crates/doc/src/adjust.rs
+++ b/crates/doc/src/adjust.rs
@@ -17,6 +17,24 @@ pub fn is_identity_curve(points: &[CurvePoint]) -> bool {
     }
 }
 
+/// A 3D LUT file format (Photoshop's `LUTFormat`).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub enum LutFormat {
+    #[serde(rename = "cube")]
+    Cube,
+    #[serde(rename = "3dl")]
+    ThreeDl,
+    #[serde(rename = "look")]
+    Look,
+}
+
+/// A Color Lookup's LUT file as loaded: its format and bytes.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct LutSource {
+    pub format: LutFormat,
+    pub bytes: Arc<Vec<u8>>,
+}
+
 /// Entries in a pencil-drawn Curves map (one per 8-bit level, as in PSD `curv` maps).
 pub const CURVE_MAP_LEN: usize = 256;
 
@@ -260,6 +278,11 @@ pub enum Adjustment {
         /// Ordered dither of ±½ an 8-bit step to hide banding (Photoshop's "Dither").
         #[serde(default)]
         dither: bool,
+        /// The LUT file `lut` was read from, embedded unchanged on PSD save as Photoshop does.
+        /// None for a table made in PhotoCraft (a built-in look); a save also ignores it when
+        /// it no longer parses to `lut`.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        source: Option<LutSource>,
     },
     Invert,
     Posterize {
diff --git a/crates/doc/src/lib.rs b/crates/doc/src/lib.rs
index 6ec9bc67e3..33589e731e 100644
--- a/crates/doc/src/lib.rs
+++ b/crates/doc/src/lib.rs
@@ -318,6 +318,10 @@ pub struct Group {
     pub expanded: bool,
     /// Set when this (top-level) group is an artboard: children are clipped to its rect.
     pub artboard: Option<Artboard>,
+    /// A Photoshop Frame's stroke (Properties › Stroke; PSD `vstk` on the frame group): drawn
+    /// along the group's enabled vector mask (the frame outline), above the framed content and
+    /// not clipped by the frame. Ignored without a vector mask.
+    pub frame_stroke: Option<ShapeStroke>,
 }
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -703,7 +707,7 @@ impl Layer {
         Self::new(name, LayerContent::Raster(Surface::new(format)))
     }
     pub fn group(name: impl Into<String>, children: Vec<Layer>) -> Self {
-        let mut l = Self::new(name, LayerContent::Group(Group { children, expanded: true, artboard: None }));
+        let mut l = Self::new(name, LayerContent::Group(Group { children, expanded: true, artboard: None, frame_stroke: None }));
         l.blend = BlendMode::PassThrough;
         l
     }
@@ -1509,7 +1513,7 @@ mod tests {
         assert_eq!(LayerContent::Adjustment(Adjustment::Invert).article(), "an");
         assert_eq!(LayerContent::Adjustment(Adjustment::Invert).kind_name(), "Adjustment");
         assert_eq!(LayerContent::Raster(Surface::new(PixelFormat::RGBA8)).article(), "a");
-        assert_eq!(LayerContent::Group(Group { children: Vec::new(), expanded: true, artboard: None }).article(), "a");
+        assert_eq!(LayerContent::Group(Group { children: Vec::new(), expanded: true, artboard: None, frame_stroke: None }).article(), "a");
     }
 }
 
diff --git a/crates/engine/src/adjust_params/tests.rs b/crates/engine/src/adjust_params/tests.rs
index a7b6cc53de..47a06738f8 100644
--- a/crates/engine/src/adjust_params/tests.rs
+++ b/crates/engine/src/adjust_params/tests.rs
@@ -63,6 +63,11 @@ fn every_kind_round_trips_through_params() {
 
 #[test]
 fn params_reach_the_model() {
+    basic_params_reach_the_model();
+    color_space_params_reach_the_model();
+}
+
+fn basic_params_reach_the_model() {
     let a = from_params("colorBalance", &json!({"midtones": [50, 0, -200]}), None, ColorMode::Rgb).unwrap();
     assert_eq!(a, Adjustment::ColorBalance { shadows: [0.0; 3], midtones: [50.0, 0.0, -100.0], highlights: [0.0; 3], preserve_luminosity: true });
     let a = from_params("channelMixer", &json!({"monochrome": true}), None, ColorMode::Rgb).unwrap();
@@ -82,6 +87,9 @@ fn params_reach_the_model() {
     assert!(matches!(a, Adjustment::HueSaturation { colorize: true, saturation: 0.0, hue: 120.0, .. }), "{a:?}");
     let a = from_params("gradientMap", &json!({"stops": [[1, "#ffffff"], [0, "#000000"]], "dither": true}), None, ColorMode::Rgb).unwrap();
     assert!(matches!(&a, Adjustment::GradientMap { stops, dither: true, .. } if stops[0].0 == 0.0));
+}
+
+fn color_space_params_reach_the_model() {
     // CMYK curves: ink channels; Lab: lightness without a composite.
     let a = from_params("curves", &json!({"black": [[0, 0], [255, 200]]}), None, ColorMode::Rgb).unwrap();
     assert!(matches!(&a, Adjustment::Curves { space: ToneSpace::Cmyk, black, .. } if black.len() == 2));
diff --git a/crates/engine/src/channel_clip.rs b/crates/engine/src/channel_clip.rs
index 47677e21ff..7823fdb18a 100644
--- a/crates/engine/src/channel_clip.rs
+++ b/crates/engine/src/channel_clip.rs
@@ -36,17 +36,18 @@ pub(crate) fn copy(s: &mut Session) -> Result<Option<Value>> {
     let Some(d) = s.active() else { return Ok(None) };
     let doc = &d.doc;
     let canvas = doc.bounds();
-    // The surface the values come from, and which of its samples is the channel.
-    let (src, k) = match d.channel_view.target {
+    // The surface the values come from, which of its samples is the channel, and whether it stores
+    // ink (CMYK, a spot channel) rather than tone.
+    let (src, k, ink) = match d.channel_view.target {
         ChannelTarget::Composite | ChannelTarget::LayerMask | ChannelTarget::VectorMask => return Ok(None),
         ChannelTarget::Color(k) => {
             let id = d.active_layer.ok_or_else(|| EngineError::Other("no active layer".into()))?;
             let surf = doc.layer(id).and_then(Layer::surface).ok_or_else(|| EngineError::Other("the active layer has no pixels".into()))?;
-            (surf, k)
+            (surf, k, surf.format().mode == ColorMode::Cmyk)
         }
         ChannelTarget::Alpha(i) => {
             let c = doc.channels.get(i).ok_or_else(|| EngineError::Other(format!("no alpha channel {i} (document has {})", doc.channels.len())))?;
-            (&c.surface, 0)
+            (&c.surface, 0, c.spot.is_some())
         }
     };
     let n = src.format().channels();
@@ -64,7 +65,8 @@ pub(crate) fn copy(s: &mut Session) -> Result<Option<Value>> {
     let len = (values.len() / n).checked_mul(2).ok_or_else(|| EngineError::Other("the channel is too large to copy".into()))?;
     let mut px = crate::allocation::capacity(len, "copying a channel")?;
     for (i, p) in values.chunks_exact(n).enumerate() {
-        px.push(p.get(k).copied().unwrap_or(0.0));
+        // A CMYK or spot channel copies as its tone (#5787).
+        px.push(p.get(k).map_or(0.0, |&v| if ink { 1.0 - v } else { v }));
         px.push(cover.as_ref().map_or(1.0, |(m, mk)| m.get(i * mk).copied().unwrap_or(0.0)));
     }
     let mut surface = Surface::new(fmt);
@@ -91,7 +93,7 @@ pub(crate) fn paste(s: &mut Session, p: &Value, k: usize, in_place: bool, limit:
     let area = src.content_bounds().intersect(&canvas);
     s.edit(label, |doc, _| {
         let surf = crate::commands::paint_surface(doc, id, &Value::Null)?;
-        let n = surf.format().channels();
+        let (n, mode) = (surf.format().channels(), surf.format().mode);
         if k >= n {
             return Err(EngineError::Other(format!("no colour channel {k} in this layer")));
         }
@@ -105,7 +107,7 @@ pub(crate) fn paste(s: &mut Session, p: &Value, k: usize, in_place: bool, limit:
             let mut px = crate::allocation::read_region(surf, area, "pasting into a channel")?;
             for (i, (dst, s)) in px.chunks_exact_mut(n).zip(&rgba).enumerate() {
                 let w = s[3] * weight.as_ref().map_or(1.0, |(m, mk)| m.get(i * mk).copied().unwrap_or(0.0));
-                let v = photocraft_color::convert::rgb_to_gray([s[0], s[1], s[2]]);
+                let v = crate::channel_cmds::tone(mode, photocraft_color::convert::rgb_to_gray([s[0], s[1], s[2]]));
                 if let Some(c) = dst.get_mut(k) {
                     *c += (v - *c) * w.clamp(0.0, 1.0);
                 }
diff --git a/crates/engine/src/channel_clip/tests.rs b/crates/engine/src/channel_clip/tests.rs
index 3d89c8f647..a5e687b297 100644
--- a/crates/engine/src/channel_clip/tests.rs
+++ b/crates/engine/src/channel_clip/tests.rs
@@ -72,6 +72,60 @@ fn alpha_channels_copy_and_paste_into_colour_channels() {
     assert!(near(&px(&s, 30, 15), &[0.0, 0.0, 0.0, 1.0]));
 }
 
+#[test]
+fn cmyk_channels_copy_and_paste_as_tone() {
+    // #5787: copying a CMYK channel gives its tone (white where there is no ink), and pasting a
+    // tone into a CMYK channel writes it back as ink.
+    for depth in [8, 16] {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": W, "height": H, "mode": "cmyk", "depth": depth, "background": "white"})).unwrap();
+        s.execute("select.rect", json!({"x": 0, "y": 0, "width": W / 2, "height": H})).unwrap();
+        s.execute("edit.fill", json!({"color": "#00ffff"})).unwrap();
+        s.execute("select.deselect", json!({})).unwrap();
+        let (left, right) = (px(&s, 5, 5), px(&s, 30, 5));
+        s.execute("channel.target", json!({"channel": "cyan"})).unwrap();
+        s.execute("edit.copy", json!({})).unwrap();
+        let clip = &s.clipboard.as_ref().unwrap().surface;
+        assert!((clip.pixel(30, 5)[0] - 1.0).abs() < 1e-3, "depth {depth}: no ink copies as white");
+        assert!((clip.pixel(5, 5)[0] - (1.0 - left[0])).abs() < 1e-3, "depth {depth}: ink copies dark");
+        // Cyan pasted into Black: black gets cyan's ink, and white stays white.
+        s.execute("channel.target", json!({"channel": "black"})).unwrap();
+        s.execute("edit.paste", json!({})).unwrap();
+        assert!(near(&px(&s, 30, 5), &right), "depth {depth}: no ink stays no ink, {:?}", px(&s, 30, 5));
+        let p = px(&s, 5, 5);
+        assert!((p[3] - left[0]).abs() < 2e-3 && near(&p[..3], &left[..3]), "depth {depth}: black = old cyan, {p:?} vs {left:?}");
+    }
+}
+
+#[test]
+fn spot_channels_copy_and_paste_as_tone() {
+    // #5787: a spot channel stores ink but copies as its tone, and a tone pasted into it goes back
+    // to ink: spot -> Black prints the spot's ink in black, Cyan -> spot gives the spot Cyan's ink.
+    for depth in [8, 16] {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": W, "height": H, "mode": "cmyk", "depth": depth, "background": "white"})).unwrap();
+        s.execute("select.rect", json!({"x": 0, "y": 0, "width": W / 2, "height": H})).unwrap();
+        s.execute("edit.fill", json!({"color": "#00ffff"})).unwrap();
+        let cyan = px(&s, 5, 5)[0];
+        s.execute("select.rect", json!({"x": 0, "y": 0, "width": 10, "height": H})).unwrap();
+        let spot = s.execute("channel.newSpot", json!({"color": "#ff00ff", "solidity": 100})).unwrap()["channel"].as_u64().unwrap();
+        s.execute("select.deselect", json!({})).unwrap();
+        s.execute("channel.target", json!({"channel": spot})).unwrap();
+        s.execute("edit.copy", json!({})).unwrap();
+        let clip = &s.clipboard.as_ref().unwrap().surface;
+        assert!(clip.pixel(5, 5)[0] < 1e-3 && (clip.pixel(30, 5)[0] - 1.0).abs() < 1e-3, "depth {depth}: ink copies dark");
+        s.execute("channel.target", json!({"channel": "black"})).unwrap();
+        s.execute("edit.paste", json!({})).unwrap();
+        assert!((px(&s, 5, 5)[3] - 1.0).abs() < 2e-3 && px(&s, 30, 5)[3] < 2e-3, "depth {depth}: black = the spot's ink");
+        s.execute("channel.target", json!({"channel": "cyan"})).unwrap();
+        s.execute("edit.copy", json!({})).unwrap();
+        s.execute("channel.target", json!({"channel": spot})).unwrap();
+        s.execute("edit.paste", json!({})).unwrap();
+        let ink = |x| s.active().unwrap().doc.channels[spot as usize].surface.sample_channel(x, 5, 0);
+        assert!(near(&[ink(5), ink(15), ink(30)], &[cyan, cyan, 0.0]), "depth {depth}: spot = Cyan's ink, {:?}", [ink(5), ink(15), ink(30)]);
+    }
+}
+
 #[test]
 fn copy_an_alpha_channel_without_a_pixel_layer() {
     let mut s = session(8);
diff --git a/crates/engine/src/cmd.rs b/crates/engine/src/cmd.rs
index 2fc665d575..1d0f41bf3e 100644
--- a/crates/engine/src/cmd.rs
+++ b/crates/engine/src/cmd.rs
@@ -82,6 +82,7 @@ pub mod file_cmds;
 pub mod fill_cmds;
 pub mod fill_key_cmds;
 pub mod float_cmds;
+pub mod font_library_cmds;
 pub(super) mod frame_cmds;
 pub mod fx_view_cmds;
 pub mod fx_visibility_cmds;
@@ -90,6 +91,7 @@ pub mod gradient_fill_cmds;
 pub mod group_view_cmds;
 pub mod history_cmds;
 pub mod history_menu_cmds;
+pub mod history_options_cmds;
 pub mod history_select_cmds;
 pub mod history_source_cmds;
 pub mod image_cmds;
@@ -437,26 +439,41 @@ fn build() -> Vec<CommandSpec> {
             "Layer…",
             ["Layer", "New"],
             Some("Cmd+Shift+N"),
-            r##"{"name":str?,"clipToPrevious":bool=false (Use Previous Layer to Create Clipping Mask; inside a clip group the layer joins it anyway),"color":"none|red|orange|yellow|green|seafoam|blue|indigo|magenta|fuchsia|violet|gray"="none","mode":"Normal|Multiply|…"="Normal","opacity":0..1=1,"fillNeutral":bool=false (fill with the mode's neutral color: modes without one are an error),"position":"above|below"="above" (below: the Layers panel's Cmd/Ctrl-click; never under the Background)}"##,
+            r##"{"name":str?,"clipToPrevious":bool=false (Use Previous Layer to Create Clipping Mask; inside a clip group the layer joins it anyway),"color":"none|red|orange|yellow|green|seafoam|blue|indigo|magenta|fuchsia|violet|gray"="none","mode":"Normal|Multiply|…"="Normal","opacity":0..1=1,"fillNeutral":bool=false (fill with the mode's neutral color: modes without one are an error),"position":"above|below"="above" (below: the Layers panel's Cmd/Ctrl-click; never under the Background)} (above the active layer, or the top layer inside it when it is an open group)"##,
             has_doc,
             crate::new_layer::run
         ),
-        cmd!("layer.new.group", "Group…", ["Layer", "New"], None, r##"{"name":str?}"##, has_doc, |s, p| {
-            let id = s.edit("New Group", |doc, active| {
-                let name = p.get("name").and_then(Value::as_str).map(str::to_string).unwrap_or_else(|| doc.next_layer_name("Group"));
-                let id = doc.insert_above(*active, Layer::group(name, vec![]));
-                *active = Some(id);
-                Ok(id)
-            })?;
-            crate::layer_multi_cmds::note_inert_insert(s, id);
-            Ok(json!({ "layer": id.0 }))
-        }),
+        cmd!(
+            "layer.new.group",
+            "Group…",
+            ["Layer", "New"],
+            None,
+            r##"{"name":text?,"color":"none|red|orange|yellow|green|seafoam|blue|indigo|magenta|fuchsia|violet|gray"="none","mode":str="passThrough" (blend mode),"opacity":0..100=100 (percent),"position":"above|below"="above" (below: the Layers panel's Cmd/Ctrl-click; never under the Background)} (above the active layer, or inside it when it is an open group; clipped when it lands inside a clipping mask)"##,
+            has_doc,
+            |s, p| {
+                let opts = crate::group_options::GroupOptions::parse("layer.new.group", p)?;
+                let below = crate::group_options::below("layer.new.group", p)?;
+                let place = if below { crate::layer_place::Place::Below } else { crate::layer_place::Place::Auto };
+                let id = s.edit("New Group", |doc, active| {
+                    let name = opts.name.clone().unwrap_or_else(|| doc.next_layer_name("Group"));
+                    let mut group = Layer::group(name, vec![]);
+                    opts.apply(&mut group);
+                    let bg = crate::background_cmds::background_id(doc);
+                    let id = crate::layer_place::insert_new(doc, *active, group, place);
+                    crate::background_cmds::keep_background_at_bottom(bg, doc)?;
+                    *active = Some(id);
+                    Ok(id)
+                })?;
+                crate::layer_multi_cmds::note_inert_insert(s, id);
+                Ok(json!({ "layer": id.0 }))
+            }
+        ),
         cmd!(
             "layer.groupLayers",
             "Group Layers",
             ["Layer"],
             Some("Cmd+G"),
-            r##"{"layer":id?,"name":str?} (no layer: every selected layer)"##,
+            r##"{"layer":id?,"name":text?,"color":"none|red|orange|yellow|green|seafoam|blue|indigo|magenta|fuchsia|violet|gray"="none","mode":str="passThrough" (blend mode),"opacity":0..100=100 (percent)} (no layer: every selected layer; the new group starts collapsed)"##,
             has_layer,
             crate::layer_multi_cmds::group_layers
         ),
@@ -592,7 +609,11 @@ fn build() -> Vec<CommandSpec> {
                 let before = s.active().ok_or(EngineError::NoDocument)?.doc.clone();
                 // Clipping and channel changes reach the layers around it: recomposite everything.
                 let local = p.get("clipped").is_none() && p.get("channels").is_none();
-                s.edit(label, |doc, _| {
+                // The eye: a history state only with History Options › Make Layer Visibility
+                // Changes Undoable.
+                let only_visibility = changed.as_slice() == ["visible"];
+                let record = !only_visibility || s.visibility_undoable();
+                s.edit_with(label, record, |doc, _| {
                     // The Background has no opacity, fill or blend mode: like Photoshop, setting
                     // one that changes its look turns it into a normal layer ("Layer 0") first.
                     let num = |k: &str| p.get(k).and_then(Value::as_f64).is_some_and(|v| v < 1.0);
@@ -782,7 +803,7 @@ fn build() -> Vec<CommandSpec> {
                     };
                     let mut l = Layer::new(doc.next_layer_name("Color Fill"), LayerContent::Fill(fill));
                     mask_new_layer(doc, &mut l, p, "layer.newFillLayer.solidColor", default_mask)?;
-                    let id = doc.insert_above(*active, l);
+                    let id = crate::layer_place::insert_new(doc, *active, l, crate::layer_place::Place::Auto);
                     *active = Some(id);
                     Ok(id)
                 })?;
@@ -814,7 +835,7 @@ fn build() -> Vec<CommandSpec> {
                     .in_mode(doc.mode);
                     let mut l = Layer::new(doc.next_layer_name("Gradient Fill"), LayerContent::Fill(fill));
                     mask_new_layer(doc, &mut l, p, "layer.newFillLayer.gradient", default_mask)?;
-                    let id = doc.insert_above(*active, l);
+                    let id = crate::layer_place::insert_new(doc, *active, l, crate::layer_place::Place::Auto);
                     *active = Some(id);
                     Ok(id)
                 })?;
@@ -906,7 +927,7 @@ fn build() -> Vec<CommandSpec> {
             "Brush Stroke",
             [],
             None,
-            r##"{"points":[[x,y,pressure?,tiltX?,tiltY?,rotation?,timeMs?,wheel?],…],"brush":{…BrushSettings}?,"preset":name?,"size":0.5..5000 px?,"hardness":0..1?,"opacity":0..1?,"flow":0..1?,"spacing":0..10?,"color":"#rrggbb"?=foreground,"mode":"normal|multiply|screen|…|clear (erases with this brush)"="normal","erase":bool?,"smoothing":0..1?,"zoom":number=1,"seed":u64?,"target":"pixels"|"mask"|"filterMask"|"quickMask"|{"channel":i}=Channels panel target}"##,
+            r##"{"points":[[x,y,pressure?,tiltX?,tiltY?,rotation?,timeMs?,wheel?],…],"brush":{…BrushSettings}?,"preset":name?,"size":0.5..5000 px?,"hardness":0..1?,"opacity":0..1?,"flow":0..1?,"fill":bool=false (fill the region the closed `points` enclose with the brush colour, its edge anti-aliased and softened by hardness, instead of stamping the outline; a closed gesture paints a filled dab, not a ring),"spacing":0..10?,"color":"#rrggbb"?=foreground,"mode":"normal|multiply|screen|…|clear (erases with this brush)"="normal","erase":bool?,"smoothing":0..1?,"zoom":number=1,"seed":u64?,"target":"pixels"|"mask"|"filterMask"|"quickMask"|{"channel":i}=Channels panel target}"##,
             has_paintable,
             crate::brush_cmds::paint_stroke
         ),
@@ -1271,7 +1292,9 @@ fn build() -> Vec<CommandSpec> {
     v.extend(crate::distort_cmds::specs());
     v.extend(crate::analysis_cmds::specs());
     v.extend(crate::notes_cmds::specs());
+    v.extend(crate::font_library_cmds::specs());
     v.extend(crate::history_cmds::specs());
+    v.extend(crate::history_options_cmds::specs());
     v.extend(crate::history_menu_cmds::specs());
     v.extend(crate::history_source_cmds::specs());
     v.extend(crate::history_select_cmds::specs());
diff --git a/crates/engine/src/cmd/adjust_cmds.rs b/crates/engine/src/cmd/adjust_cmds.rs
index 830d601b5f..5bbd7df961 100644
--- a/crates/engine/src/cmd/adjust_cmds.rs
+++ b/crates/engine/src/cmd/adjust_cmds.rs
@@ -10,6 +10,7 @@
 //! result through the selection like the other Image › Adjustments commands.
 
 use photocraft_algo::tone::{self, HdrToning, MatchColor, ShadowsHighlights};
+use photocraft_doc::adjust::{LutFormat, LutSource};
 use photocraft_doc::{Adjustment, Document, Layer, LayerContent, Rect};
 use photocraft_raster::{Surface, to_rgba};
 use serde_json::{Value, json};
@@ -104,34 +105,38 @@ pub fn selective_from_params(p: &Value, base: Option<&Adjustment>) -> Result<Adj
 /// error.
 pub fn lookup_from_params(p: &Value, base: Option<&Adjustment>) -> Result<Adjustment> {
     const CMD: &str = "colorLookup";
-    let (mut name, mut lut, mut size, mut tetrahedral, mut dither) = match base {
-        Some(Adjustment::ColorLookup { name, lut, size, tetrahedral, dither }) => (name.clone(), lut.clone(), *size, *tetrahedral, *dither),
-        _ => (String::new(), None, 0, false, false),
+    let (mut name, mut lut, mut size, mut tetrahedral, mut dither, mut source) = match base {
+        Some(Adjustment::ColorLookup { name, lut, size, tetrahedral, dither, source }) => {
+            (name.clone(), lut.clone(), *size, *tetrahedral, *dither, source.clone())
+        }
+        _ => (String::new(), None, 0, false, false, None),
     };
-    let mut loaded: Option<(photocraft_cms::lutfile::LutFile, String)> = None;
+    // The parsed table, its label and (for a file) the file as loaded, which a PSD save embeds.
+    let mut loaded: Option<(photocraft_cms::lutfile::LutFile, String, Option<LutSource>)> = None;
     if let Some(id) = opt_str(CMD, p, "lut")? {
         if id == "none" || id.is_empty() {
             name.clear();
             lut = None;
             size = 0;
+            source = None;
         } else {
             let f = photocraft_cms::lutfile::builtin(id).ok_or_else(|| bad(CMD, format!("unknown look `{id}` (built-ins: {})", builtin_ids())))?;
             let label = f.title.clone();
-            loaded = Some((f, label));
+            loaded = Some((f, label, None));
         }
     }
     let file_name = opt_str(CMD, p, "fileName")?;
     if let Some(text) = opt_str(CMD, p, "data")? {
         let file_name = file_name.unwrap_or("lut.cube");
         let f = photocraft_cms::lutfile::parse(file_name, text.as_bytes()).map_err(|e| bad(CMD, e.0))?;
-        loaded = Some((f, base_name(file_name)));
+        loaded = Some((f, base_name(file_name), Some(lut_source(file_name, text.as_bytes().to_vec()))));
     }
     if let Some(path) = opt_str(CMD, p, "file")?.filter(|s| !s.is_empty()) {
         let bytes = read_file(path).ok_or_else(|| bad(CMD, format!("can't read {path}")))?;
         let f = photocraft_cms::lutfile::parse(path, &bytes).map_err(|e| bad(CMD, format!("{path}: {}", e.0)))?;
-        loaded = Some((f, base_name(path)));
+        loaded = Some((f, base_name(path), Some(lut_source(path, bytes))));
     }
-    if let Some((f, label)) = loaded {
+    if let Some((f, label, src)) = loaded {
         if !f.domain_is_default() {
             return Err(bad(
                 CMD,
@@ -144,6 +149,7 @@ pub fn lookup_from_params(p: &Value, base: Option<&Adjustment>) -> Result<Adjust
         name = label;
         size = f.size as u32;
         lut = Some(std::sync::Arc::new(f.data));
+        source = src;
     }
     match opt_str(CMD, p, "interpolation")? {
         None => {}
@@ -157,7 +163,17 @@ pub fn lookup_from_params(p: &Value, base: Option<&Adjustment>) -> Result<Adjust
     if let Some(b) = opt_bool(CMD, p, "dither")? {
         dither = b;
     }
-    Ok(Adjustment::ColorLookup { name, lut, size, tetrahedral, dither })
+    Ok(Adjustment::ColorLookup { name, lut, size, tetrahedral, dither, source })
+}
+
+/// A loaded LUT file, tagged with the format [`photocraft_cms::lutfile::parse`] read it as.
+fn lut_source(file_name: &str, bytes: Vec<u8>) -> LutSource {
+    let format = match photocraft_cms::lutfile::Format::detect(file_name, &bytes) {
+        photocraft_cms::lutfile::Format::Cube => LutFormat::Cube,
+        photocraft_cms::lutfile::Format::ThreeDl => LutFormat::ThreeDl,
+        photocraft_cms::lutfile::Format::Look => LutFormat::Look,
+    };
+    LutSource { format, bytes: std::sync::Arc::new(bytes) }
 }
 
 fn builtin_ids() -> String {
diff --git a/crates/engine/src/cmd/adjust_cmds/tests.rs b/crates/engine/src/cmd/adjust_cmds/tests.rs
index 312caedc32..e18e37f1ec 100644
--- a/crates/engine/src/cmd/adjust_cmds/tests.rs
+++ b/crates/engine/src/cmd/adjust_cmds/tests.rs
@@ -170,7 +170,7 @@ fn color_lookup_builtin_data_and_errors() {
     // Switching interpolation keeps the table.
     s.execute("layer.setAdjustment", json!({"layer": id.0, "interpolation": "tetrahedral", "dither": true})).unwrap();
     match &doc(&s).layer(id).unwrap().content {
-        LayerContent::Adjustment(Adjustment::ColorLookup { lut: Some(_), size: 33, tetrahedral: true, dither: true, name }) => {
+        LayerContent::Adjustment(Adjustment::ColorLookup { lut: Some(_), size: 33, tetrahedral: true, dither: true, name, .. }) => {
             assert_eq!(name, "Day for Night")
         }
         other => panic!("{other:?}"),
@@ -220,6 +220,53 @@ LUT_3D_SIZE 2
 }
 
 /// The kind's parameters, read back from the model (Color Lookup with its table name and size).
+#[test]
+fn color_lookup_file_round_trips_psd_in_its_own_format() {
+    use photocraft_doc::adjust::{LutFormat, LutSource};
+    // #6544: a .3dl / .look file is kept as loaded and embedded unchanged in a PSD.
+    let mut threedl = String::from("0 1023\n");
+    for r in 0..2 {
+        for g in 0..2 {
+            for b in 0..2 {
+                threedl.push_str(&format!("{} {} {}\n", (1 - r) * 4095, (1 - g) * 4095, (1 - b) * 4095));
+            }
+        }
+    }
+    let hex: String = photocraft_cms::lutfile::LutFile::identity(2).data.iter().flat_map(|v| v.to_le_bytes()).map(|b| format!("{b:02X}")).collect();
+    let look = format!("<look><LUT><size>2</size><data>{hex}</data></LUT></look>");
+    for (text, file_name, format, psd_format) in
+        [(threedl.as_str(), "Invert.3dl", LutFormat::ThreeDl, "LUTFormat3DL"), (look.as_str(), "Grade.look", LutFormat::Look, "LUTFormatLOOK")]
+    {
+        let mut s = session(8, "rgb");
+        let r = s.execute("layer.newAdjustmentLayer.colorLookup", json!({"data": text, "fileName": file_name})).unwrap();
+        let id = photocraft_doc::LayerId(r["layer"].as_u64().unwrap());
+        let want = LutSource { format, bytes: std::sync::Arc::new(text.as_bytes().to_vec()) };
+        let source_of = |s: &Session| match adjustment_of(s, id) {
+            Adjustment::ColorLookup { source, .. } => source,
+            other => panic!("{other:?}"),
+        };
+        assert_eq!(source_of(&s), Some(want.clone()), "{file_name}");
+        // Settings that don't touch the table keep the file.
+        s.execute("layer.setAdjustment", json!({"layer": id.0, "interpolation": "tetrahedral", "dither": true})).unwrap();
+        assert_eq!(source_of(&s), Some(want.clone()), "{file_name}");
+        // Saved as PSD and reopened: same format tag, same bytes, same name.
+        let psd = photocraft_io::export(doc(&s), "psd", &photocraft_io::ExportOptions::default()).unwrap().bytes;
+        let back = photocraft_io::import("x.psd", &psd).unwrap().document;
+        let layer = back.walk().into_iter().map(|(_, _, l)| l).find(|l| matches!(l.content, LayerContent::Adjustment(Adjustment::ColorLookup { .. }))).unwrap();
+        let LayerContent::Adjustment(Adjustment::ColorLookup { name, source, .. }) = &layer.content else { panic!("not a Color Lookup") };
+        assert_eq!((name.as_str(), source.as_ref()), (file_name, Some(&want)), "{psd_format}");
+        // Choosing a built-in look replaces the table, so the file goes too.
+        s.execute("layer.setAdjustment", json!({"layer": id.0, "lut": "dayForNight"})).unwrap();
+        assert_eq!(source_of(&s), None);
+    }
+    // "none" drops it as well.
+    let mut s = session(8, "rgb");
+    let r = s.execute("layer.newAdjustmentLayer.colorLookup", json!({"data": threedl, "fileName": "Invert.3dl"})).unwrap();
+    let id = photocraft_doc::LayerId(r["layer"].as_u64().unwrap());
+    s.execute("layer.setAdjustment", json!({"layer": id.0, "lut": "none"})).unwrap();
+    assert!(matches!(adjustment_of(&s, id), Adjustment::ColorLookup { source: None, lut: None, .. }));
+}
+
 fn adjustment_of(s: &Session, id: photocraft_doc::LayerId) -> Adjustment {
     match &doc(s).layer(id).unwrap().content {
         LayerContent::Adjustment(a) => a.clone(),
diff --git a/crates/engine/src/cmd/adjust_params.rs b/crates/engine/src/cmd/adjust_params.rs
index d70ff79dcb..ae1ba0a2b8 100644
--- a/crates/engine/src/cmd/adjust_params.rs
+++ b/crates/engine/src/cmd/adjust_params.rs
@@ -1,6 +1,6 @@
 use super::enabled::{check_all_unlocked, is_mask_target, paint_surface};
 use super::layer_params::{layer_param, mask_new_layer};
-use super::*;
+use super::{Adjustment, ColorMode, EngineError, Layer, LayerContent, Map, Result, Session, Value, json, pixels};
 
 /// Add an adjustment layer above the active one; it takes the mask `mask_new_layer` builds from `p` (a path, the selection, or the default white mask).
 pub(super) fn new_adjustment(s: &mut Session, adj: Adjustment, p: &Value, cmd: &str) -> Result<Value> {
@@ -9,7 +9,7 @@ pub(super) fn new_adjustment(s: &mut Session, adj: Adjustment, p: &Value, cmd: &
     let id = s.edit(&label, |doc, active| {
         let mut l = Layer::new(doc.next_layer_name(&name), LayerContent::Adjustment(adj));
         mask_new_layer(doc, &mut l, p, cmd, true)?;
-        let id = doc.insert_above(*active, l);
+        let id = crate::layer_place::insert_new(doc, *active, l, crate::layer_place::Place::Auto);
         *active = Some(id);
         Ok(id)
     })?;
diff --git a/crates/engine/src/cmd/align_cmds.rs b/crates/engine/src/cmd/align_cmds.rs
index 869d29b724..1cddbb51cd 100644
--- a/crates/engine/src/cmd/align_cmds.rs
+++ b/crates/engine/src/cmd/align_cmds.rs
@@ -313,7 +313,7 @@ fn auto_blend(s: &mut Session, p: &Value) -> Result<Value> {
                 surf.write_region(area, px);
                 surf.prune();
             }
-            below = doc.insert_above(Some(below), l);
+            below = crate::layer_place::insert_new(doc, Some(below), l, crate::layer_place::Place::Above);
             below
         });
         let Some(px) = &blended else {
@@ -327,7 +327,7 @@ fn auto_blend(s: &mut Session, p: &Value) -> Result<Value> {
             surf.write_region(area, px);
             surf.prune();
         }
-        let nid = doc.insert_above(Some(below), l);
+        let nid = crate::layer_place::insert_new(doc, Some(below), l, crate::layer_place::Place::Above);
         *active = Some(nid);
         Ok((Some(nid), depth_id))
     })?;
diff --git a/crates/engine/src/cmd/analysis_cmds.rs b/crates/engine/src/cmd/analysis_cmds.rs
index 8932295d52..defaa834d4 100644
--- a/crates/engine/src/cmd/analysis_cmds.rs
+++ b/crates/engine/src/cmd/analysis_cmds.rs
@@ -197,7 +197,8 @@ pub(crate) fn compound<R>(s: &mut Session, label: &str, f: impl FnOnce(&mut Sess
         Ok(v) => {
             // As in `Session::edit`: undo targets what was selected just before the step (#1356).
             st.history.set_current_layers(prior);
-            st.history.record(label, before, st.layer_target());
+            st.history.record(label, before.clone(), st.layer_target());
+            st.history.add_current_visibility(&crate::visibility_changes(&before, &st.doc));
             st.trim_history();
             st.coalesce = None;
             Ok(v)
diff --git a/crates/engine/src/cmd/artboard_cmds.rs b/crates/engine/src/cmd/artboard_cmds.rs
index 5394c0193c..2f05ddfae0 100644
--- a/crates/engine/src/cmd/artboard_cmds.rs
+++ b/crates/engine/src/cmd/artboard_cmds.rs
@@ -320,12 +320,35 @@ fn artboard_from_group(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"layer": id.0, "rect": [rect.x0, rect.y0, rect.width(), rect.height()]}))
 }
 
+/// The layers' union bounds, or the canvas when they have none: the board Artboard from Layers
+/// makes when no size is given.
+fn union_bounds<'a>(layers: impl IntoIterator<Item = &'a Layer>, canvas: Rect) -> Rect {
+    layers.into_iter().filter_map(crate::layer_multi_cmds::layer_bounds).reduce(|a, b| a.union(&b)).unwrap_or(canvas)
+}
+
+/// What Artboard from Layers' dialog opens with, as in the reference application: the name the
+/// board would get and the selected top-level layers' size (`None` without a document).
+pub fn from_layers_defaults(s: &Session) -> Option<(String, [i64; 2])> {
+    let d = s.active()?;
+    let ids = crate::layer_multi_cmds::top_level(&d.doc, &crate::layer_multi_cmds::selected(s));
+    let [_, _, w, h] = xywh(union_bounds(ids.iter().filter_map(|id| d.doc.layer(*id)), d.doc.bounds()));
+    Some((next_artboard_name(&d.doc), [w, h]))
+}
+
 fn artboard_from_layers(s: &mut Session, p: &Value) -> Result<Value> {
     let sel = crate::layer_multi_cmds::selected(s);
     let d = s.active().ok_or(EngineError::NoDocument)?;
     let canvas = d.doc.bounds();
-    let name = p.get("name").and_then(Value::as_str).map(str::to_string);
-    let background = background_param(p, "layer.new.artboardFromLayers")?.unwrap_or_default();
+    let name = p.get("name").and_then(Value::as_str).filter(|n| !n.is_empty()).map(str::to_string);
+    let cmd = "layer.new.artboardFromLayers";
+    let background = background_param(p, cmd)?.unwrap_or_default();
+    // `int` rounds, so a small negative (-0.4) would pass as 0, "keep the bounds".
+    if ["width", "height"].iter().any(|k| p.get(*k).and_then(Value::as_f64).is_some_and(|v| v < 0.0)) {
+        return Err(bad(cmd, "the artboard width and height must not be negative"));
+    }
+    // A size of the user's own (a post, a story…) from the layers' top left; 0 or none keeps
+    // their bounds on that axis (#9087).
+    let size = [int(p, "width").filter(|v| *v != 0), int(p, "height").filter(|v| *v != 0)];
     let (gid, rect) = s.edit("Artboard from Layers", |doc, active| {
         let ids = crate::layer_multi_cmds::top_level(doc, &sel);
         if ids.is_empty() || ids.iter().any(|id| doc.artboard_of(*id).is_some()) {
@@ -335,7 +358,8 @@ fn artboard_from_layers(s: &mut Session, p: &Value) -> Result<Value> {
         for id in &ids {
             children.push(doc.remove(*id).ok_or(EngineError::NoLayer(*id))?);
         }
-        let rect = children.iter().filter_map(crate::layer_multi_cmds::layer_bounds).reduce(|a, b| a.union(&b)).unwrap_or(canvas);
+        let [x, y, w, h] = xywh(union_bounds(&children, canvas));
+        let rect = board_rect(cmd, [x, y, size[0].unwrap_or(w), size[1].unwrap_or(h)])?;
         let mut g = Layer::group(name.unwrap_or_else(|| next_artboard_name(doc)), children);
         set_artboard(&mut g, Artboard { rect, background, preset: String::new() });
         let gid = doc.insert_above(None, g);
@@ -687,7 +711,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "layer.new.artboardFromLayers",
             "Artboard from Layers…",
             &["Layer", "New"],
-            r##"{"name":str?,"background":…?} (the selected layers) → {layer, rect}"##,
+            r##"{"name":text,"background":"white|black|transparent|custom"="white","color":color,"width":px=0,"height":px=0} (the selected layers; name: empty gives Artboard N; color: for custom; width, height: the board's size from the layers' top left, 0 keeps their bounds) → {layer, rect}"##,
             has_free_layers,
             artboard_from_layers
         ),
diff --git a/crates/engine/src/cmd/artboard_cmds/tests.rs b/crates/engine/src/cmd/artboard_cmds/tests.rs
index ad3f7a46d0..d21011a71b 100644
--- a/crates/engine/src/cmd/artboard_cmds/tests.rs
+++ b/crates/engine/src/cmd/artboard_cmds/tests.rs
@@ -690,3 +690,43 @@ fn new_document_with_an_artboard() {
     assert!(doc(&s).artboards().is_empty());
     assert!(s.execute("file.new", json!({"artboard": "yes"})).is_err());
 }
+
+/// #9087: Artboard from Layers takes a size of the user's own, from the layers' top left; 0 or
+/// none keeps their bounds on that axis, and a negative size is refused.
+#[test]
+fn artboard_from_layers_takes_a_custom_size() {
+    for (params, want) in [
+        (json!({"width": 108, "height": 135}), [10, 10, 108, 135]),
+        (json!({"width": 0, "height": 0}), [10, 10, 20, 20]),
+        (json!({"width": 60}), [10, 10, 60, 20]),
+    ] {
+        let mut s = session(8);
+        add_square(&mut s, Rect::new(10, 10, 30, 30), [1.0, 0.0, 0.0, 1.0]);
+        let r = s.execute("layer.new.artboardFromLayers", params.clone()).unwrap();
+        assert_eq!(r["rect"], json!(want), "{params}");
+    }
+    let mut s = session(8);
+    add_square(&mut s, Rect::new(10, 10, 30, 30), [1.0, 0.0, 0.0, 1.0]);
+    assert!(s.execute("layer.new.artboardFromLayers", json!({"width": -5})).is_err());
+    // `int` rounds -0.4 to 0, which would otherwise keep the bounds.
+    assert!(s.execute("layer.new.artboardFromLayers", json!({"height": -0.4})).is_err());
+    assert!(doc(&s).artboards().is_empty(), "a refused size changes nothing");
+    assert_eq!(s.execute("layer.new.artboardFromLayers", json!({"name": ""})).unwrap()["rect"], json!([10, 10, 20, 20]));
+    assert_eq!(doc(&s).artboards()[0].1, "Artboard 1", "an empty name gives Artboard N");
+}
+
+/// The dialog's defaults (#9087): the selected layers' size and the board's name, as the command
+/// makes it with no size; the canvas when the layers have no pixels.
+#[test]
+fn from_layers_defaults_are_the_selected_layers_size() {
+    let mut s = session(8);
+    add_square(&mut s, Rect::new(10, 10, 30, 40), [1.0, 0.0, 0.0, 1.0]);
+    assert_eq!(from_layers_defaults(&s), Some(("Artboard 1".to_string(), [20, 30])));
+    s.execute("layer.new.artboardFromLayers", json!({})).unwrap();
+    add_square(&mut s, Rect::new(50, 5, 60, 10), [1.0, 0.0, 0.0, 1.0]);
+    assert_eq!(from_layers_defaults(&s), Some(("Artboard 2".to_string(), [10, 5])));
+    let mut s = session(8);
+    s.execute("layer.new.layer", json!({})).unwrap();
+    assert_eq!(from_layers_defaults(&s), Some(("Artboard 1".to_string(), [100, 80])), "an empty layer: the canvas");
+    assert_eq!(from_layers_defaults(&Session::new()), None);
+}
diff --git a/crates/engine/src/cmd/atn_cmds.rs b/crates/engine/src/cmd/atn_cmds.rs
index 32e5405d1a..7c717701bf 100644
--- a/crates/engine/src/cmd/atn_cmds.rs
+++ b/crates/engine/src/cmd/atn_cmds.rs
@@ -38,7 +38,7 @@ mod steps_make;
 mod tables;
 
 #[cfg(test)]
-use adjustments::selective_from;
+use adjustments::{levels_from, selective_from};
 pub use convert::{Imported, Skipped, Unsupported, export, function_key_name, import, parse_function_key};
 #[cfg(test)]
 use convert::{MAX_NAME_CHARS, export_item, normalise};
@@ -56,7 +56,7 @@ use files::{load, save};
 #[cfg(test)]
 use steps_doc::crop_from;
 #[cfg(test)]
-use steps_image::transform_to;
+use steps_image::{apply_image_from, transform_to};
 #[cfg(test)]
 use steps_layer::quick_mask_ref;
 #[cfg(test)]
diff --git a/crates/engine/src/cmd/atn_cmds/adjustments.rs b/crates/engine/src/cmd/atn_cmds/adjustments.rs
index 321ca5ebc4..5da802b800 100644
--- a/crates/engine/src/cmd/atn_cmds/adjustments.rs
+++ b/crates/engine/src/cmd/atn_cmds/adjustments.rs
@@ -1,7 +1,7 @@
 use super::descriptors::{color_desc, color_hex, desc, enm, get_bool, get_enum, get_list, get_num, get_obj, jbool, jnum, jstr, long, num, pct, text};
 use super::fields::{F, Kind, Mapped, fields_from, fields_to, step};
 use super::tables::{CHANNELS, channel_key, channel_ref, lookup, lookup_back};
-use super::*;
+use super::{D, Descriptor, Map, Value, json};
 
 // ------------------------------------------------------------------ adjustments
 
diff --git a/crates/engine/src/cmd/atn_cmds/convert.rs b/crates/engine/src/cmd/atn_cmds/convert.rs
index b23c578ac6..78d65979bf 100644
--- a/crates/engine/src/cmd/atn_cmds/convert.rs
+++ b/crates/engine/src/cmd/atn_cmds/convert.rs
@@ -1,7 +1,7 @@
 use super::descriptors::{desc, get_obj, jstr};
 use super::events::{event_and_descriptor, event_for};
 use super::fields::Mapped;
-use super::*;
+use super::{Action, AtnAction, AtnEvent, AtnFile, AtnItem, D, DEFAULT_SET, Descriptor, PHOTOSHOP_STEP, UnicodeString, Value, atn, json};
 
 // ------------------------------------------------------------------ import
 
diff --git a/crates/engine/src/cmd/atn_cmds/descriptors.rs b/crates/engine/src/cmd/atn_cmds/descriptors.rs
index 0fbecf60da..9e9835218b 100644
--- a/crates/engine/src/cmd/atn_cmds/descriptors.rs
+++ b/crates/engine/src/cmd/atn_cmds/descriptors.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Class, D, Descriptor, Id, Map, ReferenceItem, UnicodeString, Value, json};
 
 // ------------------------------------------------------------------ descriptor access
 
diff --git a/crates/engine/src/cmd/atn_cmds/events.rs b/crates/engine/src/cmd/atn_cmds/events.rs
index 6d2fbc4382..3760e6916e 100644
--- a/crates/engine/src/cmd/atn_cmds/events.rs
+++ b/crates/engine/src/cmd/atn_cmds/events.rs
@@ -16,7 +16,7 @@ use super::steps_layer::{
 };
 use super::steps_make::{make_from, make_to, set_from, set_to};
 use super::tables::{NOISE, OFFSET_FILL, SMART_BLUR_MODE, SMART_BLUR_QUALITY, TRIM};
-use super::*;
+use super::{AtnEvent, D, Descriptor, STOP_MESSAGE, Value, json};
 
 /// An event: code (empty when Photoshop only has a string name), string name, the panel
 /// label, the command ids it exports (the first is the one simple events import to), and the
diff --git a/crates/engine/src/cmd/atn_cmds/fields.rs b/crates/engine/src/cmd/atn_cmds/fields.rs
index 8dd32a283c..dcce669a3f 100644
--- a/crates/engine/src/cmd/atn_cmds/fields.rs
+++ b/crates/engine/src/cmd/atn_cmds/fields.rs
@@ -1,6 +1,6 @@
 use super::descriptors::{ang, color_desc, color_hex, enm, get_bool, get_enum, get_num, get_obj, long, pct, px};
 use super::tables::{blend_label, blend_ps, lookup, lookup_back};
-use super::*;
+use super::{D, Descriptor, Map, Value, json};
 
 // ------------------------------------------------------------------ field tables
 
diff --git a/crates/engine/src/cmd/atn_cmds/files.rs b/crates/engine/src/cmd/atn_cmds/files.rs
index 9666a443bb..be7bd45151 100644
--- a/crates/engine/src/cmd/atn_cmds/files.rs
+++ b/crates/engine/src/cmd/atn_cmds/files.rs
@@ -1,5 +1,5 @@
 use super::convert::{UniqueNames, export, import};
-use super::*;
+use super::{Action, DEFAULT_SET, EngineError, Result, Session, Value, bad, json};
 
 pub(super) fn load(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "actions.load";
diff --git a/crates/engine/src/cmd/atn_cmds/steps_doc.rs b/crates/engine/src/cmd/atn_cmds/steps_doc.rs
index 36100c1066..12852536ca 100644
--- a/crates/engine/src/cmd/atn_cmds/steps_doc.rs
+++ b/crates/engine/src/cmd/atn_cmds/steps_doc.rs
@@ -5,7 +5,7 @@ use super::descriptors::{
 };
 use super::fields::{Mapped, none, step, steps};
 use super::tables::{ALIGN, EXTENSION, INTENT, INTERPOLATION, MODES, PROFILES, PURGE, SAVE_FORMATS, lookup, lookup_back};
-use super::*;
+use super::{D, Descriptor, Id, Map, ReferenceItem, STOP_MESSAGE, UnicodeString, Value, json};
 
 /// `placeEvent`: File › Place Embedded / Linked, with the file and the recorded scale.
 pub(super) fn place_from(d: &Descriptor) -> Mapped {
diff --git a/crates/engine/src/cmd/atn_cmds/steps_image.rs b/crates/engine/src/cmd/atn_cmds/steps_image.rs
index bb8e1c82fd..a1b808bf34 100644
--- a/crates/engine/src/cmd/atn_cmds/steps_image.rs
+++ b/crates/engine/src/cmd/atn_cmds/steps_image.rs
@@ -4,8 +4,8 @@ use super::descriptors::{
 };
 use super::events::pixel_target;
 use super::fields::{F, Kind, Mapped, fields_from, fields_to, step};
-use super::tables::{CHANNELS, INTERPOLATION, RADIAL_METHOD, RADIAL_QUALITY, lookup, lookup_back};
-use super::*;
+use super::tables::{CHANNELS, INTERPOLATION, RADIAL_METHOD, RADIAL_QUALITY, channel_of, lookup, lookup_back};
+use super::{D, Descriptor, Map, ReferenceItem, UnicodeString, Value, json};
 
 /// `transform`: Photoshop records a Free Transform relative to the frame (offset of its centre,
 /// width/height in percent, angle). A layer moved only becomes `layer.translate`; anything
@@ -143,7 +143,7 @@ pub(super) fn apply_image_from(d: &Descriptor) -> Mapped {
         match item {
             ReferenceItem::Enumerated { class, value, .. } if class.class_id.is("Chnl") => {
                 let v = trimmed(value);
-                let Some(channel) = lookup(SOURCE_CHANNELS, &v).or_else(|| lookup(CHANNELS, &v)) else { return unsupported };
+                let Some(channel) = lookup(SOURCE_CHANNELS, &v).or_else(|| channel_of(&v)) else { return unsupported };
                 source.insert("channel".into(), channel.into());
             }
             // A named (alpha) channel.
diff --git a/crates/engine/src/cmd/atn_cmds/steps_layer.rs b/crates/engine/src/cmd/atn_cmds/steps_layer.rs
index 36e77d624b..9dbdad579b 100644
--- a/crates/engine/src/cmd/atn_cmds/steps_layer.rs
+++ b/crates/engine/src/cmd/atn_cmds/steps_layer.rs
@@ -7,7 +7,7 @@ use super::events::pixel_target;
 use super::fields::{F, Kind, Mapped, fields_to, none, step, steps};
 use super::steps_make::is_tool_class;
 use super::tables::{FILL_CONTENTS, INTERPOLATION, MENU_ITEMS, STROKE_LOCATION, blend_label, blend_ps, lookup, lookup_back};
-use super::*;
+use super::{D, Descriptor, Id, Map, ReferenceItem, UnicodeString, Value, json};
 
 pub(super) fn select_from(d: &Descriptor) -> Mapped {
     let Some(r) = get_ref(d, "null") else { return Mapped::Unsupported { harmless: false } };
diff --git a/crates/engine/src/cmd/atn_cmds/steps_make.rs b/crates/engine/src/cmd/atn_cmds/steps_make.rs
index 696a1f17f8..96f9033102 100644
--- a/crates/engine/src/cmd/atn_cmds/steps_make.rs
+++ b/crates/engine/src/cmd/atn_cmds/steps_make.rs
@@ -6,7 +6,7 @@ use super::descriptors::{
 use super::fields::{Mapped, none, step, steps};
 use super::steps_layer::quick_mask_ref;
 use super::tables::{LABEL_COLORS, MODES, blend_label, blend_ps, lookup, lookup_back};
-use super::*;
+use super::{D, Descriptor, Id, Map, ReferenceItem, Value, json};
 
 /// A `patternLayer` descriptor's pattern, scale, angle and link as the params of
 /// `layer.newFillLayer.pattern` / `layer.fill.pattern.set`. The pattern goes by name: ids differ
@@ -59,82 +59,92 @@ const MASK_USING: &[(&str, &str)] = &[
     ("HdSl", "layer.layerMask.hideSelection"),
 ];
 
+fn duplicate_layer_from_descriptor(d: &Descriptor) -> Option<Mapped> {
+    let r = get_ref(d, "null")?;
+    if ref_class(r).as_deref() != Some("Dcmn") || !matches!(target(r), Target::Class) {
+        return None;
+    }
+    let u = get_ref(d, "Usng")?;
+    if !matches!(ref_class(u).as_deref(), Some("Lyr") | Some("layerSection")) {
+        return None;
+    }
+    let mut params = layer_target(u)?;
+    params.insert("document".into(), "new".into());
+    if let Some(n) = get_text(d, "Nm  ") {
+        params.insert("documentName".into(), n.into());
+    }
+    if let Some(n) = get_text(d, "LyrN") {
+        params.insert("name".into(), n.into());
+    }
+    Some(step("layer.duplicate", Value::Object(params)))
+}
+
+fn mask_from_descriptor(d: &Descriptor) -> Option<Mapped> {
+    let Some(D::Class(c)) = d.get("Nw  ") else { return None };
+    if trimmed(&c.class_id) != "Chnl" {
+        return None;
+    }
+    let at_mask =
+        get_ref(d, "At  ").is_some_and(|r| r.len() == 1 && ref_class(r).as_deref() == Some("Chnl") && matches!(target(r), Target::Ordinal(o) if o == "Msk"));
+    Some(match get_enum(d, "Usng").and_then(|u| lookup(MASK_USING, &u)) {
+        Some(id) if at_mask => none(id),
+        _ => Mapped::Unsupported { harmless: false },
+    })
+}
+
+fn new_document_from_descriptor(d: &Descriptor) -> Option<Mapped> {
+    let nw = get_obj(d, "Nw  ")?;
+    if get_enum(d, "Usng").as_deref() == Some("Slct") {
+        let id = if get_bool(d, "Cpy ") == Some(true) { "layer.new.layerViaCopy" } else { "layer.new.layerViaCut" };
+        let mut mapped_steps = vec![(id, json!({}))];
+        if let Some(n) = get_text(nw, "Nm  ") {
+            mapped_steps.push(("layer.setProps", json!({"name": n})));
+        }
+        return Some(steps(mapped_steps));
+    }
+    if get_text(nw, "preset").is_some() {
+        return Some(none("file.newFromClipboard"));
+    }
+    let (Some(w), Some(h)) = (get_num(nw, "Wdth"), get_num(nw, "Hght")) else {
+        return Some(Mapped::Unsupported { harmless: false });
+    };
+    let res = get_num(nw, "Rslt").unwrap_or(72.0);
+    let to_px = |key: &str, value: f64| match nw.get(key) {
+        Some(D::UnitFloat { unit: PX, .. }) => value,
+        _ => value * res / 72.0,
+    };
+    let mut params = json!({"width": to_px("Wdth", w).round(), "height": to_px("Hght", h).round(), "resolution": res});
+    if let Some(n) = get_text(nw, "Nm  ") {
+        params["name"] = json!(n);
+    }
+    if let Some(D::Class(c)) = nw.get("Md  ")
+        && let Some(m) = lookup(MODES, &trimmed(&c.class_id))
+    {
+        params["mode"] = json!(m);
+    }
+    if let Some(depth) = get_num(nw, "Dpth") {
+        params["depth"] = json!(depth);
+    }
+    if let Some(fill) = get_enum(nw, "Fl  ") {
+        params["background"] = json!(match fill.as_str() {
+            "Wht" => "white",
+            "BckC" => "backgroundColor",
+            "Trns" => "transparent",
+            _ => "white",
+        });
+    }
+    Some(step("file.new", params))
+}
+
 pub(super) fn make_from(d: &Descriptor) -> Mapped {
-    // Duplicate layer/group into a new document: `Mk` with a document class, a layer
-    // `Usng`, an optional `Nm` (the new document's name) and an optional `LyrN`
-    // (the copy's name). A `Dplc` with a `T` document reference (duplicate into another
-    // open document) stays a kept Photoshop step: document indices mean nothing at replay.
-    if let Some(r) = get_ref(d, "null")
-        && ref_class(r).as_deref() == Some("Dcmn")
-        && matches!(target(r), Target::Class)
-        && let Some(u) = get_ref(d, "Usng")
-        && matches!(ref_class(u).as_deref(), Some("Lyr") | Some("layerSection"))
-        && let Some(mut p) = layer_target(u)
-    {
-        p.insert("document".into(), "new".into());
-        if let Some(n) = get_text(d, "Nm  ") {
-            p.insert("documentName".into(), n.into());
-        }
-        if let Some(n) = get_text(d, "LyrN") {
-            p.insert("name".into(), n.into());
-        }
-        return step("layer.duplicate", Value::Object(p));
+    if let Some(mapped) = duplicate_layer_from_descriptor(d) {
+        return mapped;
     }
-    // Add Layer Mask: a `Chnl` class made at the mask channel, `Usng` what it reveals.
-    if let Some(D::Class(c)) = d.get("Nw  ")
-        && trimmed(&c.class_id) == "Chnl"
-    {
-        // The target layer's mask only: a further item (a `Lyr` by name…) puts it on another layer.
-        let at_mask = get_ref(d, "At  ")
-            .is_some_and(|r| r.len() == 1 && ref_class(r).as_deref() == Some("Chnl") && matches!(target(r), Target::Ordinal(o) if o == "Msk"));
-        return match get_enum(d, "Usng").and_then(|u| lookup(MASK_USING, &u)) {
-            Some(id) if at_mask => none(id),
-            _ => Mapped::Unsupported { harmless: false },
-        };
+    if let Some(mapped) = mask_from_descriptor(d) {
+        return mapped;
     }
-    if let Some(nw) = get_obj(d, "Nw  ") {
-        // Layer via Copy / Cut (`Usng` = the selection), or a new document.
-        if get_enum(d, "Usng").as_deref() == Some("Slct") {
-            let id = if get_bool(d, "Cpy ") == Some(true) { "layer.new.layerViaCopy" } else { "layer.new.layerViaCut" };
-            let mut v = vec![(id, json!({}))];
-            if let Some(n) = get_text(nw, "Nm  ") {
-                v.push(("layer.setProps", json!({"name": n})));
-            }
-            return steps(v);
-        }
-        if get_text(nw, "preset").is_some() {
-            return none("file.newFromClipboard");
-        }
-        if let (Some(w), Some(h)) = (get_num(nw, "Wdth"), get_num(nw, "Hght")) {
-            let res = get_num(nw, "Rslt").unwrap_or(72.0);
-            // Dimensions are in points (`#Rlt`) unless given in pixels.
-            let to_px = |k: &str, v: f64| match nw.get(k) {
-                Some(D::UnitFloat { unit: PX, .. }) => v,
-                _ => v * res / 72.0,
-            };
-            let mut p = json!({"width": to_px("Wdth", w).round(), "height": to_px("Hght", h).round(), "resolution": res});
-            if let Some(n) = get_text(nw, "Nm  ") {
-                p["name"] = json!(n);
-            }
-            if let Some(D::Class(c)) = nw.get("Md  ")
-                && let Some(m) = lookup(MODES, &trimmed(&c.class_id))
-            {
-                p["mode"] = json!(m);
-            }
-            if let Some(depth) = get_num(nw, "Dpth") {
-                p["depth"] = json!(depth);
-            }
-            if let Some(f) = get_enum(nw, "Fl  ") {
-                p["background"] = json!(match f.as_str() {
-                    "Wht" => "white",
-                    "BckC" => "backgroundColor",
-                    "Trns" => "transparent",
-                    _ => "white",
-                });
-            }
-            return step("file.new", p);
-        }
-        return Mapped::Unsupported { harmless: false };
+    if let Some(mapped) = new_document_from_descriptor(d) {
+        return mapped;
     }
     let Some(r) = get_ref(d, "null") else { return Mapped::Unsupported { harmless: false } };
     let using = get_obj(d, "Usng");
@@ -316,84 +326,91 @@ pub(super) fn make_to(id: &str, p: &Value) -> Option<Descriptor> {
     })
 }
 
+fn selection_from(d: &Descriptor) -> Mapped {
+    let unsupported = Mapped::Unsupported { harmless: false };
+    match d.get("T   ") {
+        Some(D::Enumerated { value, .. }) => match trimmed(value).as_str() {
+            "Al" => none("select.all"),
+            "None" => none("select.deselect"),
+            "Prvs" => none("select.reselect"),
+            _ => unsupported,
+        },
+        Some(D::Reference(t)) => match (ref_class(t).as_deref(), target(t)) {
+            (Some("Chnl"), Target::Ordinal(o)) if o == "Trsp" => step("select.loadSelection", json!({"channel": "transparency"})),
+            // ⌘-click on the targeted channel (a layer mask after `select` of `Msk`).
+            (Some("Chnl"), Target::Ordinal(o)) if o == "Trgt" => step("select.loadSelection", json!({"channel": "targeted"})),
+            (Some("Chnl"), Target::Name(n)) => step("select.loadSelection", json!({"channel": n})),
+            _ => unsupported,
+        },
+        Some(D::Descriptor(t)) if t.class_id.is("Plgn") => {
+            let pts: Option<Vec<Value>> = get_list(t, "Pts ")
+                .unwrap_or(&[])
+                .iter()
+                .map(|v| match v {
+                    D::Descriptor(pt) => Some(json!([get_num(pt, "Hrzn")?, get_num(pt, "Vrtc")?])),
+                    _ => None,
+                })
+                .collect();
+            match pts {
+                Some(pts) if pts.len() >= 3 => step("select.lasso", json!({"points": pts})),
+                _ => unsupported,
+            }
+        }
+        Some(D::Descriptor(t)) if t.class_id.is("Rctn") || t.class_id.is("Elps") => {
+            let (Some(top), Some(left), Some(bottom), Some(right)) = (get_num(t, "Top "), get_num(t, "Left"), get_num(t, "Btom"), get_num(t, "Rght")) else {
+                return unsupported;
+            };
+            let mut p = json!({"x": left.round(), "y": top.round(), "width": (right - left).round().max(0.0), "height": (bottom - top).round().max(0.0)});
+            if t.class_id.is("Elps") {
+                p["ellipse"] = json!(true);
+            }
+            step("select.rect", p)
+        }
+        _ => unsupported,
+    }
+}
+
+fn background_from(d: &Descriptor) -> Mapped {
+    let unsupported = Mapped::Unsupported { harmless: false };
+    // On an image that opened as a normal layer there is no Background to convert;
+    // Photoshop stops there, but the step's purpose (an editable layer) is met.
+    // Photoshop's `set` of another layer doesn't target it: the selected layer stays.
+    let mut v = vec![("layer.new.layerFromBackground", json!({"ifPresent": true, "select": false}))];
+    let mut props = Map::new();
+    props.insert("layer".into(), "Layer 0".into());
+    if let Some(t) = get_obj(d, "T   ") {
+        if let Some(n) = get_text(t, "Nm  ") {
+            props.insert("name".into(), n.into());
+        }
+        if let Some(o) = get_num(t, "Opct").filter(|o| (o - 100.0).abs() > 1e-9) {
+            props.insert("opacity".into(), (o / 100.0).into());
+        }
+        match get_enum(t, "Md  ").as_deref() {
+            None | Some("Nrml") => {}
+            Some(m) => match blend_label(m) {
+                Some(label) => {
+                    props.insert("blend".into(), label.into());
+                }
+                None => return unsupported,
+            },
+        }
+    }
+    if props.len() > 1 {
+        v.push(("layer.setProps", Value::Object(props)));
+    }
+    steps(v)
+}
+
 pub(super) fn set_from(d: &Descriptor) -> Mapped {
     let Some(r) = get_ref(d, "null") else { return Mapped::Unsupported { harmless: false } };
     let unsupported = Mapped::Unsupported { harmless: false };
     match (ref_class(r).as_deref(), target(r)) {
-        (Some("Chnl"), Target::Property(p)) if p == "fsel" => match d.get("T   ") {
-            Some(D::Enumerated { value, .. }) => match trimmed(value).as_str() {
-                "Al" => none("select.all"),
-                "None" => none("select.deselect"),
-                "Prvs" => none("select.reselect"),
-                _ => unsupported,
-            },
-            Some(D::Reference(t)) => match (ref_class(t).as_deref(), target(t)) {
-                (Some("Chnl"), Target::Ordinal(o)) if o == "Trsp" => step("select.loadSelection", json!({"channel": "transparency"})),
-                // ⌘-click on the targeted channel (a layer mask after `select` of `Msk`).
-                (Some("Chnl"), Target::Ordinal(o)) if o == "Trgt" => step("select.loadSelection", json!({"channel": "targeted"})),
-                (Some("Chnl"), Target::Name(n)) => step("select.loadSelection", json!({"channel": n})),
-                _ => unsupported,
-            },
-            Some(D::Descriptor(t)) if t.class_id.is("Plgn") => {
-                let pts: Option<Vec<Value>> = get_list(t, "Pts ")
-                    .unwrap_or(&[])
-                    .iter()
-                    .map(|v| match v {
-                        D::Descriptor(pt) => Some(json!([get_num(pt, "Hrzn")?, get_num(pt, "Vrtc")?])),
-                        _ => None,
-                    })
-                    .collect();
-                match pts {
-                    Some(pts) if pts.len() >= 3 => step("select.lasso", json!({"points": pts})),
-                    _ => unsupported,
-                }
-            }
-            Some(D::Descriptor(t)) if t.class_id.is("Rctn") || t.class_id.is("Elps") => {
-                let (Some(top), Some(left), Some(bottom), Some(right)) = (get_num(t, "Top "), get_num(t, "Left"), get_num(t, "Btom"), get_num(t, "Rght"))
-                else {
-                    return unsupported;
-                };
-                let mut p = json!({"x": left.round(), "y": top.round(), "width": (right - left).round().max(0.0), "height": (bottom - top).round().max(0.0)});
-                if t.class_id.is("Elps") {
-                    p["ellipse"] = json!(true);
-                }
-                step("select.rect", p)
-            }
-            _ => unsupported,
-        },
+        (Some("Chnl"), Target::Property(p)) if p == "fsel" => selection_from(d),
         // Quick Mask mode on (`set` of the document's quick-mask property); `clearEvent` turns it off.
         (Some("Prpr"), Target::Property(p)) if p == "QucM" => step("select.editInQuickMaskMode", json!({"on": true})),
         // Layer › New › Layer From Background (Photoshop records the New Layer dialog's values
         // as a `set` of the Background); values other than the defaults then apply to the layer.
-        (Some("Lyr"), Target::Property(p)) if p == "Bckg" => {
-            // On an image that opened as a normal layer there is no Background to convert;
-            // Photoshop stops there, but the step's purpose (an editable layer) is met.
-            // Photoshop's `set` of another layer doesn't target it: the selected layer stays.
-            let mut v = vec![("layer.new.layerFromBackground", json!({"ifPresent": true, "select": false}))];
-            let mut props = Map::new();
-            props.insert("layer".into(), "Layer 0".into());
-            if let Some(t) = get_obj(d, "T   ") {
-                if let Some(n) = get_text(t, "Nm  ") {
-                    props.insert("name".into(), n.into());
-                }
-                if let Some(o) = get_num(t, "Opct").filter(|o| (o - 100.0).abs() > 1e-9) {
-                    props.insert("opacity".into(), (o / 100.0).into());
-                }
-                match get_enum(t, "Md  ").as_deref() {
-                    None | Some("Nrml") => {}
-                    Some(m) => match blend_label(m) {
-                        Some(label) => {
-                            props.insert("blend".into(), label.into());
-                        }
-                        None => return unsupported,
-                    },
-                }
-            }
-            if props.len() > 1 {
-                v.push(("layer.setProps", Value::Object(props)));
-            }
-            steps(v)
-        }
+        (Some("Lyr"), Target::Property(p)) if p == "Bckg" => background_from(d),
         // The toolbox colours.
         (Some("Clr"), Target::Property(p)) if p == "FrgC" || p == "BckC" => match get_obj(d, "T   ").and_then(color_hex) {
             Some(hex) => step("tools.setColors", json!({(if p == "FrgC" { "foreground" } else { "background" }): hex})),
diff --git a/crates/engine/src/cmd/atn_cmds/tables.rs b/crates/engine/src/cmd/atn_cmds/tables.rs
index 13b4bb9e8d..0f3bc278e9 100644
--- a/crates/engine/src/cmd/atn_cmds/tables.rs
+++ b/crates/engine/src/cmd/atn_cmds/tables.rs
@@ -1,5 +1,5 @@
 use super::descriptors::{Target, class, code, get_ref, target};
-use super::*;
+use super::{D, Descriptor, ReferenceItem};
 
 /// Photoshop's `BlnM` enumeration ↔ PhotoCraft's blend mode labels.
 const BLEND_MODES: &[(&str, &str)] = &[
@@ -78,17 +78,24 @@ pub(super) const CHANNELS: &[(&str, &str)] = &[
     ("Mgnt", "magenta"),
     ("Yllw", "yellow"),
     ("Blck", "black"),
-    ("Lmnc", "lightness"),
+    // Lab Lightness: Photoshop rejects `Lmnc` ("luminance") on a Lab document (#9384).
+    ("Lght", "lightness"),
     ("A", "a"),
     ("B", "b"),
 ];
 
+/// The channel key of a `Chnl` enumeration. `Lmnc` is what PhotoCraft wrote for Lightness before
+/// #9384; reading it keeps those actions loading.
+pub(super) fn channel_of(code: &str) -> Option<&'static str> {
+    lookup(CHANNELS, code).or_else(|| (code.trim_end() == "Lmnc").then_some("lightness"))
+}
+
 /// The channel an adjustment entry's `Chnl` reference names: `None` = the composite.
 pub(super) fn channel_key(d: &Descriptor) -> Option<Option<&'static str>> {
     let r = get_ref(d, "Chnl")?;
     Some(match target(r) {
         Target::Ordinal(o) if o == "Trgt" || o == "Cmps" => None,
-        Target::Ordinal(o) => Some(lookup(CHANNELS, &o)?),
+        Target::Ordinal(o) => Some(channel_of(&o)?),
         _ => return None,
     })
 }
diff --git a/crates/engine/src/cmd/atn_cmds/tests.rs b/crates/engine/src/cmd/atn_cmds/tests.rs
index afd3895393..08286b5329 100644
--- a/crates/engine/src/cmd/atn_cmds/tests.rs
+++ b/crates/engine/src/cmd/atn_cmds/tests.rs
@@ -2644,6 +2644,44 @@ fn levels_and_curves_name_the_composite_channel_as_photoshop_records_it() {
     assert_eq!(channels(&curves), vec![composite, red]);
 }
 
+/// A Lab document's Lightness channel is `Chnl.Lght` (#9384): Photoshop plays a Levels or Apply
+/// Image step naming it and rejects `Chnl.Lmnc` ("luminance"), which PhotoCraft wrote before.
+/// Steps PhotoCraft saved with `Lmnc` still load.
+#[test]
+fn lab_lightness_channel_is_written_and_read_as_photoshop_names_it() {
+    let exported = |id: &str, p: Value| export_item(id, &p, "S").and_then(|i| i.descriptor).unwrap_or_else(|| panic!("{id} does not export"));
+    let entry_codes = |d: &Descriptor| -> Vec<String> {
+        get_list(d, "Adjs")
+            .unwrap_or_default()
+            .iter()
+            .filter_map(|e| match e {
+                D::Descriptor(e) => match get_ref(e, "Chnl")?.first()? {
+                    ReferenceItem::Enumerated { value, .. } => Some(trimmed(value)),
+                    _ => None,
+                },
+                _ => None,
+            })
+            .collect()
+    };
+    let levels = exported("image.adjustments.levels", json!({"lightness": {"gamma": 1.5}, "a": {"inBlack": 3}}));
+    assert_eq!(entry_codes(&levels), ["Cmps", "Lght", "A"]);
+    let curves = exported("image.adjustments.curves", json!({"lightness": [[0, 10], [255, 245]]}));
+    assert_eq!(entry_codes(&curves), ["Lght"]);
+    let apply = exported("image.applyImage", json!({"sourceLayer": "merged", "sourceChannel": "Lightness"}));
+    let source = get_ref(get_obj(&apply, "With").unwrap(), "T   ").unwrap();
+    assert!(matches!(&source[0], ReferenceItem::Enumerated { value, .. } if trimmed(value) == "Lght"), "{source:?}");
+
+    // What Photoshop records, and what PhotoCraft wrote before, both read as Lightness.
+    let chnl = |c: &str| D::Reference(vec![ReferenceItem::Enumerated { class: class("Chnl"), type_id: code("Chnl"), value: code(c) }]);
+    for c in ["Lght", "Lmnc"] {
+        let lvls = desc("Lvls").with("Adjs", D::List(vec![D::Descriptor(desc("LvlA").with("Chnl", chnl(c)).with("Gmm ", D::Double(1.5)))]));
+        assert_eq!(levels_from(&lvls), Some(json!({"lightness": {"gamma": 1.5}})), "{c}");
+        let with = desc("Clcl").with("T   ", chnl(c));
+        let Mapped::Steps(steps) = apply_image_from(&desc("null").with("With", D::Descriptor(with))) else { panic!("{c}: Apply Image does not import") };
+        assert_eq!(steps[0].1["source"]["channel"], "lightness", "{c}");
+    }
+}
+
 /// Photoshop sets one colour per step: a step that sets both doesn't export rather than drop one.
 #[test]
 fn set_colors_exports_only_a_single_colour() {
diff --git a/crates/engine/src/cmd/brush_cmds.rs b/crates/engine/src/cmd/brush_cmds.rs
index 33a64bfc36..479e33790e 100644
--- a/crates/engine/src/cmd/brush_cmds.rs
+++ b/crates/engine/src/cmd/brush_cmds.rs
@@ -429,9 +429,93 @@ pub fn paint_stroke(s: &mut Session, p: &Value) -> Result<Value> {
     let pts = parse_points(p, "paint.stroke")?;
     let brush = with_blend_mode(resolve_brush(s, p, "paint.stroke")?, p);
     let label = if brush.erase && !clear_mode(p) { "Eraser" } else { "Brush Tool" };
+    if flag(p, "fill", false) {
+        return fill_region(s, p, label, brush, pts);
+    }
     stroke_with(s, "paint.stroke", p, label, brush, pts, false)
 }
 
+/// `paint.stroke {fill: true}`: fill the region enclosed by `points` (their polygon) with the
+/// brush's colour and opacity, its edge anti-aliased and softened by the brush hardness, instead of
+/// stamping the outline. A closed gesture then paints a filled dab, not a ring (#3659).
+fn fill_region(s: &mut Session, p: &Value, label: &str, brush: BrushSettings, pts: Vec<StrokePoint>) -> Result<Value> {
+    if clear_mode(p) {
+        // `clear` maps onto the eraser; a clear fill would erase the region the outline encloses,
+        // which a selection + delete does deliberately (#3659). Reject before the eraser check so
+        // the message names the real conflict.
+        return Err(bad("paint.stroke", "\"fill\" cannot be combined with \"mode\":\"clear\"; select the enclosed region and delete it instead"));
+    }
+    if brush.erase {
+        return Err(bad("paint.stroke", "\"fill\" does not support the Eraser"));
+    }
+    if pts.len() < 3 {
+        return Err(bad("paint.stroke", "\"fill\" needs at least three points (a closed region)"));
+    }
+    let (id, brush, _zoom) = stroke_target(s, p, brush)?;
+    // A hard brush (hardness 1) keeps the anti-aliased polygon edge; a soft one feathers it by half
+    // the brush width, the way its tip fades.
+    let feather_px = ((1.0 - brush.hardness.clamp(0.0, 1.0)) * brush.size * 0.5).max(0.0);
+    let (color, opacity, mode) = (brush.color, brush.opacity.clamp(0.0, 1.0), brush.mode);
+    // A colour picked as CMYK fills with its inks in a CMYK target where it covers fully, as
+    // Edit › Fill does (blend_color_mask blends partial coverage through the colour's RGB).
+    let picked = brush.color_cmyk.filter(|(rgb, _)| *rgb == [color[0], color[1], color[2]]).map(|(_, inks)| inks);
+    let cmyk = doc_cmyk_space(s);
+    let dmg = photocraft_color::convert::with_cmyk_space(cmyk.as_ref(), || {
+        s.edit(label, |doc, _| {
+            let sel = doc.selection.clone();
+            let canvas = doc.bounds();
+            let (surf, lock) = crate::channel_cmds::target_surface(doc, id, p)?;
+            // The polygon's whole-pixel bounds, grown by the feather's reach (3σ) so a soft edge
+            // fades out instead of being clipped.
+            let (mut bx0, mut by0, mut bx1, mut by1) = (f64::INFINITY, f64::INFINITY, f64::NEG_INFINITY, f64::NEG_INFINITY);
+            for sp in &pts {
+                if !(sp.x.is_finite() && sp.y.is_finite()) {
+                    return Err(bad("paint.stroke", "non-finite point in a fill"));
+                }
+                bx0 = bx0.min(sp.x);
+                by0 = by0.min(sp.y);
+                bx1 = bx1.max(sp.x);
+                by1 = by1.max(sp.y);
+            }
+            let ix = |v: f64| v.clamp(f64::from(i32::MIN), f64::from(i32::MAX)) as i32;
+            let reach = photocraft_algo::selection::feather_reach(feather_px);
+            let pad = i32::try_from(reach).unwrap_or(i32::MAX).saturating_add(2);
+            let bounds = Rect::new(
+                ix(bx0.floor()).saturating_sub(pad),
+                ix(by0.floor()).saturating_sub(pad),
+                ix(bx1.ceil()).saturating_add(pad),
+                ix(by1.ceil()).saturating_add(pad),
+            )
+            .intersect(&canvas);
+            if bounds.is_empty() {
+                return Ok(Rect::new(0, 0, 0, 0));
+            }
+            let (w, h) = (bounds.width() as usize, bounds.height() as usize);
+            // The coverage, its feathered copy (and the blur's scratch), the selection read and
+            // the mask are each a buffer over the whole region, which can be the whole canvas:
+            // reserve that peak first, so a region too big for memory is an error, not an abort.
+            const FILL: &str = "filling a painted region";
+            let peak = w.checked_mul(h).and_then(|n| n.checked_mul(5)).ok_or_else(|| crate::allocation::error(FILL, "requested size overflowed"))?;
+            drop(crate::allocation::capacity::<f32>(peak, FILL)?);
+            let xy: Vec<(f32, f32)> = pts.iter().map(|sp| (sp.x as f32, sp.y as f32)).collect();
+            let mut cov = photocraft_algo::selection::polygon(&xy, bounds, true);
+            if feather_px > 0.01 {
+                cov = photocraft_algo::selection::feather(&cov, w, h, feather_px);
+            }
+            if let Some(sel) = sel.as_ref() {
+                let sv = crate::allocation::read_region(sel, bounds, FILL)?;
+                for (c, s) in cov.iter_mut().zip(&sv) {
+                    *c *= s.clamp(0.0, 1.0);
+                }
+            }
+            let coverage = photocraft_algo::selection::mask_to_surface(&cov, bounds);
+            crate::fill_cmds::blend_color_mask(surf, bounds, color, picked, &coverage, mode, opacity, lock)?;
+            Ok(bounds)
+        })
+    })?;
+    Ok(damage_json(s, dmg))
+}
+
 /// A `paint.stroke` rendered while it is drawn, onto a copy of the active document, so the canvas
 /// shows the real dabs before the stroke commits. Committing the same params and points with
 /// `"seed": live.seed` gives the same pixels.
diff --git a/crates/engine/src/cmd/brush_cmds/mixer_live.rs b/crates/engine/src/cmd/brush_cmds/mixer_live.rs
index acdd897fd4..3c15001553 100644
--- a/crates/engine/src/cmd/brush_cmds/mixer_live.rs
+++ b/crates/engine/src/cmd/brush_cmds/mixer_live.rs
@@ -1,6 +1,9 @@
 //! Incremental Mixer Brush transaction. Source pixels are composed before each dab;
 //! only the selected target changes. Dropping the transaction cancels it.
-use super::*;
+use super::{
+    EngineError, LiveCommit, MixerSettings, Rect, Result, Session, Stroke, StrokePoint, Surface, Value, bad, check_coords, color, damage_json, doc_cmyk_space,
+    flag, has_paintable, json, layer_id, num, parse_points, pct, resolve_brush,
+};
 use photocraft_color::{PixelFormat, SampleType};
 use photocraft_doc::{Document, LayerId};
 use photocraft_paint::dynamics::DabGenerator;
diff --git a/crates/engine/src/cmd/brush_cmds/tests.rs b/crates/engine/src/cmd/brush_cmds/tests.rs
index 87504dc0e9..3a3041c4a6 100644
--- a/crates/engine/src/cmd/brush_cmds/tests.rs
+++ b/crates/engine/src/cmd/brush_cmds/tests.rs
@@ -31,6 +31,93 @@ fn stroke_backwards_compatible() {
     assert!(rgba(&s, 30, 5)[3] > 0.9 && rgba(&s, 30, 8)[3] < 0.01);
 }
 
+#[test]
+fn fill_fills_the_enclosed_region_not_the_outline() {
+    // #3659: a closed gesture with `fill` paints the interior, not a ring.
+    let mut s = session(60, 60);
+    s.execute(
+        "paint.stroke",
+        json!({"points": [[10, 10], [50, 10], [50, 50], [10, 50]], "fill": true, "size": 4, "color": "#ff0000", "brush": {"hardness": 1.0}}),
+    )
+    .unwrap();
+    assert!(rgba(&s, 30, 30)[0] > 0.9 && rgba(&s, 30, 30)[3] > 0.9, "interior filled: {:?}", rgba(&s, 30, 30));
+    assert_eq!(rgba(&s, 5, 30)[3], 0.0, "outside untouched");
+    assert_eq!(rgba(&s, 30, 5)[3], 0.0, "outside untouched");
+    // A soft brush feathers the edge outside the polygon; a hard one keeps a crisp edge.
+    let mut soft = session(60, 60);
+    soft.execute(
+        "paint.stroke",
+        json!({"points": [[10, 10], [50, 10], [50, 50], [10, 50]], "fill": true, "size": 40, "color": "#ff0000", "brush": {"hardness": 0.0}}),
+    )
+    .unwrap();
+    assert!(rgba(&soft, 8, 30)[3] > 0.0, "a soft edge paints outside the polygon: {:?}", rgba(&soft, 8, 30));
+    // Graceful failures: fewer than three points, and the Eraser.
+    assert!(s.execute("paint.stroke", json!({"points": [[10, 10], [50, 10]], "fill": true})).is_err());
+    assert!(s.execute("paint.stroke", json!({"points": [[10, 10], [50, 10], [50, 50]], "fill": true, "erase": true})).is_err());
+    // One history step, like a normal stroke.
+    let before = s.active().unwrap().history.past_len();
+    s.execute("paint.stroke", json!({"points": [[12, 12], [48, 12], [48, 48], [12, 48]], "fill": true, "color": "#0000ff"})).unwrap();
+    assert_eq!(s.active().unwrap().history.past_len(), before + 1, "fill is one history step");
+}
+
+#[test]
+fn fill_is_rejected_with_clear_mode() {
+    // #3659 review: `"mode":"clear"` maps onto the eraser, so a clear fill would erase the region
+    // the outline encloses. Reject it; a selection + delete does that deliberately.
+    let mut s = session(60, 60);
+    let poly = json!([[10, 10], [50, 10], [50, 50], [10, 50]]);
+    assert!(s.execute("paint.stroke", json!({"points": poly.clone(), "fill": true, "mode": "clear"})).is_err());
+    // `clear` without `fill` still erases along the outline (main's behaviour), unchanged.
+    s.execute("paint.stroke", json!({"points": poly, "fill": true, "size": 4, "color": "#ff0000"})).unwrap();
+    assert!(rgba(&s, 30, 30)[3] > 0.9, "the region is filled first");
+    s.execute("paint.stroke", json!({"points": [[30, 2], [30, 58]], "size": 10, "mode": "clear"})).unwrap();
+    assert!(rgba(&s, 30, 30)[3] < 0.01, "a clear stroke erased what it crossed");
+    assert!(rgba(&s, 12, 30)[3] > 0.9, "pixels the clear stroke missed remain");
+}
+
+#[test]
+fn fill_soft_edge_has_no_step() {
+    // #3779: the feather (σ = 20 here) reaches 3σ = 60 px past the square; the fill's working
+    // bounds must reach as far, or the soft edge ends in a hard step where they clip it.
+    let mut s = session(200, 200);
+    s.execute(
+        "paint.stroke",
+        json!({"points": [[80, 80], [120, 80], [120, 120], [80, 120]], "fill": true, "size": 40, "color": "#ff0000", "brush": {"hardness": 0.0}}),
+    )
+    .unwrap();
+    assert!(rgba(&s, 57, 100)[3] > 0.0, "the fade continues past 1σ: {:?}", rgba(&s, 57, 100));
+    for x in 0..199 {
+        let (a, b) = (rgba(&s, x, 100)[3], rgba(&s, x + 1, 100)[3]);
+        assert!((a - b).abs() < 0.03, "step between x={x} ({a}) and x={} ({b})", x + 1);
+    }
+}
+
+#[test]
+fn fill_paints_a_cmyk_pick_with_the_picked_inks() {
+    // #3779: like a plain stroke (#4344), a fill paints a colour picked as CMYK as its inks.
+    let cyan = [1.0f32, 0.0, 0.0, 0.0];
+    let mut s = session(16, 16);
+    s.execute("image.mode.cmyk", json!({})).unwrap();
+    let rgb = photocraft_color::convert::cmyk_to_rgb(cyan).map(|c| c.clamp(0.0, 1.0));
+    s.execute("tools.setColors", json!({"foreground": rgb, "foregroundCmyk": cyan})).unwrap();
+    s.execute("paint.stroke", json!({"points": [[2, 2], [14, 2], [14, 14], [2, 14]], "fill": true, "hardness": 1.0})).unwrap();
+    let st = s.active().unwrap();
+    let surf = st.doc.layer(st.active_layer.unwrap()).unwrap().surface().unwrap();
+    let got: Vec<f32> = surf.read_region(Rect::new(8, 8, 9, 9)).into_iter().take(4).collect();
+    assert!(got.iter().zip(cyan).all(|(a, b)| (a - b).abs() < 0.02), "{got:?}");
+}
+
+#[test]
+fn fill_works_on_cmyk_and_16_and_32_bit() {
+    for (mode, depth) in [("cmyk", 8), ("rgb", 16), ("grayscale", 32)] {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 60, "height": 30, "mode": mode, "depth": depth})).unwrap();
+        s.execute("paint.stroke", json!({"points": [[10, 5], [50, 5], [50, 25], [10, 25]], "fill": true, "color": "#000000", "hardness": 1.0})).unwrap();
+        assert!(rgba(&s, 30, 15)[0] < 0.2, "{mode}/{depth}: {:?}", rgba(&s, 30, 15));
+        assert!(rgba(&s, 5, 15)[0] > 0.8, "{mode}/{depth} outside: {:?}", rgba(&s, 5, 15));
+    }
+}
+
 #[test]
 fn stroke_accepts_full_points_brush_and_preset() {
     let mut s = session(200, 100);
@@ -493,6 +580,23 @@ fn define_brush_from_selection() {
     assert!(rgba(&s, 30, 32)[3] > 0.9);
 }
 
+#[test]
+fn fill_survives_allocation_failure() {
+    // CodeRabbit on #9775: a fill's buffers span the region, up to the whole canvas. Their peak is
+    // reserved through the fallible allocator before any of them is built, so running out of
+    // memory is the fill's own error, leaving the pixels and history alone, never an abort.
+    let mut s = session(60, 60);
+    let pixels_before = surface(&s);
+    let history_before = s.active().unwrap().history.past_len();
+    crate::allocation::fail_next_for_test();
+    let result = s.execute("paint.stroke", json!({"points": [[10, 10], [50, 10], [50, 50], [10, 50]], "fill": true, "color": "#ff0000"}));
+    let _ = crate::allocation::capacity::<u8>(0, "reset failpoint");
+    let err = result.expect_err("an allocation failure must be reported, not panic").to_string();
+    assert!(err.contains("filling a painted region"), "the fill reserves its buffers first: {err}");
+    assert_eq!(surface(&s), pixels_before, "no pixels changed");
+    assert_eq!(s.active().unwrap().history.past_len(), history_before, "no history step was recorded");
+}
+
 #[test]
 fn define_brush_from_selection_survives_allocation_failure() {
     // The sampled tip is one f32 buffer over the whole selection, and the selection mask is a
diff --git a/crates/engine/src/cmd/channel_cmds.rs b/crates/engine/src/cmd/channel_cmds.rs
index 6beb64542e..a676c05d6f 100644
--- a/crates/engine/src/cmd/channel_cmds.rs
+++ b/crates/engine/src/cmd/channel_cmds.rs
@@ -113,6 +113,7 @@ mod view;
 use calc::{apply_image, calculations};
 use manage::{delete_channel, duplicate_channel, move_channel, new_channel, new_spot, options, rename_channel, set_visible};
 use planes::edit_mode;
+pub(crate) use planes::tone;
 pub use planes::{
     GraySurface, IsolatedCurveChannel, channel_format, color_count, filter_mask_curve_channel, isolated_curve_channel, isolated_curve_channel_for,
     next_alpha_name,
@@ -123,8 +124,9 @@ use selection::{load_selection, quick_mask, save_selection};
 use spot::{merge, merge_spot, mergeable, split};
 use targeting::{SLOT_KEY, target_cmd, target_slot};
 pub(crate) use targeting::{
-    Target, channel_surface_for_filter, clear_channel, clear_color_channel, color_restriction, edits_channel, filter_mask_layer, inject_target,
-    is_channel_target, mask_target_enabled, read_target_surface, restrict_to_color, routed, target_of, target_surface, targeted_channel, targeted_color,
+    Target, channel_surface_for_filter, clear_channel, clear_color_channel, color_restriction, edits_channel, filter_mask_layer, inject_target, invert_region,
+    is_channel_target, is_spot_target, mask_target_enabled, read_target_surface, restrict_to_color, routed, target_of, target_surface, targeted_channel,
+    targeted_color,
 };
 pub use targeting::{follows_filter_mask, follows_target};
 pub(crate) use view::fix_view;
diff --git a/crates/engine/src/cmd/channel_cmds/calc.rs b/crates/engine/src/cmd/channel_cmds/calc.rs
index 57e71cb360..9c1d0ea6b8 100644
--- a/crates/engine/src/cmd/channel_cmds/calc.rs
+++ b/crates/engine/src/cmd/channel_cmds/calc.rs
@@ -1,8 +1,8 @@
 use super::manage::gray_document;
-use super::planes::{channel_format, next_alpha_name, plane_surface, read_plane};
-use super::refs::{Blending, bad, mask_plane, source, source_spec};
-use super::targeting::{Target, is_channel_target, target_of, target_surface};
-use super::*;
+use super::planes::{channel_format, edit_mode, next_alpha_name, plane_surface, read_plane, tone};
+use super::refs::{Blending, bad, doc_index, mask_plane, source, source_spec};
+use super::targeting::{Target, is_channel_target, is_spot_target, target_of, target_surface};
+use super::{AlphaChannel, ColorMode, EngineError, Result, SelectionMode, Session, Value, json, sel};
 
 // ---------------------------------------------------------------------------------------------
 // Apply Image / Calculations
@@ -13,7 +13,11 @@ pub(super) fn apply_image(s: &mut Session, p: &Value) -> Result<Value> {
     let opacity = p.get("opacity").and_then(Value::as_f64).unwrap_or(100.0).clamp(0.0, 100.0) as f32 / 100.0;
     let preserve = p.get("preserveTransparency").and_then(Value::as_bool).unwrap_or(false);
     let src_spec = source_spec(p, "source", "source").unwrap_or_else(|| json!({}));
-    let src = source(s, &src_spec, cmd, false)?;
+    // A composite's planes are in its own document's mode, which may not be the target's.
+    let src_mode = s.documents().get(doc_index(s, &src_spec, "document")?).map(|d| edit_mode(&d.doc)).ok_or(EngineError::NoDocument)?;
+    // A CMYK composite reaches a channel or a layer mask as its luminosity, as Calculations reads
+    // it: its planes are ink, and an average of their tones would leave Black alone light gray.
+    let src = source(s, &src_spec, cmd, src_mode == ColorMode::Cmyk && (is_channel_target(p) || target_of(p) == Target::Mask))?;
     let mask = mask_plane(s, p, cmd)?;
     let layer = s.active().and_then(|d| d.active_layer);
     s.edit("Apply Image", |doc, _| {
@@ -22,12 +26,22 @@ pub(super) fn apply_image(s: &mut Session, p: &Value) -> Result<Value> {
         let weight = |i: usize| opacity * mask.as_ref().map_or(1.0, |m| m[i]) * selection.as_ref().map_or(1.0, |m| m[i]);
         let mask_target = target_of(p) == Target::Mask;
         if is_channel_target(p) || mask_target {
-            // A grayscale target gets the luminosity of a colour source (one plane).
+            // A grayscale target gets one plane: a CMYK composite's luminosity (above), the average of
+            // another composite's planes.
             let srcp =
                 if src.len() == 1 { src[0].clone() } else { (0..src[0].len()).map(|i| src.iter().map(|pl| pl[i]).sum::<f32>() / src.len() as f32).collect() };
+            let spot = is_spot_target(doc, p);
+            let ink = |v: f32| if spot { 1.0 - v } else { v };
             let (surf, _) = target_surface(doc, layer, p)?;
             let base = read_plane(surf, area);
-            let out: Vec<f32> = base.iter().enumerate().map(|(i, &b)| b + (blending.apply(b, srcp[i]) - b) * weight(i)).collect();
+            let out: Vec<f32> = base
+                .iter()
+                .enumerate()
+                .map(|(i, &b)| {
+                    let b = ink(b);
+                    ink(b + (blending.apply(b, srcp[i]) - b) * weight(i))
+                })
+                .collect();
             if mask_target {
                 // A layer mask keeps its default (reveal or hide) outside the canvas.
                 if surf.channels() != 1 {
@@ -64,9 +78,15 @@ pub(super) fn apply_image(s: &mut Session, p: &Value) -> Result<Value> {
             // source-over, so applying to an empty layer copies the source in any mode.
             let out_a = if preserve { base_a } else { w + base_a * (1.0 - w) };
             for (c, b) in px[..colors].iter_mut().enumerate() {
-                let top = src.get(c).unwrap_or(&src[0])[i];
-                let blended = top + (blending.apply(*b, top) - top) * base_a;
-                *b = if preserve { *b + (blended - *b) * w } else { (w * blended + base_a * (1.0 - w) * *b) / out_a };
+                // Blended as tone, as Photoshop does: a CMYK layer's ink turns into tone and back
+                // (Multiply darkens, so it adds ink). One plane (a channel, a mask) is a tone already.
+                // A CMYK composite onto another mode darkens each tone by its Black, so Black
+                // alone stays black.
+                let k = if src_mode == ColorMode::Cmyk && sf.mode != ColorMode::Cmyk { src.get(3).map_or(1.0, |pl| tone(src_mode, pl[i])) } else { 1.0 };
+                let top = if src.len() > 1 { tone(src_mode, src.get(c).unwrap_or(&src[0])[i]) * k } else { src[0][i] };
+                let base = tone(sf.mode, *b);
+                let blended = top + (blending.apply(base, top) - top) * base_a;
+                *b = tone(sf.mode, if preserve { base + (blended - base) * w } else { (w * blended + base_a * (1.0 - w) * base) / out_a });
             }
             if sf.alpha {
                 px[colors] = out_a;
diff --git a/crates/engine/src/cmd/channel_cmds/manage.rs b/crates/engine/src/cmd/channel_cmds/manage.rs
index 0aaa045cc7..9c81381bf4 100644
--- a/crates/engine/src/cmd/channel_cmds/manage.rs
+++ b/crates/engine/src/cmd/channel_cmds/manage.rs
@@ -3,7 +3,9 @@ use super::refs::{ChanRef, alpha_index, bad, doc_index, gray_plane, parse_ref};
 use super::selection::{uniform, unselected_surface};
 use super::targeting::target;
 use super::view::{ChannelTarget, QuickMaskOptions, color_names, composite_name, fix_view, touch};
-use super::*;
+use super::{
+    AlphaChannel, Color, ColorIndicates, ColorMode, DocState, Document, EngineError, Layer, PixelFormat, Result, Session, Surface, Value, json, list, sel,
+};
 
 // ---------------------------------------------------------------------------------------------
 // Channel management
diff --git a/crates/engine/src/cmd/channel_cmds/planes.rs b/crates/engine/src/cmd/channel_cmds/planes.rs
index f434a2fa7b..e027dbb3df 100644
--- a/crates/engine/src/cmd/channel_cmds/planes.rs
+++ b/crates/engine/src/cmd/channel_cmds/planes.rs
@@ -1,5 +1,5 @@
 use super::view::{ChannelTarget, color_names};
-use super::*;
+use super::{ColorMode, DocState, Document, PixelFormat, Rect, Surface};
 
 /// The Curves dialog's Channel popup lists only this channel when the Channels panel has a
 /// single non-composite target (a colour component, layer mask, saved channel or Quick Mask).
@@ -133,6 +133,13 @@ pub(super) fn materialize(s: &mut Surface, r: Rect) {
     s.write_region(r, &v);
 }
 
+/// A colour channel sample as the Channels panel shows it: CMYK stores ink (1 = full ink) but a
+/// CMYK channel reads as its tone (white = no ink), as in Photoshop. Its own inverse, so it also
+/// turns a tone back into ink. Other modes are unchanged.
+pub(crate) fn tone(mode: ColorMode, v: f32) -> f32 {
+    if mode == ColorMode::Cmyk { 1.0 - v } else { v }
+}
+
 pub(super) fn luminosity(rgba: [f32; 4]) -> f32 {
     0.299 * rgba[0] + 0.587 * rgba[1] + 0.114 * rgba[2]
 }
diff --git a/crates/engine/src/cmd/channel_cmds/refs.rs b/crates/engine/src/cmd/channel_cmds/refs.rs
index 876fa0b49b..58708475da 100644
--- a/crates/engine/src/cmd/channel_cmds/refs.rs
+++ b/crates/engine/src/cmd/channel_cmds/refs.rs
@@ -1,6 +1,6 @@
-use super::planes::{color_count, edit_mode, luminosity, read_plane};
+use super::planes::{color_count, edit_mode, luminosity, read_plane, tone};
 use super::view::{color_names, composite_name};
-use super::*;
+use super::{BlendMode, Document, EngineError, LayerContent, LayerId, Result, Session, Value, blend_channel, from_rgba, sel, to_rgba};
 
 // ---------------------------------------------------------------------------------------------
 // Channel references
@@ -127,11 +127,19 @@ fn ref_planes(doc: &Document, layer: Option<LayerId>, active: Option<LayerId>, r
             let (px, n) = native_pixels(doc, layer)?;
             let planes: Vec<Vec<f32>> = (0..colors).map(|c| px.chunks_exact(n).map(|p| p[c]).collect()).collect();
             match r {
-                ChanRef::Color(k) => vec![planes.get(k).cloned().ok_or_else(|| EngineError::Other(format!("no colour channel {k}")))?],
+                ChanRef::Color(k) => {
+                    let plane = planes.get(k).ok_or_else(|| EngineError::Other(format!("no colour channel {k}")))?;
+                    vec![plane.iter().map(|&v| tone(edit_mode(doc), v)).collect()]
+                }
                 _ => planes,
             }
         }
-        ChanRef::Alpha(i) => vec![read_plane(&doc.channels.get(i).ok_or_else(|| EngineError::Other(format!("no alpha channel {i}")))?.surface, area)],
+        ChanRef::Alpha(i) => {
+            let ch = doc.channels.get(i).ok_or_else(|| EngineError::Other(format!("no alpha channel {i}")))?;
+            let plane = read_plane(&ch.surface, area);
+            // A spot channel stores ink (1 = solid) but reads as its tone, as in Photoshop.
+            vec![if ch.spot.is_some() { plane.into_iter().map(|v| 1.0 - v).collect() } else { plane }]
+        }
         ChanRef::QuickMask => vec![read_plane(&doc.quick_mask.as_ref().ok_or_else(|| EngineError::Other("not in Quick Mask mode".into()))?.surface, area)],
         ChanRef::Selection => vec![sel::mask_from_surface(doc.selection.as_ref(), area)],
         ChanRef::Transparency => {
diff --git a/crates/engine/src/cmd/channel_cmds/selection.rs b/crates/engine/src/cmd/channel_cmds/selection.rs
index 9a24b9fe56..a49c551d2f 100644
--- a/crates/engine/src/cmd/channel_cmds/selection.rs
+++ b/crates/engine/src/cmd/channel_cmds/selection.rs
@@ -1,7 +1,7 @@
 use super::planes::{channel_format, next_alpha_name, plane_surface, read_plane};
 use super::refs::{ChanRef, bad, doc_index, parse_ref, source};
 use super::view::{ChannelTarget, QuickMaskOptions};
-use super::*;
+use super::{AlphaChannel, ColorIndicates, Document, EngineError, PixelFormat, Rect, Result, SelectionMode, Session, Surface, Value, json, operation, sel};
 
 pub(super) fn save_selection(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "select.saveSelection";
diff --git a/crates/engine/src/cmd/channel_cmds/spot.rs b/crates/engine/src/cmd/channel_cmds/spot.rs
index a3fefee98a..773089faad 100644
--- a/crates/engine/src/cmd/channel_cmds/spot.rs
+++ b/crates/engine/src/cmd/channel_cmds/spot.rs
@@ -1,8 +1,8 @@
 use super::manage::{fix_view_now, gray_document};
-use super::planes::{channel_format, edit_mode, plane_surface, read_plane};
+use super::planes::{channel_format, edit_mode, plane_surface, read_plane, tone};
 use super::refs::{ChanRef, alpha_index, bad, gray_plane, native_pixels};
 use super::view::{ChannelTarget, ChannelView, color_names};
-use super::*;
+use super::{AlphaChannel, ColorMode, DocState, Document, EngineError, Layer, Result, Session, Value, from_rgba, json};
 
 /// Merge Spot Channel: flattens the image and prints the spot ink into the colour channels.
 pub(super) fn merge_spot(s: &mut Session, p: &Value) -> Result<Value> {
@@ -66,7 +66,7 @@ pub(super) fn split(s: &mut Session, p: &Value) -> Result<Value> {
     let short = |name: &str| name.chars().next().map(|c| c.to_ascii_uppercase().to_string()).unwrap_or_default();
     let mut docs: Vec<Document> = Vec::new();
     for (c, name) in names.iter().enumerate() {
-        let plane: Vec<f32> = px.chunks_exact(n).map(|p| p[c]).collect();
+        let plane: Vec<f32> = px.chunks_exact(n).map(|p| tone(mode, p[c])).collect();
         docs.push(gray_document(&format!("{}_{}", doc.name, short(name)), &doc, &plane));
     }
     for ch in &doc.channels {
@@ -133,7 +133,7 @@ pub(super) fn merge(s: &mut Session, p: &Value) -> Result<Value> {
     let mut data = Vec::with_capacity(npx * fmt.channels());
     for i in 0..npx {
         for pl in &planes[..cc] {
-            data.push(pl[i].clamp(0.0, 1.0));
+            data.push(tone(mode, pl[i]).clamp(0.0, 1.0));
         }
         data.push(1.0);
     }
diff --git a/crates/engine/src/cmd/channel_cmds/targeting.rs b/crates/engine/src/cmd/channel_cmds/targeting.rs
index ce131cd43a..34e1f269fb 100644
--- a/crates/engine/src/cmd/channel_cmds/targeting.rs
+++ b/crates/engine/src/cmd/channel_cmds/targeting.rs
@@ -2,7 +2,7 @@ use super::manage::fix_view_now;
 use super::planes::{color_count, materialize};
 use super::refs::{ChanRef, bad, parse_ref};
 use super::view::ChannelTarget;
-use super::*;
+use super::{ColorMode, Document, EngineError, Layer, LayerId, Rect, Result, Session, Surface, TileCoord, Value, from_rgba, json, list};
 
 // ---------------------------------------------------------------------------------------------
 // Targets for pixel commands
@@ -37,6 +37,19 @@ pub(crate) fn is_channel_target(p: &Value) -> bool {
     matches!(target_of(p), Target::Alpha(_) | Target::QuickMask)
 }
 
+/// The target is a spot channel: it stores ink but takes tone, as it reads.
+pub(crate) fn is_spot_target(doc: &Document, p: &Value) -> bool {
+    matches!(target_of(p), Target::Alpha(i) if doc.channels.get(i).is_some_and(|c| c.spot.is_some()))
+}
+
+/// Inverts `r` of a channel surface (ink to tone and back).
+pub(crate) fn invert_region(s: &mut Surface, r: Rect) -> Result<()> {
+    let mut v = crate::allocation::read_region(s, r, "inverting a channel")?;
+    v.iter_mut().for_each(|x| *x = 1.0 - *x);
+    s.try_write_region(r, &v)?;
+    Ok(())
+}
+
 /// The surface a pixel command writes to and whether the layer's transparency is locked.
 pub(crate) fn target_surface<'a>(doc: &'a mut Document, layer: Option<LayerId>, p: &Value) -> Result<(&'a mut Surface, bool)> {
     match target_of(p) {
diff --git a/crates/engine/src/cmd/channel_cmds/tests.rs b/crates/engine/src/cmd/channel_cmds/tests.rs
index 2ae1bd94b0..079b2e4c86 100644
--- a/crates/engine/src/cmd/channel_cmds/tests.rs
+++ b/crates/engine/src/cmd/channel_cmds/tests.rs
@@ -120,6 +120,38 @@ fn load_transparency_mask_and_composite() {
     assert_eq!(sel_at(&s, 10, 5), 1.0);
 }
 
+/// A white CMYK document (no ink anywhere) whose left half carries some cyan ink.
+fn cmyk_session(depth: u32) -> Session {
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 40, "height": 20, "mode": "cmyk", "depth": depth, "background": "white"})).unwrap();
+    rect(&mut s, 0, 0, 20, 20, "replace");
+    s.execute("edit.fill", json!({"color": "#00ffff"})).unwrap();
+    s.execute("select.deselect", json!({})).unwrap();
+    s
+}
+
+#[test]
+fn cmyk_channels_duplicate_and_load_as_tone_not_ink() {
+    // #5787: a CMYK channel is its tone, as the Channels panel draws it: white where there is no ink.
+    // (The merged image goes through RGB, so inked pixels may drift a few levels.)
+    for depth in [8, 16] {
+        let mut s = cmyk_session(depth);
+        let ink = px(&s, 5, 5)[0];
+        assert!(ink > 0.5 && px(&s, 30, 5)[0] == 0.0, "depth {depth}: cyan ink on the left only, {ink}");
+        s.execute("channel.duplicate", json!({"channel": "cyan"})).unwrap();
+        assert_eq!(doc(&s).channels[0].name, "Cyan copy");
+        assert!((chan(&s, 0, 30, 5) - 1.0).abs() < 1e-3, "depth {depth}: no ink duplicates as white");
+        assert!((chan(&s, 0, 5, 5) - (1.0 - ink)).abs() < 0.02, "depth {depth}: ink duplicates dark");
+        s.execute("select.loadSelection", json!({"channel": "cyan"})).unwrap();
+        assert!((sel_at(&s, 30, 5) - 1.0).abs() < 1e-3, "depth {depth}: no ink is selected");
+        assert!((sel_at(&s, 5, 5) - (1.0 - ink)).abs() < 0.02, "depth {depth}");
+        // Calculations read the same tone.
+        let r = s.execute("image.calculations", json!({"source1": {"channel": "cyan"}, "source2": {"channel": "cyan"}, "blending": "normal"})).unwrap();
+        let i = r["channel"].as_u64().unwrap() as usize;
+        assert!((chan(&s, i, 30, 5) - 1.0).abs() < 1e-3, "depth {depth}");
+    }
+}
+
 #[test]
 fn channel_management_and_view_state() {
     let mut s = session();
@@ -627,6 +659,166 @@ fn apply_image_into_alpha_channel() {
     assert!(chan(&s, 0, 3, 3) < 0.01);
 }
 
+#[test]
+fn cmyk_apply_image_of_a_colour_channel_keeps_ink_and_tone_apart() {
+    // #5787: the Cyan channel is read as tone and written back as ink, so applying it onto its own
+    // CMYK layer leaves cyan as it was, and into an alpha channel it lands as tone. (The merged
+    // image goes through RGB, so a few levels of drift are allowed.)
+    for depth in [8, 16] {
+        let mut s = cmyk_session(depth);
+        let before = (px(&s, 5, 5), px(&s, 30, 5));
+        s.execute("image.applyImage", json!({"source": {"channel": "cyan"}, "blending": "normal"})).unwrap();
+        let after = px(&s, 5, 5);
+        assert!((after[0] - before.0[0]).abs() < 0.02, "depth {depth}: cyan unchanged, {after:?} vs {:?}", before.0);
+        assert!(px(&s, 30, 5).iter().zip(&before.1).all(|(a, b)| (a - b).abs() < 1e-3), "depth {depth}: no ink stays no ink");
+        s.undo();
+        s.execute("image.applyImage", json!({"blending": "normal"})).unwrap();
+        assert!(px(&s, 5, 5).iter().zip(&before.0).all(|(a, b)| (a - b).abs() < 0.02), "depth {depth}: CMYK onto itself is a no-op");
+        s.execute("channel.new", json!({"fill": "black"})).unwrap();
+        s.execute("image.applyImage", json!({"source": {"channel": "cyan"}, "blending": "normal"})).unwrap();
+        assert!((chan(&s, 0, 30, 5) - 1.0).abs() < 1e-3, "depth {depth}: tone into an alpha channel");
+    }
+}
+
+#[test]
+fn cmyk_apply_image_blends_as_tone() {
+    // Photoshop blends a CMYK layer as tone: Multiply (the default) with a white source changes
+    // nothing, and Multiply with Cyan multiplies every channel's tone by Cyan's, so it adds ink.
+    // A spot channel reads as tone too: its solid ink applies as full ink and isn't selected.
+    for depth in [8, 16] {
+        let mut s = cmyk_session(depth);
+        let (left, right) = (px(&s, 5, 5), px(&s, 30, 5));
+        let near = |a: &[f32], b: &[f32]| a.iter().zip(b).all(|(x, y)| (x - y).abs() < 0.01);
+        s.execute("channel.new", json!({"fill": "white"})).unwrap();
+        s.execute("channel.target", json!({"channel": "composite"})).unwrap();
+        s.execute("image.applyImage", json!({"source": {"channel": 0}})).unwrap();
+        assert!(near(&px(&s, 5, 5), &left), "depth {depth}: white multiplies to no change, {:?} vs {left:?}", px(&s, 5, 5));
+        s.undo();
+        s.execute("image.applyImage", json!({"source": {"channel": "cyan"}, "blending": "multiply"})).unwrap();
+        let want: Vec<f32> = left[..4].iter().map(|&ink| 1.0 - (1.0 - ink) * (1.0 - left[0])).chain([1.0]).collect();
+        assert!(near(&px(&s, 5, 5), &want), "depth {depth}: {:?} vs {want:?}", px(&s, 5, 5));
+        assert!(near(&px(&s, 30, 5), &right), "depth {depth}: no ink stays no ink");
+        s.undo();
+        rect(&mut s, 0, 0, 20, 20, "replace");
+        let r = s.execute("channel.newSpot", json!({"color": "#ff00ff", "solidity": 100})).unwrap();
+        let spot = r["channel"].as_u64().unwrap();
+        s.execute("select.deselect", json!({})).unwrap();
+        s.execute("channel.target", json!({"channel": "composite"})).unwrap();
+        s.execute("image.applyImage", json!({"source": {"channel": spot}, "blending": "normal"})).unwrap();
+        assert!(near(&px(&s, 5, 5), &[1.0; 5]) && near(&px(&s, 30, 5), &right), "depth {depth}: spot ink applies as ink, {:?}", px(&s, 5, 5));
+        s.execute("select.loadSelection", json!({"channel": spot})).unwrap();
+        assert!(sel_at(&s, 5, 5) < 1e-3 && (sel_at(&s, 30, 5) - 1.0).abs() < 1e-3, "depth {depth}: the spot's unprinted area loads");
+    }
+}
+
+#[test]
+fn apply_image_onto_a_spot_channel_blends_as_tone() {
+    let near = |a: &[f32], b: &[f32]| a.len() == b.len() && a.iter().zip(b).all(|(x, y)| (x - y).abs() < 0.01);
+    // #5787: a spot channel stores ink but reads and takes tone, so the spot applied onto itself
+    // changes nothing (Normal or Multiply), and Cyan applied onto it gives it Cyan's ink.
+    for depth in [8, 16] {
+        let mut s = cmyk_session(depth);
+        let cyan = px(&s, 5, 5)[0];
+        rect(&mut s, 0, 0, 10, 20, "replace");
+        let spot = s.execute("channel.newSpot", json!({"color": "#ff00ff", "solidity": 100})).unwrap()["channel"].as_u64().unwrap();
+        s.execute("select.deselect", json!({})).unwrap();
+        let ink = |s: &Session| [5, 15, 30].map(|x| chan(s, spot as usize, x, 5));
+        let before = ink(&s);
+        assert!(near(&before, &[1.0, 0.0, 0.0]), "depth {depth}: {before:?}");
+        for blending in ["normal", "multiply"] {
+            s.execute("image.applyImage", json!({"source": {"channel": spot}, "blending": blending, "target": {"channel": spot}})).unwrap();
+            assert!(near(&ink(&s), &before), "depth {depth}: {blending} onto itself, {:?}", ink(&s));
+        }
+        s.execute("image.applyImage", json!({"source": {"channel": "cyan"}, "blending": "normal", "target": {"channel": spot}})).unwrap();
+        assert!(near(&ink(&s), &[cyan, cyan, 0.0]), "depth {depth}: Cyan's ink, {:?}", ink(&s));
+    }
+}
+
+#[test]
+fn apply_image_from_an_rgb_document_onto_cmyk_reads_it_in_its_own_mode() {
+    let near = |a: &[f32], b: &[f32]| a.len() == b.len() && a.iter().zip(b).all(|(x, y)| (x - y).abs() < 0.01);
+    // #5787: an RGB composite is tone in RGB terms: white multiplied (the default) onto a CMYK
+    // layer changes nothing.
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 40, "height": 20, "background": "white"})).unwrap();
+    s.execute("file.new", json!({"width": 40, "height": 20, "mode": "cmyk", "background": "white"})).unwrap();
+    rect(&mut s, 0, 0, 20, 20, "replace");
+    s.execute("edit.fill", json!({"color": "#00ffff"})).unwrap();
+    s.execute("select.deselect", json!({})).unwrap();
+    let before = (px(&s, 5, 5), px(&s, 30, 5));
+    s.execute("image.applyImage", json!({"source": {"document": 0}})).unwrap();
+    assert!(near(&px(&s, 5, 5), &before.0) && near(&px(&s, 30, 5), &before.1), "{:?} vs {before:?}", (px(&s, 5, 5), px(&s, 30, 5)));
+}
+
+#[test]
+fn apply_image_of_a_cmyk_composite_onto_a_spot_channel_blends_as_tone() {
+    // #5787: the CMYK composite stores ink, so its white has none: applied in Normal onto an empty
+    // spot channel, the spot stays empty on the white and takes ink on the Cyan.
+    for depth in [8, 16] {
+        let mut s = cmyk_session(depth);
+        let spot = s.execute("channel.newSpot", json!({"color": "#ff00ff", "solidity": 100})).unwrap()["channel"].as_u64().unwrap() as usize;
+        s.execute("image.applyImage", json!({"blending": "normal", "target": {"channel": spot}})).unwrap();
+        let (cyan, white) = (chan(&s, spot, 5, 5), chan(&s, spot, 30, 5));
+        assert!(white < 0.01 && cyan > 0.1 && cyan < 0.9, "depth {depth}: cyan {cyan}, white {white}");
+    }
+}
+
+#[test]
+fn apply_image_of_a_cmyk_composite_onto_rgb_keeps_black() {
+    // #5787: Black alone (no C, M or Y) applied from a CMYK document onto RGB stays black, and
+    // the CMYK white stays white (the merged image goes through RGB, so a few levels of drift).
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 40, "height": 20, "mode": "cmyk", "background": "white"})).unwrap();
+    {
+        let d = s.active_mut().unwrap();
+        let id = d.active_layer.unwrap();
+        let surf = std::sync::Arc::make_mut(&mut d.doc).layer_mut(id).unwrap().surface_mut().unwrap();
+        let n = surf.format().channels();
+        let mut k = vec![0.0; 20 * 20 * n];
+        k.chunks_exact_mut(n).for_each(|p| p[3] = 1.0);
+        surf.write_region(Rect::new(0, 0, 20, 20), &k);
+    }
+    s.execute("file.new", json!({"width": 40, "height": 20, "background": "white"})).unwrap();
+    s.execute("image.applyImage", json!({"source": {"document": 0}, "blending": "normal"})).unwrap();
+    let (black, white) = (px(&s, 5, 5), px(&s, 30, 5));
+    assert!(black[..3].iter().all(|&v| v < 0.05), "{black:?}");
+    assert!(white[..3].iter().all(|&v| v > 0.95), "{white:?}");
+}
+
+#[test]
+fn apply_image_of_a_cmyk_composite_onto_an_alpha_channel_takes_its_luminosity() {
+    // #5787: a CMYK composite reaches a channel as its luminosity, as Calculations reads it, so
+    // Black alone stays dark and white stays white.
+    for depth in [8, 16] {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 40, "height": 20, "mode": "cmyk", "depth": depth, "background": "white"})).unwrap();
+        {
+            let d = s.active_mut().unwrap();
+            let id = d.active_layer.unwrap();
+            let surf = std::sync::Arc::make_mut(&mut d.doc).layer_mut(id).unwrap().surface_mut().unwrap();
+            let n = surf.format().channels();
+            let mut k = vec![1.0; 20 * 20 * n];
+            k.chunks_exact_mut(n).for_each(|p| p[..3].fill(0.0));
+            surf.write_region(Rect::new(0, 0, 20, 20), &k);
+        }
+        let a = s.execute("channel.new", json!({})).unwrap()["channel"].as_u64().unwrap() as usize;
+        s.execute("image.applyImage", json!({"blending": "normal", "target": {"channel": a}})).unwrap();
+        let b = s.execute("image.calculations", json!({"source1": {}, "source2": {}, "blending": "normal"})).unwrap()["channel"].as_u64().unwrap() as usize;
+        let (black, white) = (chan(&s, a, 5, 5), chan(&s, a, 30, 5));
+        assert!(black < 0.25 && (white - 1.0).abs() < 1e-3, "depth {depth}: black {black}, white {white}");
+        assert!((black - chan(&s, b, 5, 5)).abs() < 1e-3, "depth {depth}: as Calculations reads it");
+        // A targeted layer mask is a grayscale target too: it takes the same luminosity.
+        s.execute("layer.new.layer", json!({})).unwrap();
+        s.execute("layer.layerMask.revealAll", json!({})).unwrap();
+        s.execute("channel.target", json!({"channel": "mask"})).unwrap();
+        s.execute("image.applyImage", json!({"blending": "normal"})).unwrap();
+        let d = s.active().unwrap();
+        let m = &d.doc.layer(d.active_layer.unwrap()).unwrap().mask.as_ref().unwrap().surface;
+        let (mb, mw) = (m.sample_channel(5, 5, 0), m.sample_channel(30, 5, 0));
+        assert!((mb - black).abs() < 1e-3 && (mw - 1.0).abs() < 1e-3, "depth {depth}: mask black {mb}, white {mw}");
+    }
+}
+
 #[test]
 fn apply_image_into_targeted_layer_mask_leaves_the_pixels() {
     let mut s = session();
@@ -706,6 +898,30 @@ fn split_and_merge_channels() {
     assert!(s.execute("channel.merge", json!({"mode": "cmyk"})).is_err());
 }
 
+#[test]
+fn cmyk_split_and_merge_use_tone() {
+    // #5787: Split Channels of a white CMYK image gives white grayscale documents, and merging
+    // them back gives the same CMYK pixels (within the few levels the merged image's trip
+    // through RGB costs).
+    for depth in [8, 16] {
+        let mut s = cmyk_session(depth);
+        let (left, right) = (px(&s, 5, 5), px(&s, 30, 5));
+        s.execute("channel.split", json!({})).unwrap();
+        assert_eq!(s.documents().len(), 4);
+        let v = |s: &Session, i: usize, x: i32| s.documents()[i].doc.layers[0].surface().unwrap().pixel(x, 5)[0];
+        for i in 0..4 {
+            assert!((v(&s, i, 30) - 1.0).abs() < 1e-3, "depth {depth}: channel {i} of white is white");
+        }
+        assert!((v(&s, 0, 5) - (1.0 - left[0])).abs() < 0.02, "depth {depth}: cyan ink splits dark");
+        s.set_active(0);
+        s.execute("channel.merge", json!({"mode": "cmyk", "documents": [0, 1, 2, 3]})).unwrap();
+        assert_eq!(doc(&s).mode, ColorMode::Cmyk);
+        let near = |a: &[f32], b: &[f32]| a.iter().zip(b).all(|(x, y)| (x - y).abs() < 0.02);
+        assert!(near(&px(&s, 5, 5), &left), "depth {depth}: round trip {:?} vs {left:?}", px(&s, 5, 5));
+        assert!(near(&px(&s, 30, 5), &right), "depth {depth}: white stays white {:?}", px(&s, 30, 5));
+    }
+}
+
 #[test]
 fn merge_rejects_a_repeated_source_and_keeps_unrelated_documents() {
     // #934: `documents: [0, 0, 1]` passed validation, then the close loop ran `close(1)`,
diff --git a/crates/engine/src/cmd/channel_cmds/view.rs b/crates/engine/src/cmd/channel_cmds/view.rs
index 12afd4e9ce..e93be8ff0a 100644
--- a/crates/engine/src/cmd/channel_cmds/view.rs
+++ b/crates/engine/src/cmd/channel_cmds/view.rs
@@ -1,5 +1,5 @@
 use super::planes::color_count;
-use super::*;
+use super::{AlphaChannel, Color, ColorIndicates, ColorMode, DocState, Document, Serialize};
 
 // ---------------------------------------------------------------------------------------------
 // View state
diff --git a/crates/engine/src/cmd/edit_cmds.rs b/crates/engine/src/cmd/edit_cmds.rs
index eb77590999..71800c63c6 100644
--- a/crates/engine/src/cmd/edit_cmds.rs
+++ b/crates/engine/src/cmd/edit_cmds.rs
@@ -403,7 +403,7 @@ fn paste(s: &mut Session, p: &Value, in_place: bool) -> Result<Value> {
     let id = s.edit("Paste", |doc, active| {
         let mut l = Layer::raster(doc.next_layer_name("Layer"), target);
         *crate::pixels_mut(&mut l)? = surf;
-        let id = doc.insert_above(*active, l);
+        let id = crate::layer_place::insert_new(doc, *active, l, crate::layer_place::Place::AutoEditable);
         *active = Some(id);
         doc.selection = None;
         Ok(id)
@@ -445,9 +445,13 @@ fn paste_layers(s: &mut Session, layers: &Document, dx: i32, dy: i32) -> Result<
     let id = s.edit("Paste", |doc, active| {
         doc.patterns.extend(patterns);
         doc.metadata.psd_global_blocks.extend(linked);
+        // The first pasted layer goes where a new layer would; the rest stack above it.
+        let mut place = crate::layer_place::Place::AutoEditable;
         for l in copies.layers {
-            *active = Some(doc.insert_above(*active, l));
+            *active = Some(crate::layer_place::insert_new(doc, *active, l, place));
+            place = crate::layer_place::Place::Above;
         }
+        crate::cmd::layer_multi_cmds::check_group_depth(doc, "Paste")?;
         doc.selection = None;
         active.ok_or(EngineError::Other("nothing to paste".into()))
     })?;
@@ -506,8 +510,16 @@ pub(crate) fn paste_to_target(s: &mut Session, p: &Value, in_place: bool, limit:
     let src = shifted(&clip.surface, dx, dy);
     let area = src.content_bounds().intersect(&canvas);
     s.edit(label, |doc, _| {
+        // A spot channel stores ink: the paste goes over its tone, then back to ink (#5787).
+        let spot = crate::channel_cmds::is_spot_target(doc, p);
         let (surf, _) = crate::channel_cmds::target_surface(doc, layer, p)?;
+        if spot {
+            crate::channel_cmds::invert_region(surf, area)?;
+        }
         crate::fill_cmds::composite_over(surf, &src, area, limit)?;
+        if spot {
+            crate::channel_cmds::invert_region(surf, area)?;
+        }
         surf.prune();
         doc.selection = None;
         Ok(())
@@ -579,7 +591,7 @@ fn layer_via(s: &mut Session, cut: bool) -> Result<Value> {
         }
         let mut l = Layer::raster(doc.next_layer_name("Layer"), clip.surface.format());
         *crate::pixels_mut(&mut l)? = clip.surface;
-        let nid = doc.insert_above(Some(id), l);
+        let nid = crate::layer_place::insert_new(doc, Some(id), l, crate::layer_place::Place::Above);
         *active = Some(nid);
         // Photoshop deselects: a following Free Transform moves the whole new layer (#1096).
         doc.selection = None;
@@ -761,11 +773,8 @@ fn transform_again_copy(s: &mut Session) -> Result<Value> {
         Err(e) => {
             // The copy (e.g. of a layer whose position is locked) couldn't be transformed: take
             // it back, leaving nothing to redo and no Duplicate step to record.
-            s.undo();
+            s.rollback();
             s.journal.truncate(journal);
-            if let Some(st) = s.active_mut() {
-                st.history.clear_redo();
-            }
             Err(e)
         }
     }
diff --git a/crates/engine/src/cmd/edit_cmds/tests.rs b/crates/engine/src/cmd/edit_cmds/tests.rs
index e632d9fb71..ec9a9fa8b7 100644
--- a/crates/engine/src/cmd/edit_cmds/tests.rs
+++ b/crates/engine/src/cmd/edit_cmds/tests.rs
@@ -1138,6 +1138,31 @@ fn transform_again_on_a_copy_steps_and_repeats() {
     assert!(!s.active().unwrap().history.can_redo(), "nothing to redo");
 }
 
+/// History Options › Allow Non-Linear History: the Duplicate step of a refused Transform
+/// Again on a copy moved the later states in front of it; taking it back must restore the
+/// document before the command and the History list as it was, not land on a later state.
+#[test]
+fn a_refused_transform_again_on_a_copy_rolls_back_exactly_in_non_linear_history() {
+    let mut s = session();
+    s.execute("history.options", json!({"allowNonLinearHistory": true})).unwrap();
+    s.execute("edit.transform", json!({"matrix": [1, 0, 0, 1, 10, 0]})).unwrap();
+    let id = s.active().unwrap().active_layer.unwrap();
+    s.execute("layer.setProps", json!({"layer": id.0, "locks": {"position": true}})).unwrap();
+    s.execute("layer.setProps", json!({"layer": id.0, "opacity": 0.5})).unwrap();
+    s.execute("layer.setProps", json!({"layer": id.0, "opacity": 0.25})).unwrap();
+    s.undo();
+    s.undo();
+    let st = s.active().unwrap();
+    let (doc, entries) = (st.doc.clone(), st.history.entries());
+    let redo: Vec<String> = st.history.redo_labels().map(str::to_string).collect();
+    assert_eq!(redo.len(), 2);
+    assert!(s.execute("edit.transform.againCopy", json!({})).unwrap_err().to_string().contains("locked"));
+    let st = s.active().unwrap();
+    assert!(std::sync::Arc::ptr_eq(&st.doc, &doc), "the document before the command");
+    assert_eq!(st.history.entries(), entries);
+    assert_eq!(st.history.redo_labels().map(str::to_string).collect::<Vec<_>>(), redo);
+}
+
 #[test]
 fn toggle_last_state_and_transform_again() {
     let mut s = session();
diff --git a/crates/engine/src/cmd/edit_menu_cmds/content_aware.rs b/crates/engine/src/cmd/edit_menu_cmds/content_aware.rs
index 0fe3cedd3f..928f315bdf 100644
--- a/crates/engine/src/cmd/edit_menu_cmds/content_aware.rs
+++ b/crates/engine/src/cmd/edit_menu_cmds/content_aware.rs
@@ -1,4 +1,7 @@
-use super::*;
+use super::{
+    Document, EngineError, Layer, LayerId, PixelFormat, Rect, Result, Session, Surface, Value, bad, bool_or, from_rgba_into, int, json, pixel_layer,
+    pixel_layer_id, str_or, to_rgba, writable_surface,
+};
 
 // ------------------------------------------------------------------ Content-Aware Fill
 
@@ -503,7 +506,7 @@ fn apply_content_aware_fill(s: &mut Session, label: &str, id: LayerId, output: &
                     s.write_region(window, &px);
                     s.prune();
                 }
-                let nid = doc.insert_above(Some(id), l);
+                let nid = crate::layer_place::insert_new(doc, Some(id), l, crate::layer_place::Place::Above);
                 *active = Some(nid);
                 return Ok(nid);
             }
diff --git a/crates/engine/src/cmd/edit_menu_cmds/content_aware_scale.rs b/crates/engine/src/cmd/edit_menu_cmds/content_aware_scale.rs
index 998f30821a..e0d05742df 100644
--- a/crates/engine/src/cmd/edit_menu_cmds/content_aware_scale.rs
+++ b/crates/engine/src/cmd/edit_menu_cmds/content_aware_scale.rs
@@ -1,5 +1,7 @@
 use super::content_aware::channel_mask;
-use super::*;
+use super::{
+    Document, EngineError, LayerId, PixelFormat, Rect, Result, Session, Surface, Value, bad, bool_or, f32_or, json, pixel_layer, to_rgba, writable_surface,
+};
 
 // ------------------------------------------------------------------ Content-Aware Scale
 
diff --git a/crates/engine/src/cmd/edit_menu_cmds/fade.rs b/crates/engine/src/cmd/edit_menu_cmds/fade.rs
index 5ab5e4455b..14f9b8365d 100644
--- a/crates/engine/src/cmd/edit_menu_cmds/fade.rs
+++ b/crates/engine/src/cmd/edit_menu_cmds/fade.rs
@@ -1,4 +1,7 @@
-use super::*;
+use super::{
+    BlendMode, EngineError, FadeTarget, Rect, Result, Session, Surface, Value, bad, blend_from_str, f32_or, from_rgba_into, json, str_or, surface_of,
+    surface_of_mut, to_rgba,
+};
 
 // ------------------------------------------------------------------ Fade
 
diff --git a/crates/engine/src/cmd/edit_menu_cmds/find_replace.rs b/crates/engine/src/cmd/edit_menu_cmds/find_replace.rs
index 91f16950f1..4b9e3ace73 100644
--- a/crates/engine/src/cmd/edit_menu_cmds/find_replace.rs
+++ b/crates/engine/src/cmd/edit_menu_cmds/find_replace.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Document, EngineError, LayerContent, LayerId, Result, Session, Value, bad, bool_or, json, layer_param, str_or};
 
 // ------------------------------------------------------------------ Find and Replace Text
 
diff --git a/crates/engine/src/cmd/edit_menu_cmds/presets.rs b/crates/engine/src/cmd/edit_menu_cmds/presets.rs
index 8f26426287..abc3a61172 100644
--- a/crates/engine/src/cmd/edit_menu_cmds/presets.rs
+++ b/crates/engine/src/cmd/edit_menu_cmds/presets.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{CustomShape, Deserialize, Document, EngineError, LayerContent, LayerId, Path, Result, Serialize, Session, Value, bad, json, str_or};
 
 // ------------------------------------------------------------------ Define Brush / Custom Shape
 
diff --git a/crates/engine/src/cmd/edit_menu_cmds/purge.rs b/crates/engine/src/cmd/edit_menu_cmds/purge.rs
index a422e82bfb..ae0a090a40 100644
--- a/crates/engine/src/cmd/edit_menu_cmds/purge.rs
+++ b/crates/engine/src/cmd/edit_menu_cmds/purge.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Result, Session, Value, json};
 
 // ------------------------------------------------------------------ Purge
 
diff --git a/crates/engine/src/cmd/enabled.rs b/crates/engine/src/cmd/enabled.rs
index c609b9e0ba..f7b4f00737 100644
--- a/crates/engine/src/cmd/enabled.rs
+++ b/crates/engine/src/cmd/enabled.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Document, EngineError, LayerContent, LayerId, Result, Session, Value};
 
 pub(crate) fn always(_: &Session) -> std::result::Result<(), String> {
     Ok(())
diff --git a/crates/engine/src/cmd/extra_cmds.rs b/crates/engine/src/cmd/extra_cmds.rs
index 4a3190ec72..cdefb64cba 100644
--- a/crates/engine/src/cmd/extra_cmds.rs
+++ b/crates/engine/src/cmd/extra_cmds.rs
@@ -574,7 +574,7 @@ fn set_visible(s: &mut Session, p: &Value, visible: bool) -> Result<Value> {
         return crate::layer_multi_cmds::set_visible_selected(s, visible);
     }
     let id = layer_param(s, p)?;
-    s.edit(if visible { "Show Layer" } else { "Hide Layer" }, |doc, _| {
+    s.edit_visibility(if visible { "Show Layer" } else { "Hide Layer" }, |doc, _| {
         doc.layer_mut(id).ok_or(EngineError::NoLayer(id))?.visible = visible;
         Ok(())
     })?;
@@ -640,7 +640,7 @@ fn show_only(s: &mut Session, p: &Value) -> Result<Value> {
         let rows = walk.iter().map(|(p, _, l)| (p.clone(), before.as_ref().is_none_or(|b| b.get(&l.id).copied().unwrap_or(l.visible)))).collect();
         ("Show Layers", rows, None)
     };
-    s.edit(label, |doc, _| {
+    s.edit_visibility(label, |doc, _| {
         for (p, visible) in &rows {
             if let Some(l) = doc.layer_at_mut(p) {
                 l.visible = *visible;
diff --git a/crates/engine/src/cmd/file_cmds/batch_run.rs b/crates/engine/src/cmd/file_cmds/batch_run.rs
index 24685387f0..0506b9dded 100644
--- a/crates/engine/src/cmd/file_cmds/batch_run.rs
+++ b/crates/engine/src/cmd/file_cmds/batch_run.rs
@@ -2,7 +2,7 @@ use super::open::import_at_raw_ppi;
 use super::paths::{extension, file_name, join, list_images, read_file, stem};
 use super::processing::parse_steps;
 use super::save::{SaveOpts, save_doc};
-use super::*;
+use super::{Arc, Document, EngineError, Result, Session, Value, batch_naming, json, str_param};
 
 /// Inputs of a batch command: `"input"` is a folder or an array of files.
 pub(crate) fn batch_inputs(p: &Value, cmd: &str) -> Result<Vec<String>> {
@@ -138,12 +138,16 @@ pub(crate) fn process_tree(
 
 /// The extension a batch output takes with Format "Same": the input's own, except for formats
 /// PhotoCraft opens but can't write, camera raws above all (#5799: a folder of ARWs failed on
-/// every file). Those are saved as PSD, the format Photoshop's Save As offers for a raw. An input
-/// whose file name has no extension (a dot in a folder name doesn't count) is saved as PNG.
+/// every file), GIMP files (`gz` is the last extension of `.xcf.gz`), Photoshop templates and the
+/// codec formats without a writer in this build. Those are saved as PSD, the format Photoshop's
+/// Save As offers for a raw. An input whose file name has no extension (a dot in a folder name
+/// doesn't count) is saved as PNG.
 pub(super) fn same_format(path: &str) -> String {
-    const IMPORT_ONLY: &[&str] = &["pdn", "kra", "krz", "af", "afdesign", "afphoto", "afpub", "heic", "heif", "hif", "svg", "svgz", "cin", "pcx", "xpm"];
+    const IMPORT_ONLY: &[&str] =
+        &["pdn", "kra", "krz", "af", "afdesign", "afphoto", "afpub", "heic", "heif", "hif", "svg", "svgz", "cin", "pcx", "xpm", "xcf", "xcfgz", "gz", "psdt"];
     let ext = extension(path).unwrap_or_else(|| "png".into());
-    if photocraft_io::raw::EXTENSIONS.contains(&ext.as_str()) || IMPORT_ONLY.contains(&ext.as_str()) { "psd".into() } else { ext }
+    let no_writer = photocraft_codecs::from_extension(&ext).is_some_and(|f| !f.caps().write);
+    if photocraft_io::raw::EXTENSIONS.contains(&ext.as_str()) || IMPORT_ONLY.contains(&ext.as_str()) || no_writer { "psd".into() } else { ext }
 }
 
 #[cfg(test)]
@@ -155,6 +159,17 @@ fn same_format_takes_the_file_names_extension() {
     assert_eq!(same_format("/in/IMG_0001.HEIC"), "psd");
     assert_eq!(same_format("/in/logo.svg"), "psd");
     assert_eq!(same_format("/in/scan.cin"), "psd");
+    // Formats PhotoCraft opens and does not write are saved as PSD.
+    for name in ["/in/scan.dcm", "/in/scan.DICOM", "/in/scan.dc3", "/in/page.xcf", "/in/page.xcf.gz", "/in/page.xcfgz", "/in/card.psdt"] {
+        assert_eq!(same_format(name), "psd", "{name}");
+    }
+    for f in photocraft_codecs::Format::ALL.into_iter().filter(|f| f.caps().read && !f.caps().write) {
+        for ext in f.extensions() {
+            assert_eq!(same_format(&format!("/in/a.{ext}")), "psd", "{f:?} .{ext}");
+        }
+    }
+    assert_eq!(same_format("/in/a.pam"), "pam");
+    assert_eq!(same_format("/in/a.dds"), "dds");
     // No extension in the file name: PNG, not the path after a dot in a folder name.
     assert_eq!(same_format("/in/v1.2/scan"), "png");
     assert_eq!(same_format("C:\\in.d\\scan"), "png");
diff --git a/crates/engine/src/cmd/file_cmds/export.rs b/crates/engine/src/cmd/file_cmds/export.rs
index ef6ad0e056..80213dba16 100644
--- a/crates/engine/src/cmd/file_cmds/export.rs
+++ b/crates/engine/src/cmd/file_cmds/export.rs
@@ -1,6 +1,6 @@
 use super::paths::{join, sanitize, stem, write_file};
 use super::save::{SaveOpts, encode};
-use super::*;
+use super::{ColorMode, Document, EngineError, Layer, LayerContent, LayerId, Rect, Result, Session, Surface, Value, from_rgba_into, json, str_param};
 
 // ---------- Export ----------
 
diff --git a/crates/engine/src/cmd/file_cmds/info.rs b/crates/engine/src/cmd/file_cmds/info.rs
index e038d0c097..3f9436349d 100644
--- a/crates/engine/src/cmd/file_cmds/info.rs
+++ b/crates/engine/src/cmd/file_cmds/info.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{EngineError, Result, Session, Value, json};
 
 // ---------- File Info (XMP) ----------
 
diff --git a/crates/engine/src/cmd/file_cmds/open.rs b/crates/engine/src/cmd/file_cmds/open.rs
index d95174ad9d..efc44e880f 100644
--- a/crates/engine/src/cmd/file_cmds/open.rs
+++ b/crates/engine/src/cmd/file_cmds/open.rs
@@ -1,5 +1,8 @@
 use super::paths::{file_name, read_file, stem, template_name};
-use super::*;
+use super::{
+    Affine, Arc, Document, EngineError, Layer, LayerContent, Resample, Result, Session, SmartObject, SmartSource, Value, f64_param, flattened_checked, json,
+    resize_surface, str_param, translate_surface,
+};
 
 pub(crate) fn import(name: &str, bytes: &[u8]) -> Result<Document> {
     import_result(name, bytes).map(|r| r.document)
@@ -202,7 +205,7 @@ pub fn place_bytes(s: &mut Session, name: &str, bytes: Vec<u8>, linked: Option<S
         } else {
             Layer::new(layer_name, LayerContent::Raster(px))
         };
-        let id = doc.insert_above(*active, layer);
+        let id = crate::layer_place::insert_new(doc, *active, layer, crate::layer_place::Place::AutoEditable);
         *active = Some(id);
         Ok(id)
     })?;
diff --git a/crates/engine/src/cmd/file_cmds/paths.rs b/crates/engine/src/cmd/file_cmds/paths.rs
index 7046393150..840609d826 100644
--- a/crates/engine/src/cmd/file_cmds/paths.rs
+++ b/crates/engine/src/cmd/file_cmds/paths.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{EngineError, Result, Session};
 
 // ---------- file system (native only) ----------
 
@@ -55,20 +55,26 @@ pub fn list_images(dir: &str) -> Result<Vec<String>> {
     Err(EngineError::Other(format!("cannot list {dir}: no file system on the web")))
 }
 
-/// Whether a folder entry is one the batch commands open: an `OPENABLE` extension, or GIMP's
-/// gzipped `.xcf.gz`, whose last extension alone says nothing.
+/// Whether a folder entry is one the batch commands open: an `OPENABLE` extension, an extension
+/// of a format `photocraft-codecs` reads in this build, or GIMP's gzipped `.xcf.gz`, whose last
+/// extension alone says nothing.
 #[cfg(not(target_arch = "wasm32"))]
 pub(super) fn openable_name(path: &str) -> bool {
     let lower = file_name(path).to_ascii_lowercase();
-    lower.ends_with(".xcf.gz") || lower.rsplit_once('.').is_some_and(|(_, ext)| OPENABLE.contains(&ext))
+    lower.ends_with(".xcf.gz")
+        || lower.rsplit_once('.').is_some_and(|(_, ext)| OPENABLE.contains(&ext) || photocraft_codecs::from_extension(ext).is_some_and(|f| f.caps().read))
 }
 
-/// Extensions the batch commands pick up from a folder.
+/// Extensions the batch commands pick up from a folder besides the codec formats: the document
+/// and vector formats `photocraft_io::import` reads outside `photocraft-codecs`, and the camera
+/// raws whose usual files `photocraft_raw::decode` develops. Not CR3, ORF, RAF, RW2, SRF or SR2:
+/// CR3, compressed ORF and RAF and RW2 raw formats other than 3, 4 and 5 aren't decoded yet, and
+/// import falls back to the embedded JPEG preview with only a warning, which a batch must not
+/// process silently.
 #[cfg(not(target_arch = "wasm32"))]
 const OPENABLE: &[&str] = &[
-    "pdn", "ora", "xcf", "xcfgz", "kra", "krz", "psd", "psb", "pcraft", "png", "jpg", "jpeg", "tif", "tiff", "webp", "gif", "bmp", "tga", "exr", "hdr", "qoi",
-    "ico", "pnm", "ppm", "pgm", "fits", "fit", "fts", "dpx", "heic", "heif", "hif", "dng", "cr2", "nef", "nrw", "arw", "pef", "svg", "svgz", "af", "afdesign",
-    "afphoto", "afpub",
+    "pdn", "ora", "xcf", "xcfgz", "kra", "krz", "psd", "psb", "psdt", "pcraft", "svg", "svgz", "af", "afdesign", "afphoto", "afpub", "dng", "cr2", "nef",
+    "nrw", "arw", "pef",
 ];
 
 pub(crate) fn file_name(path: &str) -> String {
diff --git a/crates/engine/src/cmd/file_cmds/processing.rs b/crates/engine/src/cmd/file_cmds/processing.rs
index b9718aab70..3388f4d7a9 100644
--- a/crates/engine/src/cmd/file_cmds/processing.rs
+++ b/crates/engine/src/cmd/file_cmds/processing.rs
@@ -2,7 +2,10 @@ use super::batch_run::{batch_inputs_tree, process_tree};
 use super::open::import_opened;
 use super::paths::{file_name, list_images, read_file, stem};
 use super::save::SaveOpts;
-use super::*;
+use super::{
+    ColorMode, Document, EngineError, Layer, LayerContent, LayerId, Result, Session, Surface, Value, buffer_surface, flattened_checked, json, size_param,
+    str_param,
+};
 
 // ---------- Automate ----------
 
diff --git a/crates/engine/src/cmd/file_cmds/save.rs b/crates/engine/src/cmd/file_cmds/save.rs
index 25104a7b13..fff62dc7f4 100644
--- a/crates/engine/src/cmd/file_cmds/save.rs
+++ b/crates/engine/src/cmd/file_cmds/save.rs
@@ -1,5 +1,5 @@
 use super::paths::{same_file, write_file};
-use super::*;
+use super::{Document, EngineError, Layer, LayerContent, Result, Session, Value, f64_param, flattened_checked, json, str_param};
 
 /// Whether saving `doc` as a TIFF writes Photoshop layer data (anything beyond a lone
 /// Background layer). The UI asks before such a save when the "ask before saving layered TIFF"
diff --git a/crates/engine/src/cmd/file_cmds/tests.rs b/crates/engine/src/cmd/file_cmds/tests.rs
index 2a23dde9f1..7eb770d844 100644
--- a/crates/engine/src/cmd/file_cmds/tests.rs
+++ b/crates/engine/src/cmd/file_cmds/tests.rs
@@ -1835,6 +1835,50 @@ fn folder_listing_recognises_gzipped_xcf_by_its_double_extension() {
     assert!(!super::openable_name("notes.txt"));
 }
 
+/// A folder batch picks up every extension that the codecs open: Cineon, DICOM, Amiga IFF, PCX,
+/// XPM, DDS, the Netpbm family, and Photoshop templates. Not the raws whose usual files open only
+/// as the embedded JPEG preview (CR3, compressed ORF and RAF, RW2 other than raw formats 3, 4 and
+/// 5): a batch would process the thumbnail without a word.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn folder_listing_takes_every_format_photocraft_opens() {
+    let codecs = ["a.cin", "a.dcm", "a.dicom", "a.dc3", "a.iff", "a.lbm", "a.ilbm", "a.pcx", "a.xpm", "a.dds", "a.pbm", "a.pam", "a.pfm", "a.psdt", "A.PCX"];
+    let raws = ["a.dng", "IMG_0001.CR2", "a.nef", "a.nrw", "a.arw", "a.pef"];
+    for name in codecs.into_iter().chain(raws) {
+        assert!(super::openable_name(name), "{name}");
+    }
+    for f in photocraft_codecs::Format::ALL.into_iter().filter(|f| f.caps().read) {
+        for ext in f.extensions() {
+            assert!(super::openable_name(&format!("a.{ext}")), "{f:?} .{ext}");
+        }
+    }
+    for name in ["a.cr3", "IMG_0001.CR3", "a.orf", "a.raf", "a.rw2", "a.srf", "a.sr2"] {
+        assert!(!super::openable_name(name), "{name}");
+    }
+    // PhotoCraft does not read AVIF.
+    assert!(!super::openable_name("a.avif"));
+}
+
+/// A batch over a folder processes PAM, PFM and DDS files instead of skipping them.
+#[test]
+fn batch_folder_processes_netpbm_and_dds_files() {
+    let dir = tmp("batch-folder-formats");
+    let src = join(&dir, "in");
+    std::fs::create_dir_all(&src).unwrap();
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 8, "height": 8, "background": "#ff0000"})).unwrap();
+    for name in ["a.pam", "b.pfm", "c.dds"] {
+        save_doc(doc(&s), &join(&src, name), None).unwrap();
+    }
+    std::fs::write(join(&src, "notes.txt"), b"not an image").unwrap();
+    let out = join(&dir, "out");
+    let r = Session::new().execute("file.automate.batch", json!({"steps": [], "input": src, "output": out, "format": "png"})).unwrap();
+    assert!(r["errors"].as_array().unwrap().is_empty(), "{r}");
+    let mut files: Vec<String> = r["files"].as_array().unwrap().iter().map(|f| file_name(f.as_str().unwrap())).collect();
+    files.sort();
+    assert_eq!(files, ["a.png", "b.png", "c.png"], "{r}");
+}
+
 /// The Compression tag (259) of a TIFF's first directory.
 fn tiff_compression_tag(b: &[u8]) -> Option<u16> {
     let le = b.get(..2)? == b"II";
diff --git a/crates/engine/src/cmd/font_library_cmds.rs b/crates/engine/src/cmd/font_library_cmds.rs
new file mode 100644
index 0000000000..7b3fb271ae
--- /dev/null
+++ b/crates/engine/src/cmd/font_library_cmds.rs
@@ -0,0 +1,105 @@
+//! The font menu's favourite font families: the star beside each font, kept until un-starred. They
+//! live in the preferences, so they survive a restart, and are plain family names: a favourite
+//! whose font is uninstalled is kept, though the menu lists installed fonts only, and shows it
+//! again once the font is back (`type.font.favorite` with `"on": false` removes it). (The
+//! recently used fonts are the shell's, `PhotocraftApp::note_recent_font`.)
+
+use serde_json::{Value, json};
+
+use crate::commands::CommandSpec;
+use crate::{EngineError, Result, Session};
+
+/// The most favourites kept (a hand-edited preferences file can't grow the menu without bound).
+pub const MAX_FAVORITE_FONTS: usize = 1000;
+/// The longest family name accepted, in characters.
+const MAX_FAMILY_CHARS: usize = 256;
+
+fn bad(cmd: &str, msg: impl Into<String>) -> EngineError {
+    EngineError::BadParams { cmd: cmd.into(), msg: msg.into() }
+}
+
+fn always(_: &Session) -> std::result::Result<(), String> {
+    Ok(())
+}
+
+/// The `family` param: a non-empty name without control characters, trimmed.
+fn family(p: &Value, cmd: &str) -> Result<String> {
+    let name = p.get("family").and_then(Value::as_str).ok_or_else(|| bad(cmd, "pass `family`, a font family name"))?.trim();
+    if name.is_empty() {
+        return Err(bad(cmd, "`family` is empty"));
+    }
+    if name.chars().count() > MAX_FAMILY_CHARS {
+        return Err(bad(cmd, format!("`family` is longer than {MAX_FAMILY_CHARS} characters")));
+    }
+    if name.chars().any(char::is_control) {
+        return Err(bad(cmd, "`family` contains control characters"));
+    }
+    Ok(name.to_string())
+}
+
+/// The favourites as the menu shows them: valid names, once each, at most [`MAX_FAVORITE_FONTS`].
+pub fn favorite_fonts(s: &Session) -> Vec<String> {
+    let mut out: Vec<String> = Vec::new();
+    for f in &s.prefs().type_.favorite_fonts {
+        if out.len() >= MAX_FAVORITE_FONTS {
+            break;
+        }
+        if !f.trim().is_empty() && !out.contains(f) {
+            out.push(f.clone());
+        }
+    }
+    out
+}
+
+/// Star or un-star a family (`on` sets it; without it the star toggles).
+fn favorite(s: &mut Session, p: &Value) -> Result<Value> {
+    const CMD: &str = "type.font.favorite";
+    let name = family(p, CMD)?;
+    let mut list = favorite_fonts(s);
+    let on = match p.get("on") {
+        None => !list.contains(&name),
+        Some(v) => v.as_bool().ok_or_else(|| bad(CMD, "`on` must be true or false"))?,
+    };
+    list.retain(|f| *f != name);
+    if on {
+        if list.len() >= MAX_FAVORITE_FONTS {
+            return Err(bad(CMD, format!("at most {MAX_FAVORITE_FONTS} favourite fonts")));
+        }
+        list.push(name.clone());
+    }
+    let stored = list.clone();
+    s.prefs.edit(|p| p.type_.favorite_fonts = stored);
+    Ok(json!({"family": name, "favorite": on, "favorites": list}))
+}
+
+fn library(s: &mut Session, _: &Value) -> Result<Value> {
+    Ok(json!({"favorites": favorite_fonts(s)}))
+}
+
+pub fn specs() -> Vec<CommandSpec> {
+    vec![
+        CommandSpec {
+            id: "type.font.favorite",
+            label: "Add to Favorites",
+            menu: &[],
+            shortcut: None,
+            params: r#"{"family":str,"on":bool?=toggle} → family, favorite, favorites"#,
+            enabled: always,
+            run: favorite,
+            journal: false,
+        },
+        CommandSpec {
+            id: "type.font.library",
+            label: "Font Library",
+            menu: &[],
+            shortcut: None,
+            params: "{} → favorites",
+            enabled: always,
+            run: library,
+            journal: false,
+        },
+    ]
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/engine/src/cmd/font_library_cmds/tests.rs b/crates/engine/src/cmd/font_library_cmds/tests.rs
new file mode 100644
index 0000000000..c31c65353a
--- /dev/null
+++ b/crates/engine/src/cmd/font_library_cmds/tests.rs
@@ -0,0 +1,79 @@
+use serde_json::json;
+
+use super::*;
+
+fn session() -> Session {
+    Session::new()
+}
+
+#[test]
+fn starring_toggles_and_on_sets_a_favourite() {
+    let mut s = session();
+    s.execute("type.font.favorite", json!({"family": "Arial"})).unwrap();
+    s.execute("type.font.favorite", json!({"family": "Bebas Neue"})).unwrap();
+    assert_eq!(favorite_fonts(&s), ["Arial", "Bebas Neue"]);
+    // Toggling again removes it; `on` sets it either way.
+    let r = s.execute("type.font.favorite", json!({"family": "Arial"})).unwrap();
+    assert_eq!(r["favorite"], false);
+    s.execute("type.font.favorite", json!({"family": "Bebas Neue", "on": true})).unwrap();
+    assert_eq!(favorite_fonts(&s), ["Bebas Neue"], "on: true doesn't duplicate");
+    s.execute("type.font.favorite", json!({"family": "Bebas Neue", "on": false})).unwrap();
+    assert!(favorite_fonts(&s).is_empty());
+}
+
+#[test]
+fn resetting_the_type_preferences_keeps_the_favourites() {
+    let mut s = session();
+    s.execute("type.font.favorite", json!({"family": "Bebas Neue"})).unwrap();
+    s.execute("prefs.set", json!({"path": "type.smartQuotes", "value": false})).unwrap();
+    s.execute("prefs.reset", json!({"path": "type"})).unwrap();
+    assert!(s.prefs().type_.smart_quotes, "the Type settings are reset");
+    assert_eq!(favorite_fonts(&s), ["Bebas Neue"], "the favourites are the user's library, not a setting");
+    // Asked for by name, or with everything, they go.
+    s.execute("prefs.reset", json!({"path": "type.favoriteFonts"})).unwrap();
+    assert!(favorite_fonts(&s).is_empty());
+    s.execute("type.font.favorite", json!({"family": "Bebas Neue"})).unwrap();
+    s.execute("prefs.reset", json!({})).unwrap();
+    assert!(favorite_fonts(&s).is_empty());
+}
+
+#[test]
+fn the_library_survives_a_preferences_round_trip_and_hostile_lists_are_tidied() {
+    let mut s = session();
+    s.execute("type.font.favorite", json!({"family": "Arial"})).unwrap();
+    let saved = serde_json::to_value(s.prefs()).unwrap();
+    assert_eq!(saved["type"]["favoriteFonts"], json!(["Arial"]));
+    let mut t = session();
+    let prefs = serde_json::from_value(saved).unwrap();
+    t.prefs.edit(|p| *p = prefs);
+    let lib = t.execute("type.font.library", json!({})).unwrap();
+    assert_eq!(lib, json!({"favorites": ["Arial"]}));
+    // Duplicates, blanks and an oversized list from a hand-edited file are tidied on read.
+    t.prefs.edit(|p| p.type_.favorite_fonts = (0..5000).map(|i| format!("F{}", i % 1200)).chain([String::new()]).collect());
+    assert_eq!(favorite_fonts(&t).len(), MAX_FAVORITE_FONTS);
+}
+
+#[test]
+fn bad_params_are_errors_and_change_nothing() {
+    let mut s = session();
+    s.execute("type.font.favorite", json!({"family": "Arial"})).unwrap();
+    for (id, p) in [
+        ("type.font.favorite", json!({})),
+        ("type.font.favorite", json!({"family": 42})),
+        ("type.font.favorite", json!({"family": "   "})),
+        ("type.font.favorite", json!({"family": "a\u{0}b"})),
+        ("type.font.favorite", json!({"family": "x".repeat(300)})),
+        ("type.font.favorite", json!({"family": "Arial", "on": "yes"})),
+    ] {
+        assert!(s.execute(id, p.clone()).is_err(), "{id} {p}");
+    }
+    assert_eq!(favorite_fonts(&s), ["Arial"]);
+}
+
+#[test]
+fn font_library_edits_are_not_recorded_into_actions() {
+    // Playing an action back must not rewrite the user's favourite fonts.
+    for id in ["type.font.favorite", "type.font.library"] {
+        assert!(!crate::actions_cmds::replayable(id), "{id}");
+    }
+}
diff --git a/crates/engine/src/cmd/frame_cmds.rs b/crates/engine/src/cmd/frame_cmds.rs
index 2ea953609f..c2cd6283a7 100644
--- a/crates/engine/src/cmd/frame_cmds.rs
+++ b/crates/engine/src/cmd/frame_cmds.rs
@@ -54,11 +54,8 @@ fn frame_from_layers(s: &mut Session, p: &Value) -> Result<Value> {
         Err(e) => {
             // The group couldn't be framed: take the grouping back, leaving nothing to redo and
             // no grouping step to record.
-            s.undo();
+            s.rollback();
             s.journal.truncate(journal);
-            if let Some(st) = s.active_mut() {
-                st.history.clear_redo();
-            }
             Err(e)
         }
     }
@@ -149,9 +146,15 @@ fn new_frame(s: &mut Session, p: &Value) -> Result<Value> {
                 crate::layer_multi_cmds::check_group_depth(doc, "New Frame")?;
                 gid
             }
-            None => doc.insert_above(*active, Layer::group(name, vec![])),
+            None => crate::layer_place::insert_new(doc, *active, Layer::group(name, vec![]), crate::layer_place::Place::AutoEditable),
         };
-        doc.layer_mut(gid).ok_or(EngineError::NoLayer(gid))?.mask = Some(mask);
+        let frame = doc.layer_mut(gid).ok_or(EngineError::NoLayer(gid))?;
+        frame.mask = Some(mask);
+        // A frame is one row, as in Photoshop: closed, so the next new layer goes above it rather
+        // than into it.
+        if let LayerContent::Group(g) = &mut frame.content {
+            g.expanded = false;
+        }
         *active = Some(gid);
         Ok(gid)
     })?;
diff --git a/crates/engine/src/cmd/gradient_fill_cmds.rs b/crates/engine/src/cmd/gradient_fill_cmds.rs
index 138be5bbeb..41f91f8bbb 100644
--- a/crates/engine/src/cmd/gradient_fill_cmds.rs
+++ b/crates/engine/src/cmd/gradient_fill_cmds.rs
@@ -322,7 +322,7 @@ fn create(s: &mut Session, p: &Value) -> Result<Value> {
         new_layer(s, &d.doc, p)?
     };
     let id = s.edit("New Gradient Fill Layer", |doc, active| {
-        let id = doc.insert_above(*active, layer);
+        let id = crate::layer_place::insert_new(doc, *active, layer, crate::layer_place::Place::AutoEditable);
         *active = Some(id);
         Ok(id)
     })?;
diff --git a/crates/engine/src/cmd/history_cmds.rs b/crates/engine/src/cmd/history_cmds.rs
index 0596bbb12d..d8bea8607b 100644
--- a/crates/engine/src/cmd/history_cmds.rs
+++ b/crates/engine/src/cmd/history_cmds.rs
@@ -39,27 +39,41 @@ fn bad(cmd: &str, msg: impl Into<String>) -> EngineError {
 /// The `state` param as an index into the active document's history entries, defaulting to the
 /// current state.
 fn state_index(s: &Session, cmd: &str, p: &Value) -> Result<(usize, usize)> {
+    state_index_upto(s, cmd, p, false)
+}
+
+/// [`state_index`], also accepting the later (dimmed, redo) states with `later`.
+fn state_index_upto(s: &Session, cmd: &str, p: &Value, later: bool) -> Result<(usize, usize)> {
     let st = s.active().ok_or(EngineError::NoDocument)?;
     let current = st.history.past_len();
+    let last = if later { current.saturating_add(st.history.redo_labels().count()) } else { current };
     let i = match p.get("state") {
         None | Some(Value::Null) => current,
         Some(_) => {
             let v = int(p, "state").ok_or_else(|| bad(cmd, "`state` must be a number"))?;
-            usize::try_from(v).ok().filter(|i| *i <= current).ok_or_else(|| bad(cmd, format!("`state` = {v} is not a state (0..={current})")))?
+            usize::try_from(v).ok().filter(|i| *i <= last).ok_or_else(|| bad(cmd, format!("`state` = {v} is not a state (0..={last})")))?
         }
     };
     Ok((i, current))
 }
 
 /// History panel › Delete: drop the state and every state after it, as Photoshop does in linear
-/// history. The document returns to the state before it, and the deleted steps can't be redone.
-/// The oldest state (the document as opened) can't be deleted.
+/// history (in non-linear history only that state, also a later one:
+/// `history_options_cmds::delete_state`). The document returns to the state before it, and the
+/// deleted steps can't be redone. The oldest state (the document as opened) can't be deleted.
 fn delete_state(s: &mut Session, p: &Value) -> Result<Value> {
     const CMD: &str = "history.deleteState";
-    let (i, current) = state_index(s, CMD, p)?;
+    // History Options › Allow Non-Linear History: only that state goes, a later (dimmed) one too.
+    let non_linear = s.active().is_some_and(|st| st.history.non_linear);
+    let (i, current) = state_index_upto(s, CMD, p, non_linear)?;
     if i == 0 {
         return Err(bad(CMD, "the oldest state can't be deleted"));
     }
+    if non_linear {
+        crate::history_options_cmds::delete_state(s, i, current)?;
+        let entries = s.active().ok_or(EngineError::NoDocument)?.history.entries();
+        return Ok(json!({ "states": entries.len(), "current": entries.last() }));
+    }
     // Step back to the state before `i`; the steps from `i` on are then redo states.
     for _ in i..=current {
         if !s.undo() {
@@ -199,8 +213,13 @@ fn delete_snapshot(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({ "snapshot": snap.id, "snapshots": st.snapshots.len() }))
 }
 
+/// A state other than the oldest exists to delete: a past or the current one, and with Allow
+/// Non-Linear History a later (dimmed) one too, also while the oldest state is current.
 fn can_delete(s: &Session) -> std::result::Result<(), String> {
-    s.active().filter(|d| d.history.past_len() > 0).map(|_| ()).ok_or_else(|| "the oldest state can't be deleted".into())
+    s.active()
+        .filter(|d| d.history.past_len() > 0 || (d.history.non_linear && d.history.can_redo()))
+        .map(|_| ())
+        .ok_or_else(|| "the oldest state can't be deleted".into())
 }
 
 fn has_doc(s: &Session) -> std::result::Result<(), String> {
@@ -245,7 +264,7 @@ pub fn specs() -> Vec<CommandSpec> {
             label: "Delete State",
             menu: &[],
             shortcut: None,
-            params: r##"{"state":index?} (History entry, 0 = oldest; default the current state) → {states,current}: removes the state and every later one"##,
+            params: r##"{"state":index?} (History entry, 0 = oldest; default the current state) → {states,current}: removes the state and every later one (with Allow Non-Linear History only that state, a later dimmed one too)"##,
             enabled: can_delete,
             run: delete_state,
             journal: true,
diff --git a/crates/engine/src/cmd/history_options_cmds.rs b/crates/engine/src/cmd/history_options_cmds.rs
new file mode 100644
index 0000000000..17341b5ae1
--- /dev/null
+++ b/crates/engine/src/cmd/history_options_cmds.rs
@@ -0,0 +1,561 @@
+//! History panel › History Options… (#2966): Allow Non-Linear History and Make Layer Visibility
+//! Changes Undoable. The values are preferences (`historyOptions.*`, also `prefs.set`), applied
+//! by [`Session::apply_prefs`] and [`Session::edit_visibility`]. Without params the command
+//! reports them; the GUI opens its dialog instead and runs it with the dialog's values on OK.
+//!
+//! Photoshop's three snapshot options (Automatically Create First Snapshot, Automatically
+//! Create New Snapshot When Saving, Show New Snapshot Dialog by Default) come with #3634, which
+//! makes the snapshots act on them.
+
+use serde_json::{Map, Value};
+
+use crate::commands::CommandSpec;
+use crate::{EngineError, Result, Session};
+
+const CMD: &str = "history.options";
+
+/// The option keys, as in `prefs.get historyOptions` and the command's params.
+pub const OPTIONS: [&str; 2] = ["allowNonLinearHistory", "makeLayerVisibilityChangesUndoable"];
+
+fn bad(msg: impl Into<String>) -> EngineError {
+    EngineError::BadParams { cmd: CMD.into(), msg: msg.into() }
+}
+
+/// The current History Options as `{allowNonLinearHistory, makeLayerVisibilityChangesUndoable}`.
+pub fn current(s: &Session) -> Value {
+    let o = &s.prefs().history_options;
+    serde_json::json!({
+        "allowNonLinearHistory": o.allow_non_linear_history,
+        "makeLayerVisibilityChangesUndoable": o.make_layer_visibility_changes_undoable,
+    })
+}
+
+fn options(s: &mut Session, p: &Value) -> Result<Value> {
+    let given: Map<String, Value> = match p {
+        Value::Null => Map::new(),
+        Value::Object(m) => m.clone(),
+        _ => return Err(bad("params must be an object")),
+    };
+    // Validate everything before changing anything.
+    let mut set = Vec::new();
+    for (k, v) in &given {
+        if !OPTIONS.contains(&k.as_str()) {
+            return Err(bad(format!("unknown option `{k}` (expected {})", OPTIONS.join(", "))));
+        }
+        let b = v.as_bool().ok_or_else(|| bad(format!("`{k}` must be true or false")))?;
+        set.push((k.clone(), b));
+    }
+    if !set.is_empty() {
+        s.edit_prefs(|prefs| {
+            for (k, b) in &set {
+                match k.as_str() {
+                    "allowNonLinearHistory" => prefs.history_options.allow_non_linear_history = *b,
+                    _ => prefs.history_options.make_layer_visibility_changes_undoable = *b,
+                }
+            }
+        });
+    }
+    Ok(current(s))
+}
+
+/// History panel › Delete in non-linear history: delete state `i` (numbered as the History panel
+/// lists them, `current` = the current state's index, the later dimmed states after it) and
+/// nothing else. Deleting the current state steps back to the one before it; the later states
+/// stay.
+pub(crate) fn delete_state(s: &mut Session, i: usize, current: usize) -> Result<()> {
+    if i == 0 {
+        return Err(EngineError::BadParams { cmd: "history.deleteState".into(), msg: "the oldest state can't be deleted".into() });
+    }
+    // A background job is computing from the current state: it must not move under it.
+    if s.active_job().is_some() {
+        return Err(EngineError::Other("the history can't step back right now".into()));
+    }
+    let keep_visibility = !s.visibility_undoable();
+    let st = s.active_mut().ok_or(EngineError::NoDocument)?;
+    st.coalesce = None;
+    if i != current {
+        let removed = match i.checked_sub(current.saturating_add(1)) {
+            Some(j) => st.history.remove_later(j),
+            None => st.history.remove(i),
+        };
+        if !removed {
+            return Err(EngineError::Other(format!("state {i} is not held")));
+        }
+        // The document is unchanged, but the History panel's rows are not: a view-only change
+        // that keeps a clean document clean.
+        let clean = st.saved_revision == st.revision;
+        st.revision += 1;
+        st.view_revision += 1;
+        if clean {
+            st.saved_revision = st.revision;
+        }
+        st.last_damage = Some(photocraft_geom::Rect::EMPTY);
+        return Ok(());
+    }
+    // The step that made the current state: the layers whose visibility it changed get it back.
+    let changed = st.history.current_visibility().to_vec();
+    let (mut d, layers) = st.history.drop_current().ok_or_else(|| EngineError::Other("the history can't step back right now".into()))?;
+    // As Undo does: Save As changes file identity outside history.
+    if d.name != st.doc.name {
+        std::sync::Arc::make_mut(&mut d).name.clone_from(&st.doc.name);
+    }
+    if keep_visibility {
+        crate::carry_visibility(&st.doc, &mut d, &changed);
+    }
+    let damage = crate::layer_multi_cmds::step_damage(&d, &st.doc);
+    st.doc = d;
+    crate::restore_target(st, layers);
+    st.revision += 1;
+    st.last_damage = damage;
+    Ok(())
+}
+
+fn always(_: &Session) -> std::result::Result<(), String> {
+    Ok(())
+}
+
+pub fn specs() -> Vec<CommandSpec> {
+    vec![CommandSpec {
+        id: CMD,
+        label: "History Options…",
+        menu: &[],
+        shortcut: None,
+        params: r##"{"allowNonLinearHistory":bool?,"makeLayerVisibilityChangesUndoable":bool?} → both values (no params: report them). Allow Non-Linear History: an edit after stepping back keeps the later states and is appended at the end; deleting a state deletes only it (default off). Make Layer Visibility Changes Undoable: showing or hiding a layer is a history state (default on). Also `prefs.set historyOptions.*`"##,
+        enabled: always,
+        run: options,
+        journal: false,
+    }]
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    fn entries(s: &Session) -> Vec<String> {
+        s.active().unwrap().history.entries()
+    }
+
+    /// A document with a layer above the background: entries Open, New Layer.
+    fn doc() -> (Session, u64) {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 16, "height": 16})).unwrap();
+        s.execute("layer.new.layer", json!({})).unwrap();
+        let id = s.active().unwrap().active_layer.unwrap().0;
+        (s, id)
+    }
+
+    #[test]
+    fn defaults_match_photoshop_and_round_trip_through_prefs() {
+        let mut s = Session::new();
+        assert_eq!(s.execute(CMD, json!({})).unwrap(), json!({"allowNonLinearHistory": false, "makeLayerVisibilityChangesUndoable": true}));
+        assert_eq!(s.execute("prefs.get", json!({"path": "historyOptions"})).unwrap(), current(&s));
+        let r = s.execute(CMD, json!({"allowNonLinearHistory": true, "makeLayerVisibilityChangesUndoable": false})).unwrap();
+        assert_eq!(r, json!({"allowNonLinearHistory": true, "makeLayerVisibilityChangesUndoable": false}));
+        assert_eq!(s.execute("prefs.get", json!({"path": "historyOptions.allowNonLinearHistory"})).unwrap(), json!(true));
+        // Saved and restored with the other preferences.
+        let saved = s.prefs_to_json();
+        let mut t = Session::new();
+        t.load_prefs_json(&saved).unwrap();
+        assert_eq!(current(&t), r);
+        // prefs.set and prefs.reset reach them too.
+        t.execute("prefs.set", json!({"path": "historyOptions.allowNonLinearHistory", "value": false})).unwrap();
+        assert_eq!(t.execute(CMD, Value::Null).unwrap()["allowNonLinearHistory"], json!(false));
+        t.execute("prefs.reset", json!({"path": "historyOptions"})).unwrap();
+        assert_eq!(current(&t), current(&Session::new()));
+        // Older preference files without the section load with the defaults.
+        t.load_prefs_json("{}").unwrap();
+        assert_eq!(current(&t), current(&Session::new()));
+    }
+
+    #[test]
+    fn bad_params_are_refused_and_change_nothing() {
+        let mut s = Session::new();
+        let before = current(&s);
+        for p in [
+            json!({"allowNonLinearHistory": "yes"}),
+            json!({"allowNonLinearHistory": 1}),
+            json!({"makeLayerVisibilityChangesUndoable": null}),
+            json!({"allowNonLinearHistory": true, "snapshots": true}),
+            json!([true]),
+            json!("x"),
+            json!(3),
+        ] {
+            assert!(s.execute(CMD, p.clone()).is_err(), "{p}");
+            assert_eq!(current(&s), before, "{p} changed nothing");
+        }
+        assert!(s.execute("prefs.set", json!({"path": "historyOptions.allowNonLinearHistory", "value": "on"})).is_err());
+        assert_eq!(current(&s), before);
+    }
+
+    #[test]
+    fn layer_visibility_is_a_history_state_only_when_undoable() {
+        // On (the default): the eye, Hide/Show Layers and ⌥-click each add a state.
+        let (mut s, id) = doc();
+        s.execute("layer.setProps", json!({"layer": id, "visible": false})).unwrap();
+        assert_eq!(entries(&s).last().map(String::as_str), Some("Layer Visibility"));
+        s.execute("edit.undo", json!({})).unwrap();
+        assert!(s.active().unwrap().doc.layer(photocraft_doc::LayerId(id)).unwrap().visible);
+
+        // Off: the document changes (and is modified) but History doesn't.
+        let (mut s, id) = doc();
+        s.execute(CMD, json!({"makeLayerVisibilityChangesUndoable": false})).unwrap();
+        let before = entries(&s);
+        let rev = s.active().unwrap().revision;
+        s.execute("layer.setProps", json!({"layer": id, "visible": false})).unwrap();
+        s.execute("layer.showLayers", json!({"layer": id})).unwrap();
+        s.execute("layer.hideLayers", json!({"layer": id})).unwrap();
+        s.execute("layer.showOnly", json!({"layer": id})).unwrap();
+        s.execute("layer.showOnly", json!({"layer": id})).unwrap();
+        // Hide Layers toggles (⌘,), so show the layer first for it to hide.
+        s.execute("layer.showLayers", json!({"layer": id})).unwrap();
+        s.execute("layer.hideLayers", json!({"layer": id})).unwrap();
+        assert_eq!(entries(&s), before, "no visibility state was recorded");
+        let st = s.active().unwrap();
+        assert!(!st.doc.layer(photocraft_doc::LayerId(id)).unwrap().visible, "the change still applies");
+        assert!(st.revision > rev && st.is_dirty());
+        // Other properties still record a state.
+        s.execute("layer.setProps", json!({"layer": id, "opacity": 0.5})).unwrap();
+        assert_eq!(entries(&s).len(), before.len() + 1);
+        // An unrecorded change leaves the redo states alone.
+        s.execute("edit.undo", json!({})).unwrap();
+        s.execute("layer.setProps", json!({"layer": id, "visible": true})).unwrap();
+        assert!(s.active().unwrap().history.can_redo());
+    }
+
+    fn visible(s: &Session, id: u64) -> bool {
+        s.active().unwrap().doc.layer(photocraft_doc::LayerId(id)).unwrap().visible
+    }
+
+    fn red(s: &Session, id: u64) -> bool {
+        let st = s.active().unwrap();
+        st.doc.layer(photocraft_doc::LayerId(id)).unwrap().surface().unwrap().pixel(1, 1)[0] > 0.5
+    }
+
+    /// Off, showing or hiding a layer is not a state, so stepping through history (Undo, Redo, a
+    /// History row) leaves the visibility as the user set it, as Photoshop does; history states
+    /// hold whole documents and would otherwise bring the old visibility back.
+    #[test]
+    fn stepping_through_history_keeps_unrecorded_visibility() {
+        let (mut s, id) = doc();
+        s.execute(CMD, json!({"makeLayerVisibilityChangesUndoable": false})).unwrap();
+        s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        s.execute("layer.setProps", json!({"layer": id, "visible": false})).unwrap();
+        assert!(s.execute("edit.undo", json!({})).unwrap().as_bool().unwrap());
+        assert!(!red(&s, id), "the fill is undone");
+        assert!(!visible(&s, id), "the layer stays hidden");
+        s.execute("layer.setProps", json!({"layer": id, "visible": true})).unwrap();
+        s.execute("edit.redo", json!({})).unwrap();
+        assert!(red(&s, id) && visible(&s, id), "redo brings the fill back, not the hidden layer");
+        s.execute("layer.setProps", json!({"layer": id, "visible": false})).unwrap();
+        // History rows: New, New Layer, Fill.
+        s.execute("history.selectState", json!({"state": 1})).unwrap();
+        assert!(!red(&s, id) && !visible(&s, id));
+        s.execute("history.selectState", json!({"state": 2})).unwrap();
+        assert!(red(&s, id) && !visible(&s, id));
+
+        // On (the default): Undo takes the hide back first, then the fill.
+        let (mut s, id) = doc();
+        s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        s.execute("layer.setProps", json!({"layer": id, "visible": false})).unwrap();
+        s.execute("edit.undo", json!({})).unwrap();
+        assert!(red(&s, id) && visible(&s, id));
+        s.execute("edit.undo", json!({})).unwrap();
+        assert!(!red(&s, id) && visible(&s, id));
+        s.execute("history.selectState", json!({"state": 3})).unwrap();
+        assert!(red(&s, id) && !visible(&s, id), "the hide is a state of its own");
+    }
+
+    /// Off, only the unrecorded visibility changes carry across history: a recorded step that
+    /// changed visibility (Apply Layer Comp) gives it back when undone and sets it again when
+    /// redone, whether by Undo / Redo, a History row or deleting the current state.
+    #[test]
+    fn stepping_over_a_recorded_visibility_change_restores_it() {
+        let (mut s, id) = doc();
+        s.execute(CMD, json!({"makeLayerVisibilityChangesUndoable": false})).unwrap();
+        // A comp with the layer hidden, then the eye shows it again (no state) and a fill.
+        s.execute("layer.setProps", json!({"layer": id, "visible": false})).unwrap();
+        s.execute("layerComp.new", json!({"name": "Hidden"})).unwrap();
+        s.execute("layer.setProps", json!({"layer": id, "visible": true})).unwrap();
+        s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        s.execute("layerComp.apply", json!({"comp": "Hidden"})).unwrap();
+        assert!(red(&s, id) && !visible(&s, id), "the comp hides the layer");
+        s.execute("edit.undo", json!({})).unwrap();
+        assert!(red(&s, id) && visible(&s, id), "undoing Apply Layer Comp shows the layer again");
+        // The eye hides it (no state): undoing the fill keeps that.
+        s.execute("layer.setProps", json!({"layer": id, "visible": false})).unwrap();
+        s.execute("edit.undo", json!({})).unwrap();
+        assert!(!red(&s, id) && !visible(&s, id), "the unrecorded hide carries across the fill's undo");
+        s.execute("edit.redo", json!({})).unwrap();
+        assert!(red(&s, id) && !visible(&s, id));
+        s.execute("layer.setProps", json!({"layer": id, "visible": true})).unwrap();
+        s.execute("edit.redo", json!({})).unwrap();
+        assert!(red(&s, id) && !visible(&s, id), "redoing the comp hides the layer again");
+
+        // History rows: New, New Layer, New Layer Comp, Fill, Apply Layer Comp.
+        assert_eq!(entries(&s).len(), 5);
+        s.execute("history.selectState", json!({"state": 2})).unwrap();
+        assert!(!red(&s, id) && visible(&s, id), "jumping back over the comp shows the layer again");
+        s.execute("history.selectState", json!({"state": 4})).unwrap();
+        assert!(red(&s, id) && !visible(&s, id), "jumping forward over the comp hides it again");
+
+        // Non-linear Delete of the current state (the comp) steps back and shows the layer too.
+        s.execute(CMD, json!({"allowNonLinearHistory": true})).unwrap();
+        s.execute("history.deleteState", json!({})).unwrap();
+        assert!(red(&s, id) && visible(&s, id), "deleting the comp's state shows the layer again");
+
+        // Non-linear Delete of a past state: the step after it now starts from the state before
+        // it, so undoing that step also gives back the visibility the deleted step changed.
+        s.execute("layerComp.apply", json!({"comp": "Hidden"})).unwrap();
+        s.execute("edit.fill", json!({"color": "#0000ff"})).unwrap();
+        let comp = entries(&s).len() - 2;
+        s.execute("history.deleteState", json!({"state": comp})).unwrap();
+        assert!(!visible(&s, id));
+        s.execute("edit.undo", json!({})).unwrap();
+        assert!(red(&s, id) && visible(&s, id), "back at the red fill, where the layer was shown");
+    }
+
+    #[test]
+    fn non_linear_history_keeps_later_states_and_delete_removes_only_one() {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 16, "height": 16})).unwrap();
+        s.execute(CMD, json!({"allowNonLinearHistory": true})).unwrap();
+        for c in ["#ff0000", "#00ff00", "#0000ff"] {
+            s.execute("edit.fill", json!({"color": c})).unwrap();
+        }
+        let filled = entries(&s);
+        assert_eq!(filled.len(), 4);
+        s.execute("edit.undo", json!({})).unwrap();
+        s.execute("edit.undo", json!({})).unwrap();
+        s.execute("image.adjustments.invert", json!({})).unwrap();
+        let after = entries(&s);
+        assert_eq!(after.len(), 5, "the two later fills are kept: {after:?}");
+        assert_eq!(after[..4], filled[..]);
+        // Delete the second fill only: the states after it stay.
+        s.execute("history.deleteState", json!({"state": 2})).unwrap();
+        let mut expected = after.clone();
+        expected.remove(2);
+        assert_eq!(entries(&s), expected);
+        // Deleting the current state steps back to the one before; nothing else goes.
+        let doc_before = s.active().unwrap().history.state(expected.len() - 2).unwrap();
+        s.execute("history.deleteState", json!({})).unwrap();
+        assert_eq!(entries(&s), expected[..expected.len() - 1].to_vec());
+        assert!(std::sync::Arc::ptr_eq(&s.active().unwrap().doc, &doc_before));
+        // After stepping back, deleting the current state keeps the later (redo) states.
+        s.execute("edit.undo", json!({})).unwrap();
+        let redo: Vec<String> = s.active().unwrap().history.redo_labels().map(str::to_string).collect();
+        s.execute("history.deleteState", json!({})).unwrap();
+        assert_eq!(s.active().unwrap().history.redo_labels().map(str::to_string).collect::<Vec<_>>(), redo);
+
+        // Turning it off applies to open documents: the next edit after stepping back discards.
+        s.execute(CMD, json!({"allowNonLinearHistory": false})).unwrap();
+        assert!(!s.active().unwrap().history.non_linear);
+        s.execute("edit.fill", json!({"color": "#808080"})).unwrap();
+        assert!(!s.active().unwrap().history.can_redo());
+        // New documents pick the option up too.
+        s.execute(CMD, json!({"allowNonLinearHistory": true})).unwrap();
+        s.execute("file.new", json!({"width": 8, "height": 8})).unwrap();
+        assert!(s.active().unwrap().history.non_linear);
+    }
+
+    /// With the oldest state current, non-linear Delete is still enabled for a later (dimmed)
+    /// state (the History panel's trash and its drop target ask for it); linear history has
+    /// nothing to delete there.
+    #[test]
+    fn non_linear_delete_is_enabled_while_the_oldest_state_is_current() {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 16, "height": 16})).unwrap();
+        for c in ["#ff0000", "#00ff00"] {
+            s.execute("edit.fill", json!({"color": c})).unwrap();
+        }
+        s.execute("edit.undo", json!({})).unwrap();
+        s.execute("edit.undo", json!({})).unwrap();
+        assert!(!s.is_enabled("history.deleteState"), "linear: only the oldest state is left to delete");
+        s.execute(CMD, json!({"allowNonLinearHistory": true})).unwrap();
+        assert!(s.is_enabled("history.deleteState"));
+        let doc = s.active().unwrap().doc.clone();
+        s.execute("history.deleteState", json!({"state": 1})).unwrap();
+        let st = s.active().unwrap();
+        assert!(std::sync::Arc::ptr_eq(&st.doc, &doc), "the document is unchanged");
+        assert_eq!(st.history.redo_labels().count(), 1, "only the first fill went");
+        assert!(s.execute("history.deleteState", json!({})).is_err(), "the oldest state itself stays");
+        s.execute("history.deleteState", json!({"state": 1})).unwrap();
+        assert!(!s.is_enabled("history.deleteState"), "nothing left but the oldest state");
+    }
+
+    /// Non-linear Delete of a past or later state leaves the document as it is, so a saved
+    /// (clean) document stays clean; deleting the current state steps back and modifies it.
+    #[test]
+    fn non_linear_delete_of_another_state_keeps_a_clean_document_clean() {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 16, "height": 16})).unwrap();
+        s.execute(CMD, json!({"allowNonLinearHistory": true})).unwrap();
+        for c in ["#ff0000", "#00ff00", "#0000ff", "#808080"] {
+            s.execute("edit.fill", json!({"color": c})).unwrap();
+        }
+        s.execute("edit.undo", json!({})).unwrap();
+        // States: New, Fill 1-3 (3 current), the dimmed Fill 4. As if just saved.
+        let st = s.active_mut().unwrap();
+        st.saved_revision = st.revision;
+        let rev = st.revision;
+        s.execute("history.deleteState", json!({"state": 1})).unwrap();
+        let st = s.active().unwrap();
+        assert!(!st.is_dirty(), "deleting a past state left the saved document unmodified");
+        assert!(st.revision > rev, "the History panel still sees the change");
+        s.execute("history.deleteState", json!({"state": 3})).unwrap();
+        assert!(!s.active().unwrap().is_dirty(), "deleting a later state left it unmodified too");
+        assert_eq!(s.active().unwrap().history.redo_labels().count(), 0);
+        // A modified document stays modified.
+        s.execute("edit.fill", json!({"color": "#ffffff"})).unwrap();
+        s.execute("history.deleteState", json!({"state": 1})).unwrap();
+        assert!(s.active().unwrap().is_dirty());
+        // The current state: the document steps back, which is a change.
+        let st = s.active_mut().unwrap();
+        st.saved_revision = st.revision;
+        s.execute("history.deleteState", json!({})).unwrap();
+        assert!(s.active().unwrap().is_dirty());
+    }
+
+    /// With the option off, a recorded step that changes visibility along with other properties
+    /// (layer.setProps visible + opacity is one Layer Properties state) is undone and redone as a
+    /// whole: the carried-over visibility skips the layers the step itself changed.
+    #[test]
+    fn undoing_a_mixed_visibility_and_opacity_change_undoes_both() {
+        let (mut s, id) = doc();
+        s.execute(CMD, json!({"makeLayerVisibilityChangesUndoable": false})).unwrap();
+        let n = entries(&s).len();
+        s.execute("layer.setProps", json!({"layer": id, "visible": false, "opacity": 0.5})).unwrap();
+        assert_eq!(entries(&s).len(), n + 1, "the mixed change is a state");
+        let opacity = |s: &Session| s.active().unwrap().doc.layer(photocraft_doc::LayerId(id)).unwrap().opacity;
+        s.execute("edit.undo", json!({})).unwrap();
+        assert!(visible(&s, id) && (opacity(&s) - 1.0).abs() < 1e-6, "undo shows the layer again and restores its opacity");
+        s.execute("edit.redo", json!({})).unwrap();
+        assert!(!visible(&s, id) && (opacity(&s) - 0.5).abs() < 1e-6, "redo hides it again");
+    }
+
+    /// Non-linear Delete reaches a later (dimmed) state too, and deletes only it; linear history
+    /// still refuses one past the current state.
+    #[test]
+    fn non_linear_delete_removes_a_later_state() {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 16, "height": 16})).unwrap();
+        for c in ["#ff0000", "#00ff00", "#0000ff"] {
+            s.execute("edit.fill", json!({"color": c})).unwrap();
+        }
+        s.execute("edit.undo", json!({})).unwrap();
+        s.execute("edit.undo", json!({})).unwrap();
+        assert!(s.execute("history.deleteState", json!({"state": 2})).is_err(), "linear: not a deletable state");
+        s.execute(CMD, json!({"allowNonLinearHistory": true})).unwrap();
+        let doc = s.active().unwrap().doc.clone();
+        let mut expected = entries(&s);
+        let mut redo: Vec<String> = s.active().unwrap().history.redo_labels().map(str::to_string).collect();
+        // Entries: New, Fill (current), then the dimmed Fill 2 (state 2) and Fill 3 (state 3).
+        s.execute("history.deleteState", json!({"state": 2})).unwrap();
+        redo.remove(0);
+        let st = s.active().unwrap();
+        assert!(std::sync::Arc::ptr_eq(&st.doc, &doc), "the document is unchanged");
+        assert_eq!(st.history.redo_labels().map(str::to_string).collect::<Vec<_>>(), redo);
+        assert_eq!(entries(&s), expected);
+        assert!(s.execute("history.deleteState", json!({"state": 4})).is_err(), "past the last state");
+        s.execute("edit.redo", json!({})).unwrap();
+        expected.push(redo[0].clone());
+        assert_eq!(entries(&s), expected);
+        let px = s.active().unwrap().doc.layers[0].surface().unwrap().pixel(1, 1);
+        assert!(px[2] > 0.5 && px[1] < 0.5, "redo reaches the blue fill: {px:?}");
+    }
+
+    /// Off, taking a step back with `Session::rollback` (a cancelled Free Transform of a made
+    /// layer, an abandoned Alt-drag copy, a compound command whose later part failed) keeps the
+    /// unrecorded visibility as Undo does, and gives back the visibility the step itself changed,
+    /// whether it takes the step back exactly, falls back to Undo or lands on the oldest state.
+    #[test]
+    fn rollback_keeps_unrecorded_visibility() {
+        // Exactly: the fill is taken back, the eye's hide stays.
+        let (mut s, id) = doc();
+        s.execute(CMD, json!({"makeLayerVisibilityChangesUndoable": false})).unwrap();
+        s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        s.execute("layer.setProps", json!({"layer": id, "visible": false})).unwrap();
+        assert!(s.rollback());
+        assert!(!red(&s, id), "the fill is taken back");
+        assert!(!visible(&s, id), "the unrecorded hide stays");
+        assert!(!s.active().unwrap().history.can_redo(), "nothing to redo");
+
+        // Landing on the oldest state (the New Layer step taken back): the hidden background stays
+        // hidden.
+        let (mut s, _) = doc();
+        s.execute(CMD, json!({"makeLayerVisibilityChangesUndoable": false})).unwrap();
+        let bg = s.active().unwrap().doc.layers[0].id.0;
+        s.execute("layer.setProps", json!({"layer": bg, "visible": false})).unwrap();
+        assert!(s.rollback());
+        assert_eq!(s.active().unwrap().doc.layers.len(), 1, "the new layer is taken back");
+        assert!(!visible(&s, bg), "the unrecorded hide stays on the oldest state");
+        assert!(!s.rollback(), "nothing left to take back");
+        assert!(!visible(&s, bg));
+
+        // A step that changed visibility (Apply Layer Comp) gives it back.
+        let (mut s, id) = doc();
+        s.execute(CMD, json!({"makeLayerVisibilityChangesUndoable": false})).unwrap();
+        s.execute("layer.setProps", json!({"layer": id, "visible": false})).unwrap();
+        s.execute("layerComp.new", json!({"name": "Hidden"})).unwrap();
+        s.execute("layer.setProps", json!({"layer": id, "visible": true})).unwrap();
+        s.execute("layerComp.apply", json!({"comp": "Hidden"})).unwrap();
+        assert!(!visible(&s, id));
+        assert!(s.rollback());
+        assert!(visible(&s, id), "taking back Apply Layer Comp shows the layer again");
+
+        // Falling back to Undo (the history changed since the fill: undo, redo).
+        let (mut s, id) = doc();
+        s.execute(CMD, json!({"makeLayerVisibilityChangesUndoable": false})).unwrap();
+        s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        s.execute("edit.undo", json!({})).unwrap();
+        s.execute("edit.redo", json!({})).unwrap();
+        s.execute("layer.setProps", json!({"layer": id, "visible": false})).unwrap();
+        assert!(s.rollback());
+        assert!(!red(&s, id) && !visible(&s, id), "the fallback Undo keeps the hide too");
+        assert!(!s.active().unwrap().history.can_redo());
+
+        // Non-linear: a step recorded after stepping back, taken back exactly, keeps the hide and
+        // gives the later state back to redo.
+        let (mut s, id) = doc();
+        s.execute(CMD, json!({"makeLayerVisibilityChangesUndoable": false, "allowNonLinearHistory": true})).unwrap();
+        s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        s.execute("edit.undo", json!({})).unwrap();
+        s.execute("image.adjustments.invert", json!({})).unwrap();
+        s.execute("layer.setProps", json!({"layer": id, "visible": false})).unwrap();
+        assert!(s.rollback());
+        assert!(!red(&s, id) && !visible(&s, id), "back before the invert, still hidden");
+        assert!(s.active().unwrap().history.can_redo(), "the fill is redoable again");
+
+        // On (the default) the eye records a state of its own, which a rollback takes back.
+        let (mut s, id) = doc();
+        s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        s.execute("layer.setProps", json!({"layer": id, "visible": false})).unwrap();
+        assert!(s.rollback());
+        assert!(red(&s, id) && visible(&s, id), "the hide is taken back, the fill stays");
+    }
+
+    /// Non-linear, a step that moves more later states than the History States limit leaves room
+    /// for is still taken back exactly by a rollback (a compound command whose later part failed):
+    /// the document before it comes back with the full list, not an Undo onto the last later
+    /// state that also drops the rest.
+    #[test]
+    fn rollback_past_the_state_limit_restores_the_list() {
+        let (mut s, id) = doc();
+        s.execute(CMD, json!({"allowNonLinearHistory": true})).unwrap();
+        s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        s.execute("image.adjustments.invert", json!({})).unwrap();
+        s.execute("edit.undo", json!({})).unwrap();
+        s.execute("edit.undo", json!({})).unwrap();
+        let before = entries(&s);
+        let redo: Vec<String> = s.active().unwrap().history.redo_labels().map(str::to_string).collect();
+        assert_eq!(redo.len(), 2);
+        s.active_mut().unwrap().history.max_states = 2;
+        s.execute("edit.fill", json!({"color": "#0000ff"})).unwrap();
+        assert!(s.rollback());
+        assert_eq!(entries(&s), before);
+        assert_eq!(s.active().unwrap().history.redo_labels().map(str::to_string).collect::<Vec<_>>(), redo);
+        assert!(!red(&s, id), "back on the New Layer state, not on the inverted fill");
+        s.execute("edit.redo", json!({})).unwrap();
+        assert!(red(&s, id), "the red fill is still redoable");
+    }
+}
diff --git a/crates/engine/src/cmd/history_select_cmds.rs b/crates/engine/src/cmd/history_select_cmds.rs
index 2409722121..3b04fe0221 100644
--- a/crates/engine/src/cmd/history_select_cmds.rs
+++ b/crates/engine/src/cmd/history_select_cmds.rs
@@ -32,6 +32,7 @@ fn select_state(s: &mut Session, p: &Value) -> Result<Value> {
     if s.active_job().is_some() {
         return Err(EngineError::Other("the history can't move while a command is still running on this document".into()));
     }
+    let keep_visibility = !s.visibility_undoable();
     let st = s.active_mut().ok_or(EngineError::NoDocument)?;
     if target == past {
         return Ok(json!({ "state": target, "changed": false }));
@@ -44,8 +45,19 @@ fn select_state(s: &mut Session, p: &Value) -> Result<Value> {
     let mut layers = None;
     let mut at = past;
     while at != target {
-        let step = if target < at { st.history.undo(doc.clone()) } else { st.history.redo(doc.clone()) };
-        let Some((d, l)) = step else { break };
+        // History Options: visibility changes that are not history states stay as they are,
+        // step by step as Undo / Redo keep them, except on the layers whose visibility the step
+        // passed over changed.
+        let undoing = target < at;
+        let mut changed = if undoing { st.history.current_visibility().to_vec() } else { Vec::new() };
+        let step = if undoing { st.history.undo(doc.clone()) } else { st.history.redo(doc.clone()) };
+        let Some((mut d, l)) = step else { break };
+        if keep_visibility {
+            if !undoing {
+                changed = st.history.current_visibility().to_vec();
+            }
+            crate::carry_visibility(&doc, &mut d, &changed);
+        }
         doc = d;
         layers = Some(l);
         at = if target < at { at - 1 } else { at + 1 };
diff --git a/crates/engine/src/cmd/layer_copy_cmds.rs b/crates/engine/src/cmd/layer_copy_cmds.rs
index 78e72f0a7b..631cceac65 100644
--- a/crates/engine/src/cmd/layer_copy_cmds.rs
+++ b/crates/engine/src/cmd/layer_copy_cmds.rs
@@ -216,8 +216,11 @@ fn copy_to_document(s: &mut Session, p: &Value) -> Result<Value> {
         doc.patterns.extend(patterns);
         let mut above = *active;
         let mut new = Vec::with_capacity(copies.layers.len());
+        // The first copy goes where a new layer would; the rest stack above it.
+        let mut place = crate::layer_place::Place::AutoEditable;
         for l in copies.layers {
-            let id = doc.insert_above(above, l);
+            let id = crate::layer_place::insert_new(doc, above, l, place);
+            place = crate::layer_place::Place::Above;
             above = Some(id);
             new.push(id);
         }
diff --git a/crates/engine/src/cmd/layer_menu_cmds/tests.rs b/crates/engine/src/cmd/layer_menu_cmds/tests.rs
index b0cceb72a8..702d65891b 100644
--- a/crates/engine/src/cmd/layer_menu_cmds/tests.rs
+++ b/crates/engine/src/cmd/layer_menu_cmds/tests.rs
@@ -432,7 +432,7 @@ fn stack_modes_render_from_the_nested_layers() {
             surf.write_region(Rect::new(3, 3, 4, 4), &photocraft_raster::from_rgba(&fmt, [v, v, v, 1.0]));
             kids.push(l);
         }
-        let g = Layer::new("stack", LayerContent::Group(photocraft_doc::Group { children: kids, expanded: true, artboard: None }));
+        let g = Layer::new("stack", LayerContent::Group(photocraft_doc::Group { children: kids, expanded: true, artboard: None, frame_stroke: None }));
         let smart = crate::smart_cmds::layer_to_smart(doc, &g)?;
         let id = smart.id;
         doc.layers = vec![smart];
diff --git a/crates/engine/src/cmd/layer_multi_cmds.rs b/crates/engine/src/cmd/layer_multi_cmds.rs
index eb927039c5..52f36b9ffa 100644
--- a/crates/engine/src/cmd/layer_multi_cmds.rs
+++ b/crates/engine/src/cmd/layer_multi_cmds.rs
@@ -5,7 +5,7 @@
 //! The selection itself lives in [`DocState::selected_layers`] (UI state, like the active layer):
 //! changing it never adds a history step. Every structural change below is one history step.
 
-use photocraft_color::{PixelFormat, SampleType};
+use photocraft_color::PixelFormat;
 use photocraft_doc::{Document, Layer, LayerContent, LayerId, VideoData};
 use photocraft_geom::Rect;
 use serde_json::{Value, json};
@@ -141,7 +141,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Group from Layers…",
             &["Layer", "New"],
             None,
-            r##"{"layer":id?,"name":str?} (no layer: every selected layer)"##,
+            r##"{"layer":id?,"name":text?,"color":"none|red|orange|yellow|green|seafoam|blue|indigo|magenta|fuchsia|violet|gray"="none","mode":str="passThrough" (blend mode),"opacity":0..100=100 (percent)} (no layer: every selected layer; the new group starts collapsed)"##,
             has_layer,
             group_layers
         ),
diff --git a/crates/engine/src/cmd/layer_multi_cmds/align.rs b/crates/engine/src/cmd/layer_multi_cmds/align.rs
index c1477f58a7..e33b11b24a 100644
--- a/crates/engine/src/cmd/layer_multi_cmds/align.rs
+++ b/crates/engine/src/cmd/layer_multi_cmds/align.rs
@@ -1,7 +1,7 @@
 use super::damage::align_bounds;
 use super::moves::{move_layers, with_links};
 use super::selection::{selected, top_level};
-use super::*;
+use super::{Document, EngineError, LayerId, Rect, Result, Session, Value, bad, json};
 
 #[derive(Clone, Copy, PartialEq, Eq, Debug)]
 enum Edge {
diff --git a/crates/engine/src/cmd/layer_multi_cmds/damage.rs b/crates/engine/src/cmd/layer_multi_cmds/damage.rs
index 040a6ee5d7..b76c7fd059 100644
--- a/crates/engine/src/cmd/layer_multi_cmds/damage.rs
+++ b/crates/engine/src/cmd/layer_multi_cmds/damage.rs
@@ -1,4 +1,6 @@
-use super::*;
+use photocraft_color::{PixelFormat, SampleType};
+
+use super::{Document, Layer, LayerContent, LayerId, Rect, Session, VideoData};
 
 /// The document pixels an edit of the layers `ids` (moved, shown, hidden or restyled; contents
 /// otherwise as they were) can have changed from `before` to `after`, or `None` for anywhere.
diff --git a/crates/engine/src/cmd/layer_multi_cmds/moves.rs b/crates/engine/src/cmd/layer_multi_cmds/moves.rs
index a8f4a04918..822e0f6ad1 100644
--- a/crates/engine/src/cmd/layer_multi_cmds/moves.rs
+++ b/crates/engine/src/cmd/layer_multi_cmds/moves.rs
@@ -1,7 +1,7 @@
 use super::damage::note_damage;
 use super::selection::{reselect, same_named_targets, selected, top_level};
 use super::structure::check_group_depth;
-use super::*;
+use super::{Document, EngineError, Layer, LayerContent, LayerId, Result, Session, Value, bad, int_i32, json};
 
 /// A Layers-panel drag of the selected layer records its drop target by name (and which of
 /// several same-named layers it is), as [`recorded_selection`] does: the id means nothing in the
diff --git a/crates/engine/src/cmd/layer_multi_cmds/selection.rs b/crates/engine/src/cmd/layer_multi_cmds/selection.rs
index 9400760c8e..8f66dfab7c 100644
--- a/crates/engine/src/cmd/layer_multi_cmds/selection.rs
+++ b/crates/engine/src/cmd/layer_multi_cmds/selection.rs
@@ -1,5 +1,5 @@
 use super::moves::{link_groups, recorded_move};
-use super::*;
+use super::{DocState, Document, EngineError, Layer, LayerContent, LayerId, Rect, Result, Session, Value, bad, json};
 
 // ---------- selection state ----------
 
diff --git a/crates/engine/src/cmd/layer_multi_cmds/structure.rs b/crates/engine/src/cmd/layer_multi_cmds/structure.rs
index 7800db630f..70aa512223 100644
--- a/crates/engine/src/cmd/layer_multi_cmds/structure.rs
+++ b/crates/engine/src/cmd/layer_multi_cmds/structure.rs
@@ -1,5 +1,5 @@
 use super::selection::{reselect, selected, top_level};
-use super::*;
+use super::{Document, EngineError, Layer, LayerContent, LayerId, PixelFormat, Result, Session, Value, bad, json};
 
 // ---------- structural commands ----------
 
@@ -97,7 +97,7 @@ pub(crate) fn check_group_depth(doc: &Document, what: &str) -> Result<()> {
 
 /// Group Layers (⌘G) / Group from Layers: the explicit layer, or every selected layer, moves
 /// into a new, collapsed group placed where the top-most of them was. Bottom-to-top order is
-/// preserved.
+/// preserved. The New Group dialog's colour, mode and opacity are set in the same history step.
 pub fn group_layers(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = match crate::commands::explicit_layer(s, p)? {
         Some(id) => vec![id],
@@ -106,11 +106,15 @@ pub fn group_layers(s: &mut Session, p: &Value) -> Result<Value> {
     if ids.is_empty() {
         return Err(EngineError::Other("no layer selected".into()));
     }
-    let name = p.get("name").and_then(Value::as_str).map(str::to_string);
+    let opts = crate::group_options::GroupOptions::parse("layer.groupLayers", p)?;
     let gid = s.edit("Group Layers", |doc, active| {
         let ids = top_level(doc, &ids);
+        // Artboards stay at the top level: inside a group they would stop being boards.
+        if ids.iter().any(|id| doc.layer(*id).is_some_and(|l| l.artboard().is_some())) {
+            return Err(EngineError::Other("artboards can't go into a group".into()));
+        }
         let top = *ids.last().ok_or(EngineError::NoLayer(LayerId(0)))?;
-        let name = name.unwrap_or_else(|| doc.next_layer_name("Group"));
+        let name = opts.name.clone().unwrap_or_else(|| doc.next_layer_name("Group"));
         // Photoshop creates the group collapsed, so the panel shows one row in place of the layers.
         let mut group = Layer::group(name, vec![]);
         if let LayerContent::Group(g) = &mut group.content {
@@ -121,7 +125,9 @@ pub fn group_layers(s: &mut Session, p: &Value) -> Result<Value> {
         for id in &ids {
             children.push(doc.remove(*id).ok_or(EngineError::NoLayer(*id))?);
         }
-        *doc.layer_mut(gid).and_then(Layer::children_mut).ok_or(EngineError::NoLayer(gid))? = children;
+        let group = doc.layer_mut(gid).ok_or(EngineError::NoLayer(gid))?;
+        *group.children_mut().ok_or(EngineError::NoLayer(gid))? = children;
+        opts.apply(group);
         check_group_depth(doc, "Group Layers")?;
         *active = Some(gid);
         Ok(gid)
@@ -278,7 +284,7 @@ pub fn duplicate_selected(s: &mut Session, in_place: bool, label: &str) -> Resul
 /// Show/hide every selected layer in one step.
 pub fn set_visible_selected(s: &mut Session, visible: bool) -> Result<Value> {
     let sel = selected(s);
-    s.edit(if visible { "Show Layers" } else { "Hide Layers" }, |doc, _| {
+    s.edit_visibility(if visible { "Show Layers" } else { "Hide Layers" }, |doc, _| {
         for id in &sel {
             doc.layer_mut(*id).ok_or(EngineError::NoLayer(*id))?.visible = visible;
         }
diff --git a/crates/engine/src/cmd/layer_multi_cmds/tests.rs b/crates/engine/src/cmd/layer_multi_cmds/tests.rs
index 0acf0068f5..689a9856b4 100644
--- a/crates/engine/src/cmd/layer_multi_cmds/tests.rs
+++ b/crates/engine/src/cmd/layer_multi_cmds/tests.rs
@@ -1,3 +1,5 @@
+use photocraft_color::SampleType;
+
 use super::damage::{align_bounds, shape_pixel_bounds};
 use super::*;
 
@@ -999,6 +1001,31 @@ fn group_from_layers_preserves_order() {
     assert!(matches!(&doc(&s).layer(g).unwrap().content, LayerContent::Group(gr) if !gr.expanded));
 }
 
+/// Artboards are top-level groups; grouping them (now a plain click on the Layers panel's New
+/// Group button with two boards selected) is refused and leaves them as they were.
+#[test]
+fn grouping_artboards_is_refused() {
+    let mut s = session(8);
+    let a = LayerId(s.execute("layer.new.artboard", json!({"rect": [0, 0, 100, 80]})).unwrap()["layer"].as_u64().unwrap());
+    let b = LayerId(s.execute("layer.new.artboard", json!({"rect": [120, 0, 100, 80]})).unwrap()["layer"].as_u64().unwrap());
+    select_all(&mut s, &[a, b]);
+    let before = doc(&s).clone();
+    let err = s.execute("layer.groupLayers", json!({})).unwrap_err();
+    assert!(err.to_string().contains("artboards"), "{err}");
+    assert!(s.execute("layer.groupLayers", json!({"layer": a.0})).is_err(), "one board is refused too");
+    assert_eq!(doc(&s).layers.iter().map(|l| l.id).collect::<Vec<_>>(), before.layers.iter().map(|l| l.id).collect::<Vec<_>>());
+    assert_eq!(doc(&s).artboards().len(), 2);
+    // A layer inside a board still groups, inside its board. (Made with no layer selected: a
+    // new layer with a board selected goes into that board, as in Photoshop.)
+    s.execute("select.deselectLayers", json!({})).unwrap();
+    let inner = rect_layer(&mut s, Rect::new(0, 0, 5, 5));
+    select_all(&mut s, &[inner]);
+    let c = LayerId(s.execute("layer.new.artboardFromLayers", json!({})).unwrap()["layer"].as_u64().unwrap());
+    assert_eq!(doc(&s).artboard_of(inner), Some(c));
+    let g = LayerId(s.execute("layer.groupLayers", json!({"layer": inner.0})).unwrap()["layer"].as_u64().unwrap());
+    assert_eq!(doc(&s).artboard_of(g), Some(c));
+}
+
 #[test]
 fn grouping_is_capped_at_the_document_nesting_limit() {
     let mut s = session(8);
diff --git a/crates/engine/src/cmd/layer_nav_cmds.rs b/crates/engine/src/cmd/layer_nav_cmds.rs
index b41a18b590..bf02936418 100644
--- a/crates/engine/src/cmd/layer_nav_cmds.rs
+++ b/crates/engine/src/cmd/layer_nav_cmds.rs
@@ -118,8 +118,10 @@ mod tests {
         s.execute("layer.select", json!({"layer": c.0, "mode": "add"})).unwrap();
         s.execute("layer.groupLayers", json!({})).unwrap();
         let group = s.active().unwrap().doc.layers.iter().find(|l| l.is_group()).unwrap().id;
-        s.execute("layer.setExpanded", json!({"layer": group.0, "expanded": true})).unwrap();
+        // D goes above the closed group (an open one would take it inside, as in Photoshop).
         let d = id(&mut s, "layer.new.layer", json!({"name": "D"}));
+        // Group Layers makes a collapsed group; open it so the panel shows B and C.
+        s.execute("layer.setExpanded", json!({"layer": group.0, "expanded": true})).unwrap();
         (s, [bg, a, group, b, c, d])
     }
 
diff --git a/crates/engine/src/cmd/layer_params.rs b/crates/engine/src/cmd/layer_params.rs
index baeb15af96..f298893b33 100644
--- a/crates/engine/src/cmd/layer_params.rs
+++ b/crates/engine/src/cmd/layer_params.rs
@@ -1,5 +1,5 @@
 use super::params::bad;
-use super::*;
+use super::{BlendMode, Document, EngineError, Layer, LayerId, LayerMask, Result, SampleType, Session, Value};
 
 /// The layer a command's `"layer"` param names: an id, or a name (the topmost layer of that
 /// name, as Photoshop's "select layer by name" action step finds it, so a loaded action replays
diff --git a/crates/engine/src/cmd/layer_xmp_cmds.rs b/crates/engine/src/cmd/layer_xmp_cmds.rs
index 4fb4eda32f..742e0adf8d 100644
--- a/crates/engine/src/cmd/layer_xmp_cmds.rs
+++ b/crates/engine/src/cmd/layer_xmp_cmds.rs
@@ -33,7 +33,7 @@ fn check_packet(raw: &str) -> Result<()> {
     if raw.contains('\0') {
         return Err(bad("`rawData` can't contain NUL characters"));
     }
-    let xml = roxmltree::Document::parse(raw).map_err(|e| bad(format!("`rawData` isn't well-formed XML: {e}")))?;
+    let xml = photocraft_io::xml::parse(raw, roxmltree::ParsingOptions::default()).map_err(|e| bad(format!("`rawData` isn't well-formed XML: {e}")))?;
     let root = xml.root_element().tag_name();
     let xmp = matches!((root.namespace(), root.name()), (Some("adobe:ns:meta/"), "xmpmeta") | (Some("http://www.w3.org/1999/02/22-rdf-syntax-ns#"), "RDF"));
     if !xmp {
diff --git a/crates/engine/src/cmd/layer_xmp_cmds/tests.rs b/crates/engine/src/cmd/layer_xmp_cmds/tests.rs
index 015f739399..5fb67ad13c 100644
--- a/crates/engine/src/cmd/layer_xmp_cmds/tests.rs
+++ b/crates/engine/src/cmd/layer_xmp_cmds/tests.rs
@@ -61,6 +61,27 @@ fn sets_reads_and_removes_as_one_undo_step_each() {
     }
 }
 
+/// A `rawData` packet nested 20 000 deep overflowed the XML parser's recursion (an abort nothing
+/// can catch, from one command param); it is a param error now. The small stack makes a
+/// regression abort instead of passing.
+#[test]
+fn deeply_nested_packets_are_refused_not_a_stack_overflow() {
+    let (s, a, _) = fixture(8);
+    let raw = format!("<x:xmpmeta xmlns:x=\"adobe:ns:meta/\">{}{}</x:xmpmeta>", "<a>".repeat(20_000), "</a>".repeat(20_000));
+    let (s, e) = std::thread::Builder::new()
+        .stack_size(1024 * 1024)
+        .spawn(move || {
+            let mut s = s;
+            let e = s.execute(ID, json!({"rawData": raw})).err();
+            (s, e)
+        })
+        .unwrap()
+        .join()
+        .unwrap();
+    assert!(matches!(&e, Some(EngineError::BadParams { msg, .. }) if msg.contains("nested")), "{e:?}");
+    assert_eq!(xmp(&s, a), None);
+}
+
 #[test]
 fn duplicating_a_layer_copies_its_packet() {
     let (mut s, a, _) = fixture(8);
diff --git a/crates/engine/src/cmd/ops.rs b/crates/engine/src/cmd/ops.rs
index 776f47e020..c106af6aac 100644
--- a/crates/engine/src/cmd/ops.rs
+++ b/crates/engine/src/cmd/ops.rs
@@ -1,6 +1,6 @@
 use super::enabled::check_all_unlocked;
 use super::layer_params::{layer_param, mask_at_depth};
-use super::*;
+use super::{Document, EngineError, Layer, LayerContent, LayerId, LayerMask, Result, Session, Value, json, pixels};
 
 pub(super) fn arrange(s: &mut Session, p: &Value, delta: i32) -> Result<Value> {
     let id = layer_param(s, p)?;
diff --git a/crates/engine/src/cmd/params.rs b/crates/engine/src/cmd/params.rs
index bd6396803d..f5d644dae7 100644
--- a/crates/engine/src/cmd/params.rs
+++ b/crates/engine/src/cmd/params.rs
@@ -1,5 +1,5 @@
 use super::layer_params::layer_param;
-use super::*;
+use super::{EngineError, LayerId, Result, Session, Value, json};
 
 // ---------- param helpers ----------
 
diff --git a/crates/engine/src/cmd/path_edit_cmds.rs b/crates/engine/src/cmd/path_edit_cmds.rs
index 503ac8efae..d06b0fb29c 100644
--- a/crates/engine/src/cmd/path_edit_cmds.rs
+++ b/crates/engine/src/cmd/path_edit_cmds.rs
@@ -6,7 +6,8 @@
 //!
 //! Every command targets a path like `path.transform`: `"name":"work"` (default), a saved path's
 //! name, or `"layer"` with `"layer":id?` for a shape layer's path (re-rendered; it stops being a
-//! live shape) or a layer's vector mask. Knots are addressed by `subpath` and `knot` index, as
+//! live shape), a layer's vector mask, or type on a path's Type Path (`"typePath":true` when the
+//! type layer also has a vector mask). Knots are addressed by `subpath` and `knot` index, as
 //! listed by `path.info`, and the result is `{name, path}` in the compact JSON form.
 
 use photocraft_doc::{LayerContent, Path};
@@ -49,6 +50,23 @@ fn knot(cmd: &str, p: &Value) -> Result<[usize; 2]> {
 fn edit_path(s: &mut Session, cmd: &str, p: &Value, label: &str, f: impl FnOnce(&mut Path) -> std::result::Result<(), String>) -> Result<Value> {
     let name = p.get("name").and_then(Value::as_str).unwrap_or("work").to_owned();
     let layer = if name == "layer" { Some(layer_id(s, p)?) } else { None };
+    // Type on a path: its own path, the text laid along it again (#9114). A vector mask on the
+    // layer stays what `"layer"` edits, as with `path.info`, unless `"typePath": true`.
+    let type_path = p.get("typePath").and_then(Value::as_bool).unwrap_or(false);
+    let typed = layer.filter(|id| {
+        s.active().and_then(|d| d.doc.layer(*id)).is_some_and(|l| {
+            matches!(&l.content, LayerContent::Text(t) if crate::type_extra_cmds::type_path(t).is_some()) && (type_path || l.vector_mask.is_none())
+        })
+    });
+    if let Some(id) = typed {
+        let path = crate::type_extra_cmds::with_text(s, &json!({"layer": id.0}), label, |t, _| {
+            let mut path = crate::type_extra_cmds::type_path(t).ok_or_else(|| bad(cmd, "the type layer is not on a path"))?;
+            f(&mut path).map_err(|e| bad(cmd, e))?;
+            crate::type_extra_cmds::set_type_path(t, &path)?;
+            Ok(path_json(&path))
+        })?;
+        return Ok(json!({ "name": name, "path": path }));
+    }
     let shape = layer.filter(|id| s.active().and_then(|d| d.doc.layer(*id)).is_some_and(|l| matches!(l.content, LayerContent::Shape(_))));
     let path = match shape {
         Some(id) => with_shape(s, id, label, |sh, _| {
@@ -149,7 +167,7 @@ fn delete_anchor(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 pub fn specs() -> Vec<CommandSpec> {
-    const TARGET: &str = r#""name":str|"work"|"layer"="work","layer":id? (with "layer": a shape layer's path or a vector mask)"#;
+    const TARGET: &str = r#""name":str|"work"|"layer"="work","layer":id? (with "layer": a shape layer's path, a vector mask, or else type on a path's Type Path),"typePath":bool=false (with "layer": the Type Path even when the type layer has a vector mask)"#;
     let spec = |id: &'static str, label: &'static str, params: String, run: fn(&mut Session, &Value) -> Result<Value>| CommandSpec {
         id,
         label,
diff --git a/crates/engine/src/cmd/pattern_cmds.rs b/crates/engine/src/cmd/pattern_cmds.rs
index 9651874591..447e4c8dc7 100644
--- a/crates/engine/src/cmd/pattern_cmds.rs
+++ b/crates/engine/src/cmd/pattern_cmds.rs
@@ -397,7 +397,7 @@ pub(crate) fn insert_fill_layer(
     let fill = Fill::Pattern { name: pat.name.clone(), scale, id: pat.id.clone(), angle, link, phase };
     let mut l = Layer::new(doc.next_layer_name("Pattern Fill"), LayerContent::Fill(fill));
     crate::commands::mask_new_layer(doc, &mut l, p, "layer.newFillLayer.pattern", default_mask)?;
-    let id = doc.insert_above(*active, l);
+    let id = crate::layer_place::insert_new(doc, *active, l, crate::layer_place::Place::Auto);
     *active = Some(id);
     Ok(id)
 }
diff --git a/crates/engine/src/cmd/print_cmds.rs b/crates/engine/src/cmd/print_cmds.rs
index d115566a7c..37b4e78e92 100644
--- a/crates/engine/src/cmd/print_cmds.rs
+++ b/crates/engine/src/cmd/print_cmds.rs
@@ -71,6 +71,176 @@ pub struct Spooler {
     pub run: SpoolFn,
 }
 
+/// A stand-in for the system's printers, installed on `Session::printer_source` (tests):
+/// `file.printers`, `file.print.printers` and the Print dialog list these and do not ask the spooler.
+/// `file.print.printers` and the dialog's driver Printer menu list them on Windows only, where the
+/// GDI route is; elsewhere they answer as that route does there. In the browser `file.printers`
+/// lists none of them, as it lists no printers there without a stand-in.
+pub type PrinterSource = std::sync::Arc<dyn Fn() -> Vec<craft_print::Printer> + Send + Sync>;
+
+/// Held while a thread of this process lists printers or calls into a printer driver.
+static SPOOLER: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
+/// Runs `f`, which lists printers or calls into a printer driver, while no other thread of this
+/// process does either. On Windows, two threads that open printers' PrintTicket providers for the
+/// first time at once can crash the process inside the spooler client (`winspool.drv`). A panic in
+/// an earlier caller does not block later ones. A call made inside `f` on the same thread runs at
+/// once.
+pub fn with_spooler<T>(f: impl FnOnce() -> T) -> T {
+    if HOLDING.get() {
+        return f();
+    }
+    let _held = SPOOLER.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    holding(f)
+}
+
+thread_local! {
+    /// Whether this thread holds `SPOOLER`.
+    static HOLDING: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
+}
+
+/// Runs `f` with `HOLDING` set; called with `SPOOLER` held.
+fn holding<T>(f: impl FnOnce() -> T) -> T {
+    struct Release;
+    impl Drop for Release {
+        fn drop(&mut self) {
+            HOLDING.set(false);
+        }
+    }
+    HOLDING.set(true);
+    let _release = Release;
+    f()
+}
+
+/// Counts the times this process asked the system for its printers.
+static SYSTEM_LISTINGS: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+
+/// How many times this process has asked the system for its printers. A session with a
+/// `printer_source` does not ask.
+pub fn system_printer_listings() -> usize {
+    SYSTEM_LISTINGS.load(std::sync::atomic::Ordering::Relaxed)
+}
+
+/// Runs `f` as `with_spooler` does, or returns `None` at once while another thread of this
+/// process holds the lock (the UI thread, which must not wait for a print job or a driver).
+pub fn try_with_spooler<T>(f: impl FnOnce() -> T) -> Option<T> {
+    if HOLDING.get() {
+        return Some(f());
+    }
+    let _held = match SPOOLER.try_lock() {
+        Ok(held) => held,
+        Err(std::sync::TryLockError::Poisoned(e)) => e.into_inner(),
+        Err(std::sync::TryLockError::WouldBlock) => return None,
+    };
+    Some(holding(f))
+}
+
+/// What the Print dialog shows when `try_with_spooler` finds the lock held.
+pub const SPOOLER_BUSY: &str = "the printer driver is busy with another print; try again when it finishes";
+
+/// The GDI route's printers, or why they could not be listed.
+pub type RgbPrinters = std::result::Result<Vec<craft_print::rgb::Printer>, craft_print::rgb::PrintError>;
+
+/// A list kept with the session's `printer_source` it came from (`None` for the system's printers).
+type Kept<T> = std::sync::Mutex<Option<(Option<PrinterSource>, T)>>;
+
+/// The last answers `system_printer_list` and `rgb_printers` got in this process.
+static LAST_PRINTERS: Kept<Vec<craft_print::Printer>> = std::sync::Mutex::new(None);
+static LAST_RGB_PRINTERS: Kept<RgbPrinters> = std::sync::Mutex::new(None);
+
+/// The kept list when it came from `source`; a list from other printers is not returned.
+fn last<T: Clone>(kept: &Kept<T>, source: Option<&PrinterSource>) -> Option<T> {
+    let kept = kept.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let (from, list) = kept.as_ref()?;
+    let same = match (from, source) {
+        (None, None) => true,
+        (Some(from), Some(source)) => std::sync::Arc::ptr_eq(from, source),
+        _ => false,
+    };
+    same.then(|| list.clone())
+}
+
+fn keep<T>(kept: &Kept<T>, source: Option<&PrinterSource>, value: T) {
+    *kept.lock().unwrap_or_else(std::sync::PoisonError::into_inner) = Some((source.cloned(), value));
+}
+
+/// Lists the printers; called with the spooler lock held.
+fn list_system_printers(s: &Session) -> Vec<craft_print::Printer> {
+    let list = match stand_in_printers(s.printer_source.as_ref(), cfg!(target_arch = "wasm32")) {
+        Some(source) => source(),
+        None => {
+            SYSTEM_LISTINGS.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+            craft_print::printers()
+        }
+    };
+    keep(&LAST_PRINTERS, s.printer_source.as_ref(), list.clone());
+    list
+}
+
+/// `file.printers`' stand-in: the session's outside the browser, and `None` in the browser, where
+/// `file.printers` lists no printers.
+fn stand_in_printers(source: Option<&PrinterSource>, browser: bool) -> Option<&PrinterSource> {
+    source.filter(|_| !browser)
+}
+
+/// Lists the GDI route's printers; called with the spooler lock held.
+fn list_rgb_printers(s: &Session) -> RgbPrinters {
+    let list = match &s.printer_source {
+        Some(source) => stand_in_rgb_printers(source, cfg!(windows)),
+        None => {
+            SYSTEM_LISTINGS.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+            craft_print::rgb::printers()
+        }
+    };
+    keep(&LAST_RGB_PRINTERS, s.printer_source.as_ref(), list.clone());
+    list
+}
+
+/// The GDI route's answer from a stand-in: its printers on Windows, and `Unsupported` elsewhere,
+/// as `craft_print::rgb::printers` answers there.
+fn stand_in_rgb_printers(source: &PrinterSource, windows: bool) -> RgbPrinters {
+    if !windows {
+        return Err(craft_print::rgb::PrintError::Unsupported);
+    }
+    Ok(source().into_iter().map(|p| craft_print::rgb::Printer { name: p.name, default: p.default }).collect())
+}
+
+/// The printers `craft-print` spools to, or the session's stand-in for them.
+fn system_printer_list(s: &Session) -> Vec<craft_print::Printer> {
+    with_spooler(|| list_system_printers(s))
+}
+
+/// The printers the GDI route prints to (`craft_print::rgb`), or on Windows the session's stand-in
+/// for them.
+pub fn rgb_printers(s: &Session) -> RgbPrinters {
+    with_spooler(|| list_rgb_printers(s))
+}
+
+/// Lists printers when the spooler is available. While it is busy, returns the cached list for
+/// the same source, or `Unsupported` if that source has no cached list.
+pub fn rgb_printers_without_waiting(s: &Session) -> RgbPrinters {
+    try_with_spooler(|| list_rgb_printers(s))
+        .or_else(|| last(&LAST_RGB_PRINTERS, s.printer_source.as_ref()))
+        .unwrap_or(Err(craft_print::rgb::PrintError::Unsupported))
+}
+
+/// Lists printers for the Print dialog. While the system spooler is busy, returns the cached
+/// list for the same source, or an empty list if that source has no cached list.
+pub fn printers_without_waiting(s: &mut Session) -> Value {
+    if stand_in_printers(s.printer_source.as_ref(), cfg!(target_arch = "wasm32")).is_none() && system_spooler().is_none() {
+        return system_printers(s, &json!({})).unwrap_or_default();
+    }
+    let list = try_with_spooler(|| list_system_printers(s)).or_else(|| last(&LAST_PRINTERS, s.printer_source.as_ref())).unwrap_or_default();
+    printers_answer(list)
+}
+
+/// `file.printers`' answer for a list from `craft-print`.
+fn printers_answer(list: Vec<craft_print::Printer>) -> Value {
+    let default = list.iter().find(|p| p.default).map(|p| p.name.clone());
+    let printers: Vec<Value> = list.into_iter().map(|p| json!({"name": p.name, "default": p.default})).collect();
+    json!({"server": Value::Null, "default": default, "printers": printers})
+}
+
 /// Why the IPP route could not spool: no route at all (the app's spooler may have one), or a
 /// failure on a route that exists (a wrong printer name, a rejected job).
 enum SpoolError {
@@ -91,7 +261,7 @@ fn spool_job(spooler: Option<&Spooler>, job: &PrintJob, lp: &craft_print::Job) -
         }
         if let Some(name) = system_spooler() {
             require_windows_pdf()?;
-            return craft_print::submit(&job.pdf, lp).map(|m| (m, name.to_string())).map_err(other);
+            return with_spooler(|| craft_print::submit(&job.pdf, lp)).map(|m| (m, name.to_string())).map_err(other);
         }
     }
     match cups_spool(job) {
@@ -190,13 +360,10 @@ fn cups_spool(job: &PrintJob) -> std::result::Result<String, SpoolError> {
 /// `file.printers`: the printers the system's (or `printServer`'s) print server knows, with the default. From
 /// `craft-print` (`lpstat`, the Windows spooler) where that is the route; over IPP for a named
 /// server and where there is no `lp` (a sandbox).
-fn system_printers(_s: &mut Session, p: &Value) -> Result<Value> {
+fn system_printers(s: &mut Session, p: &Value) -> Result<Value> {
     let named = p.get("printServer").and_then(Value::as_str).filter(|v| !v.is_empty());
-    if named.is_none() && system_spooler().is_some() {
-        let list = craft_print::printers();
-        let default = list.iter().find(|p| p.default).map(|p| p.name.clone());
-        let printers: Vec<Value> = list.into_iter().map(|p| json!({"name": p.name, "default": p.default})).collect();
-        return Ok(json!({"server": Value::Null, "default": default, "printers": printers}));
+    if named.is_none() && (stand_in_printers(s.printer_source.as_ref(), cfg!(target_arch = "wasm32")).is_some() || system_spooler().is_some()) {
+        return Ok(printers_answer(system_printer_list(s)));
     }
     #[cfg(all(not(target_arch = "wasm32"), not(target_os = "windows")))]
     {
@@ -341,8 +508,10 @@ fn pdf_string(s: &str) -> String {
 }
 
 fn deflate(data: &[u8]) -> Vec<u8> {
-    // Fast: print PDFs are transient and large; level 1 is ~4× quicker than the default.
-    let mut e = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::fast());
+    // Fast: print PDFs are transient and large. Level 3, not 1: zlib-rs level 1 writes static
+    // Huffman blocks only (13-30% bigger on photos); level 3 is the lowest that is never bigger
+    // than miniz's level 1 was, at about twice its time.
+    let mut e = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::new(3));
     let _ = e.write_all(data);
     e.finish().unwrap_or_default()
 }
@@ -736,7 +905,8 @@ fn with_driver_printable(p: &Value) -> Value {
 
 fn driver_printable(p: &Value) -> Option<Value> {
     let printer = printer_name(p).ok()?;
-    let pg = craft_print::rgb::page(&printer, printer_settings(p).ok()?.as_ref()).ok()?;
+    let settings = printer_settings(p).ok()?;
+    let pg = with_spooler(|| craft_print::rgb::page(&printer, settings.as_ref())).ok()?;
     // Only for the paper the driver is set to: a print laid out on another paper keeps the
     // fixed margin (and `print_windows` refuses it), as before.
     let (pw, ph) = paper(p, "file.print").ok()?;
@@ -905,7 +1075,7 @@ fn printer_name(p: &Value) -> Result<String> {
     if let Some(name) = p.get("printer").and_then(Value::as_str).filter(|v| !v.trim().is_empty()) {
         return Ok(name.to_string());
     }
-    craft_print::rgb::default_printer().map_err(other)?.ok_or_else(|| other("no printer chosen and no default printer is set"))
+    with_spooler(craft_print::rgb::default_printer).map_err(other)?.ok_or_else(|| other("no printer chosen and no default printer is set"))
 }
 
 /// The driver settings chosen with Print Settings… (`printerSettings`, hex), when any.
@@ -958,16 +1128,16 @@ fn settings_for_layout(
     settings: Option<craft_print::rgb::DevMode>,
     paper: (f64, f64),
 ) -> Result<(Option<craft_print::rgb::DevMode>, craft_print::rgb::Page)> {
-    let page = craft_print::rgb::page(printer, settings.as_ref()).map_err(other)?;
+    let page = with_spooler(|| craft_print::rgb::page(printer, settings.as_ref())).map_err(other)?;
     if !turned_paper(page.paper, paper) {
         return Ok((settings, page));
     }
     let base = match settings {
         Some(s) => s,
-        None => craft_print::rgb::default_settings(printer).map_err(other)?,
+        None => with_spooler(|| craft_print::rgb::default_settings(printer)).map_err(other)?,
     };
     let turned = turned_settings(&base, paper.0 > paper.1)?;
-    let page = craft_print::rgb::page(printer, Some(&turned)).map_err(other)?;
+    let page = with_spooler(|| craft_print::rgb::page(printer, Some(&turned))).map_err(other)?;
     Ok((Some(turned), page))
 }
 
@@ -1027,14 +1197,14 @@ fn print_windows(page: &PrintPage, p: &Value, title: &str, copies: u32) -> Resul
         color_policy,
         primitives: &primitives,
     };
-    let done = craft_print::rgb::print(&job, &image, rect).map_err(other)?;
+    let done = with_spooler(|| craft_print::rgb::print(&job, &image, rect)).map_err(other)?;
     Ok(
         json!({"printer": printer, "dpi": [done.dpi.0, done.dpi.1], "deviceRect": [done.device_rect.0, done.device_rect.1, done.device_rect.2, done.device_rect.3]}),
     )
 }
 
-fn printers(_: &mut Session, _: &Value) -> Result<Value> {
-    match craft_print::rgb::printers() {
+fn printers(s: &mut Session, _: &Value) -> Result<Value> {
+    match rgb_printers(s) {
         Ok(list) => Ok(json!({"supported": true, "printers": list.iter().map(|p| json!({"name": p.name, "default": p.default})).collect::<Vec<_>>()})),
         Err(craft_print::rgb::PrintError::Unsupported) => Ok(json!({"supported": false, "printers": []})),
         Err(e) => Err(other(e)),
@@ -1056,11 +1226,11 @@ fn printer_page(_: &mut Session, p: &Value) -> Result<Value> {
     if let Some(landscape) = landscape {
         let base = match settings {
             Some(s) => s,
-            None => craft_print::rgb::default_settings(&printer).map_err(other)?,
+            None => with_spooler(|| craft_print::rgb::default_settings(&printer)).map_err(other)?,
         };
         settings = Some(turned_settings(&base, landscape)?);
     }
-    let pg = craft_print::rgb::page(&printer, settings.as_ref()).map_err(other)?;
+    let pg = with_spooler(|| craft_print::rgb::page(&printer, settings.as_ref())).map_err(other)?;
     let mut out = json!({"printer": printer, "paper": [pg.paper.0, pg.paper.1], "printable": [pg.printable.0, pg.printable.1, pg.printable.2, pg.printable.3], "dpi": [pg.dpi.0, pg.dpi.1]});
     // The turned settings, to pass on as `printerSettings` (the Print dialog's Orientation does).
     if let (Some(_), Some(s), Some(o)) = (landscape, settings, out.as_object_mut()) {
diff --git a/crates/engine/src/cmd/print_cmds/tests.rs b/crates/engine/src/cmd/print_cmds/tests.rs
index ab2e104a48..6208b53ec5 100644
--- a/crates/engine/src/cmd/print_cmds/tests.rs
+++ b/crates/engine/src/cmd/print_cmds/tests.rs
@@ -258,17 +258,50 @@ fn native_rgb_route_preserves_pdf_only_color_and_page_content() {
     assert!(native_rgb_compatible(&page_of(1, vec![0; 2], false), "noColorManagement"));
 }
 
+/// Two printers, the second the default, in place of the system spooler's.
+fn test_printers() -> PrinterSource {
+    std::sync::Arc::new(|| {
+        vec![
+            craft_print::Printer { name: "Studio".into(), default: false, two_sided: None, description: String::new() },
+            craft_print::Printer { name: "Office".into(), default: true, two_sided: Some(true), description: String::new() },
+        ]
+    })
+}
+
 #[test]
 fn printer_commands_answer_without_a_document_and_reject_bad_settings() {
     let mut s = Session::new();
+    s.printer_source = Some(test_printers());
     let r = s.execute("file.print.printers", json!({})).unwrap();
     assert_eq!(r["supported"], cfg!(windows));
-    assert!(r["printers"].is_array());
+    let listed = if cfg!(windows) { json!([{"name": "Studio", "default": false}, {"name": "Office", "default": true}]) } else { json!([]) };
+    assert_eq!(r["printers"], listed);
     assert!(s.execute("file.print.page", json!({"printer": "Anything", "printerSettings": "zz"})).is_err());
     let mut s = session("rgb", 8);
     assert!(s.execute("file.print", json!({"printer": "Anything", "printerSettings": "0102", "send": true})).is_err());
 }
 
+/// The GDI route lists a stand-in's printers only on Windows. Elsewhere it answers `Unsupported`
+/// as the real route does, so the Print dialog shows the system's printers and paper controls.
+#[test]
+fn stand_in_printers_reach_the_gdi_route_on_windows_only() {
+    let source = test_printers();
+    assert_eq!(stand_in_rgb_printers(&source, false), Err(craft_print::rgb::PrintError::Unsupported));
+    let listed = stand_in_rgb_printers(&source, true).unwrap();
+    assert_eq!(listed.iter().map(|p| (p.name.as_str(), p.default)).collect::<Vec<_>>(), [("Studio", false), ("Office", true)]);
+}
+
+/// `file.printers` lists a stand-in's printers everywhere but the browser. In the browser it lists
+/// none, as the real command does there.
+#[test]
+fn stand_in_printers_reach_file_printers_outside_the_browser_only() {
+    let source = test_printers();
+    assert!(stand_in_printers(Some(&source), true).is_none());
+    let listed = stand_in_printers(Some(&source), false).map(|source| source());
+    assert_eq!(listed.unwrap_or_default().iter().map(|p| (p.name.as_str(), p.default)).collect::<Vec<_>>(), [("Studio", false), ("Office", true)]);
+    assert!(stand_in_printers(None, false).is_none());
+}
+
 /// Synthetic driver settings: a DEVMODEW of `size` bytes plus `extra` private driver bytes, every
 /// byte a pattern so a stray write shows, with `dmFields` saying only the paper size is set.
 fn devmode(size: u16, extra: u16) -> Vec<u8> {
@@ -676,13 +709,189 @@ fn disabled_printing_never_spools() {
 #[test]
 fn printers_lists_the_spooler_destinations_without_a_document() {
     let mut s = Session::new();
+    s.printer_source = Some(test_printers());
     let r = s.execute("file.printers", json!({})).unwrap();
-    let list = r["printers"].as_array().unwrap();
-    assert!(list.iter().all(|p| p["name"].is_string() && p["default"].is_boolean()));
-    match r["default"].as_str() {
-        Some(d) => assert!(list.iter().any(|p| p["name"] == d && p["default"] == true)),
-        None => assert!(list.iter().all(|p| p["default"] == false)),
+    assert_eq!(r["printers"], json!([{"name": "Studio", "default": false}, {"name": "Office", "default": true}]));
+    assert_eq!(r["default"], "Office");
+    s.printer_source = Some(std::sync::Arc::new(Vec::new));
+    let r = s.execute("file.printers", json!({})).unwrap();
+    assert_eq!((r["printers"].clone(), r["default"].clone()), (json!([]), Value::Null));
+}
+
+/// Threads that list printers at the same time enter the spooler one at a time: the stand-in
+/// printer list records how many threads were inside it at once.
+#[test]
+fn printer_listings_enter_the_spooler_one_thread_at_a_time() {
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::sync::{Arc, Barrier};
+    const THREADS: usize = 8;
+    let inside = Arc::new(AtomicUsize::new(0));
+    let most = Arc::new(AtomicUsize::new(0));
+    let start = Arc::new(Barrier::new(THREADS));
+    let threads: Vec<_> = (0..THREADS)
+        .map(|i| {
+            let (inside, most, start) = (Arc::clone(&inside), Arc::clone(&most), Arc::clone(&start));
+            std::thread::spawn(move || {
+                let mut s = Session::new();
+                s.printer_source = Some(Arc::new(move || {
+                    let now = inside.fetch_add(1, Ordering::SeqCst) + 1;
+                    most.fetch_max(now, Ordering::SeqCst);
+                    std::thread::sleep(std::time::Duration::from_millis(5));
+                    inside.fetch_sub(1, Ordering::SeqCst);
+                    vec![craft_print::Printer { name: "Office".into(), default: true, two_sided: None, description: String::new() }]
+                }));
+                start.wait();
+                for _ in 0..3 {
+                    // `file.print.printers` lists the stand-in on Windows only.
+                    let id = if i % 2 == 0 || !cfg!(windows) { "file.printers" } else { "file.print.printers" };
+                    assert_eq!(s.execute(id, json!({})).unwrap()["printers"][0]["name"], "Office");
+                }
+            })
+        })
+        .collect();
+    for t in threads {
+        t.join().unwrap();
     }
+    assert_eq!(most.load(Ordering::SeqCst), 1, "two threads were in the printer listing at once");
+}
+
+/// A caller that panics inside the spooler leaves it usable for later callers.
+#[test]
+fn a_panic_inside_the_spooler_does_not_block_later_callers() {
+    let panicked = std::thread::spawn(|| with_spooler::<()>(|| panic!("a driver call panicked"))).join();
+    assert!(panicked.is_err());
+    assert_eq!(with_spooler(|| 7), 7);
+    let mut s = Session::new();
+    s.printer_source = Some(test_printers());
+    assert_eq!(s.execute("file.printers", json!({})).unwrap()["default"], "Office");
+}
+
+/// A driver call made while this thread already holds the spooler (a command run from the Print
+/// dialog's `try_with_spooler`) runs at once.
+#[test]
+fn a_thread_holding_the_spooler_does_not_wait_for_itself() {
+    let (done, finished) = std::sync::mpsc::channel();
+    std::thread::spawn(move || {
+        let mut s = Session::new();
+        s.printer_source = Some(test_printers());
+        // Inside one outer hold, so no other test takes the lock between the calls.
+        let answers = with_spooler(|| {
+            let nested = with_spooler(|| with_spooler(|| 7));
+            let tried = try_with_spooler(|| with_spooler(|| try_with_spooler(|| 8)));
+            let listed = try_with_spooler(|| s.execute("file.printers", json!({})).unwrap()["default"].clone());
+            (nested, tried, listed)
+        });
+        done.send(answers).unwrap();
+    });
+    // Bounded, so a thread that waits for itself fails the test rather than hanging it.
+    let answers = finished.recv_timeout(std::time::Duration::from_secs(30)).expect("a thread holding the spooler waited for itself");
+    assert_eq!(answers, (7, Some(Some(8)), Some(json!("Office"))));
+}
+
+/// While another thread is in the spooler (a print job being handed over, Print Settings…), the
+/// Print dialog's listings return at once with the last lists this process got.
+#[test]
+fn listings_without_waiting_return_the_last_lists_while_the_spooler_is_busy() {
+    use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+    use std::sync::{Arc, mpsc};
+    let asked = Arc::new(AtomicUsize::new(0));
+    let counted = Arc::clone(&asked);
+    let mut s = Session::new();
+    s.printer_source = Some(Arc::new(move || {
+        counted.fetch_add(1, Ordering::SeqCst);
+        vec![craft_print::Printer { name: "Office".into(), default: true, two_sided: None, description: String::new() }]
+    }));
+    let (held_tx, held) = mpsc::channel();
+    let (release, released_rx) = mpsc::channel::<()>();
+    let released = Arc::new(AtomicBool::new(false));
+    let holder = {
+        let released = Arc::clone(&released);
+        let mut lister = Session::new();
+        lister.printer_source = s.printer_source.clone();
+        std::thread::spawn(move || {
+            with_spooler(|| {
+                // Lists this stand-in's printers once with the lock held, so another test's listing
+                // cannot replace the last lists before the listings below.
+                held_tx.send((list_system_printers(&lister), list_rgb_printers(&lister))).unwrap();
+                // Bounded, so a listing that waits fails the test rather than hanging it.
+                let _ = released_rx.recv_timeout(std::time::Duration::from_secs(5));
+                released.store(true, Ordering::SeqCst);
+            });
+        })
+    };
+    let (kept, kept_rgb) = held.recv().unwrap();
+    let before = asked.load(Ordering::SeqCst);
+    let listed = printers_without_waiting(&mut s);
+    let listed_rgb = rgb_printers_without_waiting(&s);
+    assert!(!released.load(Ordering::SeqCst), "the listing waited for the spooler");
+    release.send(()).unwrap();
+    holder.join().unwrap();
+    assert_eq!(asked.load(Ordering::SeqCst), before, "a printer list was asked for while the spooler was busy");
+    assert_eq!(listed, printers_answer(kept));
+    assert_eq!(listed_rgb, kept_rgb);
+}
+
+#[test]
+fn listings_without_waiting_skip_the_lists_of_another_stand_in() {
+    uncached_listings_do_not_wait(true);
+}
+
+#[test]
+fn listings_without_waiting_return_empty_when_no_list_was_cached() {
+    uncached_listings_do_not_wait(false);
+}
+
+fn uncached_listings_do_not_wait(cache_other: bool) {
+    use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+    use std::sync::{Arc, mpsc};
+    let asked = Arc::new(AtomicUsize::new(0));
+    let counted = Arc::clone(&asked);
+    let mut s = Session::new();
+    s.printer_source = Some(Arc::new(move || {
+        counted.fetch_add(1, Ordering::SeqCst);
+        vec![craft_print::Printer { name: "Proofing".into(), default: true, two_sided: None, description: String::new() }]
+    }));
+    let (held_tx, held) = mpsc::channel();
+    let (release, released_rx) = mpsc::channel();
+    let released = Arc::new(AtomicBool::new(false));
+    let done = Arc::clone(&released);
+    let holder = std::thread::spawn(move || {
+        with_spooler(|| {
+            if cache_other {
+                let mut other = Session::new();
+                other.printer_source = Some(test_printers());
+                list_system_printers(&other);
+                let _ = list_rgb_printers(&other);
+            } else {
+                *LAST_PRINTERS.lock().unwrap() = None;
+                *LAST_RGB_PRINTERS.lock().unwrap() = None;
+            }
+            held_tx.send(()).unwrap();
+            let _ = released_rx.recv_timeout(std::time::Duration::from_secs(5));
+            done.store(true, Ordering::SeqCst);
+        });
+    });
+    held.recv().unwrap();
+    let listed = printers_without_waiting(&mut s);
+    let listed_rgb = rgb_printers_without_waiting(&s);
+    let waited = released.load(Ordering::SeqCst);
+    let _ = release.send(());
+    holder.join().unwrap();
+    assert!(!waited, "an uncached listing waited for the spooler");
+    assert_eq!(asked.load(Ordering::SeqCst), 0);
+    assert_eq!(listed, printers_answer(Vec::new()));
+    assert_eq!(listed_rgb, Err(craft_print::rgb::PrintError::Unsupported));
+    with_spooler(|| {
+        let listed = printers_without_waiting(&mut s);
+        let listed_rgb = rgb_printers_without_waiting(&s);
+        assert_eq!(listed["printers"], json!([{"name": "Proofing", "default": true}]));
+        let names = listed_rgb.map(|list| list.into_iter().map(|p| p.name).collect::<Vec<_>>());
+        if cfg!(windows) {
+            assert_eq!(names, Ok(vec!["Proofing".to_string()]));
+        } else {
+            assert_eq!(names, Err(craft_print::rgb::PrintError::Unsupported));
+        }
+    });
 }
 
 /// Spooling tests run in a child process: `disable_printing` is process-wide and a test above
diff --git a/crates/engine/src/cmd/render_cmds.rs b/crates/engine/src/cmd/render_cmds.rs
index c6e4318e3d..cc27304fdc 100644
--- a/crates/engine/src/cmd/render_cmds.rs
+++ b/crates/engine/src/cmd/render_cmds.rs
@@ -109,7 +109,7 @@ fn draw(s: &mut Session, label: &str, p: &Value, prims: Vec<Prim>, extra: Value)
         let raster = id.and_then(|i| doc.layer(i)).is_some_and(|l| matches!(l.content, LayerContent::Raster(_)));
         let (id, created) = if want_new || !raster {
             let l = Layer::new(label.trim_end_matches('…'), LayerContent::Raster(Surface::new(doc.pixel_format())));
-            let nid = doc.insert_above(*active, l);
+            let nid = crate::layer_place::insert_new(doc, *active, l, crate::layer_place::Place::AutoEditable);
             *active = Some(nid);
             (nid, true)
         } else {
diff --git a/crates/engine/src/cmd/retouch_cmds/art_history.rs b/crates/engine/src/cmd/retouch_cmds/art_history.rs
index ab66a8f15c..0339c88263 100644
--- a/crates/engine/src/cmd/retouch_cmds/art_history.rs
+++ b/crates/engine/src/cmd/retouch_cmds/art_history.rs
@@ -7,7 +7,7 @@ use photocraft_paint::MAX_BRUSH_SIZE;
 use photocraft_paint::retouch::{Region, alpha_index};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{EngineError, Result, Session, bad, blend_param, damage_json, parse_brush, run_stroke};
 
 const CMD: &str = "paint.artHistoryBrush";
 const MAX_POINTS: usize = 4096;
diff --git a/crates/engine/src/cmd/retouch_cmds/clone.rs b/crates/engine/src/cmd/retouch_cmds/clone.rs
index 5e5ac27104..1e4ae8ca0e 100644
--- a/crates/engine/src/cmd/retouch_cmds/clone.rs
+++ b/crates/engine/src/cmd/retouch_cmds/clone.rs
@@ -1,6 +1,10 @@
 use super::heal::history_source;
 use super::sampling::{SampleLayers, sample, sample_layers};
-use super::*;
+use super::{
+    BlendMode, BrushSettings, Document, EngineError, LayerId, PixelFormat, Rect, Region, Result, SampleType, Session, Stroke, StrokePoint, Surface, Value,
+    alpha_index, apply_coverage, bad, blend_from_str, coverage, damage_json, flag, has_pixel_layer, json, parse_brush, pattern_stamp, periodic, point,
+    reject_huge_stroke, run_stroke, to_rgba,
+};
 
 /// Where a clone stroke samples: `offset` / `source` params, else the active Clone Source slot,
 /// with the slot's (or the call's) scale, rotation and flips (see `presets::clone_source`).
diff --git a/crates/engine/src/cmd/retouch_cmds/content_aware_move.rs b/crates/engine/src/cmd/retouch_cmds/content_aware_move.rs
index efa63e20b2..6e01926e3f 100644
--- a/crates/engine/src/cmd/retouch_cmds/content_aware_move.rs
+++ b/crates/engine/src/cmd/retouch_cmds/content_aware_move.rs
@@ -34,7 +34,10 @@ use photocraft_algo::content_aware::{FillOptions, color_amount, color_level, fil
 use photocraft_algo::transform::{Homography, Interp};
 
 use super::patch::{coverage, offset, selection_area, target_layer};
-use super::*;
+use super::{
+    Document, EngineError, LayerContent, LayerId, Rect, Region, Result, SampleLayers, Session, Surface, Value, alpha_index, bad, clamp_samples,
+    composite_region, damage_json, flag, has_pixel_layer, json, string, targets_pixels,
+};
 
 const CMD: &str = "paint.contentAwareMove";
 
diff --git a/crates/engine/src/cmd/retouch_cmds/dab.rs b/crates/engine/src/cmd/retouch_cmds/dab.rs
index 818c27a6f1..7ff5a600e6 100644
--- a/crates/engine/src/cmd/retouch_cmds/dab.rs
+++ b/crates/engine/src/cmd/retouch_cmds/dab.rs
@@ -1,5 +1,9 @@
 use super::sampling::{AllLayers, sample_all_layers};
-use super::*;
+use super::{
+    BrushSettings, Document, EngineError, Footprint, IndexedParallelIterator, LayerId, ParallelIterator, ParallelSliceMut, PixelFormat, Rect, Region, Result,
+    Session, Smudge, Stroke, StrokePoint, Surface, ToneRange, Value, alpha_index, apply_dab_stroke, bad, damage_json, dodge_burn, flag, from_rgba_into,
+    has_pixel_layer, json, local_blur, local_sharpen, num, parse_brush, run_stroke, sponge, string, to_rgba,
+};
 
 // ---------------------------------------------------------------------------------------------
 // Toning (Dodge / Burn / Sponge) and focus (Blur / Sharpen), Smudge
diff --git a/crates/engine/src/cmd/retouch_cmds/heal.rs b/crates/engine/src/cmd/retouch_cmds/heal.rs
index 79e42723e6..a260443caf 100644
--- a/crates/engine/src/cmd/retouch_cmds/heal.rs
+++ b/crates/engine/src/cmd/retouch_cmds/heal.rs
@@ -1,6 +1,9 @@
 use super::clone::{blend_param, clamp_samples, clone_mapping, clone_result, clone_sample};
 use super::sampling::{SampleLayers, composite_region, sample_all_layers, sample_layers};
-use super::*;
+use super::{
+    BlendMode, CompleteParams, Document, EngineError, LayerId, PixelFormat, Rect, Region, Result, Session, Stroke, Surface, Value, apply_coverage, bad,
+    coverage, damage_json, flag, inpaint, json, parse_brush, poisson, reject_huge_stroke, run_stroke, string,
+};
 
 /// Grow a stroke's coverage map by `m` pixels of zero coverage (a Dirichlet boundary for the solve).
 fn pad_coverage(bounds: Rect, cov: &[f32], m: i32) -> (Rect, Vec<f32>) {
diff --git a/crates/engine/src/cmd/retouch_cmds/patch.rs b/crates/engine/src/cmd/retouch_cmds/patch.rs
index f3cb4765a2..557c173b4b 100644
--- a/crates/engine/src/cmd/retouch_cmds/patch.rs
+++ b/crates/engine/src/cmd/retouch_cmds/patch.rs
@@ -17,7 +17,10 @@
 //! (3: 32 of 42 levels, 31 of 102; 10: 35 of 42, 95 of 102). It runs as a background job, like
 //! the move.
 
-use super::*;
+use super::{
+    BlendMode, Document, EngineError, LayerId, PixelFormat, Rect, Region, Result, Session, Surface, Value, apply_coverage, bad, clamp_samples, damage_json,
+    flag, has_pixel_layer, heal_region, json, point, poisson, run_stroke, string, targets_pixels,
+};
 
 const CMD: &str = "paint.patch";
 
diff --git a/crates/engine/src/cmd/retouch_cmds/periodic.rs b/crates/engine/src/cmd/retouch_cmds/periodic.rs
index f31542fb5a..242579198e 100644
--- a/crates/engine/src/cmd/retouch_cmds/periodic.rs
+++ b/crates/engine/src/cmd/retouch_cmds/periodic.rs
@@ -1,6 +1,6 @@
 //! Bounded reads from the repeating document tile used by Pattern Preview.
 
-use super::*;
+use super::{BlendMode, BrushSettings, Document, LayerId, Rect, Region, Result, SampleLayers, StrokePoint, Surface, alpha_index, apply_coverage, bad};
 
 /// At most four disjoint rectangles in the document tile. Projecting the dirty area separately
 /// from the stroke bounds avoids scanning the whole document when a small dab crosses a seam.
diff --git a/crates/engine/src/cmd/retouch_cmds/remove.rs b/crates/engine/src/cmd/retouch_cmds/remove.rs
index eb9ecd1028..a7283d390b 100644
--- a/crates/engine/src/cmd/retouch_cmds/remove.rs
+++ b/crates/engine/src/cmd/retouch_cmds/remove.rs
@@ -16,7 +16,10 @@
 
 use super::content_aware_move::{Target, replace};
 use super::patch::coverage;
-use super::*;
+use super::{
+    Document, EngineError, LayerId, PixelFormat, Rect, Region, Result, SampleLayers, Session, Stroke, Surface, Value, alpha_index, bad, clamp_samples,
+    composite_region, damage_json, flag, json, parse_brush, reject_huge_stroke, targets_pixels,
+};
 use photocraft_doc::Layer;
 
 const CMD: &str = "paint.remove";
@@ -216,7 +219,8 @@ fn fill_to_new_layer(doc: &mut Document, id: Option<LayerId>, out: &Region, hole
     }
     let mut l = Layer::raster(doc.next_layer_name("Layer"), fmt);
     crate::pixels_mut(&mut l)?.write_region(out.rect, &data);
-    let nid = doc.insert_above(id, l);
+    // Above the sampled layer and in its clipping mask, like Layer via Copy.
+    let nid = crate::layer_place::insert_new(doc, id, l, crate::layer_place::Place::Above);
     Ok((out.rect, nid))
 }
 
diff --git a/crates/engine/src/cmd/retouch_cmds/sampling.rs b/crates/engine/src/cmd/retouch_cmds/sampling.rs
index 31ab9ae99c..253f6648ad 100644
--- a/crates/engine/src/cmd/retouch_cmds/sampling.rs
+++ b/crates/engine/src/cmd/retouch_cmds/sampling.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Document, Footprint, LayerId, PixelFormat, Rect, Region, Result, Surface, Value, bad, flag, from_rgba_into, string, targets_pixels};
 
 // ---------------------------------------------------------------------------------------------
 // Sampling sources
diff --git a/crates/engine/src/cmd/smart_cmds/contents.rs b/crates/engine/src/cmd/smart_cmds/contents.rs
index 393b03e8ac..07a009bf0e 100644
--- a/crates/engine/src/cmd/smart_cmds/contents.rs
+++ b/crates/engine/src/cmd/smart_cmds/contents.rs
@@ -2,7 +2,10 @@ use super::filters::{smart, smart_mut};
 use super::placing::detach_psd;
 use super::rendering::{refresh, refresh_or_fail, unapplied_filters};
 use super::source::{authorized_source_bytes, source_bytes};
-use super::*;
+use super::{
+    Arc, DocId, Document, EngineError, LayerContent, LayerId, Metadata, Result, Session, SmartContentsId, SmartLink, SmartSource, Value, bad, base_name,
+    decode_source, encode_source, json, layer_param, other,
+};
 
 pub(super) fn path_param<'a>(cmd: &str, p: &'a Value) -> Result<&'a str> {
     p.get("path").and_then(Value::as_str).filter(|s| !s.is_empty()).ok_or_else(|| bad(cmd, "pass `path`"))
diff --git a/crates/engine/src/cmd/smart_cmds/filters.rs b/crates/engine/src/cmd/smart_cmds/filters.rs
index e06cb61a48..3009ecfbc0 100644
--- a/crates/engine/src/cmd/smart_cmds/filters.rs
+++ b/crates/engine/src/cmd/smart_cmds/filters.rs
@@ -1,6 +1,9 @@
 use super::rendering::{refresh_or_fail, refresh_or_fail_in};
 use super::source::source_bytes;
-use super::*;
+use super::{
+    BlendMode, Document, EngineError, Layer, LayerContent, LayerId, LayerMask, Result, Session, SmartObject, Surface, Value, bad, blend_from_str, json,
+    layer_param, other,
+};
 
 pub(super) fn smart(doc: &Document, id: LayerId) -> Result<&SmartObject> {
     match &doc.layer(id).ok_or(EngineError::NoLayer(id))?.content {
diff --git a/crates/engine/src/cmd/smart_cmds/placing.rs b/crates/engine/src/cmd/smart_cmds/placing.rs
index 857cb90338..e0472e844d 100644
--- a/crates/engine/src/cmd/smart_cmds/placing.rs
+++ b/crates/engine/src/cmd/smart_cmds/placing.rs
@@ -1,5 +1,8 @@
 use super::source::{SourceImage, buffer_to_surface, cache_key, cache_put, source_bytes};
-use super::*;
+use super::{
+    Affine, Arc, BlendMode, Document, EngineError, Homography, Layer, LayerContent, LayerId, PLACED_KEYS, Rect, Result, Session, Size, SmartContentsId,
+    SmartObject, SmartSource, Surface, Value, encode_source, json, layer_param, other, translate_surface,
+};
 
 /// Rounds float noise off a composed transform (scale 0.1 then 10 should be exactly 1), so
 /// repeated transforms land back on exact, lossless placements.
diff --git a/crates/engine/src/cmd/smart_cmds/rendering.rs b/crates/engine/src/cmd/smart_cmds/rendering.rs
index b686cf3282..a5dd8e8f1b 100644
--- a/crates/engine/src/cmd/smart_cmds/rendering.rs
+++ b/crates/engine/src/cmd/smart_cmds/rendering.rs
@@ -1,6 +1,9 @@
 use super::filters::smart;
 use super::source::{SourceImage, cache_get, cache_key, cache_put, source_bytes, source_image, source_surface, svg_source_image, vector_scale};
-use super::*;
+use super::{
+    Affine, Arc, BlendMode, Document, EngineError, Homography, JobCtx, Layer, LayerContent, LayerId, PixelFormat, Rect, Result, SmartFilter, SmartObject,
+    SmartSource, Stage, StageKey, Surface, Value, decode_source, other, stack_cache,
+};
 
 /// Layer › Smart Objects › Stack Mode: the source's layers (or, when it holds a single group, the
 /// group's layers) combined per pixel with `mode`. Cached like [`source_image`], keyed by mode.
diff --git a/crates/engine/src/cmd/smart_cmds/source.rs b/crates/engine/src/cmd/smart_cmds/source.rs
index 0e0aaee477..d7d895b28d 100644
--- a/crates/engine/src/cmd/smart_cmds/source.rs
+++ b/crates/engine/src/cmd/smart_cmds/source.rs
@@ -1,4 +1,7 @@
-use super::*;
+use super::{
+    Arc, ColorMode, Document, Layer, LayerContent, LayerId, Metadata, Mutex, PixelFormat, Rect, Result, SampleType, Session, SmartObject, SmartSource, Surface,
+    base_name, decode_source, json, other,
+};
 
 /// A linked file's bytes; `None` when it is missing or its path is not followed
 /// ([`crate::doc_path::resolve`]).
diff --git a/crates/engine/src/cmd/smart_cmds/unpack.rs b/crates/engine/src/cmd/smart_cmds/unpack.rs
index 0fdf3ac3fa..af7510da8d 100644
--- a/crates/engine/src/cmd/smart_cmds/unpack.rs
+++ b/crates/engine/src/cmd/smart_cmds/unpack.rs
@@ -161,7 +161,7 @@ fn unpacked(so: &Layer, mut layers: Vec<Layer>) -> Layer {
     g.id = LayerId::fresh();
     g.psd_id = None;
     g.blend = blend;
-    g.content = LayerContent::Group(Group { children: layers, expanded: true, artboard: None });
+    g.content = LayerContent::Group(Group { children: layers, expanded: true, artboard: None, frame_stroke: None });
     detach_psd(&mut g);
     g
 }
diff --git a/crates/engine/src/cmd/stamp_cmds.rs b/crates/engine/src/cmd/stamp_cmds.rs
index 76af35627a..b5c6a21120 100644
--- a/crates/engine/src/cmd/stamp_cmds.rs
+++ b/crates/engine/src/cmd/stamp_cmds.rs
@@ -74,7 +74,7 @@ fn stamp_visible(s: &mut Session, p: &Value) -> Result<Value> {
             return Ok(empty);
         }
         let layer = stamp_layer(doc, doc.next_layer_name("Layer"))?;
-        let id = doc.insert_above(*active, layer);
+        let id = crate::layer_place::insert_new(doc, *active, layer, crate::layer_place::Place::Above);
         *active = Some(id);
         Ok(id)
     })?;
@@ -156,7 +156,7 @@ fn stamp_selected(s: &mut Session, sel: &[LayerId]) -> Result<Value> {
         }
         let name = format!("{} (merged)", doc.layer(top).map_or("Layer", |l| l.name.as_str()));
         let layer = stamp_layer(&solo, name)?;
-        let id = doc.insert_above(Some(top), layer);
+        let id = crate::layer_place::insert_new(doc, Some(top), layer, crate::layer_place::Place::Above);
         *active = Some(id);
         Ok(id)
     })?;
diff --git a/crates/engine/src/cmd/type_caret_cmds.rs b/crates/engine/src/cmd/type_caret_cmds.rs
index 3b9b244f70..75ca3e0730 100644
--- a/crates/engine/src/cmd/type_caret_cmds.rs
+++ b/crates/engine/src/cmd/type_caret_cmds.rs
@@ -320,6 +320,13 @@ mod tests {
 
     #[test]
     fn navigate_words_lines_edges_and_keeps_a_column() {
+        check_word_moves();
+        check_newline_moves();
+        check_vertical_column_moves();
+        check_navigation_queries_are_read_only();
+    }
+
+    fn check_word_moves() {
         let mut s = session();
         let id = create(&mut s, json!({"x": 20, "y": 60, "text": "hello big world", "size": 18}));
         assert_eq!(go(&mut s, id, 0, "wordNext", None), 5);
@@ -334,7 +341,10 @@ mod tests {
         assert_eq!(go(&mut s, id, 4, "end", None), 15);
         assert_eq!(go(&mut s, id, 4, "lineStart", None), 0);
         assert_eq!(go(&mut s, id, 4, "lineEnd", None), 15);
+    }
 
+    fn check_newline_moves() {
+        let mut s = session();
         // A newline is not part of either word; line edges agree with type.info.
         let id = create(&mut s, json!({"x": 20, "y": 120, "text": "hello\nworld", "size": 18}));
         assert_eq!(go(&mut s, id, 0, "wordNext", None), 5);
@@ -353,7 +363,10 @@ mod tests {
         assert!((l1s..=l1e).contains(&next), "lineNext {next} not on {l1s}..={l1e}");
         assert_eq!(go(&mut s, id, 0, "linePrev", None), 0);
         assert_eq!(go(&mut s, id, l1e as usize, "lineNext", None), "hello\nworld".chars().count() as u64);
+    }
 
+    fn check_vertical_column_moves() {
+        let mut s = session();
         // Repeated line moves keep the document x of the original column.
         let id = create(&mut s, json!({"x": 24, "y": 200, "text": "WWWWWW\nI", "size": 28}));
         let info = s.execute("type.info", json!({"layer": id})).unwrap();
@@ -366,7 +379,13 @@ mod tests {
         assert_eq!(go(&mut s, id, end0 as usize, "lineNext", Some(x)), start1);
         assert_eq!(go(&mut s, id, end0 as usize, "lineNext", None), end1);
         assert_eq!(go(&mut s, id, start1 as usize, "linePrev", Some(x)), lines[0]["start"].as_u64().unwrap());
+    }
 
+    fn check_navigation_queries_are_read_only() {
+        let mut s = session();
+        let id = create(&mut s, json!({"x": 24, "y": 200, "text": "WWWWWW\nI", "size": 28}));
+        let caret0 = s.execute("type.caret", json!({"layer": id, "index": 0})).unwrap();
+        let x = caret0["segment"][0][0].as_f64().unwrap();
         // Queries do not record history or a journal entry.
         let steps = s.active().unwrap().history.entries().len();
         let rev = s.active().unwrap().revision;
diff --git a/crates/engine/src/cmd/type_cmds.rs b/crates/engine/src/cmd/type_cmds.rs
index 67fc34be60..1e103cf89f 100644
--- a/crates/engine/src/cmd/type_cmds.rs
+++ b/crates/engine/src/cmd/type_cmds.rs
@@ -244,6 +244,13 @@ fn step_char_metrics(t: &mut TextLayer, a: usize, b: usize, p: &Value) -> bool {
 
 /// Applies character-style keys from JSON. Returns true if any key was present.
 pub fn apply_char_props(s: &mut CharStyle, p: &Value) -> bool {
+    let mut any = apply_font_props(s, p);
+    any |= apply_char_values(s, p);
+    any |= apply_char_features(s, p);
+    any
+}
+
+fn apply_font_props(s: &mut CharStyle, p: &Value) -> bool {
     let mut any = false;
     let mut hit = |b: bool| any |= b;
     let font_key = ["font", "family", "fontStyle", "weight", "italic"].iter().any(|k| p.get(k).is_some());
@@ -309,6 +316,12 @@ pub fn apply_char_props(s: &mut CharStyle, p: &Value) -> bool {
     if font_key && s.postscript_name.is_none() {
         s.postscript_name = installed_postscript(&s.font_family, s.weight, s.italic);
     }
+    any
+}
+
+fn apply_char_values(s: &mut CharStyle, p: &Value) -> bool {
+    let mut any = false;
+    let mut hit = |b: bool| any |= b;
     if let Some(v) = f32p(p, "size") {
         s.size_pt = v.max(0.01);
         hit(true);
@@ -396,6 +409,12 @@ pub fn apply_char_props(s: &mut CharStyle, p: &Value) -> bool {
             hit(true);
         }
     }
+    any
+}
+
+fn apply_char_features(s: &mut CharStyle, p: &Value) -> bool {
+    let mut any = false;
+    let mut hit = |b: bool| any |= b;
     if let Some(Value::Object(m)) = p.get("features") {
         for (tag, v) in m {
             let value = v.as_u64().map(|x| x as u16).or_else(|| v.as_bool().map(u16::from)).unwrap_or(1);
@@ -906,7 +925,7 @@ pub fn specs() -> Vec<CommandSpec> {
                 let name = p.get("name").and_then(Value::as_str).map(str::to_string).unwrap_or_else(|| layer_name(&t.text));
                 let id = s.edit("New Type Layer", |doc, active| {
                     refresh(doc, &mut t);
-                    let id = doc.insert_above(*active, Layer::new(name, LayerContent::Text(t)));
+                    let id = crate::layer_place::insert_new(doc, *active, Layer::new(name, LayerContent::Text(t)), crate::layer_place::Place::AutoEditable);
                     *active = Some(id);
                     Ok(id)
                 })?;
diff --git a/crates/engine/src/cmd/type_extra_cmds.rs b/crates/engine/src/cmd/type_extra_cmds.rs
index 99538edb70..d8c11a52d6 100644
--- a/crates/engine/src/cmd/type_extra_cmds.rs
+++ b/crates/engine/src/cmd/type_extra_cmds.rs
@@ -415,6 +415,38 @@ fn attach_to_path(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"layer": id.0, "start": start, "flip": flip}))
 }
 
+/// Type on a path's own path in document space (#9114): what the Direct Selection tool shows and
+/// edits, as Photoshop's Type Path. `None` unless `t` is type on a path.
+pub fn type_path(t: &TextLayer) -> Option<Path> {
+    let TextShape::Path { path, .. } = &t.shape else { return None };
+    let map = |q: Point| t.transform.apply(q);
+    let knots = path.knots.iter().map(|k| Knot { anchor: map(k.anchor), in_ctrl: map(k.in_ctrl), out_ctrl: map(k.out_ctrl), smooth: k.smooth }).collect();
+    Some(Path::new(vec![Subpath { closed: path.closed, knots, op: path.op }]))
+}
+
+/// Puts an edited [`type_path`] back into `t` (its text space), keeping where the type starts and
+/// which side it runs on. It must still be one subpath with two or more points.
+pub(crate) fn set_type_path(t: &mut TextLayer, edited: &Path) -> Result<()> {
+    let TextShape::Path { start, flip, .. } = &t.shape else { return Err(EngineError::Other("the type layer is not on a path".into())) };
+    let (start, flip) = (*start, *flip);
+    let [sub] = edited.subpaths.as_slice() else { return Err(EngineError::Other("type on a path follows one path".into())) };
+    if sub.knots.len() < 2 {
+        return Err(EngineError::Other("type on a path needs a path of two or more points".into()));
+    }
+    if sub.knots.len() > MAX_TYPE_PATH_KNOTS {
+        return Err(EngineError::Other("the type path has too many anchor points".into()));
+    }
+    let inv = t.transform.inverse().ok_or_else(|| EngineError::Other("the type layer's transform cannot be inverted".into()))?;
+    let map = |q: Point| inv.apply(q);
+    let knots: Vec<Knot> =
+        sub.knots.iter().map(|k| Knot { anchor: map(k.anchor), in_ctrl: map(k.in_ctrl), out_ctrl: map(k.out_ctrl), smooth: k.smooth }).collect();
+    if !knots.iter().all(|k| [k.anchor, k.in_ctrl, k.out_ctrl].iter().all(|q| q.x.is_finite() && q.y.is_finite())) {
+        return Err(EngineError::Other("the path cannot be mapped into the type layer".into()));
+    }
+    t.shape = TextShape::Path { path: Subpath { closed: sub.closed, knots, op: sub.op }, start, flip };
+    Ok(())
+}
+
 fn is_path_text(s: &Session) -> std::result::Result<(), String> {
     match active_text(s)?.shape {
         TextShape::Path { .. } | TextShape::Area { .. } => Ok(()),
diff --git a/crates/engine/src/cmd/type_extra_cmds/tests.rs b/crates/engine/src/cmd/type_extra_cmds/tests.rs
index d1bc3c39f1..8ae504cfa1 100644
--- a/crates/engine/src/cmd/type_extra_cmds/tests.rs
+++ b/crates/engine/src/cmd/type_extra_cmds/tests.rs
@@ -314,6 +314,80 @@ fn type_attaches_to_a_path_and_releases_it() {
     assert!(matches!(text(&s, id).shape, TextShape::Path { .. }));
 }
 
+/// #9114: type on a path follows its own path when the path is edited (Direct Selection's
+/// `path.*` commands with `"name": "layer"`), as Photoshop's Type Path does; the Paths list names
+/// it, an edit is one undo step, and an edit that leaves no path is refused.
+#[test]
+fn type_follows_its_path_when_the_path_is_edited() {
+    let mut s = session(8);
+    let id = text_layer(&mut s, "Hello path");
+    s.edit("path", |doc, _| {
+        doc.work_path = Some(Path::new(vec![Subpath::polyline(&[(150.0, 10.0), (150.0, 110.0)])]));
+        Ok(())
+    })
+    .unwrap();
+    s.execute("type.attachToPath", json!({"start": 4})).unwrap();
+    // In document space, the type path is where the work path was.
+    let path = crate::type_extra_cmds::type_path(text(&s, id)).unwrap();
+    let ends: Vec<(f64, f64)> = path.subpaths[0].knots.iter().map(|k| (k.anchor.x, k.anchor.y)).collect();
+    assert!(ends.iter().zip([(150.0, 10.0), (150.0, 110.0)]).all(|(a, b)| (a.0 - b.0).abs() < 1e-6 && (a.1 - b.1).abs() < 1e-6), "{ends:?}");
+    let listed = s.execute("path.list", json!({})).unwrap();
+    assert_eq!(listed["typePath"]["kind"], "typePath", "{listed}");
+    // Swing the path's end to the right: the type now runs down and to the right.
+    let before = ink(&s, id);
+    let r = s.execute("path.moveAnchors", json!({"name": "layer", "layer": id.0, "anchors": [[0, 1]], "move": [120, 0]})).unwrap();
+    assert_eq!(r["name"], "layer");
+    let after = ink(&s, id);
+    assert!(after.width() > before.width() + 20, "{before:?} → {after:?}");
+    assert!(matches!(text(&s, id).shape, TextShape::Path { start, .. } if start == 4.0), "where the type starts is kept");
+    // The work path it came from is untouched; Undo puts the type path back.
+    assert_eq!(s.active().unwrap().doc.work_path.as_ref().unwrap().subpaths[0].knots[1].anchor.x, 150.0);
+    assert!(s.undo());
+    assert_eq!(ink(&s, id), before);
+    // An edit that would leave fewer than two points is refused and changes nothing.
+    assert!(s.execute("path.deleteAnchor", json!({"name": "layer", "layer": id.0, "subpath": 0, "knot": 0})).is_err());
+    assert_eq!(ink(&s, id), before);
+}
+
+/// #9114: a type-on-a-path layer's vector mask is still what `"name": "layer"` edits, as on main
+/// and as `path.info` reads it; `"typePath": true` edits the Type Path; `path.list` reports both.
+#[test]
+fn a_vector_mask_on_type_on_a_path_is_edited_not_the_type_path() {
+    let mut s = session(8);
+    let id = text_layer(&mut s, "Hello path");
+    s.edit("path", |doc, _| {
+        doc.work_path = Some(Path::new(vec![Subpath::polyline(&[(150.0, 10.0), (150.0, 110.0)])]));
+        Ok(())
+    })
+    .unwrap();
+    s.execute("type.attachToPath", json!({})).unwrap();
+    let rect = json!({"subpaths": [{"closed": true, "knots": [[10, 10], [200, 10], [200, 100], [10, 100]]}]});
+    s.execute("layer.vectorMask.add", json!({"layer": id.0, "path": rect})).unwrap();
+    let listed = s.execute("path.list", json!({})).unwrap();
+    assert_eq!((listed["layerPath"]["kind"].as_str(), listed["typePath"]["kind"].as_str()), (Some("vectorMask"), Some("typePath")), "{listed}");
+    let type_path = |s: &Session| crate::type_extra_cmds::type_path(text(s, id)).unwrap();
+    let before = type_path(&s);
+    let mask = |s: &Session| s.active().unwrap().doc.layer(id).unwrap().vector_mask.as_ref().unwrap().path.subpaths[0].knots[0].anchor;
+    s.execute("path.moveAnchors", json!({"name": "layer", "layer": id.0, "anchors": [[0, 0]], "move": [10, 0]})).unwrap();
+    assert_eq!(mask(&s), photocraft_geom::Point::new(20.0, 10.0), "the mask's corner moved");
+    assert_eq!(type_path(&s), before, "the Type Path stays");
+    s.execute("path.moveAnchors", json!({"name": "layer", "layer": id.0, "typePath": true, "anchors": [[0, 1]], "move": [20, 0]})).unwrap();
+    assert!((type_path(&s).subpaths[0].knots[1].anchor.x - before.subpaths[0].knots[1].anchor.x - 20.0).abs() < 1e-6, "the Type Path moved");
+    assert_eq!(mask(&s), photocraft_geom::Point::new(20.0, 10.0), "the mask stays");
+}
+
+/// An edit can't grow the Type Path past the cap `type.attachToPath` keeps.
+#[test]
+fn an_edited_type_path_keeps_the_knot_cap() {
+    let mut s = session(8);
+    let id = text_layer(&mut s, "Hi");
+    let knots: Vec<(f64, f64)> = (0..=MAX_TYPE_PATH_KNOTS).map(|i| (i as f64 * 0.001, 50.0)).collect();
+    let mut t = text(&s, id).clone();
+    t.shape = TextShape::Path { path: Subpath::polyline(&knots[..2]), start: 0.0, flip: false };
+    assert!(set_type_path(&mut t, &Path::new(vec![Subpath::polyline(&knots[..MAX_TYPE_PATH_KNOTS])])).is_ok());
+    assert!(set_type_path(&mut t, &Path::new(vec![Subpath::polyline(&knots)])).is_err());
+}
+
 /// The Type tool's click on a path: `"at"` starts the type where the path passes nearest the
 /// click, and the paragraph alignment is kept about that point, as in Photoshop.
 #[test]
diff --git a/crates/engine/src/cmd/type_styles_cmds/tests.rs b/crates/engine/src/cmd/type_styles_cmds/tests.rs
index 0a5761d58b..6f6f735ff0 100644
--- a/crates/engine/src/cmd/type_styles_cmds/tests.rs
+++ b/crates/engine/src/cmd/type_styles_cmds/tests.rs
@@ -243,3 +243,14 @@ fn preview_options_validates_without_mutating_source() {
     assert_ne!(shown.text_styles, before);
     assert_eq!(doc.text_styles, before);
 }
+
+#[test]
+fn style_options_take_a_family_with_the_style_picked_under_it() {
+    // The font menu's ">" picks a family in one of its styles: Style Options sends both.
+    let (mut s, _) = session("Hello");
+    let cs = s.execute("type.characterStyle.new", json!({"attrs": {"size": 20}, "fromSelection": false})).unwrap()["id"].as_u64().unwrap();
+    s.execute("type.characterStyle.set", json!({"id": cs, "attrs": {"font": "Arial", "fontStyle": "Bold Italic"}})).unwrap();
+    let attrs = s.execute("type.characterStyle.list", json!({})).unwrap()["styles"][1]["attrs"].clone();
+    assert_eq!(attrs["font_family"], "Arial", "{attrs}");
+    assert_eq!(attrs["font_style"], "Bold Italic", "{attrs}");
+}
diff --git a/crates/engine/src/cmd/vector_cmds.rs b/crates/engine/src/cmd/vector_cmds.rs
index 7f3753e24e..5a53d5ae07 100644
--- a/crates/engine/src/cmd/vector_cmds.rs
+++ b/crates/engine/src/cmd/vector_cmds.rs
@@ -132,7 +132,7 @@ pub fn specs() -> Vec<CommandSpec> {
             label: "List Paths",
             menu: &[],
             shortcut: None,
-            params: r##"{} → {paths:[{name,knots,subpaths}],workPath,clippingPath,layerPath (active layer's shape path / vector mask)}"##,
+            params: r##"{} → {paths:[{name,knots,subpaths}],workPath,clippingPath,layerPath (active layer's shape path / vector mask),typePath (active type layer's Type Path, if it is on a path)}"##,
             enabled: has_doc,
             run: |s, _| paths_list(s),
             journal: false,
diff --git a/crates/engine/src/cmd/vector_cmds/params.rs b/crates/engine/src/cmd/vector_cmds/params.rs
index 9661877409..6deb13186a 100644
--- a/crates/engine/src/cmd/vector_cmds/params.rs
+++ b/crates/engine/src/cmd/vector_cmds/params.rs
@@ -1,4 +1,7 @@
-use super::*;
+use super::{
+    Color, EngineError, Fill, FillRule, GradientStyle, Knot, LayerId, LineCap, LineJoin, LiveShape, Path, PathOp, Point, Result, Session, ShapeStroke,
+    StrokeAlign, Subpath, Value, bad, json,
+};
 
 pub(crate) fn layer_id(s: &Session, p: &Value) -> Result<LayerId> {
     match p.get("layer").and_then(Value::as_u64) {
diff --git a/crates/engine/src/cmd/vector_cmds/paths.rs b/crates/engine/src/cmd/vector_cmds/paths.rs
index c737ea8d69..167cb9d2a6 100644
--- a/crates/engine/src/cmd/vector_cmds/paths.rs
+++ b/crates/engine/src/cmd/vector_cmds/paths.rs
@@ -1,6 +1,9 @@
 use super::params::{color, f64p, layer_id, op_from, parse_path, path_json};
 use super::shape::{map_path, map_shape, transform_shape, with_shape};
-use super::*;
+use super::{
+    Affine, BlendMode, ClippingPath, Color, Document, EngineError, LayerContent, LayerId, NamedPath, Path, Rect, Result, SelectionMode, Session, Value, bad,
+    blend_from_str, json, sel, vector,
+};
 
 // ---------------------------------------------------------------------------
 // Document paths
@@ -49,7 +52,8 @@ pub(super) fn paths_list(s: &Session) -> Result<Value> {
     let d = s.active().ok_or(EngineError::NoDocument)?;
     let doc = &d.doc;
     let knots = |p: &Path| p.subpaths.iter().map(|s| s.knots.len()).sum::<usize>();
-    let layer = d.active_layer.and_then(|id| doc.layer(id)).and_then(|l| match &l.content {
+    let active = d.active_layer.and_then(|id| doc.layer(id));
+    let layer = active.and_then(|l| match &l.content {
         LayerContent::Shape(sh) => Some(json!({ "kind": "shape", "layer": l.id.0, "name": format!("{} Shape Path", l.name), "knots": knots(&sh.path) })),
         _ => {
             l.vector_mask.as_ref().map(|v| json!({ "kind": "vectorMask", "layer": l.id.0, "name": format!("{} Vector Mask", l.name), "knots": knots(&v.path) }))
@@ -60,6 +64,12 @@ pub(super) fn paths_list(s: &Session) -> Result<Value> {
         "workPath": doc.work_path.as_ref().map(|p| json!({ "knots": knots(p), "subpaths": p.subpaths.len() })),
         "clippingPath": doc.clipping_path.as_ref().map(|c| json!({ "name": c.name, "flatness": c.flatness })),
         "layerPath": layer,
+        // Type on a path: Photoshop's Type Path, which Direct Selection edits (#9114).
+        "typePath": active.and_then(|l| match &l.content {
+            LayerContent::Text(t) => crate::type_extra_cmds::type_path(t)
+                .map(|p| json!({ "kind": "typePath", "layer": l.id.0, "name": format!("{} Type Path", l.name), "knots": knots(&p) })),
+            _ => None,
+        }),
     }))
 }
 
diff --git a/crates/engine/src/cmd/vector_cmds/shape.rs b/crates/engine/src/cmd/vector_cmds/shape.rs
index 70af631e91..789fd8f40b 100644
--- a/crates/engine/src/cmd/vector_cmds/shape.rs
+++ b/crates/engine/src/cmd/vector_cmds/shape.rs
@@ -2,7 +2,10 @@ use super::params::{
     f64p, fill_json, layer_id, live_from_params, live_json, nums, op_from, parse_fill, parse_path, parse_stroke, path_json, radii, stroke_json,
 };
 use super::vector_mask::with;
-use super::*;
+use super::{
+    Affine, Color, Document, EngineError, Fill, FillRule, Layer, LayerContent, LayerId, LiveShape, Path, PathOp, Point, Result, SHAPE_BLOCKS, Session,
+    ShapeLayer, Value, bad, json, sel, vector,
+};
 
 fn active_shape(s: &Session) -> std::result::Result<&ShapeLayer, String> {
     let d = s.active().ok_or("no document open")?;
@@ -338,7 +341,7 @@ pub(super) fn shape_create(s: &mut Session, p: &Value) -> Result<Value> {
     let id = s.edit("New Shape Layer", |doc, active| {
         refresh_shape(doc, &mut sh);
         let name = name.unwrap_or_else(|| doc.next_layer_name(default_name(kind)));
-        let id = doc.insert_above(*active, Layer::new(name, LayerContent::Shape(sh)));
+        let id = crate::layer_place::insert_new(doc, *active, Layer::new(name, LayerContent::Shape(sh)), crate::layer_place::Place::AutoEditable);
         *active = Some(id);
         Ok(id)
     })?;
diff --git a/crates/engine/src/cmd/vector_cmds/vector_mask.rs b/crates/engine/src/cmd/vector_cmds/vector_mask.rs
index c21b214d81..34abf1eab0 100644
--- a/crates/engine/src/cmd/vector_cmds/vector_mask.rs
+++ b/crates/engine/src/cmd/vector_cmds/vector_mask.rs
@@ -1,7 +1,7 @@
 use super::params::{layer_id, parse_path, path_json};
 use super::paths::{is_work, resolve_path};
 use super::shape::with_shape;
-use super::*;
+use super::{EngineError, LayerContent, LayerId, Path, Result, Session, Value, VectorMask, bad, json, vector};
 
 // ---------------------------------------------------------------------------
 // Vector masks
diff --git a/crates/engine/src/cmd/video_cmds.rs b/crates/engine/src/cmd/video_cmds.rs
index 9917522d06..3aec55b837 100644
--- a/crates/engine/src/cmd/video_cmds.rs
+++ b/crates/engine/src/cmd/video_cmds.rs
@@ -127,7 +127,7 @@ fn new_blank(s: &mut Session, _p: &Value) -> Result<Value> {
         let name = doc.next_layer_name("Video Layer");
         let mut l = Layer::raster(name, fmt);
         l.video = Some(VideoData::new(frames, fps));
-        let id = doc.insert_above(*active, l);
+        let id = crate::layer_place::insert_new(doc, *active, l, crate::layer_place::Place::AutoEditable);
         *active = Some(id);
         sync(doc);
         Ok(id)
@@ -366,8 +366,13 @@ fn new_from_file(s: &mut Session, p: &Value) -> Result<Value> {
         let mut v = VideoData::new(frames, fps);
         v.original_frames = Some(v.frames.clone());
         v.source = photocraft_doc::VideoSource::File { path: path.clone() };
+        // The first frame is the layer's content before it is placed: an active artboard takes
+        // the layer only when its content is on the board, as `frames_to_layers` does.
+        if let (Some(first), LayerContent::Raster(surf)) = (v.frames.first(), &mut l.content) {
+            *surf = first.clone();
+        }
         l.video = Some(v);
-        let id = doc.insert_above(*active, l);
+        let id = crate::layer_place::insert_new(doc, *active, l, crate::layer_place::Place::AutoEditable);
         *active = Some(id);
         sync(doc);
         Ok(id)
@@ -438,12 +443,14 @@ fn frames_to_layers(s: &mut Session, p: &Value) -> Result<Value> {
     let n = frames.len();
     s.edit("Video Frames to Layers", |doc, active| {
         let mut above = *active;
+        let mut place = crate::layer_place::Place::AutoEditable;
         for (i, f) in frames.into_iter().enumerate() {
             let mut l = Layer::raster(format!("Frame {}", i + 1), fmt);
             if let LayerContent::Raster(surf) = &mut l.content {
                 *surf = f;
             }
-            above = Some(doc.insert_above(above, l));
+            above = Some(crate::layer_place::insert_new(doc, above, l, place));
+            place = crate::layer_place::Place::Above;
         }
         *active = above;
         Ok(())
diff --git a/crates/engine/src/cmd/video_cmds/tests.rs b/crates/engine/src/cmd/video_cmds/tests.rs
index 3560c5f2c3..7e8c05a9b4 100644
--- a/crates/engine/src/cmd/video_cmds/tests.rs
+++ b/crates/engine/src/cmd/video_cmds/tests.rs
@@ -83,6 +83,21 @@ fn new_video_layer_from_image_sequence() {
     assert!(s.active().unwrap().doc.timeline.as_ref().unwrap().duration >= 3);
 }
 
+/// CodeRabbit on #9775: footage that isn't on the active artboard stays out of it, as a placed
+/// image does; the board would clip it. Before, the layer was placed while still empty.
+#[test]
+fn footage_off_the_active_artboard_stays_out_of_it() {
+    let dir = tmpdir("board");
+    write_png(&format!("{dir}/f01.png"), 16, 12, "#ff0000");
+    write_png(&format!("{dir}/f02.png"), 16, 12, "#00ff00");
+    let mut s = session();
+    let board = s.execute("layer.new.artboard", json!({"rect": [0, 0, 4, 4]})).unwrap();
+    assert!(board["layer"].as_u64().is_some(), "{board}");
+    let r = s.execute("layer.videoLayers.newVideoLayerFromFile", json!({"path": dir})).unwrap();
+    let id = LayerId(r["layer"].as_u64().unwrap());
+    assert_eq!(s.active().unwrap().doc.artboard_of(id), None, "the footage is centred off the board");
+}
+
 #[test]
 fn frames_to_layers_and_render_video() {
     let dir = tmpdir("ftl");
diff --git a/crates/engine/src/cmd/vp_cmds.rs b/crates/engine/src/cmd/vp_cmds.rs
index eb713d9141..1a3ac8e0ca 100644
--- a/crates/engine/src/cmd/vp_cmds.rs
+++ b/crates/engine/src/cmd/vp_cmds.rs
@@ -252,7 +252,7 @@ fn vanishing_point(s: &mut Session, p: &Value) -> Result<Value> {
         let on = layer.or(*active);
         let id = if new_layer {
             let l = Layer::raster(doc.next_layer_name("Vanishing Point"), doc.pixel_format());
-            let nid = doc.insert_above(on, l);
+            let nid = crate::layer_place::insert_new(doc, on, l, crate::layer_place::Place::AutoEditable);
             *active = Some(nid);
             nid
         } else {
diff --git a/crates/engine/src/cmd/web_cmds.rs b/crates/engine/src/cmd/web_cmds.rs
index b28e7a94fb..470edd3067 100644
--- a/crates/engine/src/cmd/web_cmds.rs
+++ b/crates/engine/src/cmd/web_cmds.rs
@@ -65,7 +65,7 @@ pub fn specs() -> Vec<CommandSpec> {
         s.active().map(|_| ()).ok_or_else(|| "no document open".into())
     }
 
-    /// Generate ▸ Image Assets needs Preferences ▸ Plug-ins ▸ Generator enabled, as in
+    /// Generate ▸ Image Assets needs Preferences ▸ Plug-ins ▸ Enable Generator, as in
     /// Photoshop (where "Enable Generator" is unchecked until turned on).
     fn generator_enabled(s: &Session) -> std::result::Result<(), String> {
         has_doc(s)?;
diff --git a/crates/engine/src/cmd/web_cmds/assets.rs b/crates/engine/src/cmd/web_cmds/assets.rs
index 23f2da990c..ff265bb4d6 100644
--- a/crates/engine/src/cmd/web_cmds/assets.rs
+++ b/crates/engine/src/cmd/web_cmds/assets.rs
@@ -1,6 +1,6 @@
 use super::optimizer::{optimize, web_document};
 use super::settings::{WebFormat, WebMetadata, WebSettings};
-use super::*;
+use super::{Dither, DocId, Document, EngineError, LayerContent, LayerId, Result, Session, Value, is_windows_device_name, join, json, other, stem, write_file};
 
 // ---------- Generate › Image Assets ----------
 
diff --git a/crates/engine/src/cmd/web_cmds/optimizer.rs b/crates/engine/src/cmd/web_cmds/optimizer.rs
index 98116d7d37..14e5fd311d 100644
--- a/crates/engine/src/cmd/web_cmds/optimizer.rs
+++ b/crates/engine/src/cmd/web_cmds/optimizer.rs
@@ -1,5 +1,5 @@
 use super::settings::{WebFormat, WebMetadata, WebSettings};
-use super::*;
+use super::{Dither, Document, EngineError, Forced, PaletteKind, Rect, Result, Session, Value, json, other, quantize};
 
 // ---------- the image ----------
 
diff --git a/crates/engine/src/cmd/web_cmds/quick.rs b/crates/engine/src/cmd/web_cmds/quick.rs
index c017eb3d2f..916a06f8d2 100644
--- a/crates/engine/src/cmd/web_cmds/quick.rs
+++ b/crates/engine/src/cmd/web_cmds/quick.rs
@@ -1,6 +1,6 @@
 use super::optimizer::{optimize, web_document, web_exif, web_warnings, web_xmp};
 use super::settings::WebSettings;
-use super::*;
+use super::{EngineError, Result, Session, Value, bad, join, json, other, stem, write_file};
 
 // ---------- Export Preferences / Quick Export ----------
 
diff --git a/crates/engine/src/cmd/web_cmds/save_web.rs b/crates/engine/src/cmd/web_cmds/save_web.rs
index eeca746754..1e263c2c25 100644
--- a/crates/engine/src/cmd/web_cmds/save_web.rs
+++ b/crates/engine/src/cmd/web_cmds/save_web.rs
@@ -1,7 +1,7 @@
 use super::assets::{asset_output_path, asset_path_components};
 use super::optimizer::{optimize, web_document, web_exif, web_warnings, web_xmp};
 use super::settings::{WebSettings, rgb_hex};
-use super::*;
+use super::{EngineError, Rect, ResolvedSlice, Result, Session, SliceKind, Value, bad, join, json, other, portable_device_name, slices, stem, write_file};
 
 /// A file-name-safe slice name.
 fn slice_file(name: &str) -> String {
diff --git a/crates/engine/src/cmd/web_cmds/settings.rs b/crates/engine/src/cmd/web_cmds/settings.rs
index 19314673c0..a819cf6864 100644
--- a/crates/engine/src/cmd/web_cmds/settings.rs
+++ b/crates/engine/src/cmd/web_cmds/settings.rs
@@ -1,5 +1,5 @@
 use super::optimizer::to8;
-use super::*;
+use super::{Dither, PaletteKind, Result, Value, bad, json};
 
 // ---------- settings ----------
 
diff --git a/crates/engine/src/cmd/web_cmds/tests.rs b/crates/engine/src/cmd/web_cmds/tests.rs
index 38fa82c188..cdc7d576e7 100644
--- a/crates/engine/src/cmd/web_cmds/tests.rs
+++ b/crates/engine/src/cmd/web_cmds/tests.rs
@@ -637,7 +637,7 @@ fn image_assets_needs_the_generator_preference() {
 fn image_assets_are_generated_now_and_on_save() {
     let dir = tmp("assets");
     let mut s = session(8);
-    // Preferences ▸ Plug-ins ▸ Generator enabled: the feature is opt-in.
+    // Preferences ▸ Plug-ins ▸ Enable Generator: the feature is opt-in.
     s.execute("prefs.set", json!({"path": "plugIns.generatorEnabled", "value": true})).unwrap();
     let id = s.active().unwrap().active_layer.unwrap();
     s.execute("layer.renameLayer", json!({"layer": id.0, "name": "logo.png, 50% small/logo.gif, logo.jpg80%"})).unwrap();
@@ -661,7 +661,10 @@ fn image_assets_are_generated_now_and_on_save() {
     let s2 = session(8);
     let doc = s2.active().unwrap().doc.clone();
     let mut d = (*doc).clone();
-    d.layers.push(Layer::new("default 200% @2x", LayerContent::Group(photocraft_doc::Group { children: vec![], expanded: false, artboard: None })));
+    d.layers.push(Layer::new(
+        "default 200% @2x",
+        LayerContent::Group(photocraft_doc::Group { children: vec![], expanded: false, artboard: None, frame_stroke: None }),
+    ));
     let lid = d.layers[1].id;
     d.layer_mut(lid).unwrap().name = "icon.png".into();
     let (files, errors) = generate_assets(&d, &dir);
@@ -684,7 +687,7 @@ fn image_assets_keep_full_artboards() {
         logo.surface_mut().unwrap().fill_rect(Rect::new(12, 10, 20, 16), &photocraft_raster::from_rgba(&fmt, [1.0, 0.0, 0.0, 1.0]));
         let board =
             photocraft_doc::Artboard { rect: Rect::new(4, 6, 44, 36), background: photocraft_doc::ArtboardBackground::Transparent, preset: String::new() };
-        let group = photocraft_doc::Group { children: vec![logo], expanded: true, artboard: Some(board) };
+        let group = photocraft_doc::Group { children: vec![logo], expanded: true, artboard: Some(board), frame_stroke: None };
         doc.layers = vec![Layer::new("board.png", LayerContent::Group(group))];
         Ok(())
     })
@@ -722,8 +725,8 @@ fn image_assets_refuse_empty_artboards() {
             background: photocraft_doc::ArtboardBackground::Transparent,
             preset: String::new(),
         };
-        let empty = photocraft_doc::Group { children: vec![], expanded: true, artboard: Some(board(0)) };
-        let off = photocraft_doc::Group { children: vec![outside], expanded: true, artboard: Some(board(24)) };
+        let empty = photocraft_doc::Group { children: vec![], expanded: true, artboard: Some(board(0)), frame_stroke: None };
+        let off = photocraft_doc::Group { children: vec![outside], expanded: true, artboard: Some(board(24)), frame_stroke: None };
         doc.layers = vec![Layer::new("empty.png", LayerContent::Group(empty)), Layer::new("off.png", LayerContent::Group(off))];
         Ok(())
     })
@@ -770,8 +773,10 @@ fn image_assets_never_write_one_file_twice() {
     let dir = tmp("asset-variant-collisions");
     d.layer_mut(top).unwrap().name = "icon.png".into();
     d.layer_mut(logo).unwrap().name = "Logo".into();
-    d.layers
-        .push(Layer::new("default 50% + 200% + 200% @2x", LayerContent::Group(photocraft_doc::Group { children: vec![], expanded: false, artboard: None })));
+    d.layers.push(Layer::new(
+        "default 50% + 200% + 200% @2x",
+        LayerContent::Group(photocraft_doc::Group { children: vec![], expanded: false, artboard: None, frame_stroke: None }),
+    ));
     let (files, errors) = generate_assets(&d, &dir);
     let names: Vec<_> = files.iter().map(|p| std::path::Path::new(p).file_name().unwrap().to_string_lossy().into_owned()).collect();
     assert_eq!(names, ["icon.png", "icon@2x.png"]);
@@ -799,7 +804,7 @@ fn image_assets_reject_traversal_from_names_and_defaults() {
     d.layer_mut(id).unwrap().name = "safe.png".into();
     d.layers.push(Layer::new(
         "default ../ + /outside/ + ..\\bad/ + C:\\drive/ + 50% nested/",
-        LayerContent::Group(photocraft_doc::Group { children: vec![], expanded: false, artboard: None }),
+        LayerContent::Group(photocraft_doc::Group { children: vec![], expanded: false, artboard: None, frame_stroke: None }),
     ));
     let (files, errors) = generate_assets(&d, &dir);
     assert_eq!(
diff --git a/crates/engine/src/doc_state.rs b/crates/engine/src/doc_state.rs
index ef7c9445e4..a3a4af7327 100644
--- a/crates/engine/src/doc_state.rs
+++ b/crates/engine/src/doc_state.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Arc, Document, History, LayerId, LayerTarget, channel_cmds, float_cmds, history_cmds, layer_multi_cmds, symmetry_cmds};
 
 /// Per-document editing state.
 #[derive(Clone, Debug)]
diff --git a/crates/engine/src/error.rs b/crates/engine/src/error.rs
index e033d8db93..635089f7a2 100644
--- a/crates/engine/src/error.rs
+++ b/crates/engine/src/error.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::LayerId;
 
 #[derive(Debug, thiserror::Error)]
 pub enum EngineError {
diff --git a/crates/engine/src/filters_ext.rs b/crates/engine/src/filters_ext.rs
index 7aa726f8e0..1afc11220e 100644
--- a/crates/engine/src/filters_ext.rs
+++ b/crates/engine/src/filters_ext.rs
@@ -66,343 +66,408 @@ fn list<T: serde::de::DeserializeOwned>(p: &Value, k: &str) -> Option<Vec<T>> {
 const BLACK: [f32; 4] = [0.0, 0.0, 0.0, 1.0];
 const WHITE: [f32; 4] = [1.0, 1.0, 1.0, 1.0];
 
+/// The value `options` pairs with param `k` (default name `d`), or `other` for a name it doesn't list.
+fn choice<T: Copy>(p: &Value, k: &str, d: &str, options: &[(&str, T)], other: T) -> T {
+    let name = s(p, k, d);
+    options.iter().find(|(n, _)| *n == name).map_or(other, |&(_, v)| v)
+}
+
+const MEZZOTINT_TYPES: &[(&str, MezzotintType)] = &[
+    ("fineDots", MezzotintType::FineDots),
+    ("mediumDots", MezzotintType::MediumDots),
+    ("grainyDots", MezzotintType::GrainyDots),
+    ("coarseDots", MezzotintType::CoarseDots),
+    ("shortLines", MezzotintType::ShortLines),
+    ("mediumLines", MezzotintType::MediumLines),
+    ("longLines", MezzotintType::LongLines),
+    ("shortStrokes", MezzotintType::ShortStrokes),
+    ("mediumStrokes", MezzotintType::MediumStrokes),
+    ("longStrokes", MezzotintType::LongStrokes),
+];
+const DIFFUSE_MODES: &[(&str, DiffuseMode)] = &[
+    ("normal", DiffuseMode::Normal),
+    ("darkenOnly", DiffuseMode::DarkenOnly),
+    ("lightenOnly", DiffuseMode::LightenOnly),
+    ("anisotropic", DiffuseMode::Anisotropic),
+];
+const TILE_FILLS: &[(&str, TileFill)] =
+    &[("background", TileFill::Background), ("foreground", TileFill::Foreground), ("inverse", TileFill::Inverse), ("unaltered", TileFill::Unaltered)];
+const WIND_METHODS: &[(&str, WindMethod)] = &[("wind", WindMethod::Wind), ("blast", WindMethod::Blast), ("stagger", WindMethod::Stagger)];
+const ZIGZAG_STYLES: &[(&str, ZigZagStyle)] =
+    &[("pondRipples", ZigZagStyle::PondRipples), ("outFromCenter", ZigZagStyle::OutFromCenter), ("aroundCenter", ZigZagStyle::AroundCenter)];
+const LENS_TYPES: &[(&str, LensType)] =
+    &[("zoom", LensType::Zoom), ("prime35", LensType::Prime35), ("prime105", LensType::Prime105), ("moviePrime", LensType::MoviePrime)];
+const LIGHT_KINDS: &[(&str, LightKind)] = &[("spot", LightKind::Spot), ("point", LightKind::Point), ("infinite", LightKind::Infinite)];
+const TEXTURE_CHANNELS: &[(&str, TextureChannel)] = &[
+    ("none", TextureChannel::None),
+    ("red", TextureChannel::Red),
+    ("green", TextureChannel::Green),
+    ("blue", TextureChannel::Blue),
+    ("alpha", TextureChannel::Alpha),
+    ("luminance", TextureChannel::Luminance),
+];
+const BLUR_QUALITIES: &[(&str, BlurQuality)] = &[("high", BlurQuality::High), ("low", BlurQuality::Low), ("medium", BlurQuality::Medium)];
+const SMART_BLUR_MODES: &[(&str, SmartBlurMode)] =
+    &[("normal", SmartBlurMode::Normal), ("edgeOnly", SmartBlurMode::EdgeOnly), ("overlayEdge", SmartBlurMode::OverlayEdge)];
+const IRIS_BLADES: &[(&str, u32)] = &[("triangle", 3), ("square", 4), ("pentagon", 5), ("hexagon", 6), ("heptagon", 7), ("octagon", 8)];
+const DEPTH_SOURCES: &[(&str, DepthSource)] =
+    &[("none", DepthSource::None), ("transparency", DepthSource::Transparency), ("layerMask", DepthSource::LayerMask), ("channel", DepthSource::Channel)];
+const BLUR_SHAPES: &[(&str, BlurShape)] = &[
+    ("circle", BlurShape::Circle),
+    ("ring", BlurShape::Ring),
+    ("square", BlurShape::Square),
+    ("diamond", BlurShape::Diamond),
+    ("triangle", BlurShape::Triangle),
+    ("hexagon", BlurShape::Hexagon),
+    ("star", BlurShape::Star),
+    ("heart", BlurShape::Heart),
+    ("cross", BlurShape::Cross),
+];
+const HSB_MODELS: &[(&str, HsbModel)] = &[("rgb", HsbModel::Rgb), ("hsb", HsbModel::Hsb), ("hsl", HsbModel::Hsl)];
+
+type Build = fn(&Value) -> FilterParams;
+
+const PARAMS: &[(&str, Build)] = &[
+    // Pixelate
+    ("filter.pixelate.colorHalftone", |p| FilterParams::ColorHalftone {
+        max_radius: f(p, "maxRadius", 8.0).clamp(4.0, 127.0),
+        angles: [f(p, "channel1", 108.0), f(p, "channel2", 162.0), f(p, "channel3", 90.0), f(p, "channel4", 45.0)],
+    }),
+    ("filter.pixelate.crystallize", |p| FilterParams::Crystallize { cell_size: f(p, "cellSize", 10.0).clamp(3.0, 300.0), seed: seed(p) }),
+    ("filter.pixelate.facet", |_| FilterParams::Facet),
+    ("filter.pixelate.fragment", |_| FilterParams::Fragment),
+    ("filter.pixelate.mezzotint", |p| FilterParams::Mezzotint { kind: choice(p, "type", "fineDots", MEZZOTINT_TYPES, MezzotintType::FineDots), seed: seed(p) }),
+    ("filter.pixelate.pointillize", |p| FilterParams::Pointillize {
+        cell_size: f(p, "cellSize", 5.0).clamp(3.0, 300.0),
+        seed: seed(p),
+        background: colour(p, "background", WHITE),
+    }),
+    // Stylize
+    ("filter.stylize.diffuse", |p| FilterParams::Diffuse { mode: choice(p, "mode", "normal", DIFFUSE_MODES, DiffuseMode::Normal), seed: seed(p) }),
+    ("filter.stylize.extrude", extrude),
+    ("filter.stylize.oilPaint", oil_paint),
+    ("filter.stylize.tiles", tiles),
+    ("filter.stylize.traceContour", |p| FilterParams::TraceContour { level: f(p, "level", 128.0).clamp(0.0, 255.0), upper: s(p, "edge", "lower") == "upper" }),
+    ("filter.stylize.wind", |p| FilterParams::Wind {
+        method: choice(p, "method", "wind", WIND_METHODS, WindMethod::Wind),
+        from_right: s(p, "direction", "fromRight") != "fromLeft",
+        seed: seed(p),
+    }),
+    // Distort
+    ("filter.distort.displace", displace),
+    ("filter.distort.shear", shear),
+    ("filter.distort.zigZag", |p| FilterParams::ZigZag {
+        amount: f(p, "amount", 10.0).clamp(-100.0, 100.0),
+        ridges: f(p, "ridges", 5.0).clamp(0.0, 20.0),
+        style: choice(p, "style", "pondRipples", ZIGZAG_STYLES, ZigZagStyle::PondRipples),
+    }),
+    // Render
+    ("filter.render.clouds", |p| FilterParams::Clouds {
+        seed: seed(p),
+        difference: false,
+        foreground: colour(p, "foreground", BLACK),
+        background: colour(p, "background", WHITE),
+    }),
+    ("filter.render.differenceClouds", |p| FilterParams::Clouds {
+        seed: seed(p),
+        difference: true,
+        foreground: colour(p, "foreground", BLACK),
+        background: colour(p, "background", WHITE),
+    }),
+    ("filter.render.fibers", |p| FilterParams::Fibers {
+        variance: f(p, "variance", 16.0).clamp(1.0, 64.0),
+        strength: f(p, "strength", 4.0).clamp(1.0, 64.0),
+        seed: seed(p),
+        foreground: colour(p, "foreground", BLACK),
+        background: colour(p, "background", WHITE),
+    }),
+    ("filter.render.lensFlare", lens_flare),
+    ("filter.render.relight", |p| FilterParams::Relight {
+        angle: f(p, "angle", 45.0).clamp(-180.0, 180.0),
+        elevation: f(p, "elevation", 40.0).clamp(0.0, 90.0),
+        intensity: f(p, "intensity", 40.0).clamp(0.0, 100.0),
+        ambient: f(p, "ambient", 55.0).clamp(0.0, 100.0),
+        warmth: f(p, "warmth", 0.0).clamp(-100.0, 100.0),
+        softness: f(p, "softness", 25.0).clamp(1.0, 100.0),
+    }),
+    ("filter.render.lightingEffects", lighting_effects),
+    // Noise
+    ("filter.noise.reduceNoise", |p| FilterParams::ReduceNoise {
+        strength: f(p, "strength", 6.0).clamp(0.0, 10.0),
+        preserve_details: f(p, "preserveDetails", 60.0).clamp(0.0, 100.0),
+        reduce_color_noise: f(p, "reduceColorNoise", 45.0).clamp(0.0, 100.0),
+        sharpen_details: f(p, "sharpenDetails", 25.0).clamp(0.0, 100.0),
+        remove_jpeg_artifact: b(p, "removeJpegArtifact", false),
+    }),
+    // Blur
+    ("filter.blur.smartBlur", smart_blur),
+    ("filter.blur.lensBlur", lens_blur),
+    ("filter.blur.shapeBlur", |p| FilterParams::ShapeBlur {
+        radius: f(p, "radius", 10.0).clamp(5.0, 1000.0),
+        shape: choice(p, "shape", "circle", BLUR_SHAPES, BlurShape::Circle),
+    }),
+    // Blur Gallery
+    ("filter.blurGallery.tiltShift", tilt_shift),
+    ("filter.blurGallery.irisBlur", iris_blur),
+    ("filter.blurGallery.fieldBlur", |p| FilterParams::FieldBlur {
+        pins: list::<FieldPin>(p, "pins").unwrap_or_else(|| vec![FieldPin { x: f(p, "centerX", 0.5), y: f(p, "centerY", 0.5), blur: gallery_blur(p) }]),
+    }),
+    ("filter.blurGallery.spinBlur", spin_blur),
+    ("filter.blurGallery.pathBlur", path_blur),
+    // Other
+    ("filter.other.custom", custom),
+    ("filter.other.hsbHsl", |p| FilterParams::HsbHsl {
+        input: choice(p, "inputMode", "rgb", HSB_MODELS, HsbModel::Rgb),
+        output: choice(p, "rowOrder", "hsb", HSB_MODELS, HsbModel::Rgb),
+    }),
+    (crate::color_to_alpha_cmds::ID, crate::color_to_alpha_cmds::params),
+    // Video
+    ("filter.video.deInterlace", |p| FilterParams::DeInterlace {
+        eliminate_even: s(p, "eliminate", "oddFields") == "evenFields",
+        interpolate: s(p, "createBy", "interpolation") != "duplication",
+    }),
+    ("filter.video.ntscColors", |_| FilterParams::NtscColors),
+];
+
 /// Algorithm parameters for the ids this module owns (Photoshop dialog units).
 pub fn params_for(id: &str, p: &Value) -> Option<FilterParams> {
-    let blur = |d: f32| f(p, "blur", d).clamp(0.0, 500.0);
-    Some(match id {
-        // ---- Pixelate ----
-        "filter.pixelate.colorHalftone" => FilterParams::ColorHalftone {
-            max_radius: f(p, "maxRadius", 8.0).clamp(4.0, 127.0),
-            angles: [f(p, "channel1", 108.0), f(p, "channel2", 162.0), f(p, "channel3", 90.0), f(p, "channel4", 45.0)],
-        },
-        "filter.pixelate.crystallize" => FilterParams::Crystallize { cell_size: f(p, "cellSize", 10.0).clamp(3.0, 300.0), seed: seed(p) },
-        "filter.pixelate.facet" => FilterParams::Facet,
-        "filter.pixelate.fragment" => FilterParams::Fragment,
-        "filter.pixelate.mezzotint" => FilterParams::Mezzotint {
-            kind: match s(p, "type", "fineDots") {
-                "mediumDots" => MezzotintType::MediumDots,
-                "grainyDots" => MezzotintType::GrainyDots,
-                "coarseDots" => MezzotintType::CoarseDots,
-                "shortLines" => MezzotintType::ShortLines,
-                "mediumLines" => MezzotintType::MediumLines,
-                "longLines" => MezzotintType::LongLines,
-                "shortStrokes" => MezzotintType::ShortStrokes,
-                "mediumStrokes" => MezzotintType::MediumStrokes,
-                "longStrokes" => MezzotintType::LongStrokes,
-                _ => MezzotintType::FineDots,
-            },
-            seed: seed(p),
-        },
-        "filter.pixelate.pointillize" => {
-            FilterParams::Pointillize { cell_size: f(p, "cellSize", 5.0).clamp(3.0, 300.0), seed: seed(p), background: colour(p, "background", WHITE) }
-        }
-        // ---- Stylize ----
-        "filter.stylize.diffuse" => FilterParams::Diffuse {
-            mode: match s(p, "mode", "normal") {
-                "darkenOnly" => DiffuseMode::DarkenOnly,
-                "lightenOnly" => DiffuseMode::LightenOnly,
-                "anisotropic" => DiffuseMode::Anisotropic,
-                _ => DiffuseMode::Normal,
-            },
-            seed: seed(p),
-        },
-        "filter.stylize.extrude" => FilterParams::Extrude {
-            kind: if s(p, "type", "blocks") == "pyramids" { ExtrudeType::Pyramids } else { ExtrudeType::Blocks },
-            size: f(p, "size", 30.0).clamp(2.0, 255.0),
-            depth: f(p, "depth", 30.0).clamp(1.0, 255.0),
-            level_based: s(p, "depthMode", "random") == "levelBased",
-            solid_front: b(p, "solidFrontFaces", false),
-            mask_incomplete: b(p, "maskIncompleteBlocks", false),
-            seed: seed(p),
-        },
-        "filter.stylize.oilPaint" => FilterParams::OilPaint {
-            stylization: f(p, "stylization", 4.0).clamp(0.1, 10.0),
-            cleanliness: f(p, "cleanliness", 5.0).clamp(0.0, 10.0),
-            scale: f(p, "scale", 1.0).clamp(0.1, 10.0),
-            bristle_detail: f(p, "bristleDetail", 5.0).clamp(0.0, 10.0),
-            lighting: b(p, "lighting", true),
-            angle: f(p, "angle", -60.0),
-            shine: f(p, "shine", 1.0).clamp(0.0, 10.0),
-        },
-        "filter.stylize.tiles" => FilterParams::Tiles {
-            count: i(p, "count", 10).clamp(1, 99) as u32,
-            max_offset: f(p, "maxOffset", 10.0).clamp(1.0, 99.0),
-            fill: match s(p, "fill", "background") {
-                "foreground" => TileFill::Foreground,
-                "inverse" => TileFill::Inverse,
-                "unaltered" => TileFill::Unaltered,
-                _ => TileFill::Background,
-            },
-            foreground: colour(p, "foreground", BLACK),
-            background: colour(p, "background", WHITE),
-            seed: seed(p),
-        },
-        "filter.stylize.traceContour" => FilterParams::TraceContour { level: f(p, "level", 128.0).clamp(0.0, 255.0), upper: s(p, "edge", "lower") == "upper" },
-        "filter.stylize.wind" => FilterParams::Wind {
-            method: match s(p, "method", "wind") {
-                "blast" => WindMethod::Blast,
-                "stagger" => WindMethod::Stagger,
-                _ => WindMethod::Wind,
-            },
-            from_right: s(p, "direction", "fromRight") != "fromLeft",
-            seed: seed(p),
-        },
-        // ---- Distort ----
-        "filter.distort.displace" => FilterParams::Displace {
-            horizontal: f(p, "horizontal", 10.0).clamp(-999.0, 999.0),
-            vertical: f(p, "vertical", 10.0).clamp(-999.0, 999.0),
-            stretch: s(p, "fit", "stretch") != "tile",
-            undefined: undefined(p, "repeat"),
-            // A Displace imported from PSD carries its map; `mapPath` / `mapDocument` resolve later.
-            map: photocraft_io::smart_map::displace_embedded_map(p),
-        },
-        "filter.distort.shear" => FilterParams::Shear {
-            points: list::<[f32; 2]>(p, "points").unwrap_or_else(|| {
-                let a = f(p, "amount", 0.0).clamp(-100.0, 100.0) / 100.0;
-                vec![[0.0, 0.0], [0.5, a], [1.0, 0.0]]
-            }),
-            undefined: undefined(p, "wrap"),
-        },
-        "filter.distort.zigZag" => FilterParams::ZigZag {
-            amount: f(p, "amount", 10.0).clamp(-100.0, 100.0),
-            ridges: f(p, "ridges", 5.0).clamp(0.0, 20.0),
-            style: match s(p, "style", "pondRipples") {
-                "outFromCenter" => ZigZagStyle::OutFromCenter,
-                "aroundCenter" => ZigZagStyle::AroundCenter,
-                _ => ZigZagStyle::PondRipples,
-            },
-        },
-        // ---- Render ----
-        "filter.render.clouds" | "filter.render.differenceClouds" => FilterParams::Clouds {
-            seed: seed(p),
-            difference: id == "filter.render.differenceClouds",
-            foreground: colour(p, "foreground", BLACK),
-            background: colour(p, "background", WHITE),
-        },
-        "filter.render.fibers" => FilterParams::Fibers {
-            variance: f(p, "variance", 16.0).clamp(1.0, 64.0),
-            strength: f(p, "strength", 4.0).clamp(1.0, 64.0),
-            seed: seed(p),
-            foreground: colour(p, "foreground", BLACK),
-            background: colour(p, "background", WHITE),
-        },
-        "filter.render.lensFlare" => FilterParams::LensFlare {
-            brightness: f(p, "brightness", 100.0).clamp(10.0, 300.0),
-            center_x: f(p, "centerX", 0.5).clamp(-0.5, 1.5),
-            center_y: f(p, "centerY", 0.5).clamp(-0.5, 1.5),
-            lens: match s(p, "lens", "zoom") {
-                "prime35" => LensType::Prime35,
-                "prime105" => LensType::Prime105,
-                "moviePrime" => LensType::MoviePrime,
-                _ => LensType::Zoom,
-            },
-        },
-        "filter.render.relight" => FilterParams::Relight {
-            angle: f(p, "angle", 45.0).clamp(-180.0, 180.0),
-            elevation: f(p, "elevation", 40.0).clamp(0.0, 90.0),
-            intensity: f(p, "intensity", 40.0).clamp(0.0, 100.0),
-            ambient: f(p, "ambient", 55.0).clamp(0.0, 100.0),
-            warmth: f(p, "warmth", 0.0).clamp(-100.0, 100.0),
-            softness: f(p, "softness", 25.0).clamp(1.0, 100.0),
-        },
-        "filter.render.lightingEffects" => FilterParams::LightingEffects {
-            lights: list::<Light>(p, "lights").unwrap_or_else(|| {
-                vec![Light {
-                    kind: match s(p, "lightType", "spot") {
-                        "point" => LightKind::Point,
-                        "infinite" => LightKind::Infinite,
-                        _ => LightKind::Spot,
-                    },
-                    x: f(p, "lightX", 0.25),
-                    y: f(p, "lightY", 0.2),
-                    z: f(p, "lightZ", 0.6).clamp(0.0, 10.0),
-                    target_x: f(p, "targetX", 0.5),
-                    target_y: f(p, "targetY", 0.55),
-                    angle: f(p, "angle", 135.0),
-                    elevation: f(p, "elevation", 45.0).clamp(0.0, 90.0),
-                    color: {
-                        let c = colour(p, "color", WHITE);
-                        [c[0], c[1], c[2]]
-                    },
-                    intensity: f(p, "intensity", 75.0).clamp(-100.0, 100.0),
-                    cone: f(p, "cone", 45.0).clamp(1.0, 89.0),
-                    hotspot: f(p, "hotspot", 50.0).clamp(0.0, 100.0),
-                    radius: f(p, "radius", 0.8).clamp(0.01, 10.0),
-                }]
-            }),
-            gloss: f(p, "gloss", 0.0).clamp(-100.0, 100.0),
-            metallic: f(p, "metallic", 0.0).clamp(-100.0, 100.0),
-            exposure: f(p, "exposure", 0.0).clamp(-100.0, 100.0),
-            ambience: f(p, "ambience", 8.0).clamp(-100.0, 100.0),
-            texture: match s(p, "texture", "none") {
-                "red" => TextureChannel::Red,
-                "green" => TextureChannel::Green,
-                "blue" => TextureChannel::Blue,
-                "alpha" => TextureChannel::Alpha,
-                "luminance" => TextureChannel::Luminance,
-                _ => TextureChannel::None,
-            },
-            height: f(p, "height", 50.0).clamp(0.0, 100.0),
-            white_is_high: b(p, "whiteIsHigh", true),
-        },
-        // ---- Noise ----
-        "filter.noise.reduceNoise" => FilterParams::ReduceNoise {
-            strength: f(p, "strength", 6.0).clamp(0.0, 10.0),
-            preserve_details: f(p, "preserveDetails", 60.0).clamp(0.0, 100.0),
-            reduce_color_noise: f(p, "reduceColorNoise", 45.0).clamp(0.0, 100.0),
-            sharpen_details: f(p, "sharpenDetails", 25.0).clamp(0.0, 100.0),
-            remove_jpeg_artifact: b(p, "removeJpegArtifact", false),
-        },
-        // ---- Blur ----
-        "filter.blur.smartBlur" => FilterParams::SmartBlur {
-            radius: f(p, "radius", 3.0).clamp(0.1, 100.0),
-            threshold: f(p, "threshold", 25.0).clamp(0.1, 100.0),
-            quality: match s(p, "quality", "high") {
-                "low" => BlurQuality::Low,
-                "medium" => BlurQuality::Medium,
-                _ => BlurQuality::High,
-            },
-            mode: match s(p, "mode", "normal") {
-                "edgeOnly" => SmartBlurMode::EdgeOnly,
-                "overlayEdge" => SmartBlurMode::OverlayEdge,
-                _ => SmartBlurMode::Normal,
-            },
-        },
-        "filter.blur.lensBlur" => FilterParams::LensBlur {
-            radius: f(p, "radius", 15.0).clamp(0.0, 100.0),
-            blades: match s(p, "shape", "hexagon") {
-                "triangle" => 3,
-                "square" => 4,
-                "pentagon" => 5,
-                "heptagon" => 7,
-                "octagon" => 8,
-                _ => 6,
-            },
-            curvature: f(p, "bladeCurvature", 0.0).clamp(0.0, 100.0),
-            rotation: f(p, "rotation", 0.0),
-            depth: match s(p, "depthMap", "none") {
-                "transparency" => DepthSource::Transparency,
-                "layerMask" => DepthSource::LayerMask,
-                "channel" => DepthSource::Channel,
-                _ => DepthSource::None,
-            },
-            focal_distance: f(p, "focalDistance", 0.0).clamp(0.0, 255.0),
-            invert_depth: b(p, "invert", false),
-            brightness: f(p, "brightness", 0.0).clamp(0.0, 100.0),
-            threshold: f(p, "threshold", 255.0).clamp(0.0, 255.0),
-            noise: f(p, "noise", 0.0).clamp(0.0, 100.0),
-            distribution: if s(p, "distribution", "uniform") == "gaussian" { Distribution::Gaussian } else { Distribution::Uniform },
-            monochromatic: b(p, "monochromatic", false),
-            seed: seed(p),
-            depth_map: None,
-        },
-        "filter.blur.shapeBlur" => FilterParams::ShapeBlur {
-            radius: f(p, "radius", 10.0).clamp(5.0, 1000.0),
-            shape: match s(p, "shape", "circle") {
-                "ring" => BlurShape::Ring,
-                "square" => BlurShape::Square,
-                "diamond" => BlurShape::Diamond,
-                "triangle" => BlurShape::Triangle,
-                "hexagon" => BlurShape::Hexagon,
-                "star" => BlurShape::Star,
-                "heart" => BlurShape::Heart,
-                "cross" => BlurShape::Cross,
-                _ => BlurShape::Circle,
-            },
-        },
-        // ---- Blur Gallery ----
-        "filter.blurGallery.tiltShift" => FilterParams::TiltShift {
-            blur: blur(15.0),
-            center_x: f(p, "centerX", 0.5),
-            center_y: f(p, "centerY", 0.5),
-            angle: f(p, "angle", 0.0),
-            focus: f(p, "focus", 0.1).clamp(0.0, 2.0),
-            transition: f(p, "transition", 0.15).clamp(0.001, 2.0),
-        },
-        "filter.blurGallery.irisBlur" => FilterParams::IrisBlur {
-            pins: list::<IrisPin>(p, "pins").unwrap_or_else(|| {
-                vec![IrisPin {
+    match PARAMS.iter().find(|(k, _)| *k == id) {
+        Some((_, build)) => Some(build(p)),
+        None => crate::gallery_cmds::params_for(id, p),
+    }
+}
+
+/// The blur amount the Blur Gallery filters share.
+fn gallery_blur(p: &Value) -> f32 {
+    f(p, "blur", 15.0).clamp(0.0, 500.0)
+}
+
+/// Filter › Stylize › Extrude parameters.
+fn extrude(p: &Value) -> FilterParams {
+    FilterParams::Extrude {
+        kind: if s(p, "type", "blocks") == "pyramids" { ExtrudeType::Pyramids } else { ExtrudeType::Blocks },
+        size: f(p, "size", 30.0).clamp(2.0, 255.0),
+        depth: f(p, "depth", 30.0).clamp(1.0, 255.0),
+        level_based: s(p, "depthMode", "random") == "levelBased",
+        solid_front: b(p, "solidFrontFaces", false),
+        mask_incomplete: b(p, "maskIncompleteBlocks", false),
+        seed: seed(p),
+    }
+}
+
+/// Filter › Stylize › Oil Paint parameters.
+fn oil_paint(p: &Value) -> FilterParams {
+    FilterParams::OilPaint {
+        stylization: f(p, "stylization", 4.0).clamp(0.1, 10.0),
+        cleanliness: f(p, "cleanliness", 5.0).clamp(0.0, 10.0),
+        scale: f(p, "scale", 1.0).clamp(0.1, 10.0),
+        bristle_detail: f(p, "bristleDetail", 5.0).clamp(0.0, 10.0),
+        lighting: b(p, "lighting", true),
+        angle: f(p, "angle", -60.0),
+        shine: f(p, "shine", 1.0).clamp(0.0, 10.0),
+    }
+}
+
+/// Filter › Stylize › Tiles parameters.
+fn tiles(p: &Value) -> FilterParams {
+    FilterParams::Tiles {
+        count: i(p, "count", 10).clamp(1, 99) as u32,
+        max_offset: f(p, "maxOffset", 10.0).clamp(1.0, 99.0),
+        fill: choice(p, "fill", "background", TILE_FILLS, TileFill::Background),
+        foreground: colour(p, "foreground", BLACK),
+        background: colour(p, "background", WHITE),
+        seed: seed(p),
+    }
+}
+
+/// Filter › Distort › Displace parameters.
+fn displace(p: &Value) -> FilterParams {
+    FilterParams::Displace {
+        horizontal: f(p, "horizontal", 10.0).clamp(-999.0, 999.0),
+        vertical: f(p, "vertical", 10.0).clamp(-999.0, 999.0),
+        stretch: s(p, "fit", "stretch") != "tile",
+        undefined: undefined(p, "repeat"),
+        // PSD imports carry the map, and `mapPath` or `mapDocument` resolve later.
+        map: photocraft_io::smart_map::displace_embedded_map(p),
+    }
+}
+
+/// Filter › Distort › Shear parameters: the listed curve points, or one bend from `amount`.
+fn shear(p: &Value) -> FilterParams {
+    FilterParams::Shear {
+        points: list::<[f32; 2]>(p, "points").unwrap_or_else(|| {
+            let a = f(p, "amount", 0.0).clamp(-100.0, 100.0) / 100.0;
+            vec![[0.0, 0.0], [0.5, a], [1.0, 0.0]]
+        }),
+        undefined: undefined(p, "wrap"),
+    }
+}
+
+/// Filter › Render › Lens Flare parameters.
+fn lens_flare(p: &Value) -> FilterParams {
+    FilterParams::LensFlare {
+        brightness: f(p, "brightness", 100.0).clamp(10.0, 300.0),
+        center_x: f(p, "centerX", 0.5).clamp(-0.5, 1.5),
+        center_y: f(p, "centerY", 0.5).clamp(-0.5, 1.5),
+        lens: choice(p, "lens", "zoom", LENS_TYPES, LensType::Zoom),
+    }
+}
+
+/// The one light Lighting Effects uses when the params list no `lights`.
+fn single_light(p: &Value) -> Light {
+    let c = colour(p, "color", WHITE);
+    Light {
+        kind: choice(p, "lightType", "spot", LIGHT_KINDS, LightKind::Spot),
+        x: f(p, "lightX", 0.25),
+        y: f(p, "lightY", 0.2),
+        z: f(p, "lightZ", 0.6).clamp(0.0, 10.0),
+        target_x: f(p, "targetX", 0.5),
+        target_y: f(p, "targetY", 0.55),
+        angle: f(p, "angle", 135.0),
+        elevation: f(p, "elevation", 45.0).clamp(0.0, 90.0),
+        color: [c[0], c[1], c[2]],
+        intensity: f(p, "intensity", 75.0).clamp(-100.0, 100.0),
+        cone: f(p, "cone", 45.0).clamp(1.0, 89.0),
+        hotspot: f(p, "hotspot", 50.0).clamp(0.0, 100.0),
+        radius: f(p, "radius", 0.8).clamp(0.01, 10.0),
+    }
+}
+
+/// Filter › Render › Lighting Effects parameters.
+fn lighting_effects(p: &Value) -> FilterParams {
+    FilterParams::LightingEffects {
+        lights: list::<Light>(p, "lights").unwrap_or_else(|| vec![single_light(p)]),
+        gloss: f(p, "gloss", 0.0).clamp(-100.0, 100.0),
+        metallic: f(p, "metallic", 0.0).clamp(-100.0, 100.0),
+        exposure: f(p, "exposure", 0.0).clamp(-100.0, 100.0),
+        ambience: f(p, "ambience", 8.0).clamp(-100.0, 100.0),
+        texture: choice(p, "texture", "none", TEXTURE_CHANNELS, TextureChannel::None),
+        height: f(p, "height", 50.0).clamp(0.0, 100.0),
+        white_is_high: b(p, "whiteIsHigh", true),
+    }
+}
+
+/// Filter › Blur › Smart Blur parameters.
+fn smart_blur(p: &Value) -> FilterParams {
+    FilterParams::SmartBlur {
+        radius: f(p, "radius", 3.0).clamp(0.1, 100.0),
+        threshold: f(p, "threshold", 25.0).clamp(0.1, 100.0),
+        quality: choice(p, "quality", "high", BLUR_QUALITIES, BlurQuality::High),
+        mode: choice(p, "mode", "normal", SMART_BLUR_MODES, SmartBlurMode::Normal),
+    }
+}
+
+/// Filter › Blur › Lens Blur parameters, with the depth map resolved later.
+fn lens_blur(p: &Value) -> FilterParams {
+    FilterParams::LensBlur {
+        radius: f(p, "radius", 15.0).clamp(0.0, 100.0),
+        blades: choice(p, "shape", "hexagon", IRIS_BLADES, 6),
+        curvature: f(p, "bladeCurvature", 0.0).clamp(0.0, 100.0),
+        rotation: f(p, "rotation", 0.0),
+        depth: choice(p, "depthMap", "none", DEPTH_SOURCES, DepthSource::None),
+        focal_distance: f(p, "focalDistance", 0.0).clamp(0.0, 255.0),
+        invert_depth: b(p, "invert", false),
+        brightness: f(p, "brightness", 0.0).clamp(0.0, 100.0),
+        threshold: f(p, "threshold", 255.0).clamp(0.0, 255.0),
+        noise: f(p, "noise", 0.0).clamp(0.0, 100.0),
+        distribution: if s(p, "distribution", "uniform") == "gaussian" { Distribution::Gaussian } else { Distribution::Uniform },
+        monochromatic: b(p, "monochromatic", false),
+        seed: seed(p),
+        depth_map: None,
+    }
+}
+
+/// Blur Gallery › Tilt-Shift parameters.
+fn tilt_shift(p: &Value) -> FilterParams {
+    FilterParams::TiltShift {
+        blur: gallery_blur(p),
+        center_x: f(p, "centerX", 0.5),
+        center_y: f(p, "centerY", 0.5),
+        angle: f(p, "angle", 0.0),
+        focus: f(p, "focus", 0.1).clamp(0.0, 2.0),
+        transition: f(p, "transition", 0.15).clamp(0.001, 2.0),
+    }
+}
+
+/// Blur Gallery › Iris Blur parameters: the listed pins, or one pin from the flat params.
+fn iris_blur(p: &Value) -> FilterParams {
+    FilterParams::IrisBlur {
+        pins: list::<IrisPin>(p, "pins").unwrap_or_else(|| {
+            vec![IrisPin {
+                x: f(p, "centerX", 0.5),
+                y: f(p, "centerY", 0.5),
+                radius_x: f(p, "radiusX", 0.35).max(0.001),
+                radius_y: f(p, "radiusY", 0.25).max(0.001),
+                angle: f(p, "angle", 0.0),
+                roundness: f(p, "roundness", 0.0).clamp(0.0, 100.0),
+                feather: f(p, "feather", 0.5).clamp(0.0, 0.99),
+                blur: gallery_blur(p),
+            }]
+        }),
+    }
+}
+
+/// `a` clamped to `lo..=360`, or 0 when it isn't finite.
+fn spin_angle(a: f32, lo: f32) -> f32 {
+    if a.is_finite() { a.clamp(lo, 360.0) } else { 0.0 }
+}
+
+/// Blur Gallery › Spin Blur parameters: the listed pins with bounded angles, or one pin from the flat params.
+fn spin_blur(p: &Value) -> FilterParams {
+    FilterParams::SpinBlur {
+        pins: list::<SpinPin>(p, "pins")
+            .map(|mut v| {
+                for pin in &mut v {
+                    pin.angle = spin_angle(pin.angle, -360.0);
+                    pin.blur_angle = spin_angle(pin.blur_angle, 0.0);
+                }
+                v
+            })
+            .unwrap_or_else(|| {
+                vec![SpinPin {
                     x: f(p, "centerX", 0.5),
                     y: f(p, "centerY", 0.5),
-                    radius_x: f(p, "radiusX", 0.35).max(0.001),
-                    radius_y: f(p, "radiusY", 0.25).max(0.001),
-                    angle: f(p, "angle", 0.0),
-                    roundness: f(p, "roundness", 0.0).clamp(0.0, 100.0),
-                    feather: f(p, "feather", 0.5).clamp(0.0, 0.99),
-                    blur: blur(15.0),
+                    radius_x: f(p, "radiusX", 0.3).max(0.001),
+                    radius_y: f(p, "radiusY", 0.3).max(0.001),
+                    angle: spin_angle(f(p, "angle", 0.0), -360.0),
+                    blur_angle: f(p, "blurAngle", 15.0).clamp(0.0, 360.0),
                 }]
             }),
-        },
-        "filter.blurGallery.fieldBlur" => FilterParams::FieldBlur {
-            pins: list::<FieldPin>(p, "pins").unwrap_or_else(|| vec![FieldPin { x: f(p, "centerX", 0.5), y: f(p, "centerY", 0.5), blur: blur(15.0) }]),
-        },
-        "filter.blurGallery.spinBlur" => FilterParams::SpinBlur {
-            pins: list::<SpinPin>(p, "pins")
-                .map(|mut v| {
-                    for pin in &mut v {
-                        pin.angle = if pin.angle.is_finite() { pin.angle.clamp(-360.0, 360.0) } else { 0.0 };
-                        pin.blur_angle = if pin.blur_angle.is_finite() { pin.blur_angle.clamp(0.0, 360.0) } else { 0.0 };
-                    }
-                    v
-                })
-                .unwrap_or_else(|| {
-                    let a = f(p, "angle", 0.0);
-                    vec![SpinPin {
-                        x: f(p, "centerX", 0.5),
-                        y: f(p, "centerY", 0.5),
-                        radius_x: f(p, "radiusX", 0.3).max(0.001),
-                        radius_y: f(p, "radiusY", 0.3).max(0.001),
-                        angle: if a.is_finite() { a.clamp(-360.0, 360.0) } else { 0.0 },
-                        blur_angle: f(p, "blurAngle", 15.0).clamp(0.0, 360.0),
-                    }]
-                }),
-        },
-        "filter.blurGallery.pathBlur" => FilterParams::PathBlur {
-            paths: list::<BlurPath>(p, "paths")
-                .map(|mut v| {
-                    // Entry speeds bypass the scalar clamp above; the halo
-                    // casts one to i32 and adds, so an unclamped value
-                    // overflows (#708).
-                    for b in &mut v {
-                        b.speed = b.speed.clamp(0.0, 500.0);
-                    }
-                    v
-                })
-                .unwrap_or_else(|| {
-                    vec![BlurPath {
-                        points: vec![[f(p, "startX", 0.2), f(p, "startY", 0.5)], [f(p, "endX", 0.8), f(p, "endY", 0.5)]],
-                        speed: f(p, "speed", 50.0).clamp(0.0, 500.0),
-                        taper: f(p, "taper", 0.0).clamp(0.0, 100.0),
-                    }]
-                }),
-        },
-        // ---- Other ----
-        "filter.other.custom" => FilterParams::Custom {
-            kernel: p
-                .get("kernel")
-                .and_then(Value::as_array)
-                .map(|a| a.iter().take(25).map(|v| v.as_f64().unwrap_or(0.0).clamp(-999.0, 999.0) as f32).collect())
-                .unwrap_or_else(|| (0..25).map(|k| if k == 12 { 1.0 } else { 0.0 }).collect()),
-            scale: f(p, "scale", 1.0).clamp(1.0, 9999.0),
-            offset: f(p, "offset", 0.0).clamp(-9999.0, 9999.0),
-        },
-        "filter.other.hsbHsl" => {
-            let m = |k: &str, d: &str| match s(p, k, d) {
-                "hsb" => HsbModel::Hsb,
-                "hsl" => HsbModel::Hsl,
-                _ => HsbModel::Rgb,
-            };
-            FilterParams::HsbHsl { input: m("inputMode", "rgb"), output: m("rowOrder", "hsb") }
-        }
-        crate::color_to_alpha_cmds::ID => crate::color_to_alpha_cmds::params(p),
-        // ---- Video ----
-        "filter.video.deInterlace" => FilterParams::DeInterlace {
-            eliminate_even: s(p, "eliminate", "oddFields") == "evenFields",
-            interpolate: s(p, "createBy", "interpolation") != "duplication",
-        },
-        "filter.video.ntscColors" => FilterParams::NtscColors,
-        _ => return crate::gallery_cmds::params_for(id, p),
-    })
+    }
+}
+
+/// Blur Gallery › Path Blur parameters: the listed paths with bounded speeds, or one straight path from the flat params.
+fn path_blur(p: &Value) -> FilterParams {
+    FilterParams::PathBlur {
+        paths: list::<BlurPath>(p, "paths")
+            .map(|mut v| {
+                // The halo casts speeds to i32, so unclamped entries overflow (#708).
+                for b in &mut v {
+                    b.speed = b.speed.clamp(0.0, 500.0);
+                }
+                v
+            })
+            .unwrap_or_else(|| {
+                vec![BlurPath {
+                    points: vec![[f(p, "startX", 0.2), f(p, "startY", 0.5)], [f(p, "endX", 0.8), f(p, "endY", 0.5)]],
+                    speed: f(p, "speed", 50.0).clamp(0.0, 500.0),
+                    taper: f(p, "taper", 0.0).clamp(0.0, 100.0),
+                }]
+            }),
+    }
+}
+
+/// Filter › Other › Custom parameters: up to 25 kernel weights (the identity by default), scale and offset.
+fn custom(p: &Value) -> FilterParams {
+    FilterParams::Custom {
+        kernel: p
+            .get("kernel")
+            .and_then(Value::as_array)
+            .map(|a| a.iter().take(25).map(|v| v.as_f64().unwrap_or(0.0).clamp(-999.0, 999.0) as f32).collect())
+            .unwrap_or_else(|| (0..25).map(|k| if k == 12 { 1.0 } else { 0.0 }).collect()),
+        scale: f(p, "scale", 1.0).clamp(1.0, 9999.0),
+        offset: f(p, "offset", 0.0).clamp(-9999.0, 9999.0),
+    }
 }
 
 /// Ids whose rendering uses the foreground/background colours.
diff --git a/crates/engine/src/group_options.rs b/crates/engine/src/group_options.rs
new file mode 100644
index 0000000000..dd2ddee02f
--- /dev/null
+++ b/crates/engine/src/group_options.rs
@@ -0,0 +1,264 @@
+//! The options of Photoshop's New Group dialog (Name, Color, Mode, Opacity), shared by
+//! Layer › New › Group… (`layer.new.group`) and Group from Layers (`layer.new.groupFromLayers`,
+//! `layer.groupLayers`), so the dialog's OK is a single history step.
+
+use photocraft_color::BlendMode;
+use photocraft_doc::{LabelColor, Layer};
+use serde_json::Value;
+
+use crate::{EngineError, Result};
+
+/// New Group options parsed from command params; an absent (or `null`) key keeps the default.
+#[derive(Debug, Default)]
+pub(crate) struct GroupOptions {
+    /// `None` (or an empty name) takes the next "Group N".
+    pub name: Option<String>,
+    color: Option<LabelColor>,
+    blend: Option<BlendMode>,
+    opacity: Option<f32>,
+}
+
+impl GroupOptions {
+    /// Parses `name`, `color` (a layer colour id), `mode` (a blend mode, Pass Through included)
+    /// and `opacity` (percent, clamped to 0..100). Validates everything before any edit runs.
+    pub(crate) fn parse(cmd: &str, p: &Value) -> Result<Self> {
+        let bad = |msg: &str| EngineError::BadParams { cmd: cmd.into(), msg: msg.into() };
+        let get = |key: &str| p.get(key).filter(|v| !v.is_null());
+        let name = match get("name") {
+            None => None,
+            Some(v) => Some(v.as_str().ok_or_else(|| bad("`name` must be a string"))?.to_string()).filter(|n| !n.trim().is_empty()),
+        };
+        let color = match get("color") {
+            None => None,
+            Some(v) => Some(v.as_str().and_then(LabelColor::from_id).ok_or_else(|| {
+                bad("`color` must be a layer colour id (none, red, orange, yellow, green, seafoam, blue, indigo, magenta, fuchsia, violet, gray)")
+            })?),
+        };
+        let blend = match get("mode") {
+            None => None,
+            Some(v) => Some(
+                v.as_str()
+                    .and_then(crate::commands::blend_from_str)
+                    .ok_or_else(|| bad("`mode` must be a blend mode such as \"passThrough\" or \"multiply\""))?,
+            ),
+        };
+        let opacity = match get("opacity") {
+            None => None,
+            Some(v) => {
+                let o = v.as_f64().filter(|o| o.is_finite()).ok_or_else(|| bad("`opacity` must be a number (percent, 0..100)"))?;
+                Some((o.clamp(0.0, 100.0) / 100.0) as f32)
+            }
+        };
+        Ok(Self { name, color, blend, opacity })
+    }
+
+    /// Sets the mode, opacity and colour of a new `group`. A colour also reaches every layer inside
+    /// it, as Layer › Layer Color does on a group; "No Color" leaves the layers' own colours alone.
+    pub(crate) fn apply(&self, group: &mut Layer) {
+        if let Some(blend) = self.blend {
+            group.blend = blend;
+        }
+        if let Some(opacity) = self.opacity {
+            group.opacity = opacity;
+        }
+        match self.color {
+            Some(LabelColor::None) | None => {}
+            Some(color) => {
+                // Explicit stack: documents can nest groups deeply.
+                let mut stack = vec![group];
+                while let Some(l) = stack.pop() {
+                    l.label = color;
+                    if let Some(children) = l.children_mut() {
+                        stack.extend(children.iter_mut());
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// `layer.new.group`'s `position`: `below` (the Layers panel's ⌘/Ctrl-click) or `above` (the default).
+pub(crate) fn below(cmd: &str, p: &Value) -> Result<bool> {
+    match p.get("position").filter(|v| !v.is_null()) {
+        None => Ok(false),
+        Some(v) => match v.as_str() {
+            Some("above") => Ok(false),
+            Some("below") => Ok(true),
+            _ => Err(EngineError::BadParams { cmd: cmd.into(), msg: "`position` must be above or below".into() }),
+        },
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use photocraft_color::BlendMode;
+    use photocraft_doc::{Document, LabelColor, Layer, LayerContent, LayerId};
+    use serde_json::{Value, json};
+
+    use crate::Session;
+
+    /// Background, then `A` and `B` (`B` active).
+    fn session() -> (Session, LayerId, LayerId) {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 16, "height": 16})).unwrap();
+        let a = id(s.execute("layer.new.layer", json!({"name": "A"})).unwrap());
+        let b = id(s.execute("layer.new.layer", json!({"name": "B"})).unwrap());
+        (s, a, b)
+    }
+
+    fn id(v: Value) -> LayerId {
+        LayerId(v["layer"].as_u64().unwrap())
+    }
+
+    fn doc(s: &Session) -> &Document {
+        &s.active().unwrap().doc
+    }
+
+    fn layer(s: &Session, id: LayerId) -> &Layer {
+        doc(s).layer(id).unwrap()
+    }
+
+    fn expanded(s: &Session, id: LayerId) -> bool {
+        matches!(&layer(s, id).content, LayerContent::Group(g) if g.expanded)
+    }
+
+    fn steps(s: &Session) -> usize {
+        s.active().unwrap().history.entries().len()
+    }
+
+    fn top(s: &Session) -> Vec<LayerId> {
+        doc(s).layers.iter().map(|l| l.id).collect()
+    }
+
+    #[test]
+    fn new_group_defaults_and_dialog_options() {
+        let (mut s, _, _) = session();
+        let g = id(s.execute("layer.new.group", json!({})).unwrap());
+        let l = layer(&s, g);
+        assert_eq!((l.name.as_str(), l.blend, l.opacity, l.label), ("Group 1", BlendMode::PassThrough, 1.0, LabelColor::None));
+        assert!(expanded(&s, g), "an empty new group stays open");
+        let before = steps(&s);
+        let g = id(s.execute("layer.new.group", json!({"name": "Sky", "color": "red", "mode": "multiply", "opacity": 40})).unwrap());
+        let l = layer(&s, g);
+        assert_eq!((l.name.as_str(), l.blend, l.label), ("Sky", BlendMode::Multiply, LabelColor::Red));
+        assert!((l.opacity - 0.4).abs() < 1e-6);
+        assert_eq!(steps(&s), before + 1, "the dialog's OK is one history step");
+        // Labels as shown in the dialog work too; opacity is clamped to 0..100 %, a blank name is "Group N".
+        let g = id(s.execute("layer.new.group", json!({"name": "  ", "mode": "Linear Dodge (Add)", "opacity": 250})).unwrap());
+        let l = layer(&s, g);
+        assert_eq!((l.name.as_str(), l.blend, l.opacity), ("Group 2", BlendMode::LinearDodge, 1.0));
+        let g = id(s.execute("layer.new.group", json!({"opacity": -5, "name": null, "color": null, "mode": null, "position": null})).unwrap());
+        assert_eq!(layer(&s, g).opacity, 0.0);
+    }
+
+    #[test]
+    fn group_from_layers_is_collapsed_and_takes_the_dialog_options() {
+        let (mut s, a, b) = session();
+        s.execute("layer.setLabelColor", json!({"layer": a.0, "color": "red"})).unwrap();
+        s.execute("layer.select", json!({"layer": a.0})).unwrap();
+        s.execute("layer.select", json!({"layer": b.0, "mode": "add"})).unwrap();
+        let before = steps(&s);
+        let g = id(s.execute("layer.new.groupFromLayers", json!({"name": "Pair", "color": "none", "mode": "normal", "opacity": 50})).unwrap());
+        assert_eq!(steps(&s), before + 1, "one history step");
+        let l = layer(&s, g);
+        assert_eq!((l.name.as_str(), l.blend, l.opacity, l.label), ("Pair", BlendMode::Normal, 0.5, LabelColor::None));
+        assert!(!expanded(&s, g), "Photoshop shows a group made from layers closed");
+        assert_eq!(layer(&s, a).label, LabelColor::Red, "No Color leaves the layers' own colours alone");
+        let inspect = s.execute("document.inspect", json!({})).unwrap();
+        let row = inspect["layers"].as_array().unwrap().iter().find(|l| l["id"] == json!(g.0)).unwrap().clone();
+        assert_eq!(row["expanded"], false, "document.inspect reports it");
+        // Undo removes the group; redo brings it back closed.
+        s.undo();
+        assert!(doc(&s).layer(g).is_none());
+        s.redo();
+        assert!(!expanded(&s, g));
+        // ⌘G with a colour labels the group and every layer in it, like Layer › Layer Color.
+        s.undo();
+        s.execute("layer.select", json!({"layer": a.0})).unwrap();
+        s.execute("layer.select", json!({"layer": b.0, "mode": "add"})).unwrap();
+        let g = id(s.execute("layer.groupLayers", json!({"color": "green"})).unwrap());
+        assert!(!expanded(&s, g));
+        for l in [g, a, b] {
+            assert_eq!(layer(&s, l).label, LabelColor::Green);
+        }
+    }
+
+    #[test]
+    fn below_puts_the_new_group_under_the_active_layer() {
+        let (mut s, a, b) = session();
+        let bg = top(&s)[0];
+        let g = id(s.execute("layer.new.group", json!({"position": "below"})).unwrap());
+        assert_eq!(top(&s), vec![bg, a, g, b]);
+        // Inside a group it stays inside, under the active layer.
+        s.execute("layer.select", json!({"layer": b.0})).unwrap();
+        let outer = id(s.execute("layer.groupLayers", json!({})).unwrap());
+        s.execute("layer.select", json!({"layer": b.0})).unwrap();
+        let inner = id(s.execute("layer.new.group", json!({"position": "below"})).unwrap());
+        let children: Vec<LayerId> = layer(&s, outer).children().unwrap().iter().map(|l| l.id).collect();
+        assert_eq!(children, vec![inner, b]);
+        // Nothing goes under the Background: the group goes above it instead.
+        s.execute("layer.select", json!({"layer": bg.0})).unwrap();
+        let g2 = id(s.execute("layer.new.group", json!({"position": "below"})).unwrap());
+        assert_eq!(top(&s)[..2], [bg, g2]);
+        // With no active layer it goes to the top, like a plain New Group.
+        s.execute("select.deselectLayers", json!({})).unwrap();
+        let g3 = id(s.execute("layer.new.group", json!({"position": "below"})).unwrap());
+        assert_eq!(top(&s).last(), Some(&g3));
+    }
+
+    /// A group added inside a clipping mask (⌘-click under a clipped layer, or a plain New Group
+    /// on the base) joins the mask, as in Photoshop: the clipped layers keep their base and stay
+    /// visible, and nothing needs recompositing.
+    #[test]
+    fn a_group_added_inside_a_clipping_mask_joins_it() {
+        let (mut s, a, b) = session();
+        s.execute("layer.setProps", json!({"layer": b.0, "clipped": true})).unwrap();
+        s.execute("layer.select", json!({"layer": b.0})).unwrap();
+        let g = id(s.execute("layer.new.group", json!({"position": "below"})).unwrap());
+        assert_eq!(top(&s)[1..], [a, g, b]);
+        assert!(layer(&s, g).clipped, "under a clipped layer the group is clipped too");
+        assert_eq!(s.active().unwrap().last_damage, Some(photocraft_geom::Rect::EMPTY), "B still clips to A");
+        // On the base itself: the new group goes between A and its clipped layers.
+        s.undo();
+        s.execute("layer.select", json!({"layer": a.0})).unwrap();
+        let g = id(s.execute("layer.new.group", json!({})).unwrap());
+        assert_eq!(top(&s)[1..], [a, g, b]);
+        assert!(layer(&s, g).clipped);
+        // Outside a clipping mask nothing changes.
+        s.execute("layer.select", json!({"layer": b.0})).unwrap();
+        let g = id(s.execute("layer.new.group", json!({})).unwrap());
+        assert!(!layer(&s, g).clipped);
+    }
+
+    #[test]
+    fn bad_options_fail_without_touching_the_document() {
+        let (mut s, a, b) = session();
+        s.execute("layer.select", json!({"layer": a.0})).unwrap();
+        s.execute("layer.select", json!({"layer": b.0, "mode": "add"})).unwrap();
+        for cmd in ["layer.new.group", "layer.new.groupFromLayers", "layer.groupLayers"] {
+            let mut bad = vec![
+                json!({"name": 7}),
+                json!({"color": 5}),
+                json!({"color": "pink"}),
+                json!({"color": "Red"}),
+                json!({"mode": ""}),
+                json!({"mode": 3}),
+                json!({"mode": "sparkle"}),
+                json!({"opacity": "x"}),
+                json!({"opacity": [50]}),
+            ];
+            if cmd == "layer.new.group" {
+                bad.push(json!({"position": "yes"}));
+            }
+            for p in bad {
+                let before = (doc(&s).clone(), s.active().unwrap().revision, steps(&s));
+                assert!(s.execute(cmd, p.clone()).is_err(), "{cmd} {p} must be refused");
+                assert_eq!((doc(&s).clone(), s.active().unwrap().revision, steps(&s)), before, "{cmd} {p} changed nothing");
+            }
+            // A huge but finite opacity clamps to 100 % instead of failing.
+            let g = id(s.execute(cmd, json!({"opacity": f64::MAX})).unwrap());
+            assert_eq!(layer(&s, g).opacity, 1.0);
+            s.undo();
+        }
+    }
+}
diff --git a/crates/engine/src/inspect.rs b/crates/engine/src/inspect.rs
index e4c93c7cbc..dc681b7d8e 100644
--- a/crates/engine/src/inspect.rs
+++ b/crates/engine/src/inspect.rs
@@ -21,6 +21,8 @@ pub fn session(s: &Session) -> Value {
         })).collect::<Vec<_>>(),
         "foreground": s.tools.foreground,
         "background": s.tools.background,
+        // History panel › History Options… (`history.options`).
+        "historyOptions": crate::history_options_cmds::current(s),
     })
 }
 
diff --git a/crates/engine/src/jobs.rs b/crates/engine/src/jobs.rs
index 6799640bad..bf3560eb9f 100644
--- a/crates/engine/src/jobs.rs
+++ b/crates/engine/src/jobs.rs
@@ -331,14 +331,25 @@ fn independent_of_document(id: &str) -> bool {
 }
 
 #[cfg(not(target_arch = "wasm32"))]
-fn read_path(path: &str) -> Result<Vec<u8>> {
-    // Bounded reads, and a clear error for a file larger than memory (#375).
-    photocraft_format::read_file(std::path::Path::new(path)).map_err(|e| EngineError::Other(format!("{path}: {e}")))
+fn import_path(
+    name: &str,
+    path: &str,
+    opts: &photocraft_io::ImportOptions,
+    ctl: &photocraft_raster::Interrupt,
+) -> std::result::Result<(photocraft_io::ImportResult, bool), photocraft_io::IoError> {
+    // Bounded reads, and a clear error for a file larger than memory (#375); a PSD/PSB is
+    // parsed from the open file instead of being read whole.
+    photocraft_io::import_file_for_open_with(name, std::path::Path::new(path), opts, ctl)
 }
 
 #[cfg(target_arch = "wasm32")]
-fn read_path(path: &str) -> Result<Vec<u8>> {
-    Err(EngineError::Other(format!("cannot open paths on the web: {path}")))
+fn import_path(
+    _: &str,
+    path: &str,
+    _: &photocraft_io::ImportOptions,
+    _: &photocraft_raster::Interrupt,
+) -> std::result::Result<(photocraft_io::ImportResult, bool), photocraft_io::IoError> {
+    Err(photocraft_io::IoError::Read(format!("cannot open paths on the web: {path}")))
 }
 
 /// Run a job-capable command's heavy part. `work` runs on a worker thread when the command was
@@ -555,17 +566,19 @@ impl Session {
             false,
             move |ctx| {
                 ctx.progress(0.0, "Reading");
-                let bytes = match source {
-                    OpenSource::Bytes(b) => b,
-                    OpenSource::Path(p) => Arc::new(read_path(&p)?),
-                };
-                ctx.check()?;
-                ctx.progress(0.02, "Decoding");
-                let imported =
-                    ctx.stage(0.02, 0.95, "Decoding", |ctl| photocraft_io::import_for_open_with(&name_w, &bytes, &opts, ctl)).map_err(|e| match e {
-                        photocraft_io::IoError::Cancelled => EngineError::Cancelled,
-                        e => EngineError::Other(e.to_string()),
-                    })?;
+                let imported = match source {
+                    OpenSource::Bytes(bytes) => {
+                        ctx.check()?;
+                        ctx.progress(0.02, "Decoding");
+                        ctx.stage(0.02, 0.95, "Decoding", |ctl| photocraft_io::import_for_open_with(&name_w, &bytes, &opts, ctl))
+                    }
+                    // A PSD/PSB is decoded straight from the file, which is never read whole.
+                    OpenSource::Path(p) => ctx.stage(0.0, 0.95, "Decoding", |ctl| import_path(&name_w, &p, &opts, ctl)),
+                }
+                .map_err(|e| match e {
+                    photocraft_io::IoError::Cancelled => EngineError::Cancelled,
+                    e => EngineError::Other(e.to_string()),
+                })?;
                 ctx.progress(0.95, "Preparing layers");
                 warm_layer_bounds(&imported.0.document, || ctx.check())?;
                 // Type layers need the shared text engine, whose first use waits for the
diff --git a/crates/engine/src/kys.rs b/crates/engine/src/kys.rs
index 8cbed9c425..1406e0a384 100644
--- a/crates/engine/src/kys.rs
+++ b/crates/engine/src/kys.rs
@@ -68,7 +68,7 @@ pub fn parse(text: &str) -> Result<KysSet, String> {
         return Err("not a keyboard shortcut set (.kys): larger than 4 MiB".into());
     }
     let text = text.trim_start_matches('\u{feff}');
-    let doc = roxmltree::Document::parse(text).map_err(|e| format!("not a keyboard shortcut set (.kys): {e}"))?;
+    let doc = photocraft_io::xml::parse(text, roxmltree::ParsingOptions::default()).map_err(|e| format!("not a keyboard shortcut set (.kys): {e}"))?;
     let root = doc.root_element();
     if root.tag_name().name() != "photoshop-keyboard-shortcuts" {
         return Err("not a keyboard shortcut set (.kys): no <photoshop-keyboard-shortcuts> root".into());
@@ -385,6 +385,15 @@ mod tests {
         assert_eq!(p.alternate_keys.get("image.levels"), Some(&Vec::new()));
     }
 
+    /// A set nested 20 000 deep overflowed the XML parser's recursion (an abort nothing can
+    /// catch); it is an error now. The small stack makes a regression abort instead of passing.
+    #[test]
+    fn deeply_nested_sets_are_an_error_not_a_stack_overflow() {
+        let xml = format!("<photoshop-keyboard-shortcuts>{}{}</photoshop-keyboard-shortcuts>", "<a>".repeat(20_000), "</a>".repeat(20_000));
+        let e = std::thread::Builder::new().stack_size(512 * 1024).spawn(move || parse(&xml).err()).unwrap().join().unwrap();
+        assert!(e.as_deref().is_some_and(|m| m.contains("nested")), "{e:?}");
+    }
+
     #[test]
     fn a_row_with_the_default_and_a_function_key_keeps_both() {
         let xml =
diff --git a/crates/engine/src/layer_place.rs b/crates/engine/src/layer_place.rs
new file mode 100644
index 0000000000..3cb9c1e854
--- /dev/null
+++ b/crates/engine/src/layer_place.rs
@@ -0,0 +1,113 @@
+//! Where a new layer goes, as in Photoshop. Above the active layer, or as the top layer inside the
+//! active group when that group is open (an artboard, open or closed, when the layer's content is
+//! on the board); with nothing active, at the top of the stack. A layer that lands inside a clipping mask joins it: it is clipped when the layer
+//! just above its slot is clipped, the rule Photoshop follows on every insert (#2203), so a new
+//! layer (or group) between a base and its clipped layers never becomes their (empty) base.
+//! Artboards are never nested or clipped: a new one goes to the top level.
+
+use photocraft_doc::{Document, Layer, LayerContent, LayerId, LayerPath, MAX_GROUP_DEPTH};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Place {
+    /// New Layer, New Group, new adjustment and fill layers: inside the anchor when it is an open
+    /// group (or an artboard the content is on), else directly above it. A locked group takes the
+    /// layer too, as in Photoshop (checked with Lock All): the layer is locked through it.
+    Auto,
+    /// [`Place::Auto`] for a layer that is edited right after it is made (Type, Shape, Place's
+    /// transform box, Paste, the Gradient tool's live gradient, video layers, Render and Vanishing
+    /// Point drawing, a new frame): never inside a group with a lock of its own (all, pixels,
+    /// transparency or position) that would refuse that edit; the layer goes above the group.
+    AutoEditable,
+    /// Directly above the anchor, never inside it: a layer made from another layer, or the second
+    /// and later of several new layers.
+    Above,
+    /// Directly below the anchor (⌘-click on the Layers panel's New Layer or New Group button). Never
+    /// under the Background, where it goes above instead.
+    Below,
+}
+
+/// The slot `layer` would take: its parent's path (empty for the root) and its index among the
+/// parent's children (bottom to top). A missing or stale `anchor` means the top of the stack.
+pub fn insertion_point(doc: &Document, anchor: Option<LayerId>, layer: &Layer, place: Place) -> (LayerPath, usize) {
+    let root_top = (Vec::new(), doc.layers.len());
+    let Some(path) = anchor.and_then(|a| doc.path_of(a)) else { return root_top };
+    // An artboard stays at the top level: beside the anchor's top-level layer.
+    let path = if layer.artboard().is_some() { path.get(..1).map(<[usize]>::to_vec).unwrap_or_default() } else { path };
+    let (Some((&k, parent)), Some(target)) = (path.split_last(), doc.layer_at(&path)) else { return root_top };
+    let locks = &target.locks;
+    let editable = !(locks.all || locks.pixels || locks.transparency || locks.position);
+    match place {
+        Place::Auto | Place::AutoEditable if takes_new_layers(target, path.len(), layer) && (place == Place::Auto || editable) => {
+            (path.clone(), target.children().map_or(0, <[Layer]>::len))
+        }
+        Place::Below if crate::background_cmds::background_id(doc) != Some(target.id) => (parent.to_vec(), k),
+        _ => (parent.to_vec(), k + 1),
+    }
+}
+
+/// Inserts `layer` at its [`insertion_point`], clipped when it lands inside a clipping mask (a
+/// flag it already has is kept unless nothing is below it to clip to; an artboard is never
+/// clipped); returns its id. Never fails: a slot that can't be reached puts
+/// the layer on top of the stack.
+pub fn insert_new(doc: &mut Document, anchor: Option<LayerId>, mut layer: Layer, place: Place) -> LayerId {
+    let id = layer.id;
+    let (parent, index) = insertion_point(doc, anchor, &layer, place);
+    let sib = if parent.is_empty() { Some(&mut doc.layers) } else { doc.layer_at_mut(&parent).and_then(Layer::children_mut) };
+    if let Some(sib) = sib {
+        let mut index = index.min(sib.len());
+        if layer.artboard().is_some() {
+            // Past the clipped layers above the slot, so their clipping mask stays whole.
+            while sib.get(index).is_some_and(|above| above.clipped) {
+                index += 1;
+            }
+            layer.clipped = false;
+        } else if sib.get(index).is_some_and(|above| above.clipped) {
+            layer.clipped = true;
+        } else if index == 0 {
+            // Nothing below to clip to (a copied clipped layer pasted into an empty group).
+            layer.clipped = false;
+        }
+        sib.insert(index, layer);
+    } else {
+        doc.layers.push(layer);
+    }
+    id
+}
+
+/// Does the group `target` at depth `depth` (its path length) take a new `layer` as its top
+/// child? An open group or an artboard does, locked or not (Photoshop puts a new layer inside a
+/// group locked with Lock All), unless nesting would pass [`MAX_GROUP_DEPTH`]. An artboard
+/// takes a layer with content only when that content is centred on the board, as callers place
+/// it for the canvas (Place, Paste, a Type or Shape click): elsewhere the board would clip it.
+fn takes_new_layers(target: &Layer, depth: usize, layer: &Layer) -> bool {
+    let LayerContent::Group(g) = &target.content else { return false };
+    let on_board = |rect: photocraft_geom::Rect| {
+        crate::layer_multi_cmds::layer_bounds(layer).is_none_or(|b| {
+            let (cx, cy) = (b.x0 / 2 + b.x1 / 2, b.y0 / 2 + b.y1 / 2);
+            rect.contains(cx, cy)
+        })
+    };
+    let open = match &g.artboard {
+        Some(board) => on_board(board.rect),
+        None => g.expanded,
+    };
+    open && layer.artboard().is_none() && depth + subtree_depth(layer) <= MAX_GROUP_DEPTH
+}
+
+/// Group nesting inside `layer` itself: 0 for a layer or an empty group, as
+/// [`Document::max_group_depth`] counts it. Explicit stack: pasted groups can be deep.
+fn subtree_depth(layer: &Layer) -> usize {
+    let mut max = 0;
+    let mut stack: Vec<(&Layer, usize)> = vec![(layer, 0)];
+    while let Some((l, depth)) = stack.pop() {
+        if let Some(children) = l.children().filter(|c| !c.is_empty()) {
+            max = max.max(depth + 1);
+            stack.extend(children.iter().map(|c| (c, depth + 1)));
+        }
+    }
+    max
+}
+
+#[cfg(test)]
+#[path = "layer_place_tests.rs"]
+mod tests;
diff --git a/crates/engine/src/layer_place_tests.rs b/crates/engine/src/layer_place_tests.rs
new file mode 100644
index 0000000000..5a84035426
--- /dev/null
+++ b/crates/engine/src/layer_place_tests.rs
@@ -0,0 +1,357 @@
+use photocraft_doc::{Document, Layer, LayerContent, LayerId, MAX_GROUP_DEPTH};
+use serde_json::{Value, json};
+
+use super::*;
+use crate::Session;
+
+/// Background, then `A` and `B` (`B` active).
+fn session() -> (Session, LayerId, LayerId) {
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 16, "height": 16})).unwrap();
+    let a = id(s.execute("layer.new.layer", json!({"name": "A"})).unwrap());
+    let b = id(s.execute("layer.new.layer", json!({"name": "B"})).unwrap());
+    (s, a, b)
+}
+
+fn id(v: Value) -> LayerId {
+    LayerId(v["layer"].as_u64().unwrap())
+}
+
+fn doc(s: &Session) -> &Document {
+    &s.active().unwrap().doc
+}
+
+fn top(s: &Session) -> Vec<LayerId> {
+    doc(s).layers.iter().map(|l| l.id).collect()
+}
+
+fn children(s: &Session, group: LayerId) -> Vec<LayerId> {
+    doc(s).layer(group).unwrap().children().unwrap().iter().map(|l| l.id).collect()
+}
+
+fn set_expanded(s: &mut Session, group: LayerId, expanded: bool) {
+    s.execute("layer.setExpanded", json!({"layer": group.0, "expanded": expanded})).unwrap();
+}
+
+fn select(s: &mut Session, layer: LayerId) {
+    s.execute("layer.select", json!({"layer": layer.0})).unwrap();
+}
+
+#[test]
+fn a_new_layer_goes_inside_an_open_active_group_and_above_a_closed_one() {
+    let (mut s, a, b) = session();
+    select(&mut s, a);
+    let g = id(s.execute("layer.groupLayers", json!({})).unwrap());
+    // A group made from layers starts closed: the new layer goes above it.
+    let above = id(s.execute("layer.new.layer", json!({})).unwrap());
+    assert_eq!(top(&s)[1..], [g, above, b]);
+    assert_eq!(children(&s, g), vec![a]);
+    // Opened, it takes the new layer as its top layer.
+    select(&mut s, g);
+    set_expanded(&mut s, g, true);
+    let inside = id(s.execute("layer.new.layer", json!({})).unwrap());
+    assert_eq!(children(&s, g), vec![a, inside]);
+    // A new empty group is open, so the next new layer goes into it (New Group, then New Layer).
+    s.execute("select.deselectLayers", json!({})).unwrap();
+    let empty = id(s.execute("layer.new.group", json!({})).unwrap());
+    let first = id(s.execute("layer.new.layer", json!({})).unwrap());
+    assert_eq!(children(&s, empty), vec![first]);
+    // The same goes for the other new layers: adjustment, fill, type and shape layers.
+    select(&mut s, empty);
+    for (cmd, p) in [
+        ("layer.newAdjustmentLayer.invert", json!({})),
+        ("layer.newFillLayer.solidColor", json!({"color": "#ff0000"})),
+        ("type.create", json!({"x": 2, "y": 10, "text": "Hi"})),
+        ("shape.create", json!({"kind": "rect", "rect": [1, 1, 5, 5]})),
+    ] {
+        select(&mut s, empty);
+        let l = id(s.execute(cmd, p).unwrap());
+        assert_eq!(children(&s, empty).last(), Some(&l), "{cmd} goes inside the open group");
+    }
+}
+
+#[test]
+fn artboards_and_locked_groups_take_new_layers() {
+    let (mut s, _, b) = session();
+    let board = id(s.execute("layer.new.artboard", json!({"rect": [0, 0, 16, 16]})).unwrap());
+    set_expanded(&mut s, board, false);
+    select(&mut s, board);
+    let l = id(s.execute("layer.new.layer", json!({})).unwrap());
+    assert_eq!(doc(&s).artboard_of(l), Some(board), "an artboard takes the layer even when closed");
+    // Photoshop puts a new layer inside an open group locked with Lock All too; the layer is
+    // locked through the group.
+    select(&mut s, b);
+    let g = id(s.execute("layer.new.group", json!({})).unwrap());
+    s.execute("layer.setProps", json!({"layer": g.0, "locks": {"all": true}})).unwrap();
+    select(&mut s, g);
+    let inside = id(s.execute("layer.new.layer", json!({})).unwrap());
+    assert_eq!(children(&s, g), vec![inside]);
+    assert!(doc(&s).effective_locks(inside).all);
+}
+
+#[test]
+fn below_puts_the_new_layer_under_the_active_layer() {
+    let (mut s, a, b) = session();
+    let bg = top(&s)[0];
+    let l = id(s.execute("layer.new.layer", json!({"position": "below"})).unwrap());
+    assert_eq!(top(&s), vec![bg, a, l, b]);
+    // Never under the Background, and never inside an open group.
+    select(&mut s, bg);
+    let l2 = id(s.execute("layer.new.layer", json!({"position": "below"})).unwrap());
+    assert_eq!(top(&s)[..2], [bg, l2]);
+    let g = id(s.execute("layer.new.group", json!({})).unwrap());
+    let l3 = id(s.execute("layer.new.layer", json!({"position": "below"})).unwrap());
+    assert!(children(&s, g).is_empty());
+    let root = top(&s);
+    assert_eq!(root.iter().position(|x| *x == l3).unwrap() + 1, root.iter().position(|x| *x == g).unwrap());
+    assert!(s.execute("layer.new.layer", json!({"position": "yes"})).is_err());
+}
+
+/// The clipping rule Photoshop follows on every insert (#2203): a new layer is clipped exactly
+/// when the layer just above its slot is clipped.
+#[test]
+fn a_new_layer_joins_the_clipping_mask_it_lands_in() {
+    let (mut s, base, c1) = session();
+    let c2 = id(s.execute("layer.new.layer", json!({"name": "C2"})).unwrap());
+    for c in [c1, c2] {
+        s.execute("layer.setProps", json!({"layer": c.0, "clipped": true})).unwrap();
+    }
+    let clipped = |s: &Session, l: LayerId| doc(s).layer(l).unwrap().clipped;
+    // On the base: between the base and its clipped layers.
+    select(&mut s, base);
+    let on_base = id(s.execute("layer.new.layer", json!({})).unwrap());
+    assert!(clipped(&s, on_base));
+    // In the middle of the chain.
+    select(&mut s, c1);
+    let mid = id(s.execute("layer.new.layer", json!({})).unwrap());
+    assert!(clipped(&s, mid));
+    // Above the top clipped layer it is outside the mask.
+    select(&mut s, c2);
+    let above = id(s.execute("layer.new.layer", json!({})).unwrap());
+    assert!(!clipped(&s, above));
+    // ⌘-click New Layer under a clipped layer joins it too; under the base it does not.
+    select(&mut s, c2);
+    let l = id(s.execute("layer.new.layer", json!({"position": "below"})).unwrap());
+    assert!(clipped(&s, l));
+    select(&mut s, base);
+    let l = id(s.execute("layer.new.layer", json!({"position": "below"})).unwrap());
+    assert!(!clipped(&s, l));
+    // A group joins as well (Photoshop clips groups too), and so do the other new layers.
+    select(&mut s, base);
+    let l = id(s.execute("layer.new.group", json!({})).unwrap());
+    assert!(clipped(&s, l));
+    select(&mut s, base);
+    let l = id(s.execute("layer.newAdjustmentLayer.invert", json!({})).unwrap());
+    assert!(clipped(&s, l));
+    // A layer made from a clipped layer (Layer via Copy) stays in its mask.
+    select(&mut s, c1);
+    s.execute("select.rect", json!({"x": 0, "y": 0, "width": 4, "height": 4})).unwrap();
+    s.execute("edit.fill", json!({"color": "#00ff00"})).unwrap();
+    let l = id(s.execute("layer.new.layerViaCopy", json!({})).unwrap());
+    assert!(clipped(&s, l));
+}
+
+#[test]
+fn a_pasted_layer_goes_into_an_open_group() {
+    let (mut s, a, _) = session();
+    // A whole pixel layer on the clipboard (no selection).
+    select(&mut s, a);
+    s.execute("edit.fill", json!({"color": "#00ff00"})).unwrap();
+    s.execute("edit.copy", json!({})).unwrap();
+    let into = id(s.execute("layer.new.group", json!({"name": "Into"})).unwrap());
+    let pasted = id(s.execute("edit.paste", json!({})).unwrap());
+    assert_eq!(children(&s, into), vec![pasted]);
+}
+
+/// The second and later of several new layers stack above the first, even when the first is an
+/// open group: it must not swallow them.
+#[test]
+fn later_layers_of_a_batch_go_above_the_first() {
+    let (s, _, b) = session();
+    let mut d = doc(&s).clone();
+    let first = insert_new(&mut d, Some(b), Layer::group("open", vec![]), Place::Auto);
+    let next = Layer::raster("next", d.pixel_format());
+    let second = insert_new(&mut d, Some(first), next, Place::Above);
+    let root: Vec<LayerId> = d.layers.iter().map(|l| l.id).collect();
+    assert_eq!(root[root.len() - 2..], [first, second]);
+    assert!(d.layer(first).unwrap().children().unwrap().is_empty());
+}
+
+#[test]
+fn nesting_stops_at_the_group_depth_limit() {
+    let mut doc = Document::new("deep", photocraft_doc::Size::new(8, 8), photocraft_color::ColorMode::Rgb, photocraft_color::SampleType::U8);
+    // A chain of open groups as deep as allowed, with a layer at the bottom.
+    let mut inner = Layer::raster("deep", doc.pixel_format());
+    let deep_id = inner.id;
+    let mut ids = Vec::new();
+    for i in 0..MAX_GROUP_DEPTH {
+        let g = Layer::group(format!("g{i}"), vec![inner]);
+        ids.push(g.id);
+        inner = g;
+    }
+    doc.layers.push(inner);
+    assert_eq!(doc.max_group_depth(), MAX_GROUP_DEPTH);
+    let innermost = *ids.first().unwrap();
+    // A plain layer fits beside `deep`, inside the innermost group (the depth stays the same)…
+    let layer = Layer::raster("fits", doc.pixel_format());
+    let l = insert_new(&mut doc, Some(innermost), layer, Place::Auto);
+    assert_eq!(doc.max_group_depth(), MAX_GROUP_DEPTH);
+    assert!(doc.layer(innermost).unwrap().children().unwrap().iter().any(|c| c.id == l));
+    // …but a group with a layer in it would go one deeper: it goes beside the group instead.
+    let nested = Layer::group("nested", vec![Layer::raster("x", doc.pixel_format())]);
+    let n = insert_new(&mut doc, Some(innermost), nested, Place::Auto);
+    assert_eq!(doc.max_group_depth(), MAX_GROUP_DEPTH);
+    assert!(!doc.layer(innermost).unwrap().children().unwrap().iter().any(|c| c.id == n));
+    assert!(doc.layer(deep_id).is_some());
+}
+
+#[test]
+fn a_missing_or_stale_anchor_means_the_top_of_the_stack() {
+    let (s, _, _) = session();
+    let mut d = doc(&s).clone();
+    for anchor in [None, Some(LayerId(u64::MAX))] {
+        for place in [Place::Auto, Place::Above, Place::Below] {
+            let layer = Layer::raster("x", d.pixel_format());
+            let l = insert_new(&mut d, anchor, layer, place);
+            assert_eq!(d.layers.last().map(|x| x.id), Some(l), "{anchor:?} {place:?}");
+        }
+    }
+    assert!(matches!(d.layers.last().unwrap().content, LayerContent::Raster(_)));
+}
+
+/// Any lock on an open group still lets New Layer, New Group and new adjustment and fill layers in,
+/// as in Photoshop (checked with Lock All). A layer that is edited right after it is made (Type,
+/// Shape, Paste, Render…) goes above a group whose lock would refuse that edit,
+/// so it never comes out locked.
+#[test]
+fn locked_groups_take_new_layers_but_not_the_ones_edited_at_once() {
+    for locks in [json!({"all": true}), json!({"pixels": true}), json!({"transparency": true}), json!({"position": true})] {
+        let (mut s, _, b) = session();
+        select(&mut s, b);
+        s.execute("edit.fill", json!({"color": "#00ff00"})).unwrap();
+        s.execute("select.all", json!({})).unwrap();
+        s.execute("edit.copy", json!({})).unwrap();
+        s.execute("select.deselect", json!({})).unwrap();
+        let g = id(s.execute("layer.new.group", json!({})).unwrap());
+        s.execute("layer.setProps", json!({"layer": g.0, "locks": locks})).unwrap();
+        for (cmd, p) in [
+            ("layer.new.layer", json!({})),
+            ("layer.new.group", json!({})),
+            ("layer.newAdjustmentLayer.invert", json!({})),
+            ("layer.newFillLayer.solidColor", json!({"color": "#ff0000"})),
+        ] {
+            select(&mut s, g);
+            let l = id(s.execute(cmd, p).unwrap());
+            assert_eq!(children(&s, g).last(), Some(&l), "{cmd} goes inside the group locked with {locks}");
+        }
+        for (cmd, p) in [
+            ("type.create", json!({"x": 2, "y": 10, "text": "Hi"})),
+            ("shape.create", json!({"kind": "rect", "rect": [1, 1, 5, 5]})),
+            ("edit.paste", json!({})),
+            ("filter.render.tree", json!({})),
+            ("gradient.fill.create", json!({"from": [0, 0], "to": [16, 16]})),
+        ] {
+            select(&mut s, g);
+            let l = id(s.execute(cmd, p).unwrap_or_else(|e| panic!("{cmd} with {locks}: {e}")));
+            assert!(!children(&s, g).contains(&l), "{cmd} stays out of the group locked with {locks}");
+            assert_eq!(top(&s).iter().position(|x| *x == l), top(&s).iter().position(|x| *x == g).map(|i| i + 1), "{cmd} directly above the group");
+            assert!(!doc(&s).effective_locks(l).any(), "{cmd}: the new layer is not locked");
+            if cmd == "filter.render.tree" {
+                assert!(doc(&s).layer(l).unwrap().surface().unwrap().tile_count() > 0, "Render drew the tree with {locks}");
+            }
+        }
+    }
+    // An open group inside a locked one still takes New Layer (the lock reaches it through the outer group).
+    let (mut s, _, b) = session();
+    select(&mut s, b);
+    let outer = id(s.execute("layer.new.group", json!({})).unwrap());
+    let inner = id(s.execute("layer.new.group", json!({})).unwrap());
+    assert_eq!(children(&s, outer), vec![inner]);
+    s.execute("layer.setProps", json!({"layer": outer.0, "locks": {"pixels": true}})).unwrap();
+    select(&mut s, inner);
+    let plain = id(s.execute("layer.new.layer", json!({})).unwrap());
+    assert_eq!(children(&s, inner), vec![plain]);
+}
+
+/// Stamp Visible goes directly above an open active group, never inside it: the stamp is the
+/// composite already, and inside it the group's opacity, mode or mask would apply to it again.
+/// With a layer inside a group active, it still lands above that layer, inside the group.
+#[test]
+fn stamp_visible_goes_above_an_open_group() {
+    let (mut s, a, b) = session();
+    select(&mut s, a);
+    s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+    let g = id(s.execute("layer.groupLayers", json!({})).unwrap());
+    set_expanded(&mut s, g, true);
+    s.execute("layer.setProps", json!({"layer": g.0, "opacity": 0.5})).unwrap();
+    select(&mut s, g);
+    let stamp = id(s.execute("layer.stampVisible", json!({})).unwrap());
+    assert_eq!(children(&s, g), vec![a], "the stamp stays out of the group");
+    assert_eq!(top(&s)[1..], [g, stamp, b]);
+    // A layer inside the group active: the stamp goes above it, inside the group.
+    select(&mut s, a);
+    let inside = id(s.execute("layer.stampVisible", json!({})).unwrap());
+    assert_eq!(children(&s, g), vec![a, inside]);
+}
+
+/// An artboard takes a new layer whose content is centred on it, and a new empty layer; content
+/// placed elsewhere (Place and Paste centre on the canvas) stays at the top level instead of
+/// being clipped away by the board.
+#[test]
+fn an_artboard_takes_only_content_that_is_on_it() {
+    let (mut s, _, _) = session();
+    let board = id(s.execute("layer.new.artboard", json!({"rect": [0, 0, 8, 8]})).unwrap());
+    let mut d = doc(&s).clone();
+    let raster = |d: &Document, r: photocraft_geom::Rect| {
+        let mut l = Layer::raster("content", d.pixel_format());
+        l.surface_mut().unwrap().fill_rect(r, &[1.0, 0.0, 0.0, 1.0]);
+        l
+    };
+    let on = raster(&d, photocraft_geom::Rect::new(1, 1, 5, 5));
+    let on = insert_new(&mut d, Some(board), on, Place::Auto);
+    assert_eq!(d.artboard_of(on), Some(board));
+    let off = raster(&d, photocraft_geom::Rect::new(10, 10, 16, 16));
+    let off = insert_new(&mut d, Some(board), off, Place::Auto);
+    assert_eq!(d.artboard_of(off), None);
+    let root: Vec<LayerId> = d.layers.iter().map(|l| l.id).collect();
+    assert_eq!(root.iter().position(|x| *x == off), root.iter().position(|x| *x == board).map(|i| i + 1));
+}
+
+/// An artboard is never nested or clipped: a copied board goes beside the anchor's top-level
+/// layer, even after a first copy went into a group, and never joins a clipping mask.
+#[test]
+fn artboards_stay_at_the_top_level_and_unclipped() {
+    let (mut s, a, b) = session();
+    let board = id(s.execute("layer.new.artboard", json!({"rect": [0, 0, 8, 8]})).unwrap());
+    s.execute("layer.setProps", json!({"layer": b.0, "clipped": true})).unwrap();
+    let mut d = doc(&s).clone();
+    let copy = d.layer(board).unwrap().duplicate();
+    // On a clipping base: at the top level above its clipping mask (B keeps A as its base), not
+    // clipped.
+    let c = insert_new(&mut d, Some(a), copy.duplicate(), Place::Auto);
+    let root: Vec<LayerId> = d.layers.iter().map(|l| l.id).collect();
+    let at = |id: LayerId| root.iter().position(|x| *x == id).unwrap();
+    assert_eq!((at(b), at(c)), (at(a) + 1, at(a) + 2));
+    assert!(!d.layer(c).unwrap().clipped);
+    // After a layer that went into an open group: beside the group, not inside it.
+    let g = insert_new(&mut d, Some(a), Layer::group("open", vec![]), Place::Above);
+    let first = Layer::raster("first", d.pixel_format());
+    let first = insert_new(&mut d, Some(g), first, Place::Auto);
+    assert!(d.layer(g).unwrap().children().unwrap().iter().any(|l| l.id == first));
+    let second = insert_new(&mut d, Some(first), copy, Place::Above);
+    assert!(d.layers.iter().any(|l| l.id == second), "the board is not nested in the group");
+    assert_eq!(d.artboards().len(), 3);
+}
+
+/// A copied clipped layer pasted into an empty group has nothing below it to clip to.
+#[test]
+fn a_clipped_layer_with_nothing_below_is_released() {
+    let (s, _, b) = session();
+    let mut d = doc(&s).clone();
+    let g = insert_new(&mut d, Some(b), Layer::group("empty", vec![]), Place::Auto);
+    let mut l = Layer::raster("was clipped", d.pixel_format());
+    l.clipped = true;
+    let l = insert_new(&mut d, Some(g), l, Place::Auto);
+    assert!(d.layer(g).unwrap().children().unwrap().iter().any(|c| c.id == l));
+    assert!(!d.layer(l).unwrap().clipped);
+}
diff --git a/crates/engine/src/layer_style.rs b/crates/engine/src/layer_style.rs
index 7d0e337d34..e1a7f3755c 100644
--- a/crates/engine/src/layer_style.rs
+++ b/crates/engine/src/layer_style.rs
@@ -610,248 +610,260 @@ fn overlay_gradient(g: &mut Gradient, p: &Value) {
 /// parameter units. Absent (or unparseable) keys leave the effect unchanged, so
 /// a dialog round trip never touches what it doesn't model: an imported
 /// gradient stroke keeps its gradient while its opacity is edited.
+fn overlay_color(p: &Value, k: &str, c: &mut Color) {
+    if let Some(x) = color_of(p, k) {
+        *c = x;
+    }
+}
+
+fn overlay_contour(p: &Value, key: &str, c: &mut Contour) {
+    if let Some(x) = p.get(key).and_then(contour_from_param) {
+        *c = x;
+    }
+}
+
+fn overlay_bool(p: &Value, key: &str, b: &mut bool) {
+    if let Some(x) = b_of(p, key) {
+        *b = x;
+    }
+}
+
+fn overlay_common(c: &mut FxCommon, p: &Value) {
+    if let Some(x) = b_of(p, "enabled") {
+        c.enabled = x;
+    }
+    if let Some(x) = p.get("blend").and_then(Value::as_str).and_then(blend_from_str) {
+        c.blend = x;
+    }
+    if let Some(x) = f_of(p, "opacity") {
+        c.opacity = (x / 100.0).clamp(0.0, 1.0);
+    }
+}
+
+fn overlay_shadow(s: &mut Shadow, p: &Value, inner: bool) {
+    overlay_common(&mut s.common, p);
+    overlay_color(p, "color", &mut s.color);
+    if let Some(x) = f_of(p, "angle") {
+        s.angle = x;
+    }
+    if let Some(x) = b_of(p, "useGlobalLight") {
+        s.use_global_light = x;
+    }
+    if let Some(x) = f_of(p, "distance") {
+        s.distance = x;
+    }
+    if let Some(x) = f_of(p, if inner { "choke" } else { "spread" }) {
+        s.spread = (x / 100.0).clamp(0.0, 1.0);
+    }
+    if let Some(x) = f_of(p, "size") {
+        s.size = x;
+    }
+    overlay_contour(p, "contour", &mut s.contour);
+    overlay_bool(p, "antiAlias", &mut s.anti_alias);
+    if let Some(x) = f_of(p, "noise") {
+        s.noise = (x / 100.0).clamp(0.0, 1.0);
+    }
+    if !inner && let Some(x) = b_of(p, "knocksOut") {
+        s.knocks_out = x;
+    }
+}
+
+fn overlay_glow(g: &mut Glow, p: &Value, inner: bool) {
+    overlay_common(&mut g.common, p);
+    if let Some(c) = color_of(p, "color") {
+        g.paint = FxPaint::Color(c);
+    }
+    if let Some(t) = p.get("technique").and_then(Value::as_str) {
+        g.technique = if t == "precise" { GlowTechnique::Precise } else { GlowTechnique::Softer };
+    }
+    if let Some(x) = f_of(p, if inner { "choke" } else { "spread" }) {
+        g.spread = (x / 100.0).clamp(0.0, 1.0);
+    }
+    if let Some(x) = f_of(p, "size") {
+        g.size = x;
+    }
+    overlay_contour(p, "contour", &mut g.contour);
+    overlay_bool(p, "antiAlias", &mut g.anti_alias);
+    if let Some(x) = f_of(p, "range") {
+        g.range = (x / 100.0).clamp(0.01, 1.0);
+    }
+    if let Some(x) = f_of(p, "noise") {
+        g.noise = (x / 100.0).clamp(0.0, 1.0);
+    }
+    if inner && let Some(s) = p.get("source").and_then(Value::as_str) {
+        g.source = if s == "center" { GlowSource::Center } else { GlowSource::Edge };
+    }
+}
+
+fn overlay_stroke(s: &mut StrokeFx, p: &Value) {
+    overlay_common(&mut s.common, p);
+    if let Some(x) = f_of(p, "size") {
+        s.size = x;
+    }
+    if let Some(pos) = p.get("position").and_then(Value::as_str) {
+        s.position = match pos {
+            "inside" => StrokePosition::Inside,
+            "center" => StrokePosition::Center,
+            _ => StrokePosition::Outside,
+        };
+    }
+    overlay_bool(p, "overprint", &mut s.overprint);
+    if p.get("from").is_some() {
+        s.paint = FxPaint::Gradient(gradient(p));
+    } else if let Some(c) = color_of(p, "color") {
+        s.paint = FxPaint::Color(c);
+    }
+}
+
+fn overlay_pattern(fx: &mut Effect, p: &Value) {
+    let Effect::PatternOverlay { common, name, id, scale, angle, link, phase } = fx else { return };
+    overlay_common(common, p);
+    if let Some(x) = p.get("pattern").and_then(Value::as_str) {
+        *name = x.to_string();
+        *id = String::new();
+    }
+    if let Some(x) = f_of(p, "scale") {
+        *scale = (x / 100.0).clamp(0.01, 10.0);
+    }
+    if let Some(x) = f_of(p, "angle") {
+        *angle = x;
+    }
+    if let Some(x) = b_of(p, "link") {
+        *link = x;
+    }
+    if let Some(x) = f_of(p, "phaseX") {
+        phase.0 = x;
+    }
+    if let Some(x) = f_of(p, "phaseY") {
+        phase.1 = x;
+    }
+}
+
+fn overlay_satin(s: &mut Satin, p: &Value) {
+    overlay_common(&mut s.common, p);
+    overlay_color(p, "color", &mut s.color);
+    if let Some(x) = f_of(p, "angle") {
+        s.angle = x;
+    }
+    if let Some(x) = f_of(p, "distance") {
+        s.distance = x;
+    }
+    if let Some(x) = f_of(p, "size") {
+        s.size = x;
+    }
+    if let Some(x) = b_of(p, "invert") {
+        s.invert = x;
+    }
+    overlay_contour(p, "contour", &mut s.contour);
+    overlay_bool(p, "antiAlias", &mut s.anti_alias);
+}
+
+fn overlay_bevel(bv: &mut Bevel, p: &Value) {
+    if let Some(x) = b_of(p, "enabled") {
+        bv.enabled = x;
+    }
+    if let Some(s) = p.get("style").and_then(Value::as_str) {
+        bv.style = match s {
+            "outer" => BevelStyle::OuterBevel,
+            "emboss" => BevelStyle::Emboss,
+            "pillow" => BevelStyle::PillowEmboss,
+            "stroke" => BevelStyle::StrokeEmboss,
+            _ => BevelStyle::InnerBevel,
+        };
+    }
+    if let Some(t) = p.get("technique").and_then(Value::as_str) {
+        bv.technique = match t {
+            "chiselHard" => BevelTechnique::ChiselHard,
+            "chiselSoft" => BevelTechnique::ChiselSoft,
+            _ => BevelTechnique::Smooth,
+        };
+    }
+    if let Some(x) = f_of(p, "depth") {
+        bv.depth = x / 100.0;
+    }
+    if let Some(d) = p.get("direction").and_then(Value::as_str) {
+        bv.up = d != "down";
+    }
+    if let Some(x) = f_of(p, "size") {
+        bv.size = x;
+    }
+    if let Some(x) = f_of(p, "soften") {
+        bv.soften = x;
+    }
+    if let Some(x) = f_of(p, "angle") {
+        bv.angle = x;
+    }
+    if let Some(x) = f_of(p, "altitude") {
+        bv.altitude = x;
+    }
+    if let Some(x) = b_of(p, "useGlobalLight") {
+        bv.use_global_light = x;
+    }
+    overlay_contour(p, "glossContour", &mut bv.gloss_contour);
+    overlay_bool(p, "glossAntiAlias", &mut bv.gloss_anti_alias);
+    if let Some(blend) = p.get("highlightBlend").and_then(Value::as_str).and_then(blend_from_str) {
+        bv.highlight.blend = blend;
+    }
+    if let Some(blend) = p.get("shadowBlend").and_then(Value::as_str).and_then(blend_from_str) {
+        bv.shadow.blend = blend;
+    }
+    overlay_color(p, "highlightColor", &mut bv.highlight_color);
+    overlay_color(p, "shadowColor", &mut bv.shadow_color);
+    if let Some(x) = f_of(p, "highlightOpacity") {
+        bv.highlight.opacity = (x / 100.0).clamp(0.0, 1.0);
+    }
+    if let Some(x) = f_of(p, "shadowOpacity") {
+        bv.shadow.opacity = (x / 100.0).clamp(0.0, 1.0);
+    }
+    match b_of(p, "contour") {
+        Some(false) => bv.contour = None,
+        Some(true) if bv.contour.is_none() => bv.contour = Some(photocraft_doc::BevelContour::default()),
+        _ => {}
+    }
+    if let Some(c) = &mut bv.contour {
+        overlay_contour(p, "contourName", &mut c.contour);
+        if let Some(x) = f_of(p, "contourRange") {
+            c.range = (x / 100.0).clamp(0.01, 1.0);
+        }
+        overlay_bool(p, "contourAntiAlias", &mut c.anti_alias);
+    }
+    if let Some(t) = p.get("texture").and_then(Value::as_str).filter(|t| !t.is_empty()) {
+        bv.texture = Some(photocraft_doc::BevelTexture {
+            name: t.to_string(),
+            id: t.to_string(),
+            scale: (f(p, "textureScale", 100.0) / 100.0).clamp(0.01, 10.0),
+            depth: (f(p, "textureDepth", 100.0) / 100.0).clamp(-10.0, 10.0),
+            invert: b(p, "textureInvert", false),
+            link: b(p, "textureLink", true),
+            phase: (0.0, 0.0),
+        });
+    }
+}
+
 pub fn overlay_effect(fx: &mut Effect, p: &Value) {
     if crate::commands::check_f32_values("layer.layerStyle", p).is_err() {
         return;
     }
-    fn set_color(p: &Value, k: &str, c: &mut Color) {
-        if let Some(x) = color_of(p, k) {
-            *c = x;
-        }
-    }
-    fn set_contour(p: &Value, key: &str, c: &mut Contour) {
-        if let Some(x) = p.get(key).and_then(contour_from_param) {
-            *c = x;
-        }
-    }
-    fn set_bool(p: &Value, key: &str, b: &mut bool) {
-        if let Some(x) = b_of(p, key) {
-            *b = x;
-        }
-    }
-    fn common(c: &mut FxCommon, p: &Value) {
-        if let Some(x) = b_of(p, "enabled") {
-            c.enabled = x;
-        }
-        if let Some(x) = p.get("blend").and_then(Value::as_str).and_then(blend_from_str) {
-            c.blend = x;
-        }
-        if let Some(x) = f_of(p, "opacity") {
-            c.opacity = (x / 100.0).clamp(0.0, 1.0);
-        }
-    }
-    let inner_shadow = matches!(fx, Effect::InnerShadow(_));
-    let inner_glow = matches!(fx, Effect::InnerGlow(_));
     match fx {
-        Effect::DropShadow(s) | Effect::InnerShadow(s) => {
-            let inner = inner_shadow;
-            common(&mut s.common, p);
-            set_color(p, "color", &mut s.color);
-            if let Some(x) = f_of(p, "angle") {
-                s.angle = x;
-            }
-            if let Some(x) = b_of(p, "useGlobalLight") {
-                s.use_global_light = x;
-            }
-            if let Some(x) = f_of(p, "distance") {
-                s.distance = x;
-            }
-            if let Some(x) = f_of(p, if inner { "choke" } else { "spread" }) {
-                s.spread = (x / 100.0).clamp(0.0, 1.0);
-            }
-            if let Some(x) = f_of(p, "size") {
-                s.size = x;
-            }
-            set_contour(p, "contour", &mut s.contour);
-            set_bool(p, "antiAlias", &mut s.anti_alias);
-            if let Some(x) = f_of(p, "noise") {
-                s.noise = (x / 100.0).clamp(0.0, 1.0);
-            }
-            if !inner && let Some(x) = b_of(p, "knocksOut") {
-                s.knocks_out = x;
-            }
+        Effect::DropShadow(s) => overlay_shadow(s, p, false),
+        Effect::InnerShadow(s) => overlay_shadow(s, p, true),
+        Effect::OuterGlow(g) => overlay_glow(g, p, false),
+        Effect::InnerGlow(g) => overlay_glow(g, p, true),
+        Effect::Stroke(s) => overlay_stroke(s, p),
+        Effect::ColorOverlay { common, color } => {
+            overlay_common(common, p);
+            overlay_color(p, "color", color);
         }
-        Effect::OuterGlow(g) | Effect::InnerGlow(g) => {
-            let inner = inner_glow;
-            common(&mut g.common, p);
-            if let Some(c) = color_of(p, "color") {
-                g.paint = FxPaint::Color(c);
-            }
-            if let Some(t) = p.get("technique").and_then(Value::as_str) {
-                g.technique = if t == "precise" { GlowTechnique::Precise } else { GlowTechnique::Softer };
-            }
-            if let Some(x) = f_of(p, if inner { "choke" } else { "spread" }) {
-                g.spread = (x / 100.0).clamp(0.0, 1.0);
-            }
-            if let Some(x) = f_of(p, "size") {
-                g.size = x;
-            }
-            set_contour(p, "contour", &mut g.contour);
-            set_bool(p, "antiAlias", &mut g.anti_alias);
-            if let Some(x) = f_of(p, "range") {
-                g.range = (x / 100.0).clamp(0.01, 1.0);
-            }
-            if let Some(x) = f_of(p, "noise") {
-                g.noise = (x / 100.0).clamp(0.0, 1.0);
-            }
-            if inner && let Some(s) = p.get("source").and_then(Value::as_str) {
-                g.source = if s == "center" { GlowSource::Center } else { GlowSource::Edge };
-            }
-        }
-        Effect::Stroke(s) => {
-            common(&mut s.common, p);
-            if let Some(x) = f_of(p, "size") {
-                s.size = x;
-            }
-            if let Some(pos) = p.get("position").and_then(Value::as_str) {
-                s.position = match pos {
-                    "inside" => StrokePosition::Inside,
-                    "center" => StrokePosition::Center,
-                    _ => StrokePosition::Outside,
-                };
-            }
-            set_bool(p, "overprint", &mut s.overprint);
-            if p.get("from").is_some() {
-                s.paint = FxPaint::Gradient(gradient(p));
-            } else if let Some(c) = color_of(p, "color") {
-                s.paint = FxPaint::Color(c);
-            }
-        }
-        Effect::ColorOverlay { common: c, color } => {
-            common(c, p);
-            set_color(p, "color", color);
-        }
-        Effect::GradientOverlay { common: c, gradient: g, dither, interpolation } => {
-            common(c, p);
-            gradient_overlay::overlay(g, interpolation, p);
+        Effect::GradientOverlay { common, gradient, dither, interpolation } => {
+            overlay_common(common, p);
+            gradient_overlay::overlay(gradient, interpolation, p);
             if let Some(x) = b_of(p, "dither") {
                 *dither = x;
             }
         }
-        Effect::PatternOverlay { common: c, name, id, scale, angle, link, phase } => {
-            common(c, p);
-            if let Some(x) = p.get("pattern").and_then(Value::as_str) {
-                *name = x.to_string();
-                *id = String::new();
-            }
-            if let Some(x) = f_of(p, "scale") {
-                *scale = (x / 100.0).clamp(0.01, 10.0);
-            }
-            if let Some(x) = f_of(p, "angle") {
-                *angle = x;
-            }
-            if let Some(x) = b_of(p, "link") {
-                *link = x;
-            }
-            if let Some(x) = f_of(p, "phaseX") {
-                phase.0 = x;
-            }
-            if let Some(x) = f_of(p, "phaseY") {
-                phase.1 = x;
-            }
-        }
-        Effect::Satin(s) => {
-            common(&mut s.common, p);
-            set_color(p, "color", &mut s.color);
-            if let Some(x) = f_of(p, "angle") {
-                s.angle = x;
-            }
-            if let Some(x) = f_of(p, "distance") {
-                s.distance = x;
-            }
-            if let Some(x) = f_of(p, "size") {
-                s.size = x;
-            }
-            if let Some(x) = b_of(p, "invert") {
-                s.invert = x;
-            }
-            set_contour(p, "contour", &mut s.contour);
-            set_bool(p, "antiAlias", &mut s.anti_alias);
-        }
-        Effect::BevelEmboss(bv) => {
-            if let Some(x) = b_of(p, "enabled") {
-                bv.enabled = x;
-            }
-            if let Some(s) = p.get("style").and_then(Value::as_str) {
-                bv.style = match s {
-                    "outer" => BevelStyle::OuterBevel,
-                    "emboss" => BevelStyle::Emboss,
-                    "pillow" => BevelStyle::PillowEmboss,
-                    "stroke" => BevelStyle::StrokeEmboss,
-                    _ => BevelStyle::InnerBevel,
-                };
-            }
-            if let Some(t) = p.get("technique").and_then(Value::as_str) {
-                bv.technique = match t {
-                    "chiselHard" => BevelTechnique::ChiselHard,
-                    "chiselSoft" => BevelTechnique::ChiselSoft,
-                    _ => BevelTechnique::Smooth,
-                };
-            }
-            if let Some(x) = f_of(p, "depth") {
-                bv.depth = x / 100.0;
-            }
-            if let Some(d) = p.get("direction").and_then(Value::as_str) {
-                bv.up = d != "down";
-            }
-            if let Some(x) = f_of(p, "size") {
-                bv.size = x;
-            }
-            if let Some(x) = f_of(p, "soften") {
-                bv.soften = x;
-            }
-            if let Some(x) = f_of(p, "angle") {
-                bv.angle = x;
-            }
-            if let Some(x) = f_of(p, "altitude") {
-                bv.altitude = x;
-            }
-            if let Some(x) = b_of(p, "useGlobalLight") {
-                bv.use_global_light = x;
-            }
-            set_contour(p, "glossContour", &mut bv.gloss_contour);
-            set_bool(p, "glossAntiAlias", &mut bv.gloss_anti_alias);
-            // Keep imported PSD shading settings when a command edits other bevel fields.
-            if let Some(blend) = p.get("highlightBlend").and_then(Value::as_str).and_then(blend_from_str) {
-                bv.highlight.blend = blend;
-            }
-            if let Some(blend) = p.get("shadowBlend").and_then(Value::as_str).and_then(blend_from_str) {
-                bv.shadow.blend = blend;
-            }
-            set_color(p, "highlightColor", &mut bv.highlight_color);
-            set_color(p, "shadowColor", &mut bv.shadow_color);
-            if let Some(x) = f_of(p, "highlightOpacity") {
-                bv.highlight.opacity = (x / 100.0).clamp(0.0, 1.0);
-            }
-            if let Some(x) = f_of(p, "shadowOpacity") {
-                bv.shadow.opacity = (x / 100.0).clamp(0.0, 1.0);
-            }
-            // The Contour element: `contour` turns it on/off; its curve, Range and
-            // Anti-aliased edit the element in place, so an imported curve survives.
-            match b_of(p, "contour") {
-                Some(false) => bv.contour = None,
-                Some(true) if bv.contour.is_none() => bv.contour = Some(photocraft_doc::BevelContour::default()),
-                _ => {}
-            }
-            if let Some(c) = &mut bv.contour {
-                set_contour(p, "contourName", &mut c.contour);
-                if let Some(x) = f_of(p, "contourRange") {
-                    c.range = (x / 100.0).clamp(0.01, 1.0);
-                }
-                set_bool(p, "contourAntiAlias", &mut c.anti_alias);
-            }
-            if let Some(t) = p.get("texture").and_then(Value::as_str).filter(|t| !t.is_empty()) {
-                bv.texture = Some(photocraft_doc::BevelTexture {
-                    name: t.to_string(),
-                    id: t.to_string(),
-                    scale: (f(p, "textureScale", 100.0) / 100.0).clamp(0.01, 10.0),
-                    depth: (f(p, "textureDepth", 100.0) / 100.0).clamp(-10.0, 10.0),
-                    invert: b(p, "textureInvert", false),
-                    link: b(p, "textureLink", true),
-                    phase: (0.0, 0.0),
-                });
-            }
-        }
+        Effect::PatternOverlay { .. } => overlay_pattern(fx, p),
+        Effect::Satin(s) => overlay_satin(s, p),
+        Effect::BevelEmboss(bv) => overlay_bevel(bv, p),
     }
 }
 
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 93e91922b6..c88ae3bfaf 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -18,12 +18,14 @@ pub mod display_color;
 pub mod doc_path;
 pub mod filters;
 pub mod filters_ext;
+mod group_options;
 pub mod guide_layout;
 pub mod hidden_target;
 pub mod inspect;
 pub mod installed_profiles;
 pub mod jobs;
 pub mod kys;
+pub mod layer_place;
 pub mod layer_style;
 pub mod link_watch;
 pub mod new_layer;
@@ -88,6 +90,7 @@ pub use cmd::file_cmds;
 pub use cmd::fill_cmds;
 pub use cmd::fill_key_cmds;
 pub use cmd::float_cmds;
+pub use cmd::font_library_cmds;
 use cmd::frame_cmds;
 pub use cmd::fx_view_cmds;
 pub use cmd::fx_visibility_cmds;
@@ -96,6 +99,7 @@ pub use cmd::gradient_fill_cmds;
 pub use cmd::group_view_cmds;
 pub use cmd::history_cmds;
 pub use cmd::history_menu_cmds;
+pub use cmd::history_options_cmds;
 pub use cmd::history_select_cmds;
 pub use cmd::history_source_cmds;
 pub use cmd::image_cmds;
@@ -160,9 +164,9 @@ pub use cmd::web_cmds;
 use cmd::wia_cmds;
 pub use doc_state::{CopiedStyle, DocState, PRECHECKED, ToolState};
 pub use error::{EngineError, Result};
-pub(crate) use session::fix_selection;
 pub use session::move_item;
 use session::restore_target;
+pub(crate) use session::{carry_visibility, fix_selection, visibility_changes};
 
 /// The pixels of a raster layer (typically one a command just created), as an error instead
 /// of a panic if the layer has none.
@@ -241,6 +245,9 @@ pub struct Session {
     /// A further route for File › Print when neither `lp` nor a CUPS server over IPP is
     /// reachable (the XDG Print portal in a Flatpak); see `print_cmds::Spooler`.
     pub print_spooler: Option<print_cmds::Spooler>,
+    /// The printers `file.printers`, `file.print.printers` and the Print dialog list in place of
+    /// the system's (tests); see `print_cmds::PrinterSource`. `None` asks the spooler.
+    pub printer_source: Option<print_cmds::PrinterSource>,
     /// Background jobs (see [`jobs`]).
     jobs: jobs::Jobs,
     /// Color Sampler points dropped by the last canvas-size change (crop, Canvas Size, Image Size,
diff --git a/crates/engine/src/new_layer.rs b/crates/engine/src/new_layer.rs
index cb1b151aba..4cba7f0c52 100644
--- a/crates/engine/src/new_layer.rs
+++ b/crates/engine/src/new_layer.rs
@@ -35,10 +35,12 @@ pub(crate) struct NewLayer {
     name: Option<String>,
 }
 
-/// `layer.new.layer`: a pixel layer above the active one (below it with `position: below`, the
-/// Layers panel's ⌘/Ctrl-click), joining the clip group it lands in.
+/// `layer.new.layer`: a pixel layer where Photoshop puts a new one ([`crate::layer_place`]: above
+/// the active layer, inside it when it is an open group, below it with `position: below`, the Layers
+/// panel's ⌘/Ctrl-click), joining the clip group it lands in.
 pub fn run(s: &mut Session, p: &Value) -> Result<Value> {
     let NewLayer { clip, mode, opacity, label, neutral, below, name } = parse(p)?;
+    let place = if below { crate::layer_place::Place::Below } else { crate::layer_place::Place::Auto };
     let id = s.edit("New Layer", |doc, active| {
         let name = name.clone().unwrap_or_else(|| doc.next_layer_name("Layer"));
         let mut layer = Layer::raster(name, doc.pixel_format());
@@ -51,11 +53,7 @@ pub fn run(s: &mut Session, p: &Value) -> Result<Value> {
             let px = photocraft_raster::from_rgba(&surface.format(), [rgb[0], rgb[1], rgb[2], 1.0]);
             surface.fill_rect(bounds, &px);
         }
-        // Nothing may sit under the Background: below it the layer lands above it instead.
-        let id = match *active {
-            Some(a) if below && doc.layer(a).is_some() && !doc.is_background(a) => doc.insert_below(Some(a), layer),
-            _ => doc.insert_above(*active, layer),
-        };
+        let id = crate::layer_place::insert_new(doc, *active, layer, place);
         crate::clip_group::settle(doc, &[id], &Default::default(), clip);
         *active = Some(id);
         Ok(id)
diff --git a/crates/engine/src/prefs.rs b/crates/engine/src/prefs.rs
index 24cba73d4d..38401ff468 100644
--- a/crates/engine/src/prefs.rs
+++ b/crates/engine/src/prefs.rs
@@ -12,8 +12,9 @@
 //! OS config directory; the web shell: browser storage) and restore it with
 //! [`Session::load_prefs_json`].
 //!
-//! Engine-side values are applied by [`Session::apply_prefs`]: the history state limit (every
-//! open document), the effect-cache memory budget, and units for commands that report lengths.
+//! Engine-side values are applied by [`Session::apply_prefs`]: the history state limit and
+//! History Options › Allow Non-Linear History (every open document), the effect-cache memory
+//! budget, and units for commands that report lengths.
 //! Colour settings (`colorSettings`) are stored with the colour state
 //! ([`crate::color_cmds::ColorSettings`]) and persisted in the same document.
 
@@ -869,6 +870,9 @@ pub struct TypePrefs {
     pub font_preview: FontPreview,
     pub fill_new_type_layers_with_placeholder: bool,
     pub recent_fonts: u32,
+    /// Favourite font families, starred in the font menu (`type.font.favorite`), in the order
+    /// they were added.
+    pub favorite_fonts: Vec<String>,
 }
 
 impl Default for TypePrefs {
@@ -882,6 +886,7 @@ impl Default for TypePrefs {
             font_preview: FontPreview::Medium,
             fill_new_type_layers_with_placeholder: true,
             recent_fonts: 10,
+            favorite_fonts: Vec::new(),
         }
     }
 }
@@ -998,6 +1003,24 @@ impl Default for Integrations {
     }
 }
 
+/// The History panel's History Options… (not part of Edit › Preferences in Photoshop either).
+/// Photoshop's snapshot options come with #3634.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(default, rename_all = "camelCase")]
+pub struct HistoryOptions {
+    /// Allow Non-Linear History: editing after selecting an earlier state keeps the later
+    /// states (the new step is appended at the end), and deleting a state deletes only it.
+    pub allow_non_linear_history: bool,
+    /// Make Layer Visibility Changes Undoable: showing or hiding a layer is a history state.
+    pub make_layer_visibility_changes_undoable: bool,
+}
+
+impl Default for HistoryOptions {
+    fn default() -> Self {
+        Self { allow_non_linear_history: false, make_layer_visibility_changes_undoable: true }
+    }
+}
+
 /// Edit › Menus: hidden items and item colours, by command id.
 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
 #[serde(default, rename_all = "camelCase")]
@@ -1083,6 +1106,8 @@ pub struct Preferences {
     pub enhanced_controls: EnhancedControls,
     pub raw_defaults: RawDefaults,
     pub integrations: Integrations,
+    /// History panel › History Options… (`history.options`).
+    pub history_options: HistoryOptions,
     /// Edit › Keyboard Shortcuts: command id → shortcut (`Cmd+Shift+N` notation); an empty
     /// string removes the default shortcut.
     pub shortcuts: BTreeMap<String, String>,
@@ -1221,9 +1246,15 @@ impl Preferences {
             self.shortcuts.clear();
             return Ok(());
         }
+        // The favourite fonts are the user's library, not a Type setting: resetting the Type
+        // section keeps them (only `type.favoriteFonts` itself, or Reset All, clears them).
+        let favorites = (path == "type").then(|| self.type_.favorite_fonts.clone());
         let mut root = self.to_json();
         set_path(&mut root, path, def)?;
         *self = serde_json::from_value(root).map_err(|e| e.to_string())?;
+        if let Some(favorites) = favorites {
+            self.type_.favorite_fonts = favorites;
+        }
         Ok(())
     }
 
@@ -1268,15 +1299,18 @@ impl Session {
         r
     }
 
-    /// Push engine-relevant preferences into live state: every document's history limit, the
-    /// transform and layer-effect cache budgets and the text engine's missing-glyph protection.
+    /// Push engine-relevant preferences into live state: every document's history limit and
+    /// linearity, the transform and layer-effect cache budgets and the text engine's
+    /// missing-glyph protection.
     pub fn apply_prefs(&mut self) {
         let n = self.prefs().performance.history_states.max(1) as usize;
         let bytes = self.prefs().performance.history_budget_bytes();
         let budget = self.prefs().performance.effect_cache_mb as usize;
+        let non_linear = self.prefs().history_options.allow_non_linear_history;
         for st in &mut self.docs {
             st.history.max_states = n;
             st.history.max_bytes = bytes;
+            st.history.non_linear = non_linear;
             st.trim_history();
         }
         photocraft_compose::set_effect_cache_budget(budget << 20);
diff --git a/crates/engine/src/prefs/cmds.rs b/crates/engine/src/prefs/cmds.rs
index b8f92356da..982bf209ab 100644
--- a/crates/engine/src/prefs/cmds.rs
+++ b/crates/engine/src/prefs/cmds.rs
@@ -1,6 +1,6 @@
 use super::customize::{keyboard_shortcuts, menus};
 use super::validate::{SECTIONS, get_path, keyed};
-use super::*;
+use super::{CommandSpec, EngineError, Map, Result, Session, ToolbarCustomization, Value, json};
 
 // ------------------------------------------------------------------ commands
 
diff --git a/crates/engine/src/prefs/customize.rs b/crates/engine/src/prefs/customize.rs
index e6d76723c8..bfad131ba1 100644
--- a/crates/engine/src/prefs/customize.rs
+++ b/crates/engine/src/prefs/customize.rs
@@ -1,7 +1,7 @@
 use super::cmds::bad;
 use super::files::{file_target, read_text_file, rename_path, writable, write_files_atomically};
 use super::shortcuts::{BindKind, alternate_keys, bindable, bindable_items, conflicts, default_alternates, is_tool, normalize_shortcut, reserved_shortcut};
-use super::*;
+use super::{MenuCustomization, Preferences, Result, Session, Value, json};
 
 /// Edit › Keyboard Shortcuts (engine part): list, change and reset application shortcuts.
 pub(super) fn keyboard_shortcuts(s: &mut Session, p: &Value) -> Result<Value> {
@@ -108,65 +108,7 @@ pub(super) fn keyboard_shortcuts(s: &mut Session, p: &Value) -> Result<Value> {
         None | Some(Value::Null) => &empty,
         Some(v) => v.as_object().ok_or_else(|| bad(cmd, "`alternates` maps command ids to lists of shortcuts"))?,
     };
-    if !set.is_empty() || !alts.is_empty() {
-        let allow_unknown = p.get("allowUnknown").and_then(Value::as_bool).unwrap_or(false);
-        changed = true;
-        // Reserved system keys can't be bound, by hand or from a file.
-        let reserved = |v: &Value| -> Option<String> {
-            let keys = match v {
-                Value::String(s) => vec![s.clone()],
-                other => alternate_keys(other).unwrap_or_default(),
-            };
-            keys.into_iter().find(|k| reserved_shortcut(k))
-        };
-        if let Some((id, k)) = set.iter().chain(alts.iter()).find_map(|(id, v)| reserved(v).map(|k| (id, k))) {
-            return Err(bad(cmd, format!("`{k}` (for `{id}`) is reserved by the system and can't be assigned")));
-        }
-        for (id, v) in set {
-            if !bindable().any(|(b, _)| b == id) && !allow_unknown {
-                return Err(bad(cmd, format!("unknown command `{id}`")));
-            }
-            next.set(&format!("shortcuts.{id}"), v.clone()).map_err(|e| bad(cmd, e))?;
-        }
-        for (id, v) in alts {
-            if !bindable().any(|(b, _)| b == id) && default_alternates(id).next().is_none() && !allow_unknown {
-                return Err(bad(cmd, format!("unknown command `{id}`")));
-            }
-            next.set(&format!("alternateShortcuts.{id}"), v.clone()).map_err(|e| bad(cmd, e))?;
-        }
-        // Like Photoshop, a shortcut moved to a new command is taken away from the old one,
-        // whether the old one held it as its main key or as an alternate (#3665).
-        if p.get("removeConflicts").and_then(Value::as_bool).unwrap_or(true) {
-            let assigned: Vec<(&str, String)> = set
-                .iter()
-                .filter_map(|(id, v)| Some((id.as_str(), v.as_str().and_then(normalize_shortcut)?)))
-                .chain(alts.iter().flat_map(|(id, v)| alternate_keys(v).unwrap_or_default().into_iter().map(move |k| (id.as_str(), k))))
-                .collect();
-            for (id, sc) in assigned {
-                for (c, def) in bindable() {
-                    // Tools may share a key: they cycle with Shift, as Photoshop's groups do.
-                    if is_tool(id) && is_tool(c) {
-                        continue;
-                    }
-                    // Never strip a command that this same call is assigning:
-                    // two entries for one key are a clash inside the call, which
-                    // the returned conflicts list reports (#719). Stripping
-                    // each other here unbound both silently.
-                    if c == id || set.contains_key(c) || alts.contains_key(c) {
-                        continue;
-                    }
-                    let main = next.shortcut(c, def).map(str::to_string);
-                    if main.as_deref().and_then(normalize_shortcut).as_deref() == Some(sc.as_str()) {
-                        next.shortcuts.insert(c.to_string(), String::new());
-                    }
-                    let held = next.alternates(c, main.as_deref());
-                    if held.contains(&sc) {
-                        next.alternate_shortcuts.insert(c.to_string(), held.into_iter().filter(|k| *k != sc).collect());
-                    }
-                }
-            }
-        }
-    }
+    changed |= apply_shortcut_changes(&mut next, p, set, alts, cmd)?;
     // Then the sets are saved, deleted or switched, from the bindings as they now stand.
     changed |= crate::shortcut_sets::store(&mut next, p).map_err(|e| bad(cmd, e))?;
     // The reply and the exports read the bindings as they will be; they are committed only once
@@ -262,6 +204,75 @@ pub(super) fn keyboard_shortcuts(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(out)
 }
 
+fn apply_shortcut_changes(
+    next: &mut Preferences,
+    p: &Value,
+    set: &serde_json::Map<String, Value>,
+    alts: &serde_json::Map<String, Value>,
+    cmd: &str,
+) -> Result<bool> {
+    if set.is_empty() && alts.is_empty() {
+        return Ok(false);
+    }
+    let allow_unknown = p.get("allowUnknown").and_then(Value::as_bool).unwrap_or(false);
+    // Reserved system keys can't be bound, by hand or from a file.
+    let reserved = |v: &Value| -> Option<String> {
+        let keys = match v {
+            Value::String(s) => vec![s.clone()],
+            other => alternate_keys(other).unwrap_or_default(),
+        };
+        keys.into_iter().find(|k| reserved_shortcut(k))
+    };
+    if let Some((id, k)) = set.iter().chain(alts.iter()).find_map(|(id, v)| reserved(v).map(|k| (id, k))) {
+        return Err(bad(cmd, format!("`{k}` (for `{id}`) is reserved by the system and can't be assigned")));
+    }
+    for (id, v) in set {
+        if !bindable().any(|(b, _)| b == id) && !allow_unknown {
+            return Err(bad(cmd, format!("unknown command `{id}`")));
+        }
+        next.set(&format!("shortcuts.{id}"), v.clone()).map_err(|e| bad(cmd, e))?;
+    }
+    for (id, v) in alts {
+        if !bindable().any(|(b, _)| b == id) && default_alternates(id).next().is_none() && !allow_unknown {
+            return Err(bad(cmd, format!("unknown command `{id}`")));
+        }
+        next.set(&format!("alternateShortcuts.{id}"), v.clone()).map_err(|e| bad(cmd, e))?;
+    }
+    // Like Photoshop, a shortcut moved to a new command is taken away from the old one,
+    // whether the old one held it as its main key or as an alternate (#3665).
+    if p.get("removeConflicts").and_then(Value::as_bool).unwrap_or(true) {
+        let assigned: Vec<(&str, String)> = set
+            .iter()
+            .filter_map(|(id, v)| Some((id.as_str(), v.as_str().and_then(normalize_shortcut)?)))
+            .chain(alts.iter().flat_map(|(id, v)| alternate_keys(v).unwrap_or_default().into_iter().map(move |k| (id.as_str(), k))))
+            .collect();
+        for (id, sc) in assigned {
+            for (c, def) in bindable() {
+                // Tools may share a key: they cycle with Shift, as Photoshop's groups do.
+                if is_tool(id) && is_tool(c) {
+                    continue;
+                }
+                // Never strip a command that this same call is assigning:
+                // two entries for one key are a clash inside the call, which
+                // the returned conflicts list reports (#719). Stripping
+                // each other here unbound both silently.
+                if c == id || set.contains_key(c) || alts.contains_key(c) {
+                    continue;
+                }
+                let main = next.shortcut(c, def).map(str::to_string);
+                if main.as_deref().and_then(normalize_shortcut).as_deref() == Some(sc.as_str()) {
+                    next.shortcuts.insert(c.to_string(), String::new());
+                }
+                let held = next.alternates(c, main.as_deref());
+                if held.contains(&sc) {
+                    next.alternate_shortcuts.insert(c.to_string(), held.into_iter().filter(|k| *k != sc).collect());
+                }
+            }
+        }
+    }
+    Ok(true)
+}
+
 /// Edit › Menus: hide/show items and give them colours.
 pub(super) fn menus(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = |k: &str| -> Vec<String> {
diff --git a/crates/engine/src/prefs/files.rs b/crates/engine/src/prefs/files.rs
index d24205228a..c58604e71d 100644
--- a/crates/engine/src/prefs/files.rs
+++ b/crates/engine/src/prefs/files.rs
@@ -1,5 +1,5 @@
 use super::cmds::bad;
-use super::*;
+use super::{Result, Value};
 
 /// An output parameter (`exportKys`, `summarize`): absent or false → `None`; true (or an object
 /// without `path`) → `Some(None)`, the text comes back in the reply; `{"path": …}` →
diff --git a/crates/engine/src/prefs/shortcuts.rs b/crates/engine/src/prefs/shortcuts.rs
index 47ba5a5f83..337c8e3754 100644
--- a/crates/engine/src/prefs/shortcuts.rs
+++ b/crates/engine/src/prefs/shortcuts.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{BTreeMap, Value};
 
 /// Most further keys one command may hold; Photoshop's own defaults use one.
 pub const MAX_ALTERNATES: usize = 8;
diff --git a/crates/engine/src/prefs/store.rs b/crates/engine/src/prefs/store.rs
index 2e0c3e7576..6ed7aa4a7c 100644
--- a/crates/engine/src/prefs/store.rs
+++ b/crates/engine/src/prefs/store.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Deserialize, Map, Preferences, Serialize, Value};
 
 // ------------------------------------------------------------------ store
 
diff --git a/crates/engine/src/prefs/validate.rs b/crates/engine/src/prefs/validate.rs
index af637f90d9..37d0fdf022 100644
--- a/crates/engine/src/prefs/validate.rs
+++ b/crates/engine/src/prefs/validate.rs
@@ -1,5 +1,10 @@
 use super::shortcuts::normalize_shortcut;
-use super::*;
+use super::{
+    AppearanceMode, Ask, CanvasBorder, CanvasColor, CheckerColors, CheckerSize, ColorPicker, DarkTheme, ExportLocation, ExportMetadata, FontPreview,
+    GpuBackend, Interpolation, LightTheme, LineStyle, LinuxDisplayServer, LogDestination, LogDetail, OtherCursor, PaintingCursor, PointSize, PressureCurve,
+    QuickExportFormat, RawColorSpace, RawDemosaic, RawDepth, RawSharpen, RenderingMode, RightClickPaint, TextEngine, Theme, TypeUnit, UiFontSize, UiScale,
+    Unit, Value,
+};
 
 /// Preferences dialog sections in Photoshop's order: (id, title).
 pub const SECTIONS: [(&str, &str); 18] = [
diff --git a/crates/engine/src/preset_store.rs b/crates/engine/src/preset_store.rs
index a065e48e6d..92ad78e5dd 100644
--- a/crates/engine/src/preset_store.rs
+++ b/crates/engine/src/preset_store.rs
@@ -254,7 +254,8 @@ pub fn encode_tip(t: &GrayTile) -> Vec<u8> {
     out.push(if eight { 8 } else { 16 });
     out.extend_from_slice(&t.width.to_le_bytes());
     out.extend_from_slice(&t.height.to_le_bytes());
-    let mut z = flate2::write::ZlibEncoder::new(out, flate2::Compression::fast());
+    // Level 3: zlib-rs level 1 writes static Huffman blocks only, 13-30% bigger than miniz's level 1.
+    let mut z = flate2::write::ZlibEncoder::new(out, flate2::Compression::new(3));
     let mut buf = Vec::with_capacity(8192);
     let mut ok = true;
     for chunk in t.data.chunks(4096) {
diff --git a/crates/engine/src/presets/gradients.rs b/crates/engine/src/presets/gradients.rs
index 4105ceb1c0..20cb95d95b 100644
--- a/crates/engine/src/presets/gradients.rs
+++ b/crates/engine/src/presets/gradients.rs
@@ -641,7 +641,8 @@ fn apply(s: &mut Session, p: &Value) -> Result<Value> {
     let reverse = p.get("reverse").and_then(Value::as_bool).unwrap_or(false);
     let id = s.edit("New Gradient Fill Layer", |doc, active| {
         let fill = Fill::gradient(stops, angle, scale, style, reverse).in_mode(doc.mode);
-        let id = doc.insert_above(*active, Layer::new(doc.next_layer_name("Gradient Fill"), LayerContent::Fill(fill)));
+        let layer = Layer::new(doc.next_layer_name("Gradient Fill"), LayerContent::Fill(fill));
+        let id = crate::layer_place::insert_new(doc, *active, layer, crate::layer_place::Place::Auto);
         *active = Some(id);
         Ok(id)
     })?;
diff --git a/crates/engine/src/session.rs b/crates/engine/src/session.rs
index 18eb3dc80a..d1f360e573 100644
--- a/crates/engine/src/session.rs
+++ b/crates/engine/src/session.rs
@@ -1,6 +1,9 @@
 use super::doc_state::DocState;
 use super::error::{EngineError, Result};
-use super::*;
+use super::{
+    Arc, Document, LayerId, LayerTarget, Session, Value, brush_cmds, channel_cmds, commands, hidden_target, jobs, layer_multi_cmds, retouch_cmds, smart_cmds,
+    type_cmds,
+};
 
 mod documents;
 mod execute;
@@ -8,4 +11,4 @@ mod history;
 mod layers;
 
 pub use documents::move_item;
-pub(crate) use history::{fix_selection, restore_target};
+pub(crate) use history::{carry_visibility, fix_selection, restore_target, visibility_changes};
diff --git a/crates/engine/src/session/documents.rs b/crates/engine/src/session/documents.rs
index ea20944fbc..1ae07b35a8 100644
--- a/crates/engine/src/session/documents.rs
+++ b/crates/engine/src/session/documents.rs
@@ -1,5 +1,5 @@
 use super::history::fix_selection;
-use super::*;
+use super::{DocState, Document, Session, channel_cmds, smart_cmds};
 
 /// Move item `i` of `v` to position `to`, clamped to the end. Returns where it went; `None` when
 /// `i` is out of range.
@@ -109,6 +109,7 @@ impl Session {
         let mut st = DocState::new(doc, path);
         st.history.max_states = self.prefs.get().performance.history_states.max(1) as usize;
         st.history.max_bytes = self.prefs.get().performance.history_budget_bytes();
+        st.history.non_linear = self.prefs.get().history_options.allow_non_linear_history;
         self.docs.push(st);
         let i = self.docs.len() - 1;
         self.active = Some(i);
diff --git a/crates/engine/src/session/execute.rs b/crates/engine/src/session/execute.rs
index c3822673bb..69c389f0c6 100644
--- a/crates/engine/src/session/execute.rs
+++ b/crates/engine/src/session/execute.rs
@@ -1,5 +1,8 @@
-use super::history::fix_selection;
-use super::*;
+use super::history::{fix_selection, visibility_changes};
+use super::{
+    Arc, Document, EngineError, LayerId, Result, Session, Value, brush_cmds, channel_cmds, commands, hidden_target, jobs, layer_multi_cmds, retouch_cmds,
+    smart_cmds,
+};
 
 impl Session {
     /// Run a command by id with JSON params. Returns a JSON result.
@@ -69,6 +72,12 @@ impl Session {
         if id == "layer.new.layer" {
             crate::new_layer::parse(params)?;
         }
+        if id == "layer.new.group" {
+            crate::group_options::below(id, params)?;
+        }
+        if id == "layer.new.group" || id == "layer.new.groupFromLayers" {
+            crate::group_options::GroupOptions::parse(id, params)?;
+        }
         // A command that takes `"layer"` (an id or a name, as it resolves it) fails on one the
         // document doesn't have.
         if spec.params.contains("\"layer\":id")
@@ -163,6 +172,25 @@ impl Session {
 
     /// Apply an undoable edit to the active document.
     pub fn edit<R>(&mut self, label: &str, f: impl FnOnce(&mut Document, &mut Option<LayerId>) -> Result<R>) -> Result<R> {
+        self.edit_with(label, true, f)
+    }
+
+    /// Apply a change of layer visibility (and nothing else): a history state when History
+    /// Options › Make Layer Visibility Changes Undoable is on (the default, as in Photoshop),
+    /// otherwise the document changes without one, so the History panel and Undo skip it.
+    pub fn edit_visibility<R>(&mut self, label: &str, f: impl FnOnce(&mut Document, &mut Option<LayerId>) -> Result<R>) -> Result<R> {
+        let record = self.visibility_undoable();
+        self.edit_with(label, record, f)
+    }
+
+    /// History Options › Make Layer Visibility Changes Undoable.
+    pub fn visibility_undoable(&self) -> bool {
+        self.prefs().history_options.make_layer_visibility_changes_undoable
+    }
+
+    /// [`Self::edit`], recording a history state only when `record` is set. An unrecorded change
+    /// still marks the document modified and leaves the redo states alone.
+    pub(crate) fn edit_with<R>(&mut self, label: &str, record: bool, f: impl FnOnce(&mut Document, &mut Option<LayerId>) -> Result<R>) -> Result<R> {
         // Every mutation path (linked-file refresh, transform, place) re-renders smart objects
         // through this entry; the requesting session's authority must reach those renders.
         let _authorization = crate::jobs::render_authorization_scope(self.authorize);
@@ -223,14 +251,20 @@ impl Session {
         let key = self.coalesce_request.clone();
         let st = self.active_mut().ok_or(EngineError::NoDocument)?;
         let layers = st.layer_target();
-        if key.is_none() || st.coalesce != key || !st.history.can_undo() {
+        if !record {
+            // Nothing to coalesce with: the next recorded step starts a state of its own.
+            st.coalesce = None;
+        } else if key.is_none() || st.coalesce != key || !st.history.can_undo() {
             st.history.set_current_layers(prior);
-            st.history.record(label, before, layers);
+            st.history.record(label, before.clone(), layers);
+            st.history.add_current_visibility(&visibility_changes(&before, &st.doc));
             st.trim_history();
+            st.coalesce = key;
         } else {
             st.history.set_current_layers(layers);
+            st.history.add_current_visibility(&visibility_changes(&before, &st.doc));
+            st.coalesce = key;
         }
-        st.coalesce = key;
         st.bump_revision(keep_clean);
         st.last_damage = damage;
         self.samplers_removed += samplers_removed;
diff --git a/crates/engine/src/session/history.rs b/crates/engine/src/session/history.rs
index 0d619f47e9..b6e81e64bc 100644
--- a/crates/engine/src/session/history.rs
+++ b/crates/engine/src/session/history.rs
@@ -1,5 +1,5 @@
 use super::documents::fix_active;
-use super::*;
+use super::{Arc, DocState, Document, LayerId, LayerTarget, Session, channel_cmds, layer_multi_cmds};
 
 impl Session {
     pub fn undo(&mut self) -> bool {
@@ -7,8 +7,11 @@ impl Session {
         if self.active_job().is_some() {
             return false;
         }
+        let keep_visibility = !self.visibility_undoable();
         let Some(st) = self.active_mut() else { return false };
         st.coalesce = None;
+        // The step being undone: the layers whose visibility it changed get it back.
+        let changed = st.history.current_visibility().to_vec();
         match st.history.undo(st.doc.clone()) {
             // Undo Clear History: the list comes back, the document is the same one. Not an
             // edit: keep a clean document clean (the revision still moves for the panels).
@@ -27,6 +30,9 @@ impl Session {
                 if d.name != st.doc.name {
                     Arc::make_mut(&mut d).name.clone_from(&st.doc.name);
                 }
+                if keep_visibility {
+                    carry_visibility(&st.doc, &mut d, &changed);
+                }
                 // Pixels this step can have touched, so the canvas recomposites only that
                 // (it recomposited everything before).
                 let damage = layer_multi_cmds::step_damage(&d, &st.doc);
@@ -45,6 +51,7 @@ impl Session {
         if self.active_job().is_some() {
             return false;
         }
+        let keep_visibility = !self.visibility_undoable();
         let Some(st) = self.active_mut() else { return false };
         st.coalesce = None;
         match st.history.redo(st.doc.clone()) {
@@ -52,6 +59,11 @@ impl Session {
                 if d.name != st.doc.name {
                     Arc::make_mut(&mut d).name.clone_from(&st.doc.name);
                 }
+                if keep_visibility {
+                    // The step being redone sets the visibility it changed again.
+                    let changed = st.history.current_visibility().to_vec();
+                    carry_visibility(&st.doc, &mut d, &changed);
+                }
                 let damage = layer_multi_cmds::step_damage(&st.doc, &d);
                 let before = std::mem::replace(&mut st.doc, d);
                 let keep_clean = st.keeps_clean(&before);
@@ -65,6 +77,79 @@ impl Session {
     }
 }
 
+impl Session {
+    /// Take back the step a compound command just recorded, after its later part failed: the
+    /// document before the command is current again, nothing is left to redo, and in non-linear
+    /// history the later states that step moved stay where they were (an undo would land on the
+    /// last of them). Falls back to Undo plus forgetting the redo states when the history
+    /// changed since that step. Returns whether a step was taken back.
+    pub fn rollback(&mut self) -> bool {
+        if self.active_job().is_some() {
+            return false;
+        }
+        let keep_visibility = !self.visibility_undoable();
+        let Some(st) = self.active_mut() else { return false };
+        st.coalesce = None;
+        // The step taken back (and the later states it moved, in non-linear history): the layers
+        // whose visibility it changed get it back, the unrecorded changes stay, as for Undo.
+        let changed = st.history.current_visibility().to_vec();
+        let Some((mut d, layers)) = st.history.rollback() else {
+            let undone = self.undo();
+            if undone && let Some(st) = self.active_mut() {
+                st.history.clear_redo();
+            }
+            return undone;
+        };
+        if d.name != st.doc.name {
+            Arc::make_mut(&mut d).name.clone_from(&st.doc.name);
+        }
+        if keep_visibility {
+            carry_visibility(&st.doc, &mut d, &changed);
+        }
+        let damage = layer_multi_cmds::step_damage(&d, &st.doc);
+        let before = std::mem::replace(&mut st.doc, d);
+        // Taking back a selection-only step keeps a clean document clean, as Undo does (#6865).
+        let keep_clean = st.keeps_clean(&before);
+        restore_target(st, layers);
+        st.bump_revision(keep_clean);
+        st.last_damage = damage;
+        true
+    }
+}
+
+/// History Options › Make Layer Visibility Changes Undoable off: showing or hiding a layer is not
+/// a history state, so stepping through history must not bring the old visibility back either
+/// (history states hold whole documents). Gives every layer of `to` that `from` also has the
+/// visibility it has in `from`, except the `stepped` layers: a recorded step between the two
+/// states changed their visibility (Apply Layer Comp, a snapshot, a visibility change recorded
+/// while the option was on), so they keep the visibility `to` holds. Layers only one of them has
+/// keep theirs. Copies `to` only when something differs.
+pub(crate) fn carry_visibility(from: &Document, to: &mut Arc<Document>, stepped: &[LayerId]) {
+    let visible: std::collections::HashMap<LayerId, bool> = from.walk().into_iter().map(|(_, _, l)| (l.id, l.visible)).collect();
+    let changes: Vec<(LayerId, bool)> = to
+        .walk()
+        .into_iter()
+        .filter(|(_, _, l)| !stepped.contains(&l.id))
+        .filter_map(|(_, _, l)| visible.get(&l.id).filter(|v| **v != l.visible).map(|v| (l.id, *v)))
+        .collect();
+    if changes.is_empty() {
+        return;
+    }
+    let d = Arc::make_mut(to);
+    for (id, v) in changes {
+        if let Some(l) = d.layer_mut(id) {
+            l.visible = v;
+        }
+    }
+}
+
+/// The layers (in both documents) whose visibility differs between `before` and `after`: what a
+/// recorded step changed, for [`photocraft_ops::History::add_current_visibility`].
+pub(crate) fn visibility_changes(before: &Document, after: &Document) -> Vec<LayerId> {
+    let visible: std::collections::HashMap<LayerId, bool> = before.walk().into_iter().map(|(_, _, l)| (l.id, l.visible)).collect();
+    after.walk().into_iter().filter(|(_, _, l)| visible.get(&l.id).is_some_and(|v| *v != l.visible)).map(|(_, _, l)| l.id).collect()
+}
+
 /// Undo / redo: target the layers the restored state targeted, as far as they still exist.
 pub(crate) fn restore_target(st: &mut DocState, layers: LayerTarget) {
     // Deselect Layers is a valid history target, not a missing layer to replace with the top
diff --git a/crates/engine/src/session/layers.rs b/crates/engine/src/session/layers.rs
index b6e5d1c688..b8ea5ea89d 100644
--- a/crates/engine/src/session/layers.rs
+++ b/crates/engine/src/session/layers.rs
@@ -1,5 +1,5 @@
 use super::history::fix_selection;
-use super::*;
+use super::{Arc, EngineError, LayerId, Result, Session, channel_cmds, type_cmds};
 
 impl Session {
     /// Replace the active document's active layer without creating a history step.
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 769fcefeb4..49b1797ff3 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -1185,7 +1185,8 @@ fn move_selected_layers_keeps_selected_group_children_and_supports_above_below()
     let b = s.execute("layer.new.layer", json!({"name": "B"})).unwrap()["layer"].as_u64().unwrap();
     let c = s.execute("layer.new.layer", json!({"name": "C"})).unwrap()["layer"].as_u64().unwrap();
     let group = s.execute("layer.new.group", json!({"name": "G"})).unwrap()["layer"].as_u64().unwrap();
-    // Made before B moves into G: a new group goes above the active layer, which would then be inside G.
+    // Made from C, not from G: like Photoshop a new group goes inside an open active group.
+    s.execute("layer.select", json!({"layer": c})).unwrap();
     let target = s.execute("layer.new.group", json!({"name": "Target"})).unwrap()["layer"].as_u64().unwrap();
     s.execute("layer.moveTo", json!({"layer": b, "target": group, "position": "into"})).unwrap();
 
diff --git a/crates/engine/tests/it/layer_range_panel_order.rs b/crates/engine/tests/it/layer_range_panel_order.rs
index d442d35198..86b4ad81c8 100644
--- a/crates/engine/tests/it/layer_range_panel_order.rs
+++ b/crates/engine/tests/it/layer_range_panel_order.rs
@@ -20,8 +20,10 @@ fn shift_range_follows_visible_rows_on_both_sides_of_an_expanded_group() {
     select(&mut s, b, "replace");
     select(&mut s, c, "add");
     let group = s.execute("layer.groupLayers", json!({})).unwrap()["layer"].as_u64().unwrap();
-    s.execute("layer.setExpanded", json!({"layer": group, "expanded": true})).unwrap();
+    // D goes above the closed group (an open one would take it inside, as in Photoshop).
     let d = s.execute("layer.new.layer", json!({"name": "D"})).unwrap()["layer"].as_u64().unwrap();
+    // Group Layers makes a collapsed group, as in Photoshop; open it so B and C are visible rows.
+    s.execute("layer.setExpanded", json!({"layer": group, "expanded": true})).unwrap();
 
     for (anchor, target, wanted) in
         [(d, group, vec![d, group]), (group, d, vec![d, group]), (group, b, vec![group, c, b]), (b, group, vec![group, c, b]), (c, b, vec![c, b])]
diff --git a/crates/engine/tests/panic_hunt.rs b/crates/engine/tests/panic_hunt.rs
index 91f42be306..c4d8359e18 100644
--- a/crates/engine/tests/panic_hunt.rs
+++ b/crates/engine/tests/panic_hunt.rs
@@ -13,6 +13,8 @@ fn fresh() -> Session {
     // Belt and braces with the EXTERNAL skip below: nothing in this process may reach a printer.
     photocraft_engine::print_cmds::disable_printing();
     let mut s = Session::new();
+    // `file.printers` and `file.print.printers` list no printers and do not ask the spooler.
+    s.printer_source = Some(std::sync::Arc::new(Vec::new));
     s.execute("file.new", json!({"width": 24, "height": 16})).unwrap();
     s.execute("layer.new.layer", json!({})).unwrap();
     s.execute("select.rect", json!({"x": 1, "y": 1, "width": 6, "height": 5})).unwrap();
diff --git a/crates/format/src/autosave.rs b/crates/format/src/autosave.rs
index c5ba725edc..7b379451dd 100644
--- a/crates/format/src/autosave.rs
+++ b/crates/format/src/autosave.rs
@@ -180,38 +180,52 @@ fn worker(rx: Receiver<Job>, bundle: PathBuf, sidecar: PathBuf, last: Arc<Mutex<
     }
 }
 
+/// Publish a recovery sidecar atomically: a flushed temporary file renamed over the old one.
+///
+/// The replacing step is a plain rename on every platform, never `ReplaceFileW` (what
+/// [`crate::atomic::RealFs`] uses on Windows to keep a user file's ACL and named streams). That
+/// call first moves the old file to a backup name and only then moves the new one in, so for a
+/// moment `<key>.json` does not exist: a listing in between took the entry for a sidecar-less
+/// bundle and listed it twice, or not at all (#9034). A rename swaps the name in one step, and
+/// recovery data is private to the app, so there is no metadata to keep.
 fn write_sidecar(path: &Path, bytes: &[u8]) -> Result<()> {
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::OpenOptionsExt;
-        struct PrivateFs;
-        impl crate::atomic::AtomicFs for PrivateFs {
-            fn write_new(&self, tmp: &Path, bytes: &[u8]) -> std::io::Result<()> {
+    struct SidecarFs;
+    impl crate::atomic::AtomicFs for SidecarFs {
+        // As before: Windows refuses a read-only sidecar up front, Unix replaces it.
+        #[cfg(not(unix))]
+        fn is_readonly(&self, path: &Path) -> bool {
+            crate::atomic::RealFs.is_readonly(path)
+        }
+        fn write_new(&self, tmp: &Path, bytes: &[u8]) -> std::io::Result<()> {
+            #[cfg(unix)]
+            {
                 use std::io::Write;
+                use std::os::unix::fs::OpenOptionsExt;
                 let mut f = std::fs::OpenOptions::new().write(true).create_new(true).mode(0o600).open(tmp)?;
                 f.write_all(bytes)?;
                 crate::atomic::sync_file(&f)
             }
-            fn rename(&self, from: &Path, to: &Path) -> std::io::Result<()> {
-                crate::atomic::RealFs.rename(from, to)
-            }
-            fn remove(&self, path: &Path) -> std::io::Result<()> {
-                crate::atomic::RealFs.remove(path)
-            }
-            fn sync_dir(&self, dir: &Path) -> std::io::Result<()> {
-                crate::atomic::RealFs.sync_dir(dir)
-            }
-            fn copy_metadata(&self, from: &Path, to: &Path) -> std::io::Result<()> {
-                crate::atomic::RealFs.copy_metadata(from, to)
+            #[cfg(not(unix))]
+            {
+                crate::atomic::RealFs.write_new(tmp, bytes)
             }
         }
-        crate::atomic::atomic_write_with(&PrivateFs, crate::atomic::RenameRetry::platform(), path, bytes)?;
-        Ok(())
-    }
-    #[cfg(not(unix))]
-    {
-        crate::store::write_atomic(path, bytes)
+        fn rename(&self, from: &Path, to: &Path) -> std::io::Result<()> {
+            crate::atomic::RealFs.rename(from, to)
+        }
+        // `replace_existing` keeps the trait's default: this same one-step rename.
+        fn remove(&self, path: &Path) -> std::io::Result<()> {
+            crate::atomic::RealFs.remove(path)
+        }
+        fn sync_dir(&self, dir: &Path) -> std::io::Result<()> {
+            crate::atomic::RealFs.sync_dir(dir)
+        }
+        fn copy_metadata(&self, from: &Path, to: &Path) -> std::io::Result<()> {
+            crate::atomic::RealFs.copy_metadata(from, to)
+        }
     }
+    crate::atomic::atomic_write_with(&SidecarFs, crate::atomic::RenameRetry::platform(), path, bytes)?;
+    Ok(())
 }
 
 fn read_sidecar_bounded(path: &Path, max: usize) -> Option<Vec<u8>> {
diff --git a/crates/format/src/convert.rs b/crates/format/src/convert.rs
index 65f06fd8e2..a093bd10e0 100644
--- a/crates/format/src/convert.rs
+++ b/crates/format/src/convert.rs
@@ -11,7 +11,10 @@ use photocraft_doc::{
 use photocraft_geom::{TILE_SIZE, TileCoord};
 use photocraft_raster::{Surface, Tile, decode_pixel, encode_pixel};
 
-use crate::manifest::*;
+use crate::manifest::{
+    ChannelM, CompAppearanceM, CompStateM, ContentM, DocM, EffectsM, FillCacheM, Hash, LayerCompM, LayerM, MaskM, MetadataM, NamedPathM, PatternM,
+    SmartSourceM, SurfaceM, TileRef,
+};
 use crate::{FormatError, Result};
 
 /// Deepest group nesting a bundle may hold — the one nesting limit every consumer of the layer
@@ -125,9 +128,12 @@ fn video_m(v: &photocraft_doc::VideoData, sink: &mut dyn Sink) -> crate::manifes
 fn layer_m(l: &Layer, sink: &mut dyn Sink) -> LayerM {
     let content = match &l.content {
         LayerContent::Raster(s) => ContentM::Raster { surface: surface_m(s, sink) },
-        LayerContent::Group(g) => {
-            ContentM::Group { children: g.children.iter().map(|c| layer_m(c, sink)).collect(), expanded: g.expanded, artboard: g.artboard.clone() }
-        }
+        LayerContent::Group(g) => ContentM::Group {
+            children: g.children.iter().map(|c| layer_m(c, sink)).collect(),
+            expanded: g.expanded,
+            artboard: g.artboard.clone(),
+            frame_stroke: g.frame_stroke.clone(),
+        },
         LayerContent::Adjustment(a) => ContentM::Adjustment { adjustment: a.clone() },
         LayerContent::Fill(f) => ContentM::Fill { fill: f.clone() },
         LayerContent::Text(t) => ContentM::Text {
@@ -449,7 +455,9 @@ impl Loader<'_> {
     fn layer_with(&mut self, m: &LayerM, children: Vec<Layer>) -> Result<Layer> {
         let content = match &m.content {
             ContentM::Raster { surface } => LayerContent::Raster(self.surface(surface)?),
-            ContentM::Group { expanded, artboard, .. } => LayerContent::Group(Group { artboard: artboard.clone(), children, expanded: *expanded }),
+            ContentM::Group { expanded, artboard, frame_stroke, .. } => {
+                LayerContent::Group(Group { artboard: artboard.clone(), children, expanded: *expanded, frame_stroke: frame_stroke.clone() })
+            }
             ContentM::Adjustment { adjustment } => LayerContent::Adjustment(adjustment.clone()),
             ContentM::Fill { fill } => LayerContent::Fill(fill.clone()),
             ContentM::Text { text, font_family, size_pt, color, transform, cache, psd_raw, runs, paragraphs, shape, orientation, antialias, warp } => {
diff --git a/crates/format/src/manifest.rs b/crates/format/src/manifest.rs
index 72192c79f6..0b1e08b706 100644
--- a/crates/format/src/manifest.rs
+++ b/crates/format/src/manifest.rs
@@ -259,6 +259,9 @@ pub enum ContentM {
         /// Artboard (Layer › New › Artboard).
         #[serde(default)]
         artboard: Option<photocraft_doc::Artboard>,
+        /// A Photoshop Frame's stroke, drawn along the group's vector mask.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        frame_stroke: Option<ShapeStroke>,
     },
     Adjustment {
         adjustment: Adjustment,
diff --git a/crates/format/src/store.rs b/crates/format/src/store.rs
index fb73819e32..97e285a573 100644
--- a/crates/format/src/store.rs
+++ b/crates/format/src/store.rs
@@ -64,6 +64,34 @@ fn png(img: &Rgba8Image) -> Result<Vec<u8>> {
     photocraft_codecs::encode(&image, photocraft_codecs::Format::Png, &Default::default()).map_err(|e| FormatError::Unsupported(format!("preview: {e}")))
 }
 
+fn previews(opts: &SaveOptions) -> Result<Vec<(&'static str, Vec<u8>)>> {
+    let (composite, thumbnail) = beside(
+        opts.thumbnail.is_some() && opts.composite.is_some(),
+        || opts.composite.as_ref().map(png).transpose(),
+        || opts.thumbnail.as_ref().map(png).transpose(),
+    );
+    let mut out = Vec::new();
+    if let Some(t) = thumbnail? {
+        out.push((THUMB, t));
+    }
+    if let Some(t) = composite? {
+        out.push((COMPOSITE, t));
+    }
+    Ok(out)
+}
+
+fn beside<A: Send, B>(parallel: bool, a: impl FnOnce() -> Result<A> + Send, b: impl FnOnce() -> B) -> (Result<A>, B) {
+    if !parallel || cfg!(target_arch = "wasm32") {
+        let a = a();
+        return (a, b());
+    }
+    std::thread::scope(|sc| {
+        let h = sc.spawn(a);
+        let b = b();
+        (h.join().unwrap_or_else(|_| Err(FormatError::Io(std::io::Error::other("preview worker panicked")))), b)
+    })
+}
+
 // ---------------------------------------------------------------------------
 // Sources
 // ---------------------------------------------------------------------------
@@ -481,7 +509,6 @@ struct FileSignature {
 struct Prepared {
     manifest: Vec<u8>,
     objects: BTreeMap<String, Object>,
-    previews: Vec<(&'static str, Vec<u8>)>,
     stats: SaveStats,
 }
 
@@ -882,13 +909,6 @@ impl PcraftWriter {
         convert::check_nesting(&doc.layers)?;
         let mut c = Collect { hash_cache: Some(&mut self.hash_cache), blob_hash_cache: Some(&mut self.blob_hash_cache), ..Default::default() };
         let document = convert::doc_m(doc, &mut c);
-        let mut previews = Vec::new();
-        if let Some(t) = &opts.thumbnail {
-            previews.push((THUMB, png(t)?));
-        }
-        if let Some(t) = &opts.composite {
-            previews.push((COMPOSITE, png(t)?));
-        }
         let manifest = Manifest {
             format_version: FORMAT_VERSION,
             generator: format!("photocraft-format {}", env!("CARGO_PKG_VERSION")),
@@ -912,23 +932,40 @@ impl PcraftWriter {
         for (h, b) in c.blobs {
             objects.insert(blob_path(&h), Object::Blob(b));
         }
-        Ok(Prepared { manifest, objects, previews, stats })
+        Ok(Prepared { manifest, objects, stats })
     }
 
     /// Save as a ZIP bundle in memory.
     pub fn save_zip(&mut self, doc: &Document, opts: &SaveOptions) -> Result<(Vec<u8>, SaveStats)> {
-        let p = self.prepare(doc, opts)?;
+        // Another thread encodes the previews while the document is collected and its new
+        // objects are compressed on all cores (zstd dominates a full save).
+        let (previews, prepared) = beside(
+            opts.thumbnail.is_some() || opts.composite.is_some(),
+            || previews(opts),
+            || -> Result<_> {
+                let p = self.prepare(doc, opts)?;
+                let todo: Vec<(&String, &Object)> = p.objects.iter().filter(|(path, _)| !self.compressed.contains_key(*path)).collect();
+                let fresh: HashMap<String, Arc<Vec<u8>>> = par_compress(&todo)?.into_iter().map(|(path, data)| (path.clone(), data)).collect();
+                Ok((p, fresh))
+            },
+        );
+        let (p, mut fresh) = prepared?;
+        let previews = previews?;
         let mut stats = p.stats;
-        let mut z = ZipWriter::new();
-        z.add(MANIFEST, &p.manifest)?;
-        for (name, data) in &p.previews {
-            z.add(name, data)?;
-        }
         let mut next = HashMap::with_capacity(p.objects.len());
         let mut cached_bytes = 0usize;
-        // New objects are compressed on all cores first (zstd dominates a full save).
-        let todo: Vec<(&String, &Object)> = p.objects.iter().filter(|(path, _)| !self.compressed.contains_key(*path)).collect();
-        let mut fresh: HashMap<&String, Arc<Vec<u8>>> = par_compress(&todo)?.into_iter().collect();
+        // The archive is sized for every entry up front (#7689): previews, then reused and fresh
+        // objects at their compressed sizes.
+        let entries =
+            std::iter::once((MANIFEST, p.manifest.len())).chain(previews.iter().map(|(name, data)| (*name, data.len()))).chain(p.objects.keys().map(|path| {
+                let size = self.compressed.get(path).or_else(|| fresh.get(path)).map_or(0, |data| data.len());
+                (path.as_str(), size)
+            }));
+        let mut z = ZipWriter::with_entries(entries)?;
+        z.add(MANIFEST, &p.manifest)?;
+        for (name, data) in &previews {
+            z.add(name, data)?;
+        }
         for (path, obj) in &p.objects {
             let (key, data) = match self.compressed.remove_entry(path) {
                 Some((key, data)) => {
@@ -976,6 +1013,7 @@ impl PcraftWriter {
             validate_bundle_file(dir, &dir.join(path))?;
         }
         let p = self.prepare(doc, opts)?;
+        let previews = previews(opts)?;
         let mut stats = p.stats;
         if self.verified_directory.as_ref().is_none_or(|cache| cache.directory != canonical_dir) {
             self.verified_directory = Some(DirectoryVerificationCache { directory: canonical_dir.clone(), ..Default::default() });
@@ -1035,7 +1073,7 @@ impl PcraftWriter {
                 }
             }
         }
-        for (name, data) in &p.previews {
+        for (name, data) in &previews {
             write_bundle_file(dir, &dir.join(name), data, fs)?;
         }
         // Pin all GC directories before removing stale previews or objects.
@@ -1062,7 +1100,7 @@ impl PcraftWriter {
         // Omitted previews belong to the previous manifest until the new one commits.
         // After commit, a locked leftover is only housekeeping, just like unused objects.
         for stale in [THUMB, COMPOSITE] {
-            if !p.previews.iter().any(|(n, _)| *n == stale) {
+            if !previews.iter().any(|(n, _)| *n == stale) {
                 let _ = remove_bundle_file(dir, &dir.join(stale), &gc);
             }
         }
@@ -1190,6 +1228,53 @@ fn compressed_cache_budget_limits_retained_capacity_without_changing_bytes() {
     assert!(writer.compressed.is_empty());
 }
 
+#[cfg(test)]
+#[test]
+fn previews_follow_the_manifest_with_the_bytes_of_a_serial_encode() {
+    use photocraft_doc::{Layer, LayerContent};
+    use photocraft_geom::Size;
+    use photocraft_raster::Surface;
+
+    let mut doc = Document::new("previews", Size::new(600, 3), photocraft_color::ColorMode::Rgb, SampleType::U8);
+    let mut surface = Surface::new(doc.pixel_format());
+    for x in 0..600 {
+        surface.write_pixel(x, 1, &[x as f32 / 600.0, 0.5, 0.25, 1.0]);
+    }
+    doc.layers.push(Layer::new("pixels", LayerContent::Raster(surface)));
+    let image = |w: u32, h: u32, k: u8| {
+        let mut i = Rgba8Image::new(w, h);
+        i.pixels.iter_mut().enumerate().for_each(|(j, p)| *p = (j as u8).wrapping_mul(k));
+        i
+    };
+    let (thumb, composite) = (image(4, 3, 7), image(9, 5, 13));
+    for (t, c) in [(true, true), (true, false), (false, true), (false, false)] {
+        let opts = SaveOptions { thumbnail: t.then(|| thumb.clone()), composite: c.then(|| composite.clone()) };
+        let (bytes, _) = PcraftWriter::new().save_zip(&doc, &opts).unwrap();
+        let zip = ZipReader::new(&bytes).unwrap();
+        let names: Vec<&str> = zip.entries.iter().map(|e| e.name.as_str()).collect();
+        let mut want = vec![MANIFEST];
+        want.extend(t.then_some(THUMB));
+        want.extend(c.then_some(COMPOSITE));
+        assert_eq!(names[..want.len()], want[..]);
+        assert!(names[want.len()..].iter().all(|n| n.starts_with("tiles/") || n.starts_with("blobs/")), "{names:?}");
+        for (name, img) in [(THUMB, opts.thumbnail.as_ref()), (COMPOSITE, opts.composite.as_ref())] {
+            assert_eq!(zip.read_by_name(name, usize::MAX).ok(), img.map(|i| png(i).unwrap()), "{name}");
+        }
+    }
+    let bad = SaveOptions { thumbnail: Some(Rgba8Image { width: 4, height: 3, pixels: vec![0; 5] }), composite: Some(composite.clone()) };
+    assert!(matches!(PcraftWriter::new().save_zip(&doc, &bad), Err(FormatError::Unsupported(m)) if m.starts_with("preview")));
+    let bad = SaveOptions { thumbnail: Some(thumb.clone()), composite: Some(Rgba8Image { width: 9, height: 5, pixels: vec![0; 5] }) };
+    assert!(matches!(PcraftWriter::new().save_zip(&doc, &bad), Err(FormatError::Unsupported(m)) if m.starts_with("preview")));
+
+    let dir = std::env::temp_dir().join(format!("pcraft-previews-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    let opts = SaveOptions { thumbnail: Some(thumb.clone()), composite: Some(composite.clone()) };
+    PcraftWriter::new().save_dir(&doc, &dir, &opts).unwrap();
+    assert_eq!(std::fs::read(dir.join(THUMB)).unwrap(), png(&thumb).unwrap());
+    assert_eq!(std::fs::read(dir.join(COMPOSITE)).unwrap(), png(&composite).unwrap());
+    std::fs::remove_dir_all(&dir).unwrap();
+}
+
 #[cfg(all(test, unix))]
 #[test]
 fn gc_pinned_directory_handles_resist_subdirectory_swap() {
diff --git a/crates/format/src/zip.rs b/crates/format/src/zip.rs
index 5057e52168..2452f87903 100644
--- a/crates/format/src/zip.rs
+++ b/crates/format/src/zip.rs
@@ -3,6 +3,7 @@
 //! unzipped and re-zipped by another tool still loads). No ZIP64, no
 //! encryption, no multi-disk archives.
 
+use std::borrow::Cow;
 use std::collections::HashMap;
 use std::io::Read;
 
@@ -31,18 +32,41 @@ impl Default for ZipWriter {
 }
 
 impl ZipWriter {
+    /// Creates an empty archive of STORE entries.
     pub fn new() -> Self {
         ZipWriter { out: Vec::new(), central: Vec::new(), count: 0 }
     }
 
+    /// Reserves the complete archive from its entry names and payload sizes.
+    pub(crate) fn with_entries<'a>(entries: impl IntoIterator<Item = (&'a str, usize)>) -> Result<Self, FormatError> {
+        let (size, directory) = entries.into_iter().try_fold((22usize, 0usize), |(size, directory), (name, bytes)| {
+            let directory = directory.checked_add(46 + name.len());
+            let size = size.checked_add(76).and_then(|n| n.checked_add(name.len())).and_then(|n| n.checked_add(name.len())).and_then(|n| n.checked_add(bytes));
+            size.zip(directory).ok_or_else(|| FormatError::Unsupported("zip size overflow".into()))
+        })?;
+        let mut writer = Self::new();
+        writer.out.try_reserve_exact(size).map_err(|_| FormatError::LimitExceeded("not enough memory for zip".into()))?;
+        writer.central.try_reserve_exact(directory).map_err(|_| FormatError::LimitExceeded("not enough memory for zip directory".into()))?;
+        Ok(writer)
+    }
+
+    /// Adds a STORE entry, rejecting names or data that exceed ZIP field limits.
+    /// The entry path has a 16-bit byte length, independent of filesystem limits.
     pub fn add(&mut self, name: &str, data: &[u8]) -> Result<(), FormatError> {
         if self.count == u16::MAX {
             return Err(FormatError::Unsupported("more than 65535 zip entries (ZIP64 not supported)".into()));
         }
         let size = u32::try_from(data.len()).map_err(|_| FormatError::Unsupported("zip entry over 4 GiB".into()))?;
         let offset = u32::try_from(self.out.len()).map_err(|_| FormatError::Unsupported("zip over 4 GiB".into()))?;
-        let crc = crc32(data);
         let name_b = name.as_bytes();
+        let name_len = u16::try_from(name_b.len()).map_err(|_| FormatError::Unsupported("zip entry path exceeds the 65535-byte format limit".into()))?;
+        let local_len = 30usize
+            .checked_add(name_b.len())
+            .and_then(|n| n.checked_add(data.len()))
+            .ok_or_else(|| FormatError::Unsupported("zip entry size overflow".into()))?;
+        self.out.try_reserve(local_len).map_err(|_| FormatError::LimitExceeded("not enough memory for zip entry".into()))?;
+        self.central.try_reserve(46 + name_b.len()).map_err(|_| FormatError::LimitExceeded("not enough memory for zip directory".into()))?;
+        let crc = crc32(data);
         // Local file header.
         let o = &mut self.out;
         o.extend_from_slice(&LOCAL_SIG.to_le_bytes());
@@ -54,7 +78,7 @@ impl ZipWriter {
         o.extend_from_slice(&crc.to_le_bytes());
         o.extend_from_slice(&size.to_le_bytes());
         o.extend_from_slice(&size.to_le_bytes());
-        o.extend_from_slice(&(name_b.len() as u16).to_le_bytes());
+        o.extend_from_slice(&name_len.to_le_bytes());
         o.extend_from_slice(&0u16.to_le_bytes());
         o.extend_from_slice(name_b);
         o.extend_from_slice(data);
@@ -70,7 +94,7 @@ impl ZipWriter {
         c.extend_from_slice(&crc.to_le_bytes());
         c.extend_from_slice(&size.to_le_bytes());
         c.extend_from_slice(&size.to_le_bytes());
-        c.extend_from_slice(&(name_b.len() as u16).to_le_bytes());
+        c.extend_from_slice(&name_len.to_le_bytes());
         c.extend_from_slice(&[0; 8]); // extra len, comment len, disk, internal attrs
         c.extend_from_slice(&0u32.to_le_bytes()); // external attrs
         c.extend_from_slice(&offset.to_le_bytes());
@@ -79,9 +103,11 @@ impl ZipWriter {
         Ok(())
     }
 
+    /// Appends the central directory and returns the complete archive.
     pub fn finish(mut self) -> Result<Vec<u8>, FormatError> {
         let cd_offset = u32::try_from(self.out.len()).map_err(|_| FormatError::Unsupported("zip over 4 GiB".into()))?;
-        let cd_size = self.central.len() as u32;
+        let cd_size = u32::try_from(self.central.len()).map_err(|_| FormatError::Unsupported("zip directory over 4 GiB".into()))?;
+        self.out.try_reserve(self.central.len().saturating_add(22)).map_err(|_| FormatError::LimitExceeded("not enough memory to finish zip".into()))?;
         self.out.extend_from_slice(&self.central);
         self.out.extend_from_slice(&EOCD_SIG.to_le_bytes());
         self.out.extend_from_slice(&[0; 4]); // disk numbers
@@ -112,7 +138,7 @@ pub struct ZipReader<'a> {
     pub entries: Vec<Entry>,
     /// Name -> index of the first entry with that name, so `find` is O(1)
     /// instead of a scan per lookup (a bundle reads one entry per tile).
-    by_name: HashMap<String, usize>,
+    by_name: HashMap<Cow<'a, str>, usize>,
 }
 
 fn u16_at(b: &[u8], o: usize) -> Result<u16, FormatError> {
@@ -123,6 +149,7 @@ fn u32_at(b: &[u8], o: usize) -> Result<u32, FormatError> {
 }
 
 impl<'a> ZipReader<'a> {
+    /// Checks ZIP record bounds and indexes the first entry for each name.
     pub fn new(bytes: &'a [u8]) -> Result<Self, FormatError> {
         if bytes.len() < 22 {
             return Err(FormatError::corrupt("not a zip archive (too short)"));
@@ -150,7 +177,8 @@ impl<'a> ZipReader<'a> {
         let cd_size = u32_at(bytes, eocd + 12)? as usize;
         let cd_off = u32_at(bytes, eocd + 16)? as usize;
         let cd_end = cd_off.checked_add(cd_size).filter(|end| *end <= eocd).ok_or_else(|| FormatError::corrupt("zip central directory out of range"))?;
-        let mut entries = Vec::with_capacity(count.min(bytes.len() / 46));
+        let mut entries = Vec::with_capacity(count.min(cd_size / 46));
+        let mut by_name = HashMap::with_capacity(entries.capacity());
         let mut p = cd_off;
         for _ in 0..count {
             let header_end = p.checked_add(46).filter(|end| *end <= cd_end).ok_or_else(|| FormatError::corrupt("truncated zip central directory entry"))?;
@@ -168,7 +196,7 @@ impl<'a> ZipReader<'a> {
             let local = u32_at(bytes, p + 42)? as usize;
             let name_end = header_end.checked_add(nlen).filter(|end| *end <= cd_end).ok_or_else(|| FormatError::corrupt("zip entry name out of range"))?;
             let name = bytes.get(header_end..name_end).ok_or_else(|| FormatError::corrupt("truncated zip name"))?;
-            let name = String::from_utf8_lossy(name).into_owned();
+            let name = String::from_utf8_lossy(name);
             if flags & 1 != 0 {
                 return Err(FormatError::Unsupported("encrypted zip entries".into()));
             }
@@ -194,14 +222,11 @@ impl<'a> ZipReader<'a> {
             if data_offset.checked_add(compressed).is_none_or(|end| end > bytes.len()) {
                 return Err(FormatError::corrupt(format!("zip entry `{name}` out of range")));
             }
-            entries.push(Entry { name, method, crc, compressed, uncompressed, data_offset });
+            // The index borrows valid UTF-8 names; duplicate names keep the first entry.
+            by_name.entry(name.clone()).or_insert(entries.len());
+            entries.push(Entry { name: name.into_owned(), method, crc, compressed, uncompressed, data_offset });
             p = entry_end;
         }
-        let mut by_name = HashMap::with_capacity(entries.len());
-        for (i, e) in entries.iter().enumerate() {
-            // Duplicate names: the first entry wins, as with a front-to-back scan.
-            by_name.entry(e.name.clone()).or_insert(i);
-        }
         Ok(ZipReader { bytes, entries, by_name })
     }
 
@@ -227,8 +252,9 @@ impl<'a> ZipReader<'a> {
                 // small forged archive must not reserve gigabytes up front, so the
                 // preallocation is capped (DEFLATE expands at most ~1032x).
                 let mut out = Vec::with_capacity(e.uncompressed.min(raw.len().saturating_mul(1032)).min(64 << 20));
-                flate2::read::DeflateDecoder::new(raw)
-                    .take((max as u64).saturating_add(1))
+                // One surplus byte proves a false size without expanding to the caller's larger budget.
+                flate2::bufread::DeflateDecoder::new(raw)
+                    .take((e.uncompressed as u64).saturating_add(1))
                     .read_to_end(&mut out)
                     .map_err(|err| FormatError::corrupt(format!("zip entry `{}`: {err}", e.name)))?;
                 out
@@ -261,6 +287,20 @@ mod tests {
         assert_eq!(crc32(b"123456789"), 0xCBF4_3926);
     }
 
+    /// ZIP entry paths have a format limit even when each component is short.
+    #[test]
+    fn entry_path_length_is_checked_before_writing() {
+        let mut writer = ZipWriter::new();
+        for name in ["dir/".repeat(16384), "é/".repeat(21846)] {
+            assert!(matches!(writer.add(&name, b"invalid"), Err(FormatError::Unsupported(_))));
+            assert!(writer.out.is_empty() && writer.central.is_empty());
+        }
+        let name = "dir/".repeat(16383) + "end";
+        writer.add(&name, b"valid").unwrap();
+        let bytes = writer.finish().unwrap();
+        assert_eq!(ZipReader::new(&bytes).unwrap().read_by_name(&name, 5).unwrap(), b"valid");
+    }
+
     #[test]
     fn roundtrip() {
         let mut w = ZipWriter::new();
@@ -274,6 +314,7 @@ mod tests {
         assert_eq!(r.read_by_name("dir/b.bin", 100).unwrap(), [0, 1, 2, 3]);
         assert!(r.read_by_name("empty", 0).unwrap().is_empty());
         assert!(matches!(r.read_by_name("a.txt", 3), Err(FormatError::LimitExceeded(_))));
+        assert!(r.by_name.keys().all(|name| matches!(name, Cow::Borrowed(_))));
     }
 
     fn archive_with_comment(comment: &[u8]) -> Vec<u8> {
@@ -379,6 +420,46 @@ mod tests {
         assert_eq!(r.read_by_name("b", 100).unwrap(), b"other");
     }
 
+    /// Reservation changes neither entry bytes nor final output, and avoids growth.
+    #[test]
+    fn whole_archive_reservation_preserves_output() {
+        let entries = [("层/é.png", &b"image"[..]), ("empty", &b""[..]), ("empty", &b"duplicate"[..])];
+        for entries in [&entries[..0], &entries[..]] {
+            let mut previous = ZipWriter::new();
+            let mut reserved = ZipWriter::with_entries(entries.iter().map(|(name, data)| (*name, data.len()))).unwrap();
+            let (capacity, directory) = (reserved.out.capacity(), reserved.central.capacity());
+            for (name, data) in entries {
+                previous.add(name, data).unwrap();
+                reserved.add(name, data).unwrap();
+            }
+            assert_eq!(reserved.central.capacity(), directory);
+            let bytes = reserved.finish().unwrap();
+            assert_eq!(bytes.capacity(), capacity);
+            assert_eq!(bytes, previous.finish().unwrap());
+        }
+        assert!(matches!(ZipWriter::with_entries([("x", usize::MAX)]), Err(FormatError::Unsupported(_))));
+        assert!(matches!(ZipWriter::with_entries([("x", isize::MAX as usize)]), Err(FormatError::LimitExceeded(_))));
+    }
+
+    /// Invalid UTF-8 names retain their lossy spelling and first-entry lookup.
+    #[test]
+    fn name_index_borrows_unicode_and_owns_lossy_names() {
+        let mut writer = ZipWriter::new();
+        for name in ["层/é.png", "a", "b"] {
+            writer.add(name, name.as_bytes()).unwrap();
+        }
+        let mut bytes = writer.finish().unwrap();
+        let mut p = u32_at(&bytes, bytes.len() - 6).unwrap() as usize;
+        p += 46 + "层/é.png".len();
+        bytes[p + 46] = 0xff;
+        bytes[p + 47 + 46] = 0xfe;
+        let reader = ZipReader::new(&bytes).unwrap();
+        assert_eq!(reader.read_by_name("层/é.png", 100).unwrap(), "层/é.png".as_bytes());
+        assert!(matches!(reader.by_name.get_key_value("层/é.png").unwrap().0, Cow::Borrowed(_)));
+        assert!(matches!(reader.by_name.get_key_value("�").unwrap().0, Cow::Owned(_)));
+        assert_eq!(reader.read_by_name("�", 1).unwrap(), b"a");
+    }
+
     #[test]
     fn crc_mismatch_detected() {
         let mut w = ZipWriter::new();
@@ -390,9 +471,63 @@ mod tests {
         assert!(r.read_by_name("a", 100).is_err());
     }
 
-    /// A valid DEFLATE-compressed bundle may be read with an effectively
-    /// unlimited caller budget (e.g. corruption/round-trip checks). On 64-bit
-    /// targets `usize::MAX as u64 + 1` overflows, so the decoder must saturate.
+    #[test]
+    fn slice_deflate_matches_buffered_reader_and_preserves_checks() {
+        use std::io::Write as _;
+
+        let content = b"PhotoCraft ZIP payload".repeat(5000);
+        let mut encoder = flate2::write::DeflateEncoder::new(Vec::new(), flate2::Compression::none());
+        encoder.write_all(&content).unwrap();
+        let compressed = encoder.finish().unwrap();
+        assert!(compressed.len() > 32 * 1024);
+        let mut previous = Vec::new();
+        flate2::read::DeflateDecoder::new(compressed.as_slice()).read_to_end(&mut previous).unwrap();
+        let mut writer = ZipWriter::new();
+        writer.add("payload", &compressed).unwrap();
+        let bytes = writer.finish().unwrap();
+        let reader = ZipReader::new(&bytes).unwrap();
+        let mut entry = reader.entries[0].clone();
+        entry.method = 8;
+        entry.uncompressed = content.len();
+        entry.crc = crc32(&content);
+        assert_eq!(reader.read(&entry, content.len()).unwrap(), previous);
+        assert!(matches!(reader.read(&entry, content.len() - 1), Err(FormatError::LimitExceeded(_))));
+        entry.crc ^= 1;
+        assert!(matches!(reader.read(&entry, content.len()), Err(FormatError::Corrupt(_))));
+        entry.crc ^= 1;
+        entry.compressed /= 2;
+        assert!(matches!(reader.read(&entry, content.len()), Err(FormatError::Corrupt(_))));
+    }
+
+    /// A false small size must stop expansion before decoding the rest of the stream.
+    #[test]
+    fn deflate_surplus_stops_before_a_corrupt_suffix() {
+        // Exceed miniz's internal 32 KiB output buffer before the corrupt block.
+        let raw = [&[0, 0xff, 0xff, 0, 0][..], &[b'x'; 65535], &[7]].concat();
+        let reader = ZipReader { bytes: &raw, entries: Vec::new(), by_name: HashMap::new() };
+        for declared in [0, 7] {
+            let entry = Entry { name: "surplus".into(), method: 8, crc: 0, compressed: raw.len(), uncompressed: declared, data_offset: 0 };
+            let err = reader.read(&entry, usize::MAX).unwrap_err();
+            assert!(err.to_string().contains("wrong size"), "{err}");
+        }
+    }
+
+    /// Correct output length and CRC do not replace the final DEFLATE block.
+    #[test]
+    fn deflate_requires_a_complete_stream_including_empty_entries() {
+        for (raw, content) in [(&[0, 1, 0, 0xfe, 0xff, b'x', 1, 0, 0, 0xff, 0xff][..], &b"x"[..]), (&[3, 0][..], &b""[..])] {
+            let reader = ZipReader { bytes: raw, entries: Vec::new(), by_name: HashMap::new() };
+            let mut entry =
+                Entry { name: "complete".into(), method: 8, crc: crc32(content), compressed: raw.len(), uncompressed: content.len(), data_offset: 0 };
+            assert_eq!(reader.read(&entry, content.len()).unwrap(), content);
+            for cut in 0..raw.len() {
+                entry.compressed = cut;
+                assert!(matches!(reader.read(&entry, content.len()), Err(FormatError::Corrupt(_))), "cut at {cut}");
+            }
+        }
+    }
+
+    /// An unlimited caller budget still checks a DEFLATE entry's declared size.
     #[test]
     fn deflated_entry_with_unbounded_limit_round_trips() {
         use std::io::Write as _;
diff --git a/crates/format/tests/it/autosave.rs b/crates/format/tests/it/autosave.rs
index 24d61d50d3..26be1c9d76 100644
--- a/crates/format/tests/it/autosave.rs
+++ b/crates/format/tests/it/autosave.rs
@@ -304,3 +304,54 @@ fn failed_cleanup_after_commit_does_not_fail_the_save() {
     assert_eq!(load_path(&dir).unwrap(), doc);
     std::fs::remove_dir_all(dir.parent().unwrap()).unwrap();
 }
+
+/// #9034: while a document's autosave replaces its entry, a listing (another launch's recovery
+/// prompt, or the launch's own check after closing a second document) sees that entry exactly
+/// once. On Windows the sidecar used to be replaced through `ReplaceFileW`, which moves the old
+/// sidecar to a backup name before moving the new one in: a listing in between found the bundle
+/// without a sidecar and listed it a second time (or, the other way round, not at all).
+#[test]
+fn a_listing_during_an_autosave_sees_the_entry_exactly_once() {
+    let dir = temp_dir("listing-during-autosave");
+    let doc = Document::new("Busy", photocraft_doc::Size { width: 4, height: 4 }, ColorMode::Rgb, SampleType::U8);
+    save_once(&dir, "busy", doc.clone());
+    let done = Arc::new(std::sync::atomic::AtomicBool::new(false));
+    let writer = {
+        let (dir, done) = (dir.clone(), done.clone());
+        std::thread::spawn(move || {
+            // Sets `done` however the thread ends, so a failing writer stops the listing loop
+            // and `join` reports its panic instead of the test hanging.
+            struct SetOnDrop(Arc<std::sync::atomic::AtomicBool>);
+            impl Drop for SetOnDrop {
+                fn drop(&mut self) {
+                    self.0.store(true, std::sync::atomic::Ordering::SeqCst);
+                }
+            }
+            let _done = SetOnDrop(done);
+            let saver = Autosaver::new(&dir, "busy");
+            for revision in 2..=200 {
+                saver.request(Arc::new(doc.clone()), revision, None, SaveOptions::default());
+                // Wait for this write, so every revision replaces the sidecar once.
+                let completed = loop {
+                    let completed = saver.take_completed();
+                    if !completed.is_empty() {
+                        break completed;
+                    }
+                    std::thread::yield_now();
+                };
+                assert!(completed.iter().all(|(_, result)| result.is_ok()), "revision {revision}: {completed:?}");
+            }
+            saver.flush()
+        })
+    };
+    let mut listings = 0u32;
+    while !done.load(std::sync::atomic::Ordering::SeqCst) {
+        let entries = list_recovery(&dir);
+        let keys: Vec<&str> = entries.iter().map(|e| e.info.key.as_str()).collect();
+        assert_eq!(keys, ["busy"], "listing {listings} during an autosave: {entries:?}");
+        listings += 1;
+    }
+    assert!(writer.join().unwrap().is_some_and(|r| r.is_ok()));
+    assert!(listings > 0);
+    std::fs::remove_dir_all(dir).unwrap();
+}
diff --git a/crates/format/tests/it/frame_stroke.rs b/crates/format/tests/it/frame_stroke.rs
new file mode 100644
index 0000000000..89567ee7f0
--- /dev/null
+++ b/crates/format/tests/it/frame_stroke.rs
@@ -0,0 +1,37 @@
+//! A Photoshop Frame's stroke (`Group::frame_stroke`) survives a `.pcraft` round trip; older
+//! manifests, written before it existed, load without one (#4381).
+
+use photocraft_color::{Color, ColorMode, SampleType};
+use photocraft_doc::{Document, Fill, Layer, LayerContent, ShapeStroke, Size, StrokeAlign};
+use photocraft_format::*;
+
+fn stroke_of(d: &Document) -> Option<ShapeStroke> {
+    match &d.layers.first()?.content {
+        LayerContent::Group(g) => g.frame_stroke.clone(),
+        _ => None,
+    }
+}
+
+#[test]
+fn frame_stroke_roundtrips_and_defaults_when_absent() {
+    let mut doc = Document::new("a", Size::new(40, 30), ColorMode::Rgb, SampleType::U8);
+    let stroke =
+        ShapeStroke { width: 8.0, align: StrokeAlign::Inside, paint: Fill::Solid(Color::rgb(1.0, 0.0, 0.0)), dashes: vec![2.0, 1.0], ..ShapeStroke::default() };
+    let mut g = Layer::group("Frame 1", vec![]);
+    if let LayerContent::Group(gr) = &mut g.content {
+        gr.frame_stroke = Some(stroke.clone());
+    }
+    doc.layers.push(g);
+    let bytes = save_to_bytes(&doc, &SaveOptions::default()).unwrap();
+    assert_eq!(stroke_of(&load_from_bytes(&bytes).unwrap()), Some(stroke));
+
+    // A manifest without the key (older files) loads with no stroke.
+    let m = read_manifest(&bytes).unwrap();
+    let mut v = serde_json::to_value(&m.document).unwrap();
+    let content = &mut v["layers"][0]["content"];
+    assert!(content.get("frame_stroke").is_some());
+    content.as_object_mut().unwrap().remove("frame_stroke");
+    let old: photocraft_format::manifest::DocM = serde_json::from_value(v).unwrap();
+    let photocraft_format::manifest::ContentM::Group { frame_stroke, .. } = &old.layers[0].content else { panic!("not a group") };
+    assert!(frame_stroke.is_none());
+}
diff --git a/crates/format/tests/it/main.rs b/crates/format/tests/it/main.rs
index 6c822f4282..71eae66ddd 100644
--- a/crates/format/tests/it/main.rs
+++ b/crates/format/tests/it/main.rs
@@ -6,6 +6,7 @@ mod common;
 mod corruption;
 mod directory_symlinks;
 mod float_roundtrip;
+mod frame_stroke;
 mod layer_labels;
 mod roundtrip;
 mod smart_contents;
diff --git a/crates/format/tests/it/roundtrip.rs b/crates/format/tests/it/roundtrip.rs
index 06d3928fd1..32ef503139 100644
--- a/crates/format/tests/it/roundtrip.rs
+++ b/crates/format/tests/it/roundtrip.rs
@@ -280,10 +280,11 @@ fn text_run_baseline_roundtrips() {
 fn zip_incremental_only_new_tiles() {
     let mut doc = rich_doc(ColorMode::Rgb, SampleType::U16);
     let mut w = PcraftWriter::new();
-    let (_, s1) = w.save_zip(&doc, &SaveOptions::default()).unwrap();
+    let (first, s1) = w.save_zip(&doc, &SaveOptions::default()).unwrap();
     assert!(s1.tiles_total > 5);
     assert_eq!(s1.tiles_written, s1.tiles_total);
-    let (_, s2) = w.save_zip(&doc, &SaveOptions::default()).unwrap();
+    let (cached, s2) = w.save_zip(&doc, &SaveOptions::default()).unwrap();
+    assert_eq!(first, cached);
     assert_eq!(s2.tiles_written, 0);
     assert_eq!(s2.tiles_reused, s2.tiles_total);
     assert_eq!(s2.blobs_written, 0);
@@ -293,6 +294,7 @@ fn zip_incremental_only_new_tiles() {
     let (bytes, s3) = w.save_zip(&doc, &SaveOptions::default()).unwrap();
     assert_eq!(s3.tiles_written, 1);
     assert_eq!(load_from_bytes(&bytes).unwrap(), doc);
+    assert_eq!(bytes, PcraftWriter::new().save_zip(&doc, &SaveOptions::default()).unwrap().0);
 }
 
 #[test]
@@ -884,6 +886,25 @@ fn variables_follow_layer_id_remapping() {
     assert!(back.walk().into_iter().all(|(_, _, l)| l.id != gone), "dangling target must not address a live layer");
 }
 
+#[test]
+fn color_lookup_lut_file_round_trips_and_old_files_load() {
+    use photocraft_doc::Adjustment;
+    use photocraft_doc::adjust::{LutFormat, LutSource};
+    let lut = Some(std::sync::Arc::new(vec![0.5f32; 24]));
+    let source = Some(LutSource { format: LutFormat::ThreeDl, bytes: std::sync::Arc::new(b"0 1023\n0 0 0\n".to_vec()) });
+    let adj = Adjustment::ColorLookup { name: "Film.3dl".into(), lut, size: 2, tetrahedral: false, dither: false, source };
+    let mut doc = Document::new("d", photocraft_doc::Size::new(4, 4), ColorMode::Rgb, SampleType::U8);
+    doc.insert_above(None, Layer::new("lookup", LayerContent::Adjustment(adj.clone())));
+    let back = load_from_bytes(&save_to_bytes(&doc, &SaveOptions::default()).unwrap()).unwrap();
+    assert_eq!(back, doc, "the LUT file survives a .pcraft round trip (#6544)");
+    // A .pcraft written before the field existed has no `source`: it loads as None.
+    let mut v = serde_json::to_value(&adj).unwrap();
+    let removed = v.as_object_mut().and_then(|o| o.values_mut().next()).and_then(|f| f.as_object_mut()).and_then(|f| f.remove("source"));
+    assert!(removed.is_some(), "{v}");
+    let Adjustment::ColorLookup { source: None, name, .. } = serde_json::from_value(v).unwrap() else { panic!("old lookup must load") };
+    assert_eq!(name, "Film.3dl");
+}
+
 /// Removing previews is post-commit housekeeping, not part of publishing the new document.
 #[test]
 fn directory_save_without_previews_removes_stale_files_after_commit() {
diff --git a/crates/geom/src/warp.rs b/crates/geom/src/warp.rs
index 90c70cc30f..8c1320cf6a 100644
--- a/crates/geom/src/warp.rs
+++ b/crates/geom/src/warp.rs
@@ -836,15 +836,8 @@ impl BezierMesh {
             *f = f.max((1.0 - interior) * w);
         }
         // Every control point moves with the anchor it is closest to.
-        for j in 0..self.ny() {
-            for i in 0..nx {
-                let (ai, aj) = (((i + 1) / 3).min(cols), ((j + 1) / 3).min(rows));
-                let k = share[aj * (cols + 1) + ai];
-                let p = &mut self.points[j * nx + i];
-                p[0] += d[0] * k;
-                p[1] += d[1] * k;
-            }
-        }
+        let ny = self.ny();
+        move_control_points(&mut self.points, nx, ny, cols, rows, &share, d);
         // Close the gap exactly, with three groups of control points that share the work:
         // - the four inner points of the grabbed patch (all of it in the middle of the patch,
         //   little near a grid line, where they barely reach the surface);
@@ -1022,6 +1015,18 @@ impl BezierMesh {
     }
 }
 
+fn move_control_points(points: &mut [[f64; 2]], nx: usize, ny: usize, cols: usize, rows: usize, shares: &[f64], delta: [f64; 2]) {
+    for j in 0..ny {
+        for i in 0..nx {
+            let (ai, aj) = (((i + 1) / 3).min(cols), ((j + 1) / 3).min(rows));
+            let share = shares[aj * (cols + 1) + ai];
+            let point = &mut points[j * nx + i];
+            point[0] += delta[0] * share;
+            point[1] += delta[1] * share;
+        }
+    }
+}
+
 /// A complete warp: what Photoshop's `warp` descriptor stores, plus the custom mesh.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
diff --git a/crates/gpu/src/batch.rs b/crates/gpu/src/batch.rs
index 988a580cc4..700ed8361f 100644
--- a/crates/gpu/src/batch.rs
+++ b/crates/gpu/src/batch.rs
@@ -1,6 +1,6 @@
 use super::convert::{W, words};
 use super::textures::Resident;
-use super::*;
+use super::{DeviceHealth, F, I, Kernel, Plan, Rect, TILE_SIZE, TileCoord, U, plan, timing};
 
 /// The uniform record of a pass.
 pub(crate) fn op_words(p: &plan::Pass<'_>, tex: Option<[i32; 4]>, mask: Option<[i32; 4]>, map: Option<Rect>) -> Vec<u8> {
diff --git a/crates/gpu/src/cells.rs b/crates/gpu/src/cells.rs
index 8d8a44ec97..ab3c451bed 100644
--- a/crates/gpu/src/cells.rs
+++ b/crates/gpu/src/cells.rs
@@ -4,7 +4,7 @@ use super::convert::{convert_tile, convert_tiles, keep_overlap, put_tiles, words
 use super::kit::{Bound, FrameRes, texture_group, uniform_group};
 use super::paging::cell_rect;
 use super::textures::{CachedPattern, Cell, ChunkOut, ResKey, Resident, ResidentRef, Stats, Tex, TexKind};
-use super::*;
+use super::{Arc, Compositor, DocId, HashMap, I, Kernel, Pattern, Plan, Rect, Role, Surface, TILE_SIZE, TileCoord, plan};
 
 impl Compositor {
     /// Bring the pages of `cell` that `plan` samples up to date and resolve its effect maps.
diff --git a/crates/gpu/src/convert.rs b/crates/gpu/src/convert.rs
index 6b0a7e6f98..9dbfc81814 100644
--- a/crates/gpu/src/convert.rs
+++ b/crates/gpu/src/convert.rs
@@ -1,6 +1,6 @@
 use super::batch::write_tile;
 use super::textures::{Resident, TexKind};
-use super::*;
+use super::{Arc, F, HashMap, I, PixelFormat, Rect, SampleType, Surface, TILE_SIZE, Tile, TileCoord, U, fx};
 
 /// Distinct tiles converted per parallel batch: bounds the converted bytes held at once (64 tiles
 /// of a 16-bit page are 32 MiB).
diff --git a/crates/gpu/src/encode.rs b/crates/gpu/src/encode.rs
index 037a4cc80d..cfa4bbd723 100644
--- a/crates/gpu/src/encode.rs
+++ b/crates/gpu/src/encode.rs
@@ -4,7 +4,7 @@ use super::convert::lut_texture;
 use super::kit::FrameRes;
 use super::paging::{OVER_BUDGET, cell_rect, first_error, grid_rect_count, grid_rects, lru_victims, scoped_work, uniform_buffer_len};
 use super::textures::{ChunkOut, FxKey, ResKey, Resident, Stats};
-use super::*;
+use super::{Compositor, Document, LayerId, Plan, Rect, Surface, Unsupported, plan, timing};
 
 impl Compositor {
     /// Composite `region` of `doc`. Each finished chunk is passed to `sink` while its encoder is
diff --git a/crates/gpu/src/fx.rs b/crates/gpu/src/fx.rs
index 34982cd2be..ceff607686 100644
--- a/crates/gpu/src/fx.rs
+++ b/crates/gpu/src/fx.rs
@@ -25,13 +25,14 @@ use std::collections::HashMap;
 use std::hash::{Hash, Hasher};
 use std::sync::Arc;
 
-use photocraft_compose::effects::BevelPaint;
 use photocraft_compose::effects::FieldKind;
-use photocraft_doc::{BevelTechnique, Contour, Effect, GlobalLight, GlowSource, GlowTechnique, Layer, LayerContent, Pattern};
+use photocraft_doc::{Contour, Effect, GlobalLight, Layer, LayerContent, Pattern};
 use photocraft_geom::{Rect, TileCoord};
 use photocraft_raster::{Surface, Tile};
 
-use crate::plan::{Kernel, stroke_widths};
+use crate::plan::Kernel;
+
+mod builders;
 
 /// Input of a map stage.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
@@ -306,181 +307,14 @@ pub(crate) fn program(e: &Effect, light: &GlobalLight, vector_shape: bool) -> Ma
 pub(crate) fn program_with(e: &Effect, light: &GlobalLight, vector_shape: bool, patterns: &[Pattern], anchor: (f64, f64)) -> MapProgram {
     let mut b = B { stages: Vec::new(), fields: Vec::new() };
     let maps = match e {
-        Effect::DropShadow(s) | Effect::InnerShadow(s) => {
-            // shadow_map
-            let inner = matches!(e, Effect::InnerShadow(_));
-            let angle = if s.use_global_light { light.angle } else { s.angle };
-            let (dx, dy) = offset(angle, s.distance);
-            let src = b.shift(In::Shape, dx, dy, if inner { 1.0 } else { 0.0 }, inner);
-            let (r, bw) = photocraft_compose::effects::spread_split(s.size, s.spread);
-            let mut m = src;
-            if r > 0.0 {
-                // dist_outside of the shifted map is the shifted field (integer offsets; shifted-in
-                // pixels are far away for a drop shadow, inside for an inner shadow).
-                let f = b.field(if inner { FieldKind::ChokeInside } else { FieldKind::StrokeOutside }, r);
-                let d = if dx == 0.0 && dy == 0.0 {
-                    f
-                } else {
-                    b.push(stage(Kernel::MShift, Some(f), None, [dx, dy, if inner { -0.5 } else { 1e10 }, 0.0], dx.abs().max(dy.abs()) as i32))
-                };
-                m = b.dilate(src, d, r);
-            }
-            let m = b.blur(m, bw);
-            b.finish(m, None, false, &s.contour, inner, 0);
-            1
-        }
-        Effect::OuterGlow(g) | Effect::InnerGlow(g) => {
-            // glow_map
-            let inner = matches!(e, Effect::InnerGlow(_));
-            let center = inner && g.source == GlowSource::Center;
-            match g.technique {
-                GlowTechnique::Precise => {
-                    let d = b.field(if inner { FieldKind::Inside } else { FieldKind::Outside }, g.size);
-                    let solid = g.size * g.spread;
-                    let soft = (g.size + 1.0 - solid).max(1e-3);
-                    let m = b.push(stage(Kernel::MGlow, Some(d), None, [solid, soft, 0.0, 0.0], 0));
-                    b.finish_glow(m, photocraft_compose::effects::glow_lut(g), inner, center);
-                }
-                GlowTechnique::Softer => {
-                    // Inner glows (edge, and centre as 1 - the edge result) spread 1 - alpha.
-                    let src = if inner { b.shift(In::Shape, 0.0, 0.0, 0.0, true) } else { In::Shape };
-                    let (r, bw) = photocraft_compose::effects::spread_split(g.size, g.spread);
-                    let mut m = src;
-                    if r > 0.0 {
-                        let d = b.field(if inner { FieldKind::ChokeInside } else { FieldKind::StrokeOutside }, r);
-                        m = b.dilate(src, d, r);
-                    }
-                    let m = b.blur(m, bw);
-                    b.finish_glow(m, photocraft_compose::effects::glow_lut(g), inner, center);
-                }
-            }
-            1
-        }
-        Effect::Satin(s) => {
-            // satin_map
-            let (dx, dy) = offset(s.angle, photocraft_compose::effects::satin_distance(s));
-            let a = b.shift(In::Shape, dx, dy, 0.0, false);
-            let a = b.conv(a, photocraft_compose::effects::tent_kernel(s.size));
-            let c = b.shift(In::Shape, -dx, -dy, 0.0, false);
-            let c = b.conv(c, photocraft_compose::effects::tent_kernel(s.size));
-            b.finish_lut(a, Some(c), s.invert, photocraft_compose::effects::satin_lut(&s.contour), true, 0);
-            1
-        }
-        Effect::BevelEmboss(bv) => {
-            // bevel_maps: height map (tent blur of the shape, or chiselled distance ramps), then
-            // highlight / shadow shading inside and / or outside the shape.
-            let g = photocraft_compose::effects::bevel_geom(bv);
-            let size = bv.size.max(1.0);
-            let paint = |p: BevelPaint| match p {
-                BevelPaint::Outer => 0.0,
-                BevelPaint::Both => 1.0,
-                BevelPaint::Inner => 2.0,
-            };
-            let mut h = if bv.technique == BevelTechnique::Smooth {
-                b.conv(In::Shape, photocraft_compose::effects::tent_kernel(g.width))
-            } else {
-                let [din, dout] = b.bevel_fields(size);
-                let soft = g.chisel_soft > 0.0;
-                let h = b.push(stage(Kernel::MBevelH, Some(din), Some(dout), [paint(g.paint), size, f32::from(u8::from(soft)), 0.0], 0));
-                // As `effects::bevel_height`: only emboss styles blur a Chisel Soft ramp.
-                if soft && g.paint == BevelPaint::Both { b.conv(h, photocraft_compose::effects::tent_kernel(g.chisel_soft)) } else { h }
-            };
-            if let Some(c) = &bv.contour {
-                // Contour element: the height through the contour (`bevel_contour_lut`).
-                let lut = photocraft_compose::effects::bevel_contour_lut(c);
-                let mut st = stage(Kernel::MFinish, Some(h), None, [0.0, 0.0, 1.0, 0.0], 0);
-                st.lut = Some(Arc::new(lut));
-                h = b.push(st);
-            }
-            if let Some(t) = &bv.texture
-                && let Some(pat) = photocraft_doc::pattern::find(patterns, &t.id, &t.name).filter(|p| p.is_paintable())
-            {
-                // Texture element (`effects::bevel_height`): luminance × depth / unit added.
-                let unit = if bv.depth.abs() > 1e-6 { (g.depth / bv.depth).abs().max(1e-3) } else { g.width.max(1.0) };
-                let pl = photocraft_compose::pattern::Placement::anchored(anchor, t.link, t.phase, t.scale, 0.0);
-                let (origin, cs, inv) = pl.parts();
-                let mut st = stage(Kernel::MBevelTex, Some(h), None, [t.depth / unit, f32::from(u8::from(t.invert)), 0.0, 0.0], 0);
-                st.p3 = [origin.0 as f32, origin.1 as f32, cs.0 as f32, cs.1 as f32];
-                st.p4 = [inv as f32, pat.width as f32, pat.height as f32, 0.0];
-                st.pattern = Some(pat.clone());
-                h = b.push(st);
-            }
-            if bv.soften >= 1.0 {
-                h = b.conv(h, photocraft_compose::effects::tent_kernel(bv.soften));
-            }
-            let (angle, altitude) = if bv.use_global_light { (light.angle, light.altitude) } else { (bv.angle, bv.altitude) };
-            let (sa, ca) = angle.to_radians().sin_cos();
-            let (se, ce) = altitude.to_radians().sin_cos();
-            let lut = contour_lut(&bv.gloss_contour).map(Arc::new);
-            // Region (`fs_mbevelshade`): 0 inside, 1 under the edge and outside, 2 / 3 emboss /
-            // pillow emboss (both halves in one map).
-            let passes: Vec<(f32, f32)> = match g.paint {
-                BevelPaint::Inner => vec![(g.depth, 0.0)],
-                BevelPaint::Outer => vec![(g.depth, 1.0)],
-                BevelPaint::Both => vec![(g.depth, if g.pillow { 3.0 } else { 2.0 })],
-            };
-            let mut out = 0;
-            for (depth, region) in &passes {
-                for which in [0.0, 1.0] {
-                    let mut s = stage(Kernel::MBevelShade, Some(h), None, [ca * ce, -sa * ce, se, se], 1);
-                    s.p1 = [*depth, *region, which, f32::from(u8::from(lut.is_some()))];
-                    s.p3 = [f32::from(u8::from(g.paint == BevelPaint::Outer && bv.technique != BevelTechnique::Smooth)), 0.0, 0.0, 0.0];
-                    s.lut = lut.clone();
-                    s.s = Some(In::Shape);
-                    s.out = Some(out);
-                    out += 1;
-                    b.stages.push(s);
-                }
-            }
-            out
-        }
-        Effect::Stroke(st) => {
-            // composite_with_effects' stroke bands (maps 0 outside, 1 inside)
-            let (in_w, out_w) = stroke_widths(st);
-            if out_w > 0.0 {
-                // Narrow strokes keep the fitted chamfer, wide ones the exact transform (#3646);
-                // the CPU picks the same field by the same width (`stroke_outside_exact`).
-                let kind = match (vector_shape, photocraft_compose::effects::stroke_outside_exact(out_w)) {
-                    (true, true) => FieldKind::StrokeOutsideVector,
-                    (true, false) => FieldKind::StrokeOutsideVectorChamfer,
-                    (false, true) => FieldKind::StrokeOutsideExact,
-                    (false, false) => FieldKind::StrokeOutside,
-                };
-                let d = b.field(kind, out_w);
-                let mut s = stage(Kernel::MStroke, Some(d), None, [out_w, 0.0, 0.0, 0.0], 0);
-                s.out = Some(0);
-                b.stages.push(s);
-            }
-            if in_w > 0.0 {
-                let d = b.field(FieldKind::StrokeInside, in_w);
-                let mut s = stage(Kernel::MStroke, Some(d), None, [in_w, 0.0, 0.0, 0.0], 0);
-                s.out = Some(1);
-                b.stages.push(s);
-            }
-            2
-        }
+        Effect::DropShadow(s) | Effect::InnerShadow(s) => b.shadow(s, light, matches!(e, Effect::InnerShadow(_))),
+        Effect::OuterGlow(g) | Effect::InnerGlow(g) => b.glow(g, matches!(e, Effect::InnerGlow(_))),
+        Effect::Satin(s) => b.satin(s),
+        Effect::BevelEmboss(bv) => b.bevel(bv, light, patterns, anchor),
+        Effect::Stroke(st) => b.stroke(st, vector_shape),
         Effect::ColorOverlay { .. } | Effect::GradientOverlay { .. } | Effect::PatternOverlay { .. } => return MapProgram::empty(),
     };
-    let mut h = std::collections::hash_map::DefaultHasher::new();
-    for s in &b.stages {
-        (format!("{:?}", s.kernel), s.a, s.b, s.s, s.radius, s.out).hash(&mut h);
-        for v in s.p0.iter().chain(&s.p1).chain(&s.p3).chain(&s.p4) {
-            v.to_bits().hash(&mut h);
-        }
-        if let Some(p) = &s.pattern {
-            (&p.id, &p.name, p.width, p.height).hash(&mut h);
-            for (c, t) in p.surface.tiles() {
-                (c.tx, c.ty, Arc::as_ptr(t) as usize).hash(&mut h);
-            }
-        }
-        if let Some(l) = &s.lut {
-            for v in l.iter() {
-                v.to_bits().hash(&mut h);
-            }
-        }
-    }
-    (maps, &b.fields).hash(&mut h);
-    MapProgram { key: h.finish() | 1, maps, stages: b.stages, fields: b.fields }
+    MapProgram { key: b.key(maps), maps, stages: b.stages, fields: b.fields }
 }
 
 // ---------------------------------------------------------------------------------------------
diff --git a/crates/gpu/src/fx/builders.rs b/crates/gpu/src/fx/builders.rs
new file mode 100644
index 0000000000..39bc9c4fba
--- /dev/null
+++ b/crates/gpu/src/fx/builders.rs
@@ -0,0 +1,208 @@
+use std::hash::{Hash, Hasher};
+use std::sync::Arc;
+
+use photocraft_compose::effects::{self as fx, BevelGeom, BevelPaint, FieldKind};
+use photocraft_doc::{Bevel, BevelTechnique, BevelTexture, GlobalLight, Glow, GlowSource, GlowTechnique, Pattern, Satin, Shadow, StrokeFx};
+
+use super::{B, In, contour_lut, offset, stage};
+use crate::plan::{Kernel, stroke_widths};
+
+/// A flag as the shaders read it: 1.0 or 0.0.
+fn flag(v: bool) -> f32 {
+    f32::from(u8::from(v))
+}
+
+impl B {
+    /// Drop or Inner Shadow stages. Returns the number of maps written.
+    pub(super) fn shadow(&mut self, s: &Shadow, light: &GlobalLight, inner: bool) -> usize {
+        // shadow_map
+        let angle = if s.use_global_light { light.angle } else { s.angle };
+        let (dx, dy) = offset(angle, s.distance);
+        let src = self.shift(In::Shape, dx, dy, if inner { 1.0 } else { 0.0 }, inner);
+        let m = self.spread_blur(src, (s.size, s.spread), inner, dx, dy);
+        self.finish(m, None, false, &s.contour, inner, 0);
+        1
+    }
+
+    /// `src` spread or choked by `spread` of `size`, then blurred by the rest.
+    fn spread_blur(&mut self, src: In, (size, spread): (f32, f32), inner: bool, dx: f32, dy: f32) -> In {
+        let (r, bw) = fx::spread_split(size, spread);
+        if r <= 0.0 {
+            return self.blur(src, bw);
+        }
+        // The shifted map's distance field is the field shifted by the same whole pixels.
+        let f = self.field(if inner { FieldKind::ChokeInside } else { FieldKind::StrokeOutside }, r);
+        let d = if dx == 0.0 && dy == 0.0 {
+            f
+        } else {
+            self.push(stage(Kernel::MShift, Some(f), None, [dx, dy, if inner { -0.5 } else { 1e10 }, 0.0], dx.abs().max(dy.abs()) as i32))
+        };
+        let m = self.dilate(src, d, r);
+        self.blur(m, bw)
+    }
+
+    /// Outer or Inner Glow stages, Precise or Softer. Returns the number of maps written.
+    pub(super) fn glow(&mut self, g: &Glow, inner: bool) -> usize {
+        // glow_map
+        let center = inner && g.source == GlowSource::Center;
+        let m = match g.technique {
+            GlowTechnique::Precise => {
+                let d = self.field(if inner { FieldKind::Inside } else { FieldKind::Outside }, g.size);
+                let solid = g.size * g.spread;
+                let soft = (g.size + 1.0 - solid).max(1e-3);
+                self.push(stage(Kernel::MGlow, Some(d), None, [solid, soft, 0.0, 0.0], 0))
+            }
+            GlowTechnique::Softer => {
+                // Inner glows spread 1 - alpha.
+                let src = if inner { self.shift(In::Shape, 0.0, 0.0, 0.0, true) } else { In::Shape };
+                self.spread_blur(src, (g.size, g.spread), inner, 0.0, 0.0)
+            }
+        };
+        self.finish_glow(m, fx::glow_lut(g), inner, center);
+        1
+    }
+
+    /// Satin stages. Returns the number of maps written.
+    pub(super) fn satin(&mut self, s: &Satin) -> usize {
+        // satin_map
+        let (dx, dy) = offset(s.angle, fx::satin_distance(s));
+        let a = self.shift(In::Shape, dx, dy, 0.0, false);
+        let a = self.conv(a, fx::tent_kernel(s.size));
+        let c = self.shift(In::Shape, -dx, -dy, 0.0, false);
+        let c = self.conv(c, fx::tent_kernel(s.size));
+        self.finish_lut(a, Some(c), s.invert, fx::satin_lut(&s.contour), true, 0);
+        1
+    }
+
+    /// Bevel and Emboss stages: the height map with its contour, texture and soften, then the shading. Returns the number of maps written.
+    pub(super) fn bevel(&mut self, bv: &Bevel, light: &GlobalLight, patterns: &[Pattern], anchor: (f64, f64)) -> usize {
+        // bevel_maps: a height map, then highlight and shadow shading.
+        let g = fx::bevel_geom(bv);
+        let mut h = self.bevel_height(bv, &g);
+        if let Some(c) = &bv.contour {
+            // Contour element: the height through `bevel_contour_lut`.
+            let mut st = stage(Kernel::MFinish, Some(h), None, [0.0, 0.0, 1.0, 0.0], 0);
+            st.lut = Some(Arc::new(fx::bevel_contour_lut(c)));
+            h = self.push(st);
+        }
+        if let Some(t) = &bv.texture
+            && let Some(pat) = photocraft_doc::pattern::find(patterns, &t.id, &t.name).filter(|p| p.is_paintable())
+        {
+            let unit = if bv.depth.abs() > 1e-6 { (g.depth / bv.depth).abs().max(1e-3) } else { g.width.max(1.0) };
+            h = self.bevel_texture(h, t, pat, unit, anchor);
+        }
+        if bv.soften >= 1.0 {
+            h = self.conv(h, fx::tent_kernel(bv.soften));
+        }
+        self.bevel_shading(h, bv, &g, light)
+    }
+
+    /// The bevel's height map: a tent blur of the shape for Smooth, distance ramps for the chisel techniques.
+    fn bevel_height(&mut self, bv: &Bevel, g: &BevelGeom) -> In {
+        if bv.technique == BevelTechnique::Smooth {
+            return self.conv(In::Shape, fx::tent_kernel(g.width));
+        }
+        let paint = match g.paint {
+            BevelPaint::Outer => 0.0,
+            BevelPaint::Both => 1.0,
+            BevelPaint::Inner => 2.0,
+        };
+        let size = bv.size.max(1.0);
+        let [din, dout] = self.bevel_fields(size);
+        let soft = g.chisel_soft > 0.0;
+        let h = self.push(stage(Kernel::MBevelH, Some(din), Some(dout), [paint, size, flag(soft), 0.0], 0));
+        // Only emboss styles blur a Chisel Soft ramp, as in `effects::bevel_height`.
+        if soft && g.paint == BevelPaint::Both { self.conv(h, fx::tent_kernel(g.chisel_soft)) } else { h }
+    }
+
+    /// `h` with the Texture element's pattern luminance added.
+    fn bevel_texture(&mut self, h: In, t: &BevelTexture, pat: &Pattern, unit: f32, anchor: (f64, f64)) -> In {
+        // Texture element: adds luminance × depth / unit to the height.
+        let pl = photocraft_compose::pattern::Placement::anchored(anchor, t.link, t.phase, t.scale, 0.0);
+        let (origin, cs, inv) = pl.parts();
+        let mut st = stage(Kernel::MBevelTex, Some(h), None, [t.depth / unit, flag(t.invert), 0.0, 0.0], 0);
+        st.p3 = [origin.0 as f32, origin.1 as f32, cs.0 as f32, cs.1 as f32];
+        st.p4 = [inv as f32, pat.width as f32, pat.height as f32, 0.0];
+        st.pattern = Some(pat.clone());
+        self.push(st)
+    }
+
+    /// Highlight and shadow shading of height map `h` into maps 0 and 1. Returns 2.
+    fn bevel_shading(&mut self, h: In, bv: &Bevel, g: &BevelGeom, light: &GlobalLight) -> usize {
+        let (angle, altitude) = if bv.use_global_light { (light.angle, light.altitude) } else { (bv.angle, bv.altitude) };
+        let (sa, ca) = angle.to_radians().sin_cos();
+        let (se, ce) = altitude.to_radians().sin_cos();
+        let lut = contour_lut(&bv.gloss_contour).map(Arc::new);
+        // Region for `fs_mbevelshade`: 0 inside, 1 outside, 2 emboss, 3 pillow emboss.
+        let region = match g.paint {
+            BevelPaint::Inner => 0.0,
+            BevelPaint::Outer => 1.0,
+            BevelPaint::Both if g.pillow => 3.0,
+            BevelPaint::Both => 2.0,
+        };
+        let outer_chisel = g.paint == BevelPaint::Outer && bv.technique != BevelTechnique::Smooth;
+        for (out, which) in [0.0, 1.0].into_iter().enumerate() {
+            let mut s = stage(Kernel::MBevelShade, Some(h), None, [ca * ce, -sa * ce, se, se], 1);
+            s.p1 = [g.depth, region, which, flag(lut.is_some())];
+            s.p3 = [flag(outer_chisel), 0.0, 0.0, 0.0];
+            s.lut = lut.clone();
+            s.s = Some(In::Shape);
+            s.out = Some(out);
+            self.stages.push(s);
+        }
+        2
+    }
+
+    /// Stroke stages, the outside band into map 0 and the inside band into map 1. Returns 2.
+    pub(super) fn stroke(&mut self, st: &StrokeFx, vector_shape: bool) -> usize {
+        // Stroke bands: map 0 outside, map 1 inside.
+        let (in_w, out_w) = stroke_widths(st);
+        if out_w > 0.0 {
+            // Narrow strokes keep the fitted chamfer, wide ones the exact transform (#3646);
+            // the CPU picks the same field by the same width (`stroke_outside_exact`).
+            let kind = match (vector_shape, fx::stroke_outside_exact(out_w)) {
+                (true, true) => FieldKind::StrokeOutsideVector,
+                (true, false) => FieldKind::StrokeOutsideVectorChamfer,
+                (false, true) => FieldKind::StrokeOutsideExact,
+                (false, false) => FieldKind::StrokeOutside,
+            };
+            self.stroke_band(kind, out_w, 0);
+        }
+        if in_w > 0.0 {
+            self.stroke_band(FieldKind::StrokeInside, in_w, 1);
+        }
+        2
+    }
+
+    /// One stroke band of `width` from distance field `kind` into map `out`.
+    fn stroke_band(&mut self, kind: FieldKind, width: f32, out: usize) {
+        let d = self.field(kind, width);
+        let mut s = stage(Kernel::MStroke, Some(d), None, [width, 0.0, 0.0, 0.0], 0);
+        s.out = Some(out);
+        self.stages.push(s);
+    }
+
+    /// A hash of the built stages and fields that keys the compiled program (never 0).
+    pub(super) fn key(&self, maps: usize) -> u64 {
+        let mut h = std::collections::hash_map::DefaultHasher::new();
+        for s in &self.stages {
+            (format!("{:?}", s.kernel), s.a, s.b, s.s, s.radius, s.out).hash(&mut h);
+            for v in s.p0.iter().chain(&s.p1).chain(&s.p3).chain(&s.p4) {
+                v.to_bits().hash(&mut h);
+            }
+            if let Some(p) = &s.pattern {
+                (&p.id, &p.name, p.width, p.height).hash(&mut h);
+                for (c, t) in p.surface.tiles() {
+                    (c.tx, c.ty, Arc::as_ptr(t) as usize).hash(&mut h);
+                }
+            }
+            if let Some(l) = &s.lut {
+                for v in l.iter() {
+                    v.to_bits().hash(&mut h);
+                }
+            }
+        }
+        (maps, &self.fields).hash(&mut h);
+        h.finish() | 1
+    }
+}
diff --git a/crates/gpu/src/fx_passes.rs b/crates/gpu/src/fx_passes.rs
index a549979f63..f3f5ce6da3 100644
--- a/crates/gpu/src/fx_passes.rs
+++ b/crates/gpu/src/fx_passes.rs
@@ -3,7 +3,7 @@ use super::consts::{MAP16, MAP32};
 use super::kit::MapDraw;
 use super::paging::field_reaches;
 use super::textures::{FxEntry, FxKey, ProgState, Stats, Tex};
-use super::*;
+use super::{Arc, Compositor, Document, FieldKind, HashMap, LayerContent, Rect, Unsupported, fx, plan};
 
 impl Compositor {
     /// Build or update the effect maps of one layer over `region`: its whole effect region, or
diff --git a/crates/gpu/src/kit.rs b/crates/gpu/src/kit.rs
index 2de048a2e2..6ac1b76dc3 100644
--- a/crates/gpu/src/kit.rs
+++ b/crates/gpu/src/kit.rs
@@ -1,7 +1,7 @@
 use super::consts::{CHUNK_UNIFORM, OP_UNIFORM, STRIDE};
 use super::convert::{lut_texture, words};
 use super::textures::{ResKey, ResidentRef};
-use super::*;
+use super::{Arc, HashMap, I, Kernel, NonZeroU64, Rect};
 
 /// Pipelines and layouts, shared by cheap clones (wgpu handles are reference counted).
 #[derive(Clone)]
diff --git a/crates/gpu/src/paging.rs b/crates/gpu/src/paging.rs
index c6d4b61563..b07f8e8db4 100644
--- a/crates/gpu/src/paging.rs
+++ b/crates/gpu/src/paging.rs
@@ -1,6 +1,6 @@
 use super::consts::STRIDE;
 use super::textures::Cell;
-use super::*;
+use super::{DeviceHealth, FieldKind, HashMap, Rect, Unsupported, fx};
 
 /// Document pixels of page cell `c`.
 pub(crate) fn cell_rect(c: Cell, page: u32) -> Rect {
diff --git a/crates/gpu/src/plan/lower.rs b/crates/gpu/src/plan/lower.rs
index 42dd17e099..a38cdde867 100644
--- a/crates/gpu/src/plan/lower.rs
+++ b/crates/gpu/src/plan/lower.rs
@@ -1,5 +1,5 @@
 use super::types::Unsupported;
-use super::*;
+use super::{Adjustment, BlendMode, Fill, Gradient, Layer, LayerContent, Pattern, StrokePosition, ToneSpace, Transfer, adjust, lut3d_len};
 
 /// Paint source of an effect.
 pub(super) enum Paint<'a> {
diff --git a/crates/gpu/src/plan/planner.rs b/crates/gpu/src/plan/planner.rs
index 577237e975..88de5a81b4 100644
--- a/crates/gpu/src/plan/planner.rs
+++ b/crates/gpu/src/plan/planner.rs
@@ -2,7 +2,7 @@ use super::lower::{
     Paint, adjustment_on_gpu, adjustment_program, check_gradient_stops, gradient_rows, placement, single_content_pass, stroke_widths, style_index,
 };
 use super::types::{Checkpoint, DocCtx, FxLayer, Kernel, MapRef, MaskUse, Pass, Role, SurfaceRef, TexUse, Unsupported};
-use super::*;
+use super::{Adjustment, BlendMode, Effect, Fill, FxPaint, Glow, Layer, LayerContent, LayerId, Plan, Rect, Slot, Surface, bounds, has_effects};
 
 pub(super) struct Planner<'a> {
     passes: Vec<Pass<'a>>,
@@ -29,6 +29,27 @@ enum Cov {
     One,
 }
 
+struct EffectState<'a> {
+    layer: &'a Layer,
+    items: Vec<&'a Effect>,
+    rev: Vec<(usize, &'a Effect)>,
+    fx: usize,
+    content: Slot,
+    lay_src: Slot,
+    vstroke: Option<Slot>,
+    backdrop: Slot,
+    w: Slot,
+    l: Slot,
+    clip: Rect,
+    sb: Rect,
+    anchor: (f64, f64),
+    outline: bool,
+    relative: bool,
+    vector_shape: bool,
+    atop: bool,
+    premerge: bool,
+}
+
 /// Shader flags for effect passes (keep in sync with compose.wgsl). Coverage `m` of a paint, with
 /// `a` the layer's alpha and `inside` = `a > 0.5/255`:
 /// knockout `m × (1 − a × k)` (k in `p4.w`); gate `inside ? m : 0`; rel `inside ? min(m / a, 1) : 0`;
@@ -133,6 +154,28 @@ pub const INIT_OUTLINE: i32 = 7;
 /// `MapRef::item` of the layer's effect shape (`compose::layer_shape`) instead of an effect map.
 pub const SHAPE_MAP: usize = usize::MAX;
 
+fn check_effect_gradients(items: &[&Effect]) -> Result<(), Unsupported> {
+    for effect in items {
+        let gradient = match effect {
+            Effect::GradientOverlay { gradient, .. } => Some(gradient),
+            Effect::Stroke(stroke) => match &stroke.paint {
+                FxPaint::Gradient(g) => Some(g),
+                _ => None,
+            },
+            Effect::OuterGlow(glow) | Effect::InnerGlow(glow) => match &glow.paint {
+                FxPaint::Gradient(g) => Some(g),
+                _ => None,
+            },
+            _ => None,
+        };
+        if let Some(gradient) = gradient {
+            check_gradient_stops(&gradient.stops)?;
+            check_gradient_stops(&gradient.opacity_stops)?;
+        }
+    }
+    Ok(())
+}
+
 impl<'a> Planner<'a> {
     pub(super) fn new(cx: DocCtx<'a>) -> Self {
         Planner { passes: Vec::new(), free: Vec::new(), refs: Vec::new(), cx, fx: Vec::new(), checkpoints: Vec::new(), visits: 0 }
@@ -374,6 +417,15 @@ impl<'a> Planner<'a> {
                 p.mask = self.mask_use(layer);
                 after = self.emit(p);
             }
+            // A Frame's stroke over the frame's content, at the group's opacity (compose).
+            if let Some(stroke) = photocraft_compose::shape_split::frame_stroke(layer, self.cx.canvas, self.cx.depth) {
+                let stroke = self.shape_part(layer, Role::Stroke, stroke);
+                let mut p = Pass::new(Kernel::Blend, 0);
+                p.a = Some(after);
+                p.b = Some(stroke);
+                p.opacity = opacity;
+                after = self.emit(p);
+            }
             if visible_clipped.is_empty() {
                 self.release(before);
                 return Ok(after);
@@ -554,12 +606,20 @@ impl<'a> Planner<'a> {
         match &layer.content {
             LayerContent::Group(g) => {
                 let empty = self.clear();
-                let s = self.stack(&g.children, empty)?;
+                let mut s = self.stack(&g.children, empty)?;
                 if layer.mask.is_some() || layer.vector_mask.is_some() {
                     let mut p = Pass::new(Kernel::Mask, 0);
                     p.a = Some(s);
                     p.mask = self.mask_use(layer);
-                    return Ok(self.emit(p));
+                    s = self.emit(p);
+                }
+                // A Frame's stroke over its masked content (compose::render_content).
+                if let Some(stroke) = photocraft_compose::shape_split::frame_stroke(layer, self.cx.canvas, self.cx.depth) {
+                    let stroke = self.shape_part(layer, Role::Stroke, stroke);
+                    let mut p = Pass::new(Kernel::Blend, 0);
+                    p.a = Some(s);
+                    p.b = Some(stroke);
+                    s = self.emit(p);
                 }
                 Ok(s)
             }
@@ -707,10 +767,11 @@ impl<'a> Planner<'a> {
         Ok(self.emit(p))
     }
 
-    /// `composite_with_effects` (atop = false) or the clipped-layer variant of `composite_atop`
-    /// (atop = true: effects over the base treated as opaque, keeping the base's alpha).
+    /// Plans enabled layer effects in the same phase order as the CPU compositor.
     /// Consumes `backdrop`.
     fn effects(&mut self, layer: &'a Layer, clipped: &[&'a Layer], backdrop: Slot, atop: bool) -> Result<Slot, Unsupported> {
+        let items: Vec<&'a Effect> = layer.effects.items.iter().filter(|e| e.enabled()).collect();
+        check_effect_gradients(&items)?;
         let canvas = self.cx.canvas;
         let region = bounds::effect_region(layer, canvas);
         let sb = photocraft_compose::paint_bounds(layer).unwrap_or_else(|| bounds::layer_bounds(layer, canvas));
@@ -775,44 +836,67 @@ impl<'a> Planner<'a> {
             content = self.emit(p);
         }
 
-        let items: Vec<&'a Effect> = layer.effects.items.iter().filter(|e| e.enabled()).collect();
-        for e in &items {
-            let gradient = match e {
-                Effect::GradientOverlay { gradient, .. } => Some(gradient),
-                Effect::Stroke(s) => match &s.paint {
-                    FxPaint::Gradient(g) => Some(g),
-                    _ => None,
-                },
-                Effect::OuterGlow(g) | Effect::InnerGlow(g) => match &g.paint {
-                    FxPaint::Gradient(g) => Some(g),
-                    _ => None,
-                },
-                _ => None,
-            };
-            if let Some(g) = gradient {
-                check_gradient_stops(&g.stops)?;
-                check_gradient_stops(&g.opacity_stops)?;
-            }
-        }
         // Linked patterns tile from the effects reference point (else the layer's top-left).
+        let premerge = photocraft_compose::effects::premerges_layer(layer);
         let anchor = layer.effects.reference.unwrap_or((f64::from(sb.x0), f64::from(sb.y0)));
         let vector_shape = matches!(layer.content, LayerContent::Shape(_)) && !outline;
-        let map = |item: usize, map: usize| MapRef { fx, item, map };
-        let rev: Vec<(usize, &'a Effect)> = items.iter().copied().enumerate().rev().collect();
-        let init = |s: &mut Self, src: Slot, b: Option<Slot>, kind: i32, opacity: f32| {
-            let mut p = Pass::new(Kernel::FxInit, 0);
-            p.a = Some(src);
-            p.b = b;
-            p.adjust_kind = kind;
-            p.opacity = opacity;
-            p.clip = Some(clip);
-            s.emit(p)
+        let rev = items.iter().copied().enumerate().rev().collect();
+        let mut work = EffectState {
+            layer,
+            items,
+            rev,
+            fx,
+            content,
+            lay_src,
+            vstroke,
+            backdrop,
+            w: backdrop,
+            l: lay_src,
+            clip,
+            sb,
+            anchor,
+            outline,
+            relative,
+            vector_shape,
+            atop,
+            premerge,
         };
+        if let Some(merged) = self.effect_exterior(&mut work) {
+            self.release(work.content);
+            return Ok(merged);
+        }
+        self.effect_layer_base(&mut work);
+        self.effect_paints(&mut work);
+        self.effect_vector_stroke(&mut work);
+        self.effect_inside_strokes(&mut work);
+        self.effect_inner_bevel(&mut work);
+        self.effect_alpha(&mut work);
+        self.effect_outside_strokes(&mut work);
+        self.effect_outer_bevel(&mut work);
+        let merged = self.effect_merge(&mut work);
+        self.release(work.content);
+        Ok(self.write_back(work.backdrop, merged, work.clip))
+    }
 
+    fn effect_exterior(&mut self, work: &mut EffectState<'a>) -> Option<Slot> {
+        let layer = work.layer;
+        let items = work.items.clone();
+        let rev = work.rev.clone();
+        let fx = work.fx;
+        let content = work.content;
+        let lay_src = work.lay_src;
+        let backdrop = work.backdrop;
+        let clip = work.clip;
+        let sb = work.sb;
+        let atop = work.atop;
+        let relative = work.relative;
+        let premerge = work.premerge;
+        let anchor = work.anchor;
+        let map = |item: usize, map: usize| MapRef { fx, item, map };
         // Exterior effects over the backdrop (an opaque copy of it for clipped layers).
         let mut w = if atop {
             let b = self.retain(backdrop);
-            init(self, b, None, INIT_OPAQUE, 1.0)
+            self.fx_init(clip, b, None, INIT_OPAQUE, 1.0)
         } else {
             self.retain(backdrop)
         };
@@ -849,7 +933,6 @@ impl<'a> Planner<'a> {
         // Only exterior effects (drop shadows, outer glows): nothing is painted between the
         // layer's colour inside its shape and the shape's alpha, so the merge derives both from
         // the shape (`F_LAYER_SHAPE`) instead of two passes building the layer.
-        let premerge = photocraft_compose::effects::premerges_layer(layer);
         if !relative && !premerge && items.iter().all(|e| matches!(e, Effect::DropShadow(_) | Effect::OuterGlow(_))) {
             let mut p = Pass::new(Kernel::FxMerge, 0);
             p.a = Some(w);
@@ -862,16 +945,28 @@ impl<'a> Planner<'a> {
             p.extra[3] = photocraft_compose::text_gamma(layer);
             p.clip = Some(clip);
             let merged = self.emit(p);
-            self.release(content);
-            return Ok(self.write_back(backdrop, merged, clip));
+            let merged = self.write_back(backdrop, merged, clip);
+            return Some(merged);
         }
+        work.w = w;
+        None
+    }
+
+    fn effect_layer_base(&mut self, work: &mut EffectState<'a>) {
+        let layer = work.layer;
+        let content = work.content;
+        let lay_src = work.lay_src;
+        let w = work.w;
+        let clip = work.clip;
+        let relative = work.relative;
+        let premerge = work.premerge;
         // The layer: its colour at fill opacity inside its shape; interior effects are painted
         // relative to the shape (coverage within it), then the shape's alpha applies.
         let mut l = if relative {
             let c = self.retain(content);
-            init(self, lay_src, Some(c), INIT_RELATIVE, layer.fill_opacity)
+            self.fx_init(clip, lay_src, Some(c), INIT_RELATIVE, layer.fill_opacity)
         } else {
-            init(self, lay_src, None, INIT_INSIDE, layer.fill_opacity)
+            self.fx_init(clip, lay_src, None, INIT_INSIDE, layer.fill_opacity)
         };
         // Blend Interior Effects as Group off: the layer merges in its mode first and the
         // interior effects paint over the result (`effects::premerges_layer`).
@@ -885,6 +980,18 @@ impl<'a> Planner<'a> {
             p.clip = Some(clip);
             l = self.emit(p);
         }
+        work.l = l;
+    }
+
+    fn effect_paints(&mut self, work: &mut EffectState<'a>) {
+        let rev = work.rev.clone();
+        let fx = work.fx;
+        let content = work.content;
+        let mut l = work.l;
+        let clip = work.clip;
+        let sb = work.sb;
+        let anchor = work.anchor;
+        let map = |item: usize, map: usize| MapRef { fx, item, map };
         for &(_, e) in &rev {
             if let Effect::PatternOverlay { common, name, id, scale, angle, link, phase } = e
                 && let Some(pat) = photocraft_doc::pattern::find(self.cx.patterns, id, name).filter(|p| p.is_paintable())
@@ -919,6 +1026,15 @@ impl<'a> Planner<'a> {
                 l = self.paint(l, content, Cov::Map(map(i, 0), 0.0), &Paint::Color(s.color.to_rgb()), s.common.blend, s.common.opacity, F_REL, clip, sb);
             }
         }
+        work.l = l;
+    }
+
+    fn effect_vector_stroke(&mut self, work: &mut EffectState<'a>) {
+        let layer = work.layer;
+        let content = work.content;
+        let mut l = work.l;
+        let vstroke = work.vstroke;
+        let clip = work.clip;
         if let Some(s) = vstroke {
             let mut p = Pass::new(Kernel::FxInit, 0);
             p.a = Some(l);
@@ -929,6 +1045,19 @@ impl<'a> Planner<'a> {
             p.clip = Some(clip);
             l = self.emit(p);
         }
+        work.l = l;
+    }
+
+    fn effect_inside_strokes(&mut self, work: &mut EffectState<'a>) {
+        let layer = work.layer;
+        let rev = work.rev.clone();
+        let fx = work.fx;
+        let content = work.content;
+        let mut l = work.l;
+        let clip = work.clip;
+        let sb = work.sb;
+        let anchor = work.anchor;
+        let map = |item: usize, map: usize| MapRef { fx, item, map };
         // Inside stroke parts are painted over the layer (bottom instance first).
         for &(i, e) in &rev {
             if let Effect::Stroke(st) = e {
@@ -949,6 +1078,17 @@ impl<'a> Planner<'a> {
                 }
             }
         }
+        work.l = l;
+    }
+
+    fn effect_inner_bevel(&mut self, work: &mut EffectState<'a>) {
+        let rev = work.rev.clone();
+        let fx = work.fx;
+        let content = work.content;
+        let mut l = work.l;
+        let clip = work.clip;
+        let sb = work.sb;
+        let map = |item: usize, map: usize| MapRef { fx, item, map };
         let bevel_paint = |b: &photocraft_doc::Bevel| photocraft_compose::effects::bevel_geom(b).paint;
         for &(i, e) in &rev {
             if let Effect::BevelEmboss(b) = e
@@ -968,9 +1108,32 @@ impl<'a> Planner<'a> {
                 l = self.paint(l, content, Cov::Map(map(i, 1), 0.0), &Paint::Color(b.shadow_color.to_rgb()), b.shadow.blend, b.shadow.opacity, F_REL, clip, sb);
             }
         }
+        work.l = l;
+    }
+
+    fn effect_alpha(&mut self, work: &mut EffectState<'a>) {
+        let content = work.content;
+        let mut l = work.l;
+        let clip = work.clip;
         // The shape's own alpha.
         let c = self.retain(content);
-        l = init(self, l, Some(c), INIT_ALPHA, 1.0);
+        l = self.fx_init(clip, l, Some(c), INIT_ALPHA, 1.0);
+        work.l = l;
+    }
+
+    fn effect_outside_strokes(&mut self, work: &mut EffectState<'a>) {
+        let layer = work.layer;
+        let items = work.items.clone();
+        let fx = work.fx;
+        let content = work.content;
+        let mut w = work.w;
+        let l = work.l;
+        let clip = work.clip;
+        let sb = work.sb;
+        let anchor = work.anchor;
+        let outline = work.outline;
+        let vector_shape = work.vector_shape;
+        let map = |item: usize, map: usize| MapRef { fx, item, map };
         // Outside stroke parts lie beneath the layer and blend onto the exterior result with their
         // own mode; a higher stroke covers the ones below it (each takes its coverage × opacity
         // not yet taken above it, blended over the result as it was before the strokes).
@@ -987,7 +1150,7 @@ impl<'a> Planner<'a> {
                 // The layer's alpha rides along the coverage: `effects::outline_share`, and for
                 // pixel layers the stroke's share beneath a partly covering layer (fill < 100 %).
                 let ll = self.retain(l);
-                cover = Some(init(self, ll, None, INIT_COVER, 1.0));
+                cover = Some(self.fx_init(clip, ll, None, INIT_COVER, 1.0));
             }
             for (n, &(i, st)) in outs.iter().enumerate() {
                 let paint = self.fx_paint(&st.paint, anchor);
@@ -1029,6 +1192,18 @@ impl<'a> Planner<'a> {
             p.clip = Some(clip);
             w = self.emit(p);
         }
+        work.w = w;
+    }
+
+    fn effect_outer_bevel(&mut self, work: &mut EffectState<'a>) {
+        let rev = work.rev.clone();
+        let bevel_paint = |b: &photocraft_doc::Bevel| photocraft_compose::effects::bevel_geom(b).paint;
+        let fx = work.fx;
+        let content = work.content;
+        let mut w = work.w;
+        let clip = work.clip;
+        let sb = work.sb;
+        let map = |item: usize, map: usize| MapRef { fx, item, map };
         for &(i, e) in &rev {
             if let Effect::BevelEmboss(b) = e
                 && bevel_paint(b) == photocraft_compose::effects::BevelPaint::Outer
@@ -1049,13 +1224,30 @@ impl<'a> Planner<'a> {
             }
         }
 
+        work.w = w;
+    }
+
+    fn effect_merge(&mut self, work: &mut EffectState<'a>) -> Slot {
+        let layer = work.layer;
+        let rev = work.rev.clone();
+        let fx = work.fx;
+        let content = work.content;
+        let w = work.w;
+        let l = work.l;
+        let backdrop = work.backdrop;
+        let clip = work.clip;
+        let sb = work.sb;
+        let atop = work.atop;
+        let premerge = work.premerge;
+        let bevel_paint = |b: &photocraft_doc::Bevel| photocraft_compose::effects::bevel_geom(b).paint;
+        let map = |item: usize, map: usize| MapRef { fx, item, map };
         let mode = if premerge || layer.blend == BlendMode::PassThrough { BlendMode::Normal } else { layer.blend };
         let late: Vec<(usize, &'a photocraft_doc::Bevel)> = rev
             .iter()
             .filter_map(|&(i, e)| if let Effect::BevelEmboss(b) = e { Some((i, b)) } else { None })
             .filter(|(_, b)| bevel_paint(b) == photocraft_compose::effects::BevelPaint::Both)
             .collect();
-        let merged = if late.is_empty() {
+        if late.is_empty() {
             let mut p = Pass::new(Kernel::FxMerge, 0);
             p.a = Some(w);
             p.b = Some(l);
@@ -1093,11 +1285,17 @@ impl<'a> Planner<'a> {
             p.flags = if atop { F_ATOP } else { 0 } | F_NO_LAYER;
             p.clip = Some(clip);
             self.emit(p)
-        };
-        self.release(content);
+        }
+    }
 
-        // Write the clipped result back into the backdrop (in place when nothing else holds it).
-        Ok(self.write_back(backdrop, merged, clip))
+    fn fx_init(&mut self, clip: Rect, src: Slot, b: Option<Slot>, kind: i32, opacity: f32) -> Slot {
+        let mut pass = Pass::new(Kernel::FxInit, 0);
+        pass.a = Some(src);
+        pass.b = b;
+        pass.adjust_kind = kind;
+        pass.opacity = opacity;
+        pass.clip = Some(clip);
+        self.emit(pass)
     }
 
     fn fx_paint(&self, p: &'a FxPaint, anchor: (f64, f64)) -> Paint<'a> {
diff --git a/crates/gpu/src/plan/tests.rs b/crates/gpu/src/plan/tests.rs
index 283fe034de..83f286bf2b 100644
--- a/crates/gpu/src/plan/tests.rs
+++ b/crates/gpu/src/plan/tests.rs
@@ -108,7 +108,8 @@ fn outer_glow_plan_knocks_out_see_through_fill() {
 #[test]
 fn color_lookup_with_an_overflowing_stored_size_uploads_no_table() {
     for size in [1 << 22, u32::MAX] {
-        let a = Adjustment::ColorLookup { name: "x".into(), lut: Some(std::sync::Arc::new(vec![0.5; 24])), size, tetrahedral: false, dither: false };
+        let a =
+            Adjustment::ColorLookup { name: "x".into(), lut: Some(std::sync::Arc::new(vec![0.5; 24])), size, tetrahedral: false, dither: false, source: None };
         let (kind, _, rows) = adjustment_program(&a, Transfer::Srgb, SampleType::U8, photocraft_color::ColorMode::Rgb);
         assert_eq!((kind, rows.is_none()), (0, true), "size {size}");
     }
diff --git a/crates/gpu/src/plan/types.rs b/crates/gpu/src/plan/types.rs
index e83fac8c8c..13005dbba2 100644
--- a/crates/gpu/src/plan/types.rs
+++ b/crates/gpu/src/plan/types.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{BlendMode, Document, GlobalLight, Layer, LayerId, Pattern, Rect, Slot, Surface, Transfer};
 
 /// Pipeline (fragment entry point) of a pass.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
diff --git a/crates/gpu/src/readback.rs b/crates/gpu/src/readback.rs
index 14dd73a831..9abf5f071e 100644
--- a/crates/gpu/src/readback.rs
+++ b/crates/gpu/src/readback.rs
@@ -1,5 +1,5 @@
 use super::textures::Stats;
-use super::*;
+use super::{Compositor, Document, Rect, Unsupported};
 
 /// Blocking readback of a composite (native tests and tools).
 #[cfg(not(target_arch = "wasm32"))]
diff --git a/crates/gpu/src/setup.rs b/crates/gpu/src/setup.rs
index 06f7a6ce81..1eef2147b5 100644
--- a/crates/gpu/src/setup.rs
+++ b/crates/gpu/src/setup.rs
@@ -3,7 +3,9 @@ use super::consts::{ACC_FORMAT, CHUNK, CHUNK_UNIFORM, FX_BUDGET, MAP16, MAP32, M
 use super::kit::{Kit, SHADER, tex_entry, uniform_entry};
 use super::paging::{cell_rect, field_reaches, first_error, grid_rects};
 use super::textures::{FxEntry, Resident, Tex, TexKind};
-use super::*;
+use super::{
+    Compositor, DeviceHealth, DocId, Document, Fault, HashMap, Kernel, LayerContent, Plan, Rect, Role, TILE_SIZE, Unsupported, fx, plan, prefix, timing,
+};
 
 impl Compositor {
     /// Create a compositor with the default accumulation format ([`ACC_FORMAT`]).
@@ -386,7 +388,7 @@ impl Compositor {
 
     /// A pattern's texture must fit the device and the per-pattern cap; a larger one renders on
     /// the CPU compositor.
-    fn check_pattern(&self, pat: &Pattern) -> Result<(), Unsupported> {
+    fn check_pattern(&self, pat: &photocraft_doc::Pattern) -> Result<(), Unsupported> {
         if pat.width > self.device_max || pat.height > self.device_max {
             return Err(Unsupported(format!("pattern `{}` larger than the GPU texture limit", pat.name)));
         }
diff --git a/crates/gpu/src/textures.rs b/crates/gpu/src/textures.rs
index 1b28f61150..5b52dfefaa 100644
--- a/crates/gpu/src/textures.rs
+++ b/crates/gpu/src/textures.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Arc, DocId, FieldKind, HashMap, LayerId, PixelFormat, Rect, Role, SampleType, Tile, TileCoord, fx, timing};
 
 /// A finished chunk: straight-alpha RGBA32F pixels of `rect` (document coordinates) at the
 /// texture's origin.
diff --git a/crates/gpu/tests/it/parity.rs b/crates/gpu/tests/it/parity.rs
index d56b0eddae..ea1af9951e 100644
--- a/crates/gpu/tests/it/parity.rs
+++ b/crates/gpu/tests/it/parity.rs
@@ -715,7 +715,7 @@ fn lookup(n: usize, tetrahedral: bool, dither: bool) -> Adjustment {
             }
         }
     }
-    Adjustment::ColorLookup { name: "test".into(), lut: Some(std::sync::Arc::new(t)), size: n as u32, tetrahedral, dither }
+    Adjustment::ColorLookup { name: "test".into(), lut: Some(std::sync::Arc::new(t)), size: n as u32, tetrahedral, dither, source: None }
 }
 
 /// 32-bit Hue/Saturation on colours at and above HSL lightness 1 and with a negative channel,
@@ -2482,6 +2482,36 @@ fn stroked_shapes_with_clipped_layers() {
     }
 }
 
+/// A Photoshop Frame's stroke (#4381): along the group's vector mask, above its masked content,
+/// for an empty frame and one holding a layer, pass-through and isolated.
+#[test]
+fn frame_strokes() {
+    let Some(mut g) = gpu() else { return };
+    use photocraft_doc::vector::{Path, ShapeStroke, StrokeAlign, Subpath, VectorMask};
+    for depth in [SampleType::U8, SampleType::U16, SampleType::F32] {
+        for (blend, align, content) in [
+            (BlendMode::PassThrough, StrokeAlign::Inside, false),
+            (BlendMode::PassThrough, StrokeAlign::Outside, true),
+            (BlendMode::Multiply, StrokeAlign::Center, true),
+        ] {
+            let mut d = Document::new("t", Size::new(80, 64), ColorMode::Rgb, depth);
+            d.layers.push(noise_layer("bg", d.pixel_format(), Rect::from_xywh(0, 0, 80, 64), 1, 0.3));
+            let kids = if content { vec![noise_layer("c", d.pixel_format(), Rect::from_xywh(0, 0, 80, 64), 7, 0.4)] } else { vec![] };
+            let mut l = Layer::group("Frame 1", kids);
+            l.blend = blend;
+            l.opacity = 0.8;
+            l.vector_mask = Some(VectorMask::new(Path::new(vec![Subpath::polygon(&[(10.3, 8.6), (66.2, 12.1), (58.7, 54.4), (16.9, 48.2)])])));
+            if let LayerContent::Group(gr) = &mut l.content {
+                gr.frame_stroke = Some(ShapeStroke { width: 5.0, align, paint: Fill::Solid(Color::rgb(0.9, 0.1, 0.1)), ..Default::default() });
+            }
+            d.layers.push(l);
+            let st = photocraft_gpu::render_to_vec_stats(&mut g.comp, &g.device, &g.queue, &d, d.bounds());
+            assert!(st.is_ok(), "planned on the GPU");
+            check(&mut g, &d, &format!("{depth:?} frame stroke {blend:?} {align:?} content {content}"));
+        }
+    }
+}
+
 #[test]
 fn artboards() {
     let Some(mut g) = gpu() else { return };
@@ -3076,6 +3106,25 @@ fn pass_through_clipping_base_with_an_adjustment() {
     check(&mut g, &d, "pass-through clipping base with an adjustment");
 }
 
+/// Transparency Shapes Layer off changes the special eight's blend (the layer's alpha blends as
+/// Fill, #5692); the GPU has no pass for it and leaves such documents to the CPU. Other modes look
+/// the same either way and stay on the GPU.
+#[test]
+fn transparency_shapes_off_special_blend_falls_back_to_the_cpu() {
+    let Some(mut g) = gpu() else { return };
+    let mut d = base_doc(64, 48);
+    let mut l = noise_layer("top", PixelFormat::RGBA8, Rect::new(4, 3, 60, 45), 2, 0.0);
+    l.blend = BlendMode::ColorDodge;
+    l.opacity = 0.53;
+    l.advanced.transparency_shapes = false;
+    d.layers.push(l);
+    assert!(render_to_vec(&mut g.comp, &g.device, &g.queue, &d, d.bounds()).is_err(), "Color Dodge with Transparency Shapes Layer off");
+    if let Some(l) = d.layers.last_mut() {
+        l.blend = BlendMode::Multiply;
+    }
+    check(&mut g, &d, "Multiply with Transparency Shapes Layer off");
+}
+
 /// #5846: a shape's Density and Feather soften its fill (its own rendered pixels), with and
 /// without a vector stroke over clipped layers and layer effects: the GPU matches the CPU.
 #[test]
diff --git a/crates/io/Cargo.toml b/crates/io/Cargo.toml
index 83ccd3b784..4eb91fb728 100644
--- a/crates/io/Cargo.toml
+++ b/crates/io/Cargo.toml
@@ -49,6 +49,7 @@ resvg = { version = "0.45", default-features = false, features = ["text", "syste
 resvg = { version = "0.45", default-features = false, features = ["text", "raster-images"] }
 
 [dev-dependencies]
+miniz_oxide = "0.9"
 crc32fast = "1.5"
 photocraft-affinity = { workspace = true, features = ["synth"] }
 flate2 = { workspace = true }
diff --git a/crates/io/examples/bench_abr.rs b/crates/io/examples/bench_abr.rs
index 0811cb0ae8..17d4740962 100644
--- a/crates/io/examples/bench_abr.rs
+++ b/crates/io/examples/bench_abr.rs
@@ -62,7 +62,7 @@ fn main() {
     // `--write <path>`: also save a small showcase file (procedural tips) for UI snapshots.
     let args: Vec<String> = std::env::args().collect();
     if let Some(path) = args.iter().position(|a| a == "--write").and_then(|i| args.get(i + 1)) {
-        use photocraft_paint::procedural::*;
+        use photocraft_paint::procedural::{charcoal_tip, leaf_tip, sponge_tip, star_tip};
         let tips = [("Leafy", leaf_tip(96)), ("Charcoal Stick", charcoal_tip(96, 3)), ("Sea Sponge", sponge_tip(96, 5)), ("Star Burst", star_tip(96))];
         let samples: Vec<AbrSample> = tips
             .iter()
diff --git a/crates/io/examples/bench_export.rs b/crates/io/examples/bench_export.rs
new file mode 100644
index 0000000000..bd5685ecc7
--- /dev/null
+++ b/crates/io/examples/bench_export.rs
@@ -0,0 +1,93 @@
+//! Export timings on a realistic photo document (default 7360×4912 = 36 MP): the opened photo,
+//! a painted layer covering part of the canvas, and a soft half-transparent layer.
+//!
+//! ```sh
+//! cargo run --release -p photocraft-io --example bench_export -- [--size 7360x4912] [--reps 7] [--only pcraft] [--out DIR]
+//! ```
+//!
+//! Each row is the median (and min) of `--reps` runs. `--out DIR` writes each format's bytes to
+//! `DIR/out.<ext>` so two builds' output can be compared.
+use std::time::Instant;
+
+use photocraft_doc::Layer;
+use photocraft_geom::Rect;
+
+fn arg(args: &[String], name: &str) -> Option<String> {
+    args.iter().position(|a| a == name).and_then(|i| args.get(i + 1).cloned())
+}
+
+fn photo(w: u32, h: u32) -> photocraft_codecs::Image {
+    let mut px = vec![0u8; w as usize * h as usize * 3];
+    for (y, row) in px.chunks_mut(w as usize * 3).enumerate() {
+        for x in 0..w as usize {
+            let (fx, fy) = (x as f32 / w as f32, y as f32 / h as f32);
+            let n = ((x.wrapping_mul(73_856_093) ^ y.wrapping_mul(19_349_663)) % 997) as f32 / 997.0 - 0.5;
+            let blob = (-(((fx - 0.4) * 3.0).powi(2) + ((fy - 0.55) * 4.0).powi(2))).exp();
+            let r = 0.55 + 0.35 * (fx * 6.0).sin() * 0.5 + 0.3 * blob + n * 0.06;
+            let g = 0.45 + 0.25 * (fy * 9.0 + fx * 2.0).cos() * 0.5 + 0.2 * blob + n * 0.06;
+            let b = 0.35 + 0.4 * fy - 0.2 * blob + n * 0.06;
+            for (c, v) in [r, g, b].into_iter().enumerate() {
+                row[x * 3 + c] = (v.clamp(0.0, 1.0) * 255.0 + 0.5) as u8;
+            }
+        }
+    }
+    photocraft_codecs::Image::from_raw(w, h, photocraft_codecs::ChannelLayout::Rgb, photocraft_codecs::SampleType::U8, px).expect("image")
+}
+
+fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    let (w, h) = arg(&args, "--size").and_then(|s| s.split_once('x').and_then(|(a, b)| Some((a.parse().ok()?, b.parse().ok()?)))).unwrap_or((7360u32, 4912u32));
+    let reps: usize = arg(&args, "--reps").and_then(|s| s.parse().ok()).unwrap_or(7);
+    let only = arg(&args, "--only");
+    let out = arg(&args, "--out");
+
+    let png = photocraft_codecs::encode(&photo(w, h), photocraft_codecs::Format::Png, &Default::default()).expect("png");
+    let mut doc = photocraft_io::import("photo.png", &png).expect("import").document;
+    let fmt = doc.pixel_format();
+    let mut paint = Layer::raster("paint", fmt);
+    if let Some(s) = paint.surface_mut() {
+        let (pw, ph) = (w / 2, h / 3);
+        let data: Vec<f32> = (0..pw * ph)
+            .flat_map(|i| {
+                let (x, y) = (i % pw, i / pw);
+                let a = if (x / 64 + y / 64) % 3 == 0 { 0.0 } else { 0.85 };
+                [0.75, (x % 256) as f32 / 255.0, (y % 256) as f32 / 255.0, a]
+            })
+            .collect();
+        s.write_region(Rect::from_xywh(w as i32 / 8, h as i32 / 4, pw, ph), &data);
+    }
+    doc.layers.push(paint);
+    let mut soft = Layer::raster("soft", fmt);
+    soft.opacity = 0.6;
+    if let Some(s) = soft.surface_mut() {
+        s.fill_rect(Rect::from_xywh(w as i32 / 2, 0, w / 2, h), &[0.1, 0.2, 0.9, 0.5]);
+    }
+    doc.layers.push(soft);
+
+    println!("document {w}×{h}, {} layers, {reps} reps (median / min ms)", doc.layers.len());
+    // "pcraft+cache" is the app's Save: one export cache per document, so the first save
+    // compresses every tile and later ones reuse what fits the cache (timed after a warm-up save).
+    for ext in ["psd", "pcraft", "pcraft+cache", "tif", "png", "jpg"] {
+        if only.as_deref().is_some_and(|o| o != ext) {
+            continue;
+        }
+        let cached = ext == "pcraft+cache";
+        let opts = photocraft_io::ExportOptions { pcraft_cache: cached.then(photocraft_io::PcraftExportCache::default), ..Default::default() };
+        let name = format!("x.{}", ext.trim_end_matches("+cache"));
+        if cached {
+            photocraft_io::export(&doc, &name, &opts).expect("warm-up");
+        }
+        let mut times = Vec::with_capacity(reps);
+        let mut bytes = Vec::new();
+        for _ in 0..reps {
+            let t = Instant::now();
+            bytes = photocraft_io::export(&doc, &name, &opts).expect("export").bytes;
+            times.push(t.elapsed().as_secs_f64() * 1000.0);
+        }
+        times.sort_by(f64::total_cmp);
+        println!("{ext:>7}: {:9.1} / {:9.1}  ({} bytes)", times[times.len() / 2], times[0], bytes.len());
+        if let Some(dir) = &out {
+            std::fs::write(format!("{dir}/out.{}", ext.replace('+', "-")), &bytes).expect("write");
+        }
+    }
+}
diff --git a/crates/io/examples/gen_abr_library.rs b/crates/io/examples/gen_abr_library.rs
index cbb2ad303c..c19e4a85d8 100644
--- a/crates/io/examples/gen_abr_library.rs
+++ b/crates/io/examples/gen_abr_library.rs
@@ -13,7 +13,7 @@
 //! `--raw` store tips uncompressed (bigger files). Each file stays under the reader's decoded cap (1 GiB; 512 MiB on 32-bit).
 #![allow(clippy::unwrap_used, clippy::expect_used)]
 
-use photocraft_paint::procedural::*;
+use photocraft_paint::procedural::{bristle_tip, chalk_tip, charcoal_tip, grass_tip, leaf_tip, rake_tip, spatter_tip, sponge_tip, star_tip};
 use photocraft_paint::tile::GrayTile;
 use photocraft_psd::abr::{AbrSample, MAX_TOTAL_BYTES, write_v6};
 use photocraft_psd::descriptor::{Descriptor, UnicodeString, Value};
diff --git a/crates/io/examples/oracle_diff.rs b/crates/io/examples/oracle_diff.rs
index fddef567a9..cc4b5aa0de 100644
--- a/crates/io/examples/oracle_diff.rs
+++ b/crates/io/examples/oracle_diff.rs
@@ -22,9 +22,244 @@ fn main() {
         corpus_summary(std::path::Path::new(&path));
         return;
     }
-    let bytes = std::fs::read(&path).unwrap();
+    run_file(&path);
+}
+
+fn run_file(path: &str) {
+    let bytes = std::fs::read(path).unwrap();
     let file = photocraft_psd::PsdFile::from_bytes(&bytes).unwrap();
-    let mut imp = photocraft_io::import(&path, &bytes).unwrap();
+    let mut imp = photocraft_io::import(path, &bytes).unwrap();
+    configure_visibility(&mut imp.document.layers);
+    let doc = &imp.document;
+    println!("mode {:?} depth {:?} layers {} warnings {:?} light {:?}", doc.mode, doc.depth, doc.layer_count(), imp.warnings, doc.global_light);
+    print_layer_details(doc);
+    dump_filter_effects(&file);
+    let ours = photocraft_compose::flatten(doc).px;
+    let merged = photocraft_io::merged_composite(&file).unwrap();
+    compare_modes(doc, &ours, &merged);
+}
+
+fn compare_modes(doc: &photocraft_doc::Document, ours: &[[f32; 4]], merged: &[[f32; 4]]) {
+    if std::env::args().nth(3).as_deref() == Some("png") {
+        write_comparison_png(doc, ours, merged);
+        return;
+    }
+    if std::env::args().nth(3).as_deref() == Some("dump") {
+        // dump prefix: raw little-endian f32 RGBA (straight) planes for offline fitting:
+        // prefix_ours.f32, prefix_ps.f32, prefix_L<i>.f32 (each top-level layer's own pixels,
+        // masks not applied) and prefix.txt (width, height, layer names).
+        let out = std::env::args().nth(4).expect("prefix");
+        let wr = |name: String, px: &[[f32; 4]]| {
+            let bytes: Vec<u8> = px.iter().flat_map(|p| p.iter().flat_map(|v| v.to_le_bytes())).collect();
+            std::fs::write(name, bytes).unwrap();
+        };
+        wr(format!("{out}_ours.f32"), ours);
+        wr(format!("{out}_ps.f32"), merged);
+        let mut meta = format!("{} {}\n", doc.size.width, doc.size.height);
+        for (i, l) in doc.layers.iter().enumerate() {
+            let b = photocraft_compose::surface_to_buffer(
+                l.surface().unwrap_or(&photocraft_raster::Surface::new(photocraft_color::PixelFormat::RGBA8)),
+                doc.bounds(),
+            );
+            wr(format!("{out}_L{i}.f32"), &b.px);
+            meta += &format!("{i} {}\n", l.name);
+        }
+        std::fs::write(format!("{out}.txt"), meta).unwrap();
+        return;
+    }
+    if std::env::args().nth(3).as_deref() == Some("layerpx") {
+        // layerpx x y: each layer's own pixel (0-255).
+        let x: i32 = std::env::args().nth(4).and_then(|s| s.parse().ok()).unwrap_or(0);
+        let y: i32 = std::env::args().nth(5).and_then(|s| s.parse().ok()).unwrap_or(0);
+        for l in doc.walk() {
+            if let Some(s) = l.2.surface() {
+                println!("{:?}: {:?}", l.2.name, s.pixel(x, y).iter().map(|v| (v * 255.0 * 100.0).round() / 100.0).collect::<Vec<_>>());
+            }
+        }
+        return;
+    }
+    if std::env::args().nth(3).as_deref() == Some("grid") {
+        // grid x0 y0 x1 y1 [channel]: ours / photoshop values (0-255, premultiplied colour).
+        let w = doc.size.width as usize;
+        let a: Vec<usize> = (4..8).map(|i| std::env::args().nth(i).and_then(|s| s.parse().ok()).unwrap_or(0)).collect();
+        let ch: usize = std::env::args().nth(8).and_then(|s| s.parse().ok()).unwrap_or(3);
+        for (label, img) in [("ours", &ours), ("ps", &merged)] {
+            println!("{label} (channel {ch}):");
+            for y in a[1]..a[3] {
+                let row: Vec<String> = (a[0]..a[2])
+                    .map(|x| {
+                        let p = img[y * w + x];
+                        let v = if ch == 3 { p[3] } else { p[ch] * p[3] };
+                        format!("{:4}", (v * 255.0).round())
+                    })
+                    .collect();
+                println!("  y={y:4} {}", row.join(""));
+            }
+        }
+        return;
+    }
+    if std::env::args().nth(3).as_deref() == Some("bylayer") {
+        // Max error and bad-pixel count inside each layer's bounds grown by its effects' reach
+        // (regions overlap; a quick way to tell which layer or effect is off).
+        let (w, h) = (doc.size.width as i32, doc.size.height as i32);
+        for (_, _, l) in doc.walk() {
+            let Some(sf) = l.surface() else { continue };
+            let cb = sf.content_bounds();
+            let mut b = photocraft_geom::Rect::new(i32::MAX, i32::MAX, i32::MIN, i32::MIN);
+            for y in cb.y0..cb.y1 {
+                for x in cb.x0..cb.x1 {
+                    let p = sf.pixel(x, y);
+                    if p[p.len() - 1] > 0.0 {
+                        b = photocraft_geom::Rect::new(b.x0.min(x), b.y0.min(y), b.x1.max(x + 1), b.y1.max(y + 1));
+                    }
+                }
+            }
+            if b.x0 > b.x1 {
+                continue;
+            }
+            let m = photocraft_compose::effects::margin(l);
+            let r = photocraft_geom::Rect::new((b.x0 - m).max(0), (b.y0 - m).max(0), (b.x1 + m).min(w), (b.y1 + m).min(h));
+            let (mut worst, mut at, mut bad) = (0.0f32, (0, 0), 0usize);
+            for y in r.y0..r.y1 {
+                for x in r.x0..r.x1 {
+                    let i = (y * w + x) as usize;
+                    let (a, b) = (ours[i], merged[i]);
+                    let d = (0..3).map(|c| (a[c] * a[3] - b[c] * b[3]).abs()).fold((a[3] - b[3]).abs(), f32::max);
+                    if d > 2.0 / 255.0 {
+                        bad += 1;
+                    }
+                    if d > worst {
+                        (worst, at) = (d, (x, y));
+                    }
+                }
+            }
+            let fx: Vec<&str> = l.effects.items.iter().filter(|e| e.enabled()).map(|e| e.label()).collect();
+            println!("{:<32} {:>6.1} at {:?} bad {:>6}  {:?} {:?}", l.name, worst * 255.0, at, bad, l.blend, fx);
+        }
+        return;
+    }
+    if std::env::args().nth(3).as_deref() == Some("worst") {
+        // The N worst pixels (premultiplied max channel error), with coordinates.
+        let w = doc.size.width as usize;
+        let n: usize = std::env::args().nth(4).and_then(|s| s.parse().ok()).unwrap_or(20);
+        let mut v: Vec<(f32, usize)> = ours
+            .iter()
+            .zip(merged)
+            .enumerate()
+            .map(|(i, (a, b))| ((0..4).map(|c| (a[c] * a[3] - b[c] * b[3]).abs()).fold((a[3] - b[3]).abs(), f32::max), i))
+            .collect();
+        v.sort_by(|a, b| b.0.total_cmp(&a.0));
+        for (d, i) in v.into_iter().take(n) {
+            let (a, b) = (ours[i], merged[i]);
+            println!("({:4},{:4}) d={:5.1} ours {:?} ps {:?}", i % w, i / w, d * 255.0, a.map(|v| (v * 255.0).round()), b.map(|v| (v * 255.0).round()));
+        }
+        return;
+    }
+    if std::env::args().nth(3).as_deref() == Some("row") {
+        let w = doc.size.width as usize;
+        let y: usize = std::env::args().nth(4).and_then(|s| s.parse().ok()).unwrap_or(0);
+        let (x0, x1): (usize, usize) =
+            (std::env::args().nth(5).and_then(|s| s.parse().ok()).unwrap_or(0), std::env::args().nth(6).and_then(|s| s.parse().ok()).unwrap_or(w));
+        for x in (x0..x1).step_by(((x1 - x0) / 20).max(1)) {
+            let (a, b) = (ours[y * w + x], merged[y * w + x]);
+            println!("x={x:5} ours {:?} ps {:?}", a.map(|v| (v * 1000.0).round() / 1000.0), b.map(|v| (v * 1000.0).round() / 1000.0));
+        }
+        return;
+    }
+    if std::env::args().nth(3).as_deref() == Some("solve") {
+        // solve layer-name x0 y0 x1 y1: per pixel the layer's content alpha `l`, its shape's path
+        // coverage `cov`, Photoshop's alpha `A` and the alpha `s` an effect beneath the layer
+        // would need (A = s + l (1 - s)) over a transparent backdrop.
+        let name = std::env::args().nth(4).expect("layer name");
+        let a: Vec<i32> = (5..9).map(|i| std::env::args().nth(i).and_then(|s| s.parse().ok()).unwrap_or(0)).collect();
+        let w = doc.size.width as usize;
+        let l = doc.walk().into_iter().map(|t| t.2).find(|l| l.name == name).expect("layer");
+        let r = photocraft_geom::Rect::new(a[0], a[1], a[2], a[3]);
+        let cov = match &l.content {
+            photocraft_doc::LayerContent::Shape(sh) => photocraft_vector::path_coverage(&sh.path, r),
+            _ => vec![0.0; r.width() as usize * r.height() as usize],
+        };
+        for y in r.y0..r.y1 {
+            for x in r.x0..r.x1 {
+                let la = l.surface().map_or(0.0, |s| s.pixel(x, y)[3]);
+                let c = cov[((y - r.y0) * r.width() as i32 + x - r.x0) as usize];
+                let p = merged[y as usize * w + x as usize];
+                let o = ours[y as usize * w + x as usize];
+                let s = if la < 1.0 { (p[3] - la) / (1.0 - la) } else { f32::NAN };
+                println!("({x:3},{y:3}) l {la:.3} cov {c:.3} A {:.3} ours {:.3} s {s:.3} ps {:?}", p[3], o[3], p.map(|v| (v * 255.0).round()));
+            }
+        }
+        return;
+    }
+    if std::env::args().nth(3).as_deref() == Some("line") {
+        // line x0 y0 x1 y1: every pixel on the segment, straight RGBA 0-255, ours | ps.
+        let w = doc.size.width as usize;
+        let a: Vec<i64> = (4..8).map(|i| std::env::args().nth(i).and_then(|s| s.parse().ok()).unwrap_or(0)).collect();
+        let n = (a[2] - a[0]).abs().max((a[3] - a[1]).abs()).max(1);
+        for k in 0..=n {
+            let (x, y) = ((a[0] + (a[2] - a[0]) * k / n) as usize, (a[1] + (a[3] - a[1]) * k / n) as usize);
+            let (o, p) = (ours[y * w + x], merged[y * w + x]);
+            println!("({x:4},{y:4}) ours {:?} ps {:?}", o.map(|v| (v * 255.0).round()), p.map(|v| (v * 255.0).round()));
+        }
+        return;
+    }
+    if std::env::args().nth(3).as_deref() == Some("col") {
+        let (w, h) = (doc.size.width as usize, doc.size.height as usize);
+        let x = std::env::args().nth(4).and_then(|s| s.parse().ok()).unwrap_or(w / 2);
+        for k in 0..=16 {
+            let y = ((h - 1) * k / 16).min(h - 1);
+            let (a, b) = (ours[y * w + x], merged[y * w + x]);
+            println!("y={y:5} ours {:?} ps {:?}", a.map(|v| (v * 1000.0).round() / 1000.0), b.map(|v| (v * 1000.0).round() / 1000.0));
+        }
+        return;
+    }
+    let n = std::env::args().nth(2).and_then(|s| s.parse().ok()).unwrap_or(8usize);
+    for (i, (a, b)) in ours.iter().zip(merged).enumerate().take(n) {
+        println!("{i:4}: ours {:?}\n      ps   {:?}", a.map(|v| (v * 1000.0).round() / 1000.0), b.map(|v| (v * 1000.0).round() / 1000.0));
+    }
+}
+
+fn write_comparison_png(doc: &photocraft_doc::Document, ours: &[[f32; 4]], merged: &[[f32; 4]]) {
+    // ours | photoshop | diff heatmap, side by side (over white).
+    let out = std::env::args().nth(4).expect("out.png");
+    let (w, h) = (doc.size.width as usize, doc.size.height as usize);
+    let mut img = vec![0u8; w * 3 * h * 4];
+    let q = |v: f32| (v.clamp(0.0, 1.0) * 255.0).round() as u8;
+    for y in 0..h {
+        for x in 0..w {
+            let (a, b) = (ours[y * w + x], merged[y * w + x]);
+            let over = |p: [f32; 4]| [p[0] * p[3] + 1.0 - p[3], p[1] * p[3] + 1.0 - p[3], p[2] * p[3] + 1.0 - p[3]];
+            let (oa, ob) = (over(a), over(b));
+            let d = (0..3).map(|c| (oa[c] - ob[c]).abs()).fold(0.0f32, f32::max);
+            let heat = [q((d * 4.0).min(1.0)), q((1.0 - d * 4.0).max(0.0) * 0.3), 0];
+            for (k, px) in [[q(oa[0]), q(oa[1]), q(oa[2])], [q(ob[0]), q(ob[1]), q(ob[2])], heat].iter().enumerate() {
+                let o = (y * w * 3 + k * w + x) * 4;
+                img[o..o + 3].copy_from_slice(px);
+                img[o + 3] = 255;
+            }
+        }
+    }
+    // SCALE=n: nearest-neighbour upscale (small files).
+    let k: usize = std::env::var("SCALE").ok().and_then(|s| s.parse().ok()).unwrap_or(1).clamp(1, 16);
+    let (img, w, h) = if k > 1 {
+        let mut big = vec![0u8; w * 3 * k * h * k * 4];
+        for y in 0..h * k {
+            for x in 0..w * 3 * k {
+                let (s, d) = (((y / k) * w * 3 + x / k) * 4, (y * w * 3 * k + x) * 4);
+                big[d..d + 4].copy_from_slice(&img[s..s + 4]);
+            }
+        }
+        (big, w * k, h * k)
+    } else {
+        (img, w, h)
+    };
+    let image =
+        photocraft_codecs::Image::from_raw((w * 3) as u32, h as u32, photocraft_codecs::ChannelLayout::Rgba, photocraft_codecs::SampleType::U8, img).unwrap();
+    std::fs::write(&out, photocraft_codecs::encode(&image, photocraft_codecs::Format::Png, &Default::default()).unwrap()).unwrap();
+    println!("wrote {out}");
+}
+
+fn configure_visibility(layers: &mut [photocraft_doc::Layer]) {
     if std::env::var_os("HIDE_ADJ").is_some() {
         // Composite without adjustment layers (their input, for fitting transfer curves).
         fn hide(ls: &mut [photocraft_doc::Layer]) {
@@ -37,18 +272,19 @@ fn main() {
                 }
             }
         }
-        hide(&mut imp.document.layers);
+        hide(layers);
     }
     if let Some(keep) = std::env::var_os("ONLY") {
         // Hide every top-level layer but the bottom one and those named in ONLY (comma-separated).
         let keep = keep.to_string_lossy().to_string();
         let names: Vec<&str> = keep.split(',').collect();
-        for l in imp.document.layers.iter_mut().skip(1) {
+        for l in layers.iter_mut().skip(1) {
             l.visible = names.contains(&l.name.as_str());
         }
     }
-    let doc = &imp.document;
-    println!("mode {:?} depth {:?} layers {} warnings {:?} light {:?}", doc.mode, doc.depth, doc.layer_count(), imp.warnings, doc.global_light);
+}
+
+fn print_layer_details(doc: &photocraft_doc::Document) {
     for l in doc.walk() {
         let l = l.2;
         println!(
@@ -184,6 +420,9 @@ fn main() {
             }
         }
     }
+}
+
+fn dump_filter_effects(file: &photocraft_psd::PsdFile) {
     if std::env::var_os("DUMP_FX").is_some() {
         fn walk(d: &photocraft_psd::descriptor::Descriptor, depth: usize) {
             for (k, v) in &d.items {
@@ -219,222 +458,6 @@ fn main() {
             }
         }
     }
-    let ours = photocraft_compose::flatten(doc).px;
-    let merged = photocraft_io::merged_composite(&file).unwrap();
-    if std::env::args().nth(3).as_deref() == Some("png") {
-        // ours | photoshop | diff heatmap, side by side (over white).
-        let out = std::env::args().nth(4).expect("out.png");
-        let (w, h) = (doc.size.width as usize, doc.size.height as usize);
-        let mut img = vec![0u8; w * 3 * h * 4];
-        let q = |v: f32| (v.clamp(0.0, 1.0) * 255.0).round() as u8;
-        for y in 0..h {
-            for x in 0..w {
-                let (a, b) = (ours[y * w + x], merged[y * w + x]);
-                let over = |p: [f32; 4]| [p[0] * p[3] + 1.0 - p[3], p[1] * p[3] + 1.0 - p[3], p[2] * p[3] + 1.0 - p[3]];
-                let (oa, ob) = (over(a), over(b));
-                let d = (0..3).map(|c| (oa[c] - ob[c]).abs()).fold(0.0f32, f32::max);
-                let heat = [q((d * 4.0).min(1.0)), q((1.0 - d * 4.0).max(0.0) * 0.3), 0];
-                for (k, px) in [[q(oa[0]), q(oa[1]), q(oa[2])], [q(ob[0]), q(ob[1]), q(ob[2])], heat].iter().enumerate() {
-                    let o = (y * w * 3 + k * w + x) * 4;
-                    img[o..o + 3].copy_from_slice(px);
-                    img[o + 3] = 255;
-                }
-            }
-        }
-        // SCALE=n: nearest-neighbour upscale (small files).
-        let k: usize = std::env::var("SCALE").ok().and_then(|s| s.parse().ok()).unwrap_or(1).clamp(1, 16);
-        let (img, w, h) = if k > 1 {
-            let mut big = vec![0u8; w * 3 * k * h * k * 4];
-            for y in 0..h * k {
-                for x in 0..w * 3 * k {
-                    let (s, d) = (((y / k) * w * 3 + x / k) * 4, (y * w * 3 * k + x) * 4);
-                    big[d..d + 4].copy_from_slice(&img[s..s + 4]);
-                }
-            }
-            (big, w * k, h * k)
-        } else {
-            (img, w, h)
-        };
-        let image =
-            photocraft_codecs::Image::from_raw((w * 3) as u32, h as u32, photocraft_codecs::ChannelLayout::Rgba, photocraft_codecs::SampleType::U8, img)
-                .unwrap();
-        std::fs::write(&out, photocraft_codecs::encode(&image, photocraft_codecs::Format::Png, &Default::default()).unwrap()).unwrap();
-        println!("wrote {out}");
-        return;
-    }
-    if std::env::args().nth(3).as_deref() == Some("dump") {
-        // dump prefix: raw little-endian f32 RGBA (straight) planes for offline fitting:
-        // prefix_ours.f32, prefix_ps.f32, prefix_L<i>.f32 (each top-level layer's own pixels,
-        // masks not applied) and prefix.txt (width, height, layer names).
-        let out = std::env::args().nth(4).expect("prefix");
-        let wr = |name: String, px: &[[f32; 4]]| {
-            let bytes: Vec<u8> = px.iter().flat_map(|p| p.iter().flat_map(|v| v.to_le_bytes())).collect();
-            std::fs::write(name, bytes).unwrap();
-        };
-        wr(format!("{out}_ours.f32"), &ours);
-        wr(format!("{out}_ps.f32"), &merged);
-        let mut meta = format!("{} {}\n", doc.size.width, doc.size.height);
-        for (i, l) in doc.layers.iter().enumerate() {
-            let b = photocraft_compose::surface_to_buffer(
-                l.surface().unwrap_or(&photocraft_raster::Surface::new(photocraft_color::PixelFormat::RGBA8)),
-                doc.bounds(),
-            );
-            wr(format!("{out}_L{i}.f32"), &b.px);
-            meta += &format!("{i} {}\n", l.name);
-        }
-        std::fs::write(format!("{out}.txt"), meta).unwrap();
-        return;
-    }
-    if std::env::args().nth(3).as_deref() == Some("layerpx") {
-        // layerpx x y: each layer's own pixel (0-255).
-        let x: i32 = std::env::args().nth(4).and_then(|s| s.parse().ok()).unwrap_or(0);
-        let y: i32 = std::env::args().nth(5).and_then(|s| s.parse().ok()).unwrap_or(0);
-        for l in doc.walk() {
-            if let Some(s) = l.2.surface() {
-                println!("{:?}: {:?}", l.2.name, s.pixel(x, y).iter().map(|v| (v * 255.0 * 100.0).round() / 100.0).collect::<Vec<_>>());
-            }
-        }
-        return;
-    }
-    if std::env::args().nth(3).as_deref() == Some("grid") {
-        // grid x0 y0 x1 y1 [channel]: ours / photoshop values (0-255, premultiplied colour).
-        let w = doc.size.width as usize;
-        let a: Vec<usize> = (4..8).map(|i| std::env::args().nth(i).and_then(|s| s.parse().ok()).unwrap_or(0)).collect();
-        let ch: usize = std::env::args().nth(8).and_then(|s| s.parse().ok()).unwrap_or(3);
-        for (label, img) in [("ours", &ours), ("ps", &merged)] {
-            println!("{label} (channel {ch}):");
-            for y in a[1]..a[3] {
-                let row: Vec<String> = (a[0]..a[2])
-                    .map(|x| {
-                        let p = img[y * w + x];
-                        let v = if ch == 3 { p[3] } else { p[ch] * p[3] };
-                        format!("{:4}", (v * 255.0).round())
-                    })
-                    .collect();
-                println!("  y={y:4} {}", row.join(""));
-            }
-        }
-        return;
-    }
-    if std::env::args().nth(3).as_deref() == Some("bylayer") {
-        // Max error and bad-pixel count inside each layer's bounds grown by its effects' reach
-        // (regions overlap; a quick way to tell which layer or effect is off).
-        let (w, h) = (doc.size.width as i32, doc.size.height as i32);
-        for (_, _, l) in doc.walk() {
-            let Some(sf) = l.surface() else { continue };
-            let cb = sf.content_bounds();
-            let mut b = photocraft_geom::Rect::new(i32::MAX, i32::MAX, i32::MIN, i32::MIN);
-            for y in cb.y0..cb.y1 {
-                for x in cb.x0..cb.x1 {
-                    let p = sf.pixel(x, y);
-                    if p[p.len() - 1] > 0.0 {
-                        b = photocraft_geom::Rect::new(b.x0.min(x), b.y0.min(y), b.x1.max(x + 1), b.y1.max(y + 1));
-                    }
-                }
-            }
-            if b.x0 > b.x1 {
-                continue;
-            }
-            let m = photocraft_compose::effects::margin(l);
-            let r = photocraft_geom::Rect::new((b.x0 - m).max(0), (b.y0 - m).max(0), (b.x1 + m).min(w), (b.y1 + m).min(h));
-            let (mut worst, mut at, mut bad) = (0.0f32, (0, 0), 0usize);
-            for y in r.y0..r.y1 {
-                for x in r.x0..r.x1 {
-                    let i = (y * w + x) as usize;
-                    let (a, b) = (ours[i], merged[i]);
-                    let d = (0..3).map(|c| (a[c] * a[3] - b[c] * b[3]).abs()).fold((a[3] - b[3]).abs(), f32::max);
-                    if d > 2.0 / 255.0 {
-                        bad += 1;
-                    }
-                    if d > worst {
-                        (worst, at) = (d, (x, y));
-                    }
-                }
-            }
-            let fx: Vec<&str> = l.effects.items.iter().filter(|e| e.enabled()).map(|e| e.label()).collect();
-            println!("{:<32} {:>6.1} at {:?} bad {:>6}  {:?} {:?}", l.name, worst * 255.0, at, bad, l.blend, fx);
-        }
-        return;
-    }
-    if std::env::args().nth(3).as_deref() == Some("worst") {
-        // The N worst pixels (premultiplied max channel error), with coordinates.
-        let w = doc.size.width as usize;
-        let n: usize = std::env::args().nth(4).and_then(|s| s.parse().ok()).unwrap_or(20);
-        let mut v: Vec<(f32, usize)> = ours
-            .iter()
-            .zip(&merged)
-            .enumerate()
-            .map(|(i, (a, b))| ((0..4).map(|c| (a[c] * a[3] - b[c] * b[3]).abs()).fold((a[3] - b[3]).abs(), f32::max), i))
-            .collect();
-        v.sort_by(|a, b| b.0.total_cmp(&a.0));
-        for (d, i) in v.into_iter().take(n) {
-            let (a, b) = (ours[i], merged[i]);
-            println!("({:4},{:4}) d={:5.1} ours {:?} ps {:?}", i % w, i / w, d * 255.0, a.map(|v| (v * 255.0).round()), b.map(|v| (v * 255.0).round()));
-        }
-        return;
-    }
-    if std::env::args().nth(3).as_deref() == Some("row") {
-        let w = doc.size.width as usize;
-        let y: usize = std::env::args().nth(4).and_then(|s| s.parse().ok()).unwrap_or(0);
-        let (x0, x1): (usize, usize) =
-            (std::env::args().nth(5).and_then(|s| s.parse().ok()).unwrap_or(0), std::env::args().nth(6).and_then(|s| s.parse().ok()).unwrap_or(w));
-        for x in (x0..x1).step_by(((x1 - x0) / 20).max(1)) {
-            let (a, b) = (ours[y * w + x], merged[y * w + x]);
-            println!("x={x:5} ours {:?} ps {:?}", a.map(|v| (v * 1000.0).round() / 1000.0), b.map(|v| (v * 1000.0).round() / 1000.0));
-        }
-        return;
-    }
-    if std::env::args().nth(3).as_deref() == Some("solve") {
-        // solve layer-name x0 y0 x1 y1: per pixel the layer's content alpha `l`, its shape's path
-        // coverage `cov`, Photoshop's alpha `A` and the alpha `s` an effect beneath the layer
-        // would need (A = s + l (1 - s)) over a transparent backdrop.
-        let name = std::env::args().nth(4).expect("layer name");
-        let a: Vec<i32> = (5..9).map(|i| std::env::args().nth(i).and_then(|s| s.parse().ok()).unwrap_or(0)).collect();
-        let w = doc.size.width as usize;
-        let l = doc.walk().into_iter().map(|t| t.2).find(|l| l.name == name).expect("layer");
-        let r = photocraft_geom::Rect::new(a[0], a[1], a[2], a[3]);
-        let cov = match &l.content {
-            photocraft_doc::LayerContent::Shape(sh) => photocraft_vector::path_coverage(&sh.path, r),
-            _ => vec![0.0; r.width() as usize * r.height() as usize],
-        };
-        for y in r.y0..r.y1 {
-            for x in r.x0..r.x1 {
-                let la = l.surface().map_or(0.0, |s| s.pixel(x, y)[3]);
-                let c = cov[((y - r.y0) * r.width() as i32 + x - r.x0) as usize];
-                let p = merged[y as usize * w + x as usize];
-                let o = ours[y as usize * w + x as usize];
-                let s = if la < 1.0 { (p[3] - la) / (1.0 - la) } else { f32::NAN };
-                println!("({x:3},{y:3}) l {la:.3} cov {c:.3} A {:.3} ours {:.3} s {s:.3} ps {:?}", p[3], o[3], p.map(|v| (v * 255.0).round()));
-            }
-        }
-        return;
-    }
-    if std::env::args().nth(3).as_deref() == Some("line") {
-        // line x0 y0 x1 y1: every pixel on the segment, straight RGBA 0-255, ours | ps.
-        let w = doc.size.width as usize;
-        let a: Vec<i64> = (4..8).map(|i| std::env::args().nth(i).and_then(|s| s.parse().ok()).unwrap_or(0)).collect();
-        let n = (a[2] - a[0]).abs().max((a[3] - a[1]).abs()).max(1);
-        for k in 0..=n {
-            let (x, y) = ((a[0] + (a[2] - a[0]) * k / n) as usize, (a[1] + (a[3] - a[1]) * k / n) as usize);
-            let (o, p) = (ours[y * w + x], merged[y * w + x]);
-            println!("({x:4},{y:4}) ours {:?} ps {:?}", o.map(|v| (v * 255.0).round()), p.map(|v| (v * 255.0).round()));
-        }
-        return;
-    }
-    if std::env::args().nth(3).as_deref() == Some("col") {
-        let (w, h) = (doc.size.width as usize, doc.size.height as usize);
-        let x = std::env::args().nth(4).and_then(|s| s.parse().ok()).unwrap_or(w / 2);
-        for k in 0..=16 {
-            let y = ((h - 1) * k / 16).min(h - 1);
-            let (a, b) = (ours[y * w + x], merged[y * w + x]);
-            println!("y={y:5} ours {:?} ps {:?}", a.map(|v| (v * 1000.0).round() / 1000.0), b.map(|v| (v * 1000.0).round() / 1000.0));
-        }
-        return;
-    }
-    let n = std::env::args().nth(2).and_then(|s| s.parse().ok()).unwrap_or(8usize);
-    for (i, (a, b)) in ours.iter().zip(&merged).enumerate().take(n) {
-        println!("{i:4}: ours {:?}\n      ps   {:?}", a.map(|v| (v * 1000.0).round() / 1000.0), b.map(|v| (v * 1000.0).round() / 1000.0));
-    }
 }
 
 /// The corpus oracle table (as `tests/it/corpus.rs`), files in parallel, without a test build.
@@ -467,7 +490,7 @@ fn corpus_summary(root: &std::path::Path) {
         let ours = photocraft_compose::flatten(&imp.document).px;
         let mut m = 0.0f32;
         let mut bad = 0usize;
-        for (a, b) in ours.iter().zip(&merged) {
+        for (a, b) in ours.iter().zip(merged) {
             let d = (0..4).map(|c| (a[c] * a[3] - b[c] * b[3]).abs()).fold((a[3] - b[3]).abs(), f32::max);
             m = m.max(d);
             if (0..4).any(|c| (a[c] * a[3] - b[c] * b[3]).abs() > TOL) {
diff --git a/crates/io/examples/psd_open_mem.rs b/crates/io/examples/psd_open_mem.rs
new file mode 100644
index 0000000000..903eb35af9
--- /dev/null
+++ b/crates/io/examples/psd_open_mem.rs
@@ -0,0 +1,56 @@
+//! Opens a file the way the app's background open does and reports the time. Run it under
+//! `/usr/bin/time -l` for the peak memory. `--read` reads the whole file first and imports the
+//! bytes, as opens did before `import_file` (to compare).
+//!
+//! `cargo run --release -p photocraft-io --example psd_open_mem -- <file.psd> [--read]`
+
+fn main() {
+    let Some(path) = std::env::args().nth(1).filter(|a| a != "--read") else {
+        eprintln!("usage: psd_open_mem <file.psd>");
+        std::process::exit(2);
+    };
+    if std::env::args().any(|a| a == "--read") {
+        read_then_import(&path);
+        return;
+    }
+    let t = std::time::Instant::now();
+    let res =
+        match photocraft_io::import_file(&path, std::path::Path::new(&path), &photocraft_io::ImportOptions::default(), &photocraft_raster::Interrupt::NONE) {
+            Ok(r) => r,
+            Err(e) => {
+                eprintln!("{path}: open failed: {e}");
+                std::process::exit(1);
+            }
+        };
+    report(&path, &format!("open {:.2}s", t.elapsed().as_secs_f64()), &res);
+}
+
+fn read_then_import(path: &str) {
+    let t = std::time::Instant::now();
+    let bytes = match photocraft_format::read_file(std::path::Path::new(path)) {
+        Ok(b) => b,
+        Err(e) => {
+            eprintln!("{path}: read failed: {e}");
+            std::process::exit(1);
+        }
+    };
+    let read_s = t.elapsed().as_secs_f64();
+    let t = std::time::Instant::now();
+    let res = match photocraft_io::import_with(path, &bytes, &photocraft_raster::Interrupt::NONE) {
+        Ok(r) => r,
+        Err(e) => {
+            eprintln!("{path}: open failed: {e}");
+            std::process::exit(1);
+        }
+    };
+    drop(bytes);
+    report(path, &format!("read {read_s:.2}s, import {:.2}s", t.elapsed().as_secs_f64()), &res);
+}
+
+fn report(path: &str, times: &str, res: &photocraft_io::ImportResult) {
+    let doc = &res.document;
+    println!("{path}: {times}, {} layers ({} top level)", doc.walk().len(), doc.layers.len());
+    for w in &res.warnings {
+        println!("  warning: {w}");
+    }
+}
diff --git a/crates/io/src/adjust_map.rs b/crates/io/src/adjust_map.rs
index 2cac91c4a0..463c882efb 100644
--- a/crates/io/src/adjust_map.rs
+++ b/crates/io/src/adjust_map.rs
@@ -11,9 +11,11 @@
 //! stay [`Adjustment::Unsupported`] and are written back verbatim.
 
 use photocraft_doc::Adjustment;
-use photocraft_doc::adjust::{CURVE_MAP_LEN, CurvePoint, HueRange, LevelsChannel, ToneSpace, curve_map, curve_map_outputs};
+use photocraft_doc::adjust::{CURVE_MAP_LEN, CurvePoint, HueRange, LevelsChannel, LutFormat, LutSource, ToneSpace, curve_map};
 use photocraft_psd::descriptor::{Descriptor, Value, VersionedDescriptor};
 
+mod encode;
+
 /// All PSD adjustment keys recognized as adjustment layers.
 pub const ADJUSTMENT_KEYS: [&[u8; 4]; 16] =
     [b"levl", b"curv", b"hue2", b"brit", b"nvrt", b"thrs", b"post", b"expA", b"vibA", b"blnc", b"mixr", b"grdm", b"phfl", b"selc", b"blwh", b"clrL"];
@@ -459,12 +461,12 @@ fn read_lookup(d: &[u8]) -> Result<Adjustment, String> {
         Some(_) => return Err("its LUT data is empty".into()),
         None => return Err("it uses a colour profile (abstract or device link), not a LUT file, which isn't supported yet".into()),
     };
-    let (ext, format) = match desc_enum(&desc, "LUTFormat") {
-        Some(b"LUTFormat3DL") => ("x.3dl", "3DL"),
-        Some(b"LUTFormatLOOK") => ("x.look", "LOOK"),
-        _ => ("x.cube", "CUBE"),
+    let format = match desc_enum(&desc, "LUTFormat") {
+        Some(b"LUTFormat3DL") => LutFormat::ThreeDl,
+        Some(b"LUTFormatLOOK") => LutFormat::Look,
+        _ => LutFormat::Cube,
     };
-    let lut = photocraft_cms::lutfile::parse(ext, bytes).map_err(|e| format!("its {format} LUT can't be read ({e})"))?;
+    let lut = parse_lut_source(format, bytes).map_err(|e| format!("its {} LUT can't be read ({e})", psd_lut_format(format).trim_start_matches("LUTFormat")))?;
     if !lut.domain_is_default() {
         return Err(format!(
             "its LUT has a non-default input domain (DOMAIN_MIN {:?}, DOMAIN_MAX {:?}), which is not supported yet",
@@ -478,9 +480,47 @@ fn read_lookup(d: &[u8]) -> Result<Adjustment, String> {
         lut: Some(std::sync::Arc::new(lut.data)),
         tetrahedral: false,
         dither: desc_bool(&desc, "Dthr").unwrap_or(false),
+        // Kept so a save embeds the file as loaded (Photoshop never converts it).
+        source: Some(LutSource { format, bytes: std::sync::Arc::new(bytes.clone()) }),
     })
 }
 
+/// A LUT file's table, read the way a PSD read does (an XML file tagged `.cube` is sniffed as `.look`).
+fn parse_lut_source(format: LutFormat, bytes: &[u8]) -> Result<photocraft_cms::lutfile::LutFile, photocraft_cms::lutfile::LutError> {
+    let format = match format {
+        LutFormat::Cube => photocraft_cms::lutfile::Format::Cube,
+        LutFormat::ThreeDl => photocraft_cms::lutfile::Format::ThreeDl,
+        LutFormat::Look => photocraft_cms::lutfile::Format::Look,
+    };
+    photocraft_cms::lutfile::parse(&format!("x.{}", format.extension()), bytes)
+}
+
+/// Photoshop's `LUTFormatType` value for a format.
+fn psd_lut_format(format: LutFormat) -> &'static str {
+    match format {
+        LutFormat::Cube => "LUTFormatCUBE",
+        LutFormat::ThreeDl => "LUTFormat3DL",
+        LutFormat::Look => "LUTFormatLOOK",
+    }
+}
+
+/// The source file of a Color Lookup to embed as is: only while it still parses to the
+/// layer's table, so an edited table is never saved with stale bytes.
+fn lut_source_for<'a>(source: Option<&'a LutSource>, table: &[f32], size: usize) -> Option<&'a LutSource> {
+    let source = source?;
+    let file = parse_lut_source(source.format, &source.bytes).ok()?;
+    (file.size == size && file.data == table).then_some(source)
+}
+
+/// `name` with a `.3dl` / `.look` extension swapped for `.cube`, for a table saved as `.cube`.
+fn cube_file_name(name: &str) -> String {
+    let lower = name.to_ascii_lowercase();
+    match [".3dl", ".look"].iter().find(|ext| lower.ends_with(*ext)) {
+        Some(ext) => format!("{}.cube", name.get(..name.len() - ext.len()).unwrap_or(name)),
+        None => name.to_string(),
+    }
+}
+
 /// The descriptor of a `vibA` / `blwh` block: a 4-byte descriptor version (16), then the descriptor.
 fn versioned(d: &[u8]) -> Option<Descriptor> {
     VersionedDescriptor::parse_prefix(d).ok().map(|(v, _)| v.descriptor)
@@ -630,206 +670,37 @@ fn levels_write(v: &mut Vec<u8>, c: &LevelsChannel) {
 /// (Brightness/Contrast also writes a `CgEd` descriptor). Every evaluated kind has an
 /// encoding; the result is empty only for an [`Adjustment::Unsupported`] with a malformed key.
 pub fn write(adj: &Adjustment) -> Vec<([u8; 4], Vec<u8>)> {
-    let mut v = Vec::new();
+    let block = |key: &[u8; 4], data: Vec<u8>| vec![(*key, data)];
     match adj {
-        Adjustment::Invert => return vec![(*b"nvrt", Vec::new())],
-        Adjustment::Threshold { level } => {
-            put16(&mut v, q255(*level).max(1));
-            put16(&mut v, 0);
-            return vec![(*b"thrs", v)];
-        }
-        Adjustment::Posterize { levels } => {
-            put16(&mut v, (*levels).clamp(2, 255) as u16);
-            put16(&mut v, 0);
-            return vec![(*b"post", v)];
-        }
-        Adjustment::BrightnessContrast { brightness, contrast, legacy } => {
-            v.extend_from_slice(&clamp_i16(*brightness).to_be_bytes());
-            v.extend_from_slice(&clamp_i16(*contrast).to_be_bytes());
-            put16(&mut v, 127);
-            v.push(0);
-            let d = Descriptor::new("null")
-                .with("Vrsn", Value::Integer(1))
-                .with("Brgh", Value::Integer(brightness.round() as i32))
-                .with("Cntr", Value::Integer(contrast.round() as i32))
-                .with("means", Value::Integer(127))
-                .with("Lab ", Value::Boolean(false))
-                .with("useLegacy", Value::Boolean(*legacy))
-                .with("Auto", Value::Boolean(false));
-            return vec![(*b"brit", v), (*b"CgEd", VersionedDescriptor::new(d).to_bytes())];
-        }
+        Adjustment::Invert => return block(b"nvrt", Vec::new()),
+        Adjustment::Threshold { level } => return block(b"thrs", encode::words(&[q255(*level).max(1), 0])),
+        Adjustment::Posterize { levels } => return block(b"post", encode::words(&[(*levels).clamp(2, 255) as u16, 0])),
+        Adjustment::BrightnessContrast { brightness, contrast, legacy } => return encode::brightness_contrast(*brightness, *contrast, *legacy),
         Adjustment::HueSaturation { hue, saturation, lightness, colorize, ranges } => {
-            put16(&mut v, 2);
-            v.push(u8::from(*colorize));
-            v.push(0);
-            // The colorize triplet, then the master triplet. The inactive one gets Photoshop's
-            // defaults; the colorize hue (0..360 in the model) is stored signed, -180..180.
-            let (colorize_hsl, master) = if *colorize {
-                let h = hue.rem_euclid(360.0);
-                ([if h > 180.0 { h - 360.0 } else { h }, *saturation, *lightness], [0.0; 3])
-            } else {
-                ([30.0, 25.0, 0.0], [*hue, *saturation, *lightness])
-            };
-            for x in colorize_hsl.into_iter().chain(master) {
-                v.extend_from_slice(&clamp_i16(x).to_be_bytes());
-            }
-            // Six hue ranges (reds, yellows, greens, cyans, blues, magentas): range values in
-            // 0..360, then the range's hue, saturation and lightness.
-            for r in ranges {
-                for x in r.bounds {
-                    put16(&mut v, x.rem_euclid(360.0).round() as u16 % 360);
-                }
-                for x in [r.hue, r.saturation, r.lightness] {
-                    v.extend_from_slice(&clamp_i16(x).to_be_bytes());
-                }
-            }
-            return vec![(*b"hue2", v)];
-        }
-        Adjustment::Exposure { exposure, offset, gamma } => {
-            put16(&mut v, 1);
-            for x in [exposure, offset, gamma] {
-                v.extend_from_slice(&x.to_be_bytes());
-            }
-            v.push(1); // color space flag (spec: "1 byte")
-            return vec![(*b"expA", v)];
-        }
-        Adjustment::Levels { master, per_channel, space, black } => {
-            put16(&mut v, 2);
-            levels_write(&mut v, master);
-            for c in per_channel {
-                levels_write(&mut v, c);
-            }
-            let ident = LevelsChannel::default();
-            levels_write(&mut v, if *space == ToneSpace::Cmyk { black } else { &ident });
-            for _ in 5..29 {
-                levels_write(&mut v, &LevelsChannel::default());
-            }
-            return vec![(*b"levl", v)];
+            return block(b"hue2", encode::hue_saturation([*hue, *saturation, *lightness], *colorize, ranges));
         }
+        Adjustment::Exposure { exposure, offset, gamma } => return block(b"expA", encode::exposure(*exposure, *offset, *gamma)),
+        Adjustment::Levels { master, per_channel, space, black } => return block(b"levl", encode::levels(master, per_channel, *space, black)),
         Adjustment::Curves { master, per_channel, space, black, pencil } => {
-            v.push(u8::from(*pencil));
-            put16(&mut v, 1);
-            let ink = *space == ToneSpace::Cmyk && black.len() >= 2;
-            v.extend_from_slice(&(if ink { 0b11111u32 } else { 0b1111 }).to_be_bytes());
-            for c in std::iter::once(master).chain(per_channel.iter()).chain(ink.then_some(black)) {
-                if *pencil {
-                    v.extend(curve_map_outputs(c).iter().map(|&o| u8::try_from(q255(o)).unwrap_or(u8::MAX)));
-                    continue;
-                }
-                put16(&mut v, c.len().min(19) as u16);
-                for p in c.iter().take(19) {
-                    put16(&mut v, q255(p.output));
-                    put16(&mut v, q255(p.input));
-                }
-            }
-            return vec![(*b"curv", v)];
+            return block(b"curv", encode::curves(master, per_channel, *space, black, *pencil));
         }
-        Adjustment::SelectiveColor { relative, adjustments } => {
-            put16(&mut v, 1);
-            put16(&mut v, u16::from(!*relative));
-            v.extend_from_slice(&[0; 8]);
-            for rec in adjustments {
-                for x in rec {
-                    v.extend_from_slice(&clamp_i16(x.clamp(-100.0, 100.0)).to_be_bytes());
-                }
-            }
-            return vec![(*b"selc", v)];
-        }
-        Adjustment::ColorLookup { name, lut, size, dither, .. } => {
-            // A lookup without a usable table (none chosen yet, or a bad size) renders as the
-            // identity, so it is written as a 2³ identity cube rather than dropped.
-            let n = *size as usize;
-            let cube = lut.as_deref().zip(photocraft_doc::adjust::lut3d_len(*size)).and_then(|(table, len)| table.get(..len)).filter(|_| n <= 256);
-            let (file, dither) = match cube {
-                Some(cube) => (
-                    photocraft_cms::lutfile::LutFile { title: String::new(), size: n, data: cube.to_vec(), domain_min: [0.0; 3], domain_max: [1.0; 3] },
-                    *dither,
-                ),
-                _ => (photocraft_cms::lutfile::LutFile { title: String::new(), ..photocraft_cms::lutfile::LutFile::identity(2) }, false),
-            };
-            let en =
-                |t: &str, val: &str| Value::Enumerated { type_id: photocraft_psd::descriptor::Id::new(t), value: photocraft_psd::descriptor::Id::new(val) };
-            let text = |t: &str| Value::Text(photocraft_psd::descriptor::UnicodeString::new_nul(t));
-            let d = Descriptor::new("null")
-                .with("lookupType", en("colorLookupType", "3DLUT"))
-                .with("NM  ", text(name))
-                .with("Dthr", Value::Boolean(dither))
-                .with("profile", Value::RawData(Vec::new()))
-                .with("LUTFormat", en("LUTFormatType", "LUTFormatCUBE"))
-                .with("dataOrder", en("colorLookupOrder", "rgbOrder"))
-                .with("tableOrder", en("colorLookupOrder", "bgrOrder"))
-                .with("LUT3DFileData", Value::RawData(photocraft_cms::lutfile::write_cube(&file).into_bytes()))
-                .with("LUT3DFileName", text(name));
-            put16(&mut v, 1);
-            v.extend_from_slice(&VersionedDescriptor::new(d).to_bytes());
-            return vec![(*b"clrL", v)];
+        Adjustment::SelectiveColor { relative, adjustments } => return block(b"selc", encode::selective_color(*relative, adjustments)),
+        Adjustment::ColorLookup { name, lut, size, dither, source, .. } => {
+            return block(b"clrL", encode::color_lookup(name, lut.as_deref().map(Vec::as_slice), *size, *dither, source.as_ref()));
         }
         Adjustment::GradientMap { stops, reverse, dither } => {
-            // Photoshop needs two stops; fewer are written as the gradient they render as
-            // (none: black to white, i.e. the gray value itself; one: that colour throughout).
-            let stops = match stops.as_slice() {
-                [] => vec![(0.0, [0.0; 3]), (1.0, [1.0; 3])],
-                [(_, c)] => vec![(0.0, *c), (1.0, *c)],
-                s => s.to_vec(),
-            };
-            return vec![(*b"grdm", write_gradient_map(&stops, *reverse, *dither))];
-        }
-        Adjustment::Vibrance { vibrance, saturation } => {
-            let d = Descriptor::new("null")
-                .with("vibrance", Value::Integer(i32::from(clamp_i16(vibrance.clamp(-100.0, 100.0)))))
-                .with("Strt", Value::Integer(i32::from(clamp_i16(saturation.clamp(-100.0, 100.0)))));
-            return vec![(*b"vibA", VersionedDescriptor::new(d).to_bytes())];
+            return block(b"grdm", write_gradient_map(&encode::gradient_stops(stops), *reverse, *dither));
         }
+        Adjustment::Vibrance { vibrance, saturation } => return block(b"vibA", encode::vibrance(*vibrance, *saturation)),
         Adjustment::ColorBalance { shadows, midtones, highlights, preserve_luminosity } => {
-            for x in shadows.iter().chain(midtones).chain(highlights) {
-                v.extend_from_slice(&clamp_i16(x.clamp(-100.0, 100.0)).to_be_bytes());
-            }
-            v.push(u8::from(*preserve_luminosity));
-            v.push(0);
-            return vec![(*b"blnc", v)];
-        }
-        Adjustment::BlackWhite { weights, tint } => {
-            let mut d = Descriptor::new("null");
-            for (w, k) in weights.iter().zip(BW_KEYS) {
-                d = d.with(k, Value::Integer(i32::from(clamp_i16(w.clamp(-200.0, 300.0)))));
-            }
-            let d = d
-                .with("useTint", Value::Boolean(tint.is_some()))
-                .with("tintColor", Value::Descriptor(rgb_desc(tint.unwrap_or(BW_TINT))))
-                .with("bwPresetKind", Value::Integer(1))
-                .with("blackAndWhitePresetFileName", Value::Text(photocraft_psd::descriptor::UnicodeString::new_nul("")));
-            return vec![(*b"blwh", VersionedDescriptor::new(d).to_bytes())];
+            return block(b"blnc", encode::color_balance([shadows, midtones, highlights], *preserve_luminosity));
         }
+        Adjustment::BlackWhite { weights, tint } => return block(b"blwh", encode::black_white(weights, *tint)),
         Adjustment::PhotoFilter { color, density, preserve_luminosity } => {
-            // Version 2: an RGB colour structure keeps the colour at 16 bits.
-            put16(&mut v, 2);
-            put16(&mut v, 0);
-            for x in color {
-                put16(&mut v, (x.clamp(0.0, 1.0) * 65535.0).round() as u16);
-            }
-            put16(&mut v, 0);
-            v.extend_from_slice(&((density.clamp(0.0, 1.0) * 100.0).round() as u32).to_be_bytes());
-            v.push(u8::from(*preserve_luminosity));
-            // Photoshop requires the 17-byte Photo Filter payload after the version to be
-            // padded to a 4-byte boundary INSIDE the tagged block's declared length.
-            // A single pad byte made an 18-byte `phfl` block that Photoshop could not open
-            // even though PhotoCraft and other tolerant readers accepted it (#1455).
-            v.extend_from_slice(&[0, 0, 0]);
-            return vec![(*b"phfl", v)];
+            return block(b"phfl", encode::photo_filter(*color, *density, *preserve_luminosity));
         }
         Adjustment::ChannelMixer { matrix, monochrome } => {
-            put16(&mut v, 1);
-            put16(&mut v, u16::from(*monochrome));
-            // Red, green, blue, then the gray record (the first row, which monochrome uses).
-            for row in matrix.iter().chain(std::iter::once(&matrix[0])) {
-                let pct = |x: f32| clamp_i16((x * 100.0).clamp(-200.0, 200.0)).to_be_bytes();
-                for x in &row[..3] {
-                    v.extend_from_slice(&pct(*x));
-                }
-                v.extend_from_slice(&[0, 0]);
-                v.extend_from_slice(&pct(row[3]));
-            }
-            return vec![(*b"mixr", v)];
+            return block(b"mixr", encode::channel_mixer(matrix, *monochrome));
         }
         Adjustment::Unsupported { psd_key, raw } => {
             let k = psd_key.as_bytes();
diff --git a/crates/io/src/adjust_map/encode.rs b/crates/io/src/adjust_map/encode.rs
new file mode 100644
index 0000000000..08d3075b57
--- /dev/null
+++ b/crates/io/src/adjust_map/encode.rs
@@ -0,0 +1,236 @@
+use photocraft_doc::adjust::{CurvePoint, HueRange, LevelsChannel, LutFormat, LutSource, ToneSpace, curve_map_outputs};
+use photocraft_psd::descriptor::{Descriptor, Id, UnicodeString, Value, VersionedDescriptor};
+
+use super::{BW_KEYS, BW_TINT, clamp_i16, cube_file_name, levels_write, lut_source_for, psd_lut_format, put16, q255, rgb_desc};
+
+/// The values as big-endian 16-bit words.
+pub(super) fn words(xs: &[u16]) -> Vec<u8> {
+    let mut v = Vec::new();
+    for &x in xs {
+        put16(&mut v, x);
+    }
+    v
+}
+
+/// Appends `x` as a clamped big-endian 16-bit integer.
+fn push_i16(v: &mut Vec<u8>, x: f32) {
+    v.extend_from_slice(&clamp_i16(x).to_be_bytes());
+}
+
+/// The legacy Brightness/Contrast block and its descriptor block.
+pub(super) fn brightness_contrast(brightness: f32, contrast: f32, legacy: bool) -> Vec<([u8; 4], Vec<u8>)> {
+    let mut v = Vec::new();
+    push_i16(&mut v, brightness);
+    push_i16(&mut v, contrast);
+    put16(&mut v, 127);
+    v.push(0);
+    let d = Descriptor::new("null")
+        .with("Vrsn", Value::Integer(1))
+        .with("Brgh", Value::Integer(brightness.round() as i32))
+        .with("Cntr", Value::Integer(contrast.round() as i32))
+        .with("means", Value::Integer(127))
+        .with("Lab ", Value::Boolean(false))
+        .with("useLegacy", Value::Boolean(legacy))
+        .with("Auto", Value::Boolean(false));
+    vec![(*b"brit", v), (*b"CgEd", VersionedDescriptor::new(d).to_bytes())]
+}
+
+/// Hue/Saturation payload: the master values, then the six hue ranges.
+pub(super) fn hue_saturation(hsl: [f32; 3], colorize: bool, ranges: &[HueRange; 6]) -> Vec<u8> {
+    let mut v = words(&[2]);
+    v.push(u8::from(colorize));
+    v.push(0);
+    // The colorize triplet, then the master triplet. The inactive one gets Photoshop's
+    // defaults; the colorize hue (0..360 in the model) is stored signed, -180..180.
+    let [hue, saturation, lightness] = hsl;
+    let (colorize_hsl, master) = if colorize {
+        let h = hue.rem_euclid(360.0);
+        ([if h > 180.0 { h - 360.0 } else { h }, saturation, lightness], [0.0; 3])
+    } else {
+        ([30.0, 25.0, 0.0], hsl)
+    };
+    for x in colorize_hsl.into_iter().chain(master) {
+        push_i16(&mut v, x);
+    }
+    // Six hue ranges: four bounds in 0..360, then hue, saturation and lightness.
+    for r in ranges {
+        for x in r.bounds {
+            put16(&mut v, x.rem_euclid(360.0).round() as u16 % 360);
+        }
+        for x in [r.hue, r.saturation, r.lightness] {
+            push_i16(&mut v, x);
+        }
+    }
+    v
+}
+
+/// Exposure payload.
+pub(super) fn exposure(exposure: f32, offset: f32, gamma: f32) -> Vec<u8> {
+    let mut v = words(&[1]);
+    for x in [exposure, offset, gamma] {
+        v.extend_from_slice(&x.to_be_bytes());
+    }
+    v.push(1); // color space flag (spec: "1 byte")
+    v
+}
+
+/// Levels payload: master, the three colour channels, black (CMYK only), then identity records.
+pub(super) fn levels(master: &LevelsChannel, per_channel: &[LevelsChannel; 3], space: ToneSpace, black: &LevelsChannel) -> Vec<u8> {
+    let mut v = words(&[2]);
+    levels_write(&mut v, master);
+    for c in per_channel {
+        levels_write(&mut v, c);
+    }
+    let ident = LevelsChannel::default();
+    levels_write(&mut v, if space == ToneSpace::Cmyk { black } else { &ident });
+    for _ in 5..29 {
+        levels_write(&mut v, &LevelsChannel::default());
+    }
+    v
+}
+
+/// Curves payload: each channel's points, or its 256-entry map in pencil mode.
+pub(super) fn curves(master: &[CurvePoint], per_channel: &[Vec<CurvePoint>; 3], space: ToneSpace, black: &[CurvePoint], pencil: bool) -> Vec<u8> {
+    let mut v = vec![u8::from(pencil)];
+    put16(&mut v, 1);
+    let ink = space == ToneSpace::Cmyk && black.len() >= 2;
+    v.extend_from_slice(&(if ink { 0b11111u32 } else { 0b1111 }).to_be_bytes());
+    for c in std::iter::once(master).chain(per_channel.iter().map(Vec::as_slice)).chain(ink.then_some(black)) {
+        if pencil {
+            v.extend(curve_map_outputs(c).iter().map(|&o| u8::try_from(q255(o)).unwrap_or(u8::MAX)));
+            continue;
+        }
+        put16(&mut v, c.len().min(19) as u16);
+        for p in c.iter().take(19) {
+            put16(&mut v, q255(p.output));
+            put16(&mut v, q255(p.input));
+        }
+    }
+    v
+}
+
+/// Selective Color payload, with each value clamped to ±100%.
+pub(super) fn selective_color(relative: bool, adjustments: &[[f32; 4]; 9]) -> Vec<u8> {
+    let mut v = words(&[1, u16::from(!relative)]);
+    v.extend_from_slice(&[0; 8]);
+    for rec in adjustments {
+        for x in rec {
+            push_i16(&mut v, x.clamp(-100.0, 100.0));
+        }
+    }
+    v
+}
+
+/// Color Lookup payload, written as an identity cube when there is no usable table.
+pub(super) fn color_lookup(name: &str, lut: Option<&[f32]>, size: u32, dither: bool, source: Option<&LutSource>) -> Vec<u8> {
+    // A lookup without a usable table (none chosen yet, or a bad size) renders as the
+    // identity, so it is written as a 2³ identity cube rather than dropped.
+    let n = size as usize;
+    let cube = lut.zip(photocraft_doc::adjust::lut3d_len(size)).and_then(|(table, len)| table.get(..len)).filter(|_| n <= 256);
+    // Like Photoshop, embed the LUT file as loaded, in its own format; a table made or
+    // changed in PhotoCraft is written as `.cube`, named to match.
+    let (format, data, name, dither) = match cube {
+        Some(cube) => match lut_source_for(source, cube, n) {
+            Some(src) => (src.format, src.bytes.to_vec(), name.to_string(), dither),
+            None => {
+                let file = photocraft_cms::lutfile::LutFile { title: String::new(), size: n, data: cube.to_vec(), domain_min: [0.0; 3], domain_max: [1.0; 3] };
+                (LutFormat::Cube, photocraft_cms::lutfile::write_cube(&file).into_bytes(), cube_file_name(name), dither)
+            }
+        },
+        _ => {
+            let file = photocraft_cms::lutfile::LutFile { title: String::new(), ..photocraft_cms::lutfile::LutFile::identity(2) };
+            (LutFormat::Cube, photocraft_cms::lutfile::write_cube(&file).into_bytes(), cube_file_name(name), false)
+        }
+    };
+    let en = |t: &str, val: &str| Value::Enumerated { type_id: Id::new(t), value: Id::new(val) };
+    let text = |t: &str| Value::Text(UnicodeString::new_nul(t));
+    let d = Descriptor::new("null")
+        .with("lookupType", en("colorLookupType", "3DLUT"))
+        .with("NM  ", text(&name))
+        .with("Dthr", Value::Boolean(dither))
+        .with("profile", Value::RawData(Vec::new()))
+        .with("LUTFormat", en("LUTFormatType", psd_lut_format(format)))
+        .with("dataOrder", en("colorLookupOrder", "rgbOrder"))
+        .with("tableOrder", en("colorLookupOrder", "bgrOrder"))
+        .with("LUT3DFileData", Value::RawData(data))
+        .with("LUT3DFileName", text(&name));
+    let mut v = words(&[1]);
+    v.extend_from_slice(&VersionedDescriptor::new(d).to_bytes());
+    v
+}
+
+/// At least the two stops Photoshop needs, matching how fewer stops render.
+pub(super) fn gradient_stops(stops: &[(f32, [f32; 3])]) -> Vec<(f32, [f32; 3])> {
+    // Photoshop needs two stops: none becomes black to white, one becomes a flat colour.
+    match stops {
+        [] => vec![(0.0, [0.0; 3]), (1.0, [1.0; 3])],
+        [(_, c)] => vec![(0.0, *c), (1.0, *c)],
+        s => s.to_vec(),
+    }
+}
+
+/// A descriptor integer of `x` clamped to `lo..=hi`.
+fn percent(x: f32, lo: f32, hi: f32) -> Value {
+    Value::Integer(i32::from(clamp_i16(x.clamp(lo, hi))))
+}
+
+/// Vibrance payload.
+pub(super) fn vibrance(vibrance: f32, saturation: f32) -> Vec<u8> {
+    let d = Descriptor::new("null").with("vibrance", percent(vibrance, -100.0, 100.0)).with("Strt", percent(saturation, -100.0, 100.0));
+    VersionedDescriptor::new(d).to_bytes()
+}
+
+/// Color Balance payload: shadows, midtones and highlights, then Preserve Luminosity.
+pub(super) fn color_balance(tones: [&[f32; 3]; 3], preserve_luminosity: bool) -> Vec<u8> {
+    let mut v = Vec::new();
+    for x in tones.into_iter().flatten() {
+        push_i16(&mut v, x.clamp(-100.0, 100.0));
+    }
+    v.push(u8::from(preserve_luminosity));
+    v.push(0);
+    v
+}
+
+/// Black & White payload.
+pub(super) fn black_white(weights: &[f32; 6], tint: Option<[f32; 3]>) -> Vec<u8> {
+    let mut d = Descriptor::new("null");
+    for (w, k) in weights.iter().zip(BW_KEYS) {
+        d = d.with(k, percent(*w, -200.0, 300.0));
+    }
+    let d = d
+        .with("useTint", Value::Boolean(tint.is_some()))
+        .with("tintColor", Value::Descriptor(rgb_desc(tint.unwrap_or(BW_TINT))))
+        .with("bwPresetKind", Value::Integer(1))
+        .with("blackAndWhitePresetFileName", Value::Text(UnicodeString::new_nul("")));
+    VersionedDescriptor::new(d).to_bytes()
+}
+
+/// Photo Filter payload, version 2 with a 16-bit colour.
+pub(super) fn photo_filter(color: [f32; 3], density: f32, preserve_luminosity: bool) -> Vec<u8> {
+    // Version 2 keeps the colour at 16 bits.
+    let mut v = words(&[2, 0]);
+    for x in color {
+        put16(&mut v, (x.clamp(0.0, 1.0) * 65535.0).round() as u16);
+    }
+    put16(&mut v, 0);
+    v.extend_from_slice(&((density.clamp(0.0, 1.0) * 100.0).round() as u32).to_be_bytes());
+    v.push(u8::from(preserve_luminosity));
+    // Photoshop only opens the payload padded to 4 bytes inside the block (#1455).
+    v.extend_from_slice(&[0, 0, 0]);
+    v
+}
+
+/// Channel Mixer payload: the red, green and blue records, then the gray record.
+pub(super) fn channel_mixer(matrix: &[[f32; 4]; 3], monochrome: bool) -> Vec<u8> {
+    let mut v = words(&[1, u16::from(monochrome)]);
+    // Red, green and blue rows, then the gray record that monochrome uses.
+    for row in matrix.iter().chain(std::iter::once(&matrix[0])) {
+        let pct = |x: f32| clamp_i16((x * 100.0).clamp(-200.0, 200.0)).to_be_bytes();
+        for x in &row[..3] {
+            v.extend_from_slice(&pct(*x));
+        }
+        v.extend_from_slice(&[0, 0]);
+        v.extend_from_slice(&pct(row[3]));
+    }
+    v
+}
diff --git a/crates/io/src/adjust_map/tests.rs b/crates/io/src/adjust_map/tests.rs
index 70727fba4f..c369327d86 100644
--- a/crates/io/src/adjust_map/tests.rs
+++ b/crates/io/src/adjust_map/tests.rs
@@ -219,7 +219,9 @@ fn roundtrips() {
     rt(Adjustment::ChannelMixer { matrix: [[0.5, 0.3, 0.2, 0.0], [0.1, 0.8, 0.1, 0.05], [0.0, 0.2, 0.9, -0.05]], monochrome: false });
     rt(Adjustment::ChannelMixer { matrix: [[0.4, 0.4, 0.2, 0.1], [0.0, 1.0, 0.0, 0.0], [-2.0, 0.0, 2.0, 0.0]], monochrome: true });
     let id = photocraft_cms::lutfile::LutFile::identity(5);
-    rt(Adjustment::ColorLookup { name: "Look.cube".into(), lut: Some(std::sync::Arc::new(id.data)), size: 5, tetrahedral: false, dither: true });
+    let cube = photocraft_cms::lutfile::write_cube(&id).into_bytes();
+    let source = Some(LutSource { format: LutFormat::Cube, bytes: std::sync::Arc::new(cube) });
+    rt(Adjustment::ColorLookup { name: "Look.cube".into(), lut: Some(std::sync::Arc::new(id.data)), size: 5, tetrahedral: false, dither: true, source });
 }
 
 #[test]
@@ -246,6 +248,105 @@ fn selective_color_synthetic_block() {
     assert_eq!(write(&a)[0].1, d);
 }
 
+/// A 2³ Lustre `.3dl` (12-bit, blue fastest) that inverts every colour.
+fn inverting_3dl() -> Vec<u8> {
+    let mut text = String::from("# made by hand\n0 1023\n");
+    for r in 0..2 {
+        for g in 0..2 {
+            for b in 0..2 {
+                text.push_str(&format!("{} {} {}\n", (1 - r) * 4095, (1 - g) * 4095, (1 - b) * 4095));
+            }
+        }
+    }
+    text.into_bytes()
+}
+
+/// A 2³ SpeedGrade `.look` holding the identity.
+fn identity_look() -> Vec<u8> {
+    let hex: String = photocraft_cms::lutfile::LutFile::identity(2).data.iter().flat_map(|v| v.to_le_bytes()).map(|b| format!("{b:02X}")).collect();
+    format!("<?xml version=\"1.0\"?>\n<look><LUT><size>\"2\"</size><data>\"{hex}\"</data></LUT></look>\n").into_bytes()
+}
+
+/// A `clrL` block as Photoshop writes one for a loaded LUT file.
+fn clrl_block(format: &str, bytes: &[u8], name: &str) -> Vec<u8> {
+    let en = |t: &str, val: &str| Value::Enumerated { type_id: photocraft_psd::descriptor::Id::new(t), value: photocraft_psd::descriptor::Id::new(val) };
+    let text = |t: &str| Value::Text(photocraft_psd::descriptor::UnicodeString::new_nul(t));
+    let desc = Descriptor::new("null")
+        .with("lookupType", en("colorLookupType", "3DLUT"))
+        .with("NM  ", text(name))
+        .with("LUTFormat", en("LUTFormatType", format))
+        .with("LUT3DFileData", Value::RawData(bytes.to_vec()))
+        .with("LUT3DFileName", text(name));
+    let mut d = vec![0, 1];
+    d.extend(VersionedDescriptor::new(desc).to_bytes());
+    d
+}
+
+/// The descriptor of the `clrL` block `a` is written as.
+fn written_clrl(a: &Adjustment) -> Descriptor {
+    let b = write(a);
+    assert_eq!(&b[0].0, b"clrL");
+    VersionedDescriptor::parse_prefix(&b[0].1[2..]).unwrap().0.descriptor
+}
+
+fn raw<'a>(d: &'a Descriptor, key: &str) -> &'a [u8] {
+    let Some(Value::RawData(b)) = d.get(key) else { panic!("{key} missing") };
+    b
+}
+
+#[test]
+fn color_lookup_keeps_a_3dl_or_look_file_as_loaded() {
+    // #6544: Photoshop embeds the LUT file as loaded and tags its format; it never converts it.
+    for (format, kind, bytes, name) in
+        [("LUTFormat3DL", LutFormat::ThreeDl, inverting_3dl(), "Invert.3DL"), ("LUTFormatLOOK", LutFormat::Look, identity_look(), "Grade.look")]
+    {
+        let a = parse(b"clrL", &clrl_block(format, &bytes, name), None, Channels::Rgb);
+        let Adjustment::ColorLookup { name: n, lut: Some(_), size: 2, source: Some(src), .. } = &a else { panic!("{a:?}") };
+        assert_eq!((n.as_str(), src.format, src.bytes.as_slice()), (name, kind, bytes.as_slice()));
+        let d = written_clrl(&a);
+        assert_eq!(desc_enum(&d, "LUTFormat"), Some(format.as_bytes()), "{name}");
+        assert_eq!(raw(&d, "LUT3DFileData"), bytes.as_slice(), "{name}: the file's bytes, unchanged");
+        assert_eq!(desc_text(&d, "LUT3DFileName").as_deref(), Some(name));
+        assert_eq!(desc_text(&d, "NM  ").as_deref(), Some(name));
+        // And it reads back as the same layer.
+        let b = write(&a);
+        assert_eq!(parse(&b[0].0, &b[0].1, None, Channels::Rgb), a);
+    }
+}
+
+#[test]
+fn color_lookup_table_without_matching_file_is_saved_as_cube_named_to_match() {
+    let a = parse(b"clrL", &clrl_block("LUTFormat3DL", &inverting_3dl(), "Invert.3DL"), None, Channels::Rgb);
+    let Adjustment::ColorLookup { name, size, tetrahedral, dither, source, .. } = a else { panic!("{a:?}") };
+    // The table no longer matches the stored file (changed in PhotoCraft): the bytes are stale.
+    let id = photocraft_cms::lutfile::LutFile::identity(2).data;
+    let edited = Adjustment::ColorLookup { name, lut: Some(std::sync::Arc::new(id.clone())), size, tetrahedral, dither, source };
+    let d = written_clrl(&edited);
+    assert_eq!(desc_enum(&d, "LUTFormat"), Some(&b"LUTFormatCUBE"[..]));
+    assert_eq!(desc_text(&d, "LUT3DFileName").as_deref(), Some("Invert.cube"));
+    assert_eq!(photocraft_cms::lutfile::parse("x.cube", raw(&d, "LUT3DFileData")).unwrap().data, id);
+    // A table made in PhotoCraft (no file) named like another format is also renamed.
+    let made =
+        Adjustment::ColorLookup { name: "Grade.look".into(), lut: Some(std::sync::Arc::new(id)), size: 2, tetrahedral: false, dither: false, source: None };
+    let d = written_clrl(&made);
+    assert_eq!(desc_enum(&d, "LUTFormat"), Some(&b"LUTFormatCUBE"[..]));
+    assert_eq!(desc_text(&d, "LUT3DFileName").as_deref(), Some("Grade.cube"));
+    assert_eq!(desc_text(&d, "NM  ").as_deref(), Some("Grade.cube"));
+    // An unreadable stored file falls back the same way instead of failing the save.
+    let junk = Adjustment::ColorLookup {
+        name: "Junk.3dl".into(),
+        lut: Some(std::sync::Arc::new(photocraft_cms::lutfile::LutFile::identity(2).data)),
+        size: 2,
+        tetrahedral: false,
+        dither: false,
+        source: Some(LutSource { format: LutFormat::ThreeDl, bytes: std::sync::Arc::new(b"\xFF not a lut".to_vec()) }),
+    };
+    assert_eq!(desc_text(&written_clrl(&junk), "LUT3DFileName").as_deref(), Some("Junk.cube"));
+    assert_eq!(cube_file_name("a.b.3dl"), "a.b.cube");
+    assert_eq!(cube_file_name("Day for Night"), "Day for Night");
+    assert_eq!(cube_file_name("x.cube"), "x.cube");
+}
+
 #[test]
 fn color_lookup_synthetic_block() {
     let cube = b"TITLE \"t\"\nLUT_3D_SIZE 2\n0 0 0\n1 0 0\n0 1 0\n1 1 0\n0 0 1\n1 0 1\n0 1 1\n1 1 1\n";
@@ -324,25 +425,43 @@ fn color_lookup_default_domains_stay_supported() {
 
 #[test]
 fn malformed_falls_back_to_unsupported() {
-    assert!(matches!(parse(b"levl", &[0, 2, 1], None, Channels::Rgb), Adjustment::Unsupported { .. }));
-    assert!(matches!(parse(b"curv", &[0, 0, 9], None, Channels::Rgb), Adjustment::Unsupported { .. }));
-    assert!(matches!(parse(b"thrs", &[], None, Channels::Rgb), Adjustment::Unsupported { .. }));
-    assert!(matches!(parse(b"blnc", &[0; 18], None, Channels::Rgb), Adjustment::Unsupported { .. }));
-    assert!(matches!(parse(b"vibA", &[0, 0, 0, 15, 0], None, Channels::Rgb), Adjustment::Unsupported { .. }));
-    assert!(matches!(parse(b"blwh", &[], None, Channels::Rgb), Adjustment::Unsupported { .. }));
-    assert!(matches!(parse(b"mixr", &[0, 2, 0, 0], None, Channels::Rgb), Adjustment::Unsupported { .. }));
-    // A CMYK mixer (black source used) stays raw in CMYK documents; our own RGB layout maps.
+    malformed_adjustments_are_unsupported();
+    malformed_channel_mixers_are_unsupported();
+    malformed_photo_filters_are_unsupported();
+    arbitrary_adjustment_bytes_do_not_panic();
+}
+
+fn malformed_adjustments_are_unsupported() {
+    for (key, bytes) in [
+        (&b"levl"[..], &[0, 2, 1][..]),
+        (&b"curv"[..], &[0, 0, 9][..]),
+        (&b"thrs"[..], &[][..]),
+        (&b"blnc"[..], &[0; 18][..]),
+        (&b"vibA"[..], &[0, 0, 0, 15, 0][..]),
+        (&b"blwh"[..], &[][..]),
+        (&b"mixr"[..], &[0, 2, 0, 0][..]),
+    ] {
+        let key: &[u8; 4] = key.try_into().unwrap_or(b"????");
+        assert!(matches!(parse(key, bytes, None, Channels::Rgb), Adjustment::Unsupported { .. }), "{key:?}");
+    }
+}
+
+fn malformed_channel_mixers_are_unsupported() {
     let mut cmyk = i16s(&[1, 0]);
     for r in 0..4 {
         cmyk.extend(i16s(&std::array::from_fn::<i16, 5, _>(|k| if k == r { 100 } else { 0 })));
     }
-    assert!(matches!(parse(b"mixr", &cmyk, None, Channels::Cmyk), Adjustment::Unsupported { .. }));
-    assert!(matches!(parse(b"mixr", &cmyk, None, Channels::Other), Adjustment::Unsupported { .. }));
+    for channels in [Channels::Cmyk, Channels::Other] {
+        assert!(matches!(parse(b"mixr", &cmyk, None, channels), Adjustment::Unsupported { .. }));
+    }
     let ours = write(&Adjustment::ChannelMixer { matrix: [[1.0, 0.0, 0.0, 0.0], [0.0, 1.0, 0.0, 0.0], [0.0, 0.0, 1.0, 0.0]], monochrome: false });
-    assert!(matches!(parse(b"mixr", &ours[0].1, None, Channels::Cmyk), Adjustment::ChannelMixer { .. }));
-    assert!(matches!(parse(b"mixr", &ours[0].1, None, Channels::Other), Adjustment::ChannelMixer { .. }));
+    for channels in [Channels::Cmyk, Channels::Other] {
+        assert!(matches!(parse(b"mixr", &ours[0].1, None, channels), Adjustment::ChannelMixer { .. }));
+    }
     assert!(matches!(parse(b"mixr", &[0, 1, 0, 0, 0, 100], None, Channels::Rgb), Adjustment::Unsupported { .. }));
-    // Photo Filter: unknown version, HSB colour space, out-of-range version-3 XYZ, truncated.
+}
+
+fn malformed_photo_filters_are_unsupported() {
     assert!(matches!(parse(b"phfl", &[0, 4, 0, 0], None, Channels::Rgb), Adjustment::Unsupported { .. }));
     assert!(matches!(parse(b"phfl", &[0, 2, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 25, 1], None, Channels::Rgb), Adjustment::Unsupported { .. }));
     for bad in [[200_000u32, 0, 0], [0, u32::MAX, 0]] {
@@ -354,12 +473,14 @@ fn malformed_falls_back_to_unsupported() {
         assert!(matches!(parse(b"phfl", &xyz, None, Channels::Rgb), Adjustment::Unsupported { .. }));
     }
     assert!(matches!(parse(b"phfl", &[0, 2, 0, 0, 0, 0], None, Channels::Rgb), Adjustment::Unsupported { .. }));
-    // Arbitrary bytes never panic, whatever the key.
+}
+
+fn arbitrary_adjustment_bytes_do_not_panic() {
     for key in ADJUSTMENT_KEYS {
         for len in 0..64usize {
-            let d: Vec<u8> = (0..len).map(|i| (i * 37 + len) as u8).collect();
-            let _ = parse(key, &d, Some(&d), Channels::Rgb);
-            let _ = parse(key, &d, None, Channels::Other);
+            let data: Vec<u8> = (0..len).map(|i| (i * 37 + len) as u8).collect();
+            let _ = parse(key, &data, Some(&data), Channels::Rgb);
+            let _ = parse(key, &data, None, Channels::Other);
         }
     }
 }
@@ -547,7 +668,7 @@ fn degenerate_adjustments_still_get_an_encoding() {
     }
     // A colour lookup without a (usable) table becomes an identity cube, without dither.
     for lut in [None, Some(std::sync::Arc::new(vec![0.5; 7]))] {
-        let b = write(&Adjustment::ColorLookup { name: "L".into(), lut, size: 3, tetrahedral: false, dither: true });
+        let b = write(&Adjustment::ColorLookup { name: "L".into(), lut, size: 3, tetrahedral: false, dither: true, source: None });
         let back = parse(&b[0].0, &b[0].1, None, Channels::Rgb);
         let Adjustment::ColorLookup { lut: Some(t), size: 2, dither: false, name, .. } = back else { panic!("{back:?}") };
         assert_eq!(name, "L");
diff --git a/crates/io/src/affinity.rs b/crates/io/src/affinity.rs
index f794e1be40..4e5ed90f86 100644
--- a/crates/io/src/affinity.rs
+++ b/crates/io/src/affinity.rs
@@ -149,7 +149,7 @@ impl Builder {
                 let r = self.bbox(to_doc, page);
                 let mut g = Layer::new(
                     format!("Page {}", i + 1),
-                    LayerContent::Group(Group { children: std::mem::take(&mut children), expanded: true, artboard: None }),
+                    LayerContent::Group(Group { children: std::mem::take(&mut children), expanded: true, artboard: None, frame_stroke: None }),
                 );
                 if let LayerContent::Group(gr) = &mut g.content {
                     gr.artboard = Some(Artboard { rect: r, background: ArtboardBackground::White, preset: String::new() });
@@ -244,7 +244,7 @@ impl Builder {
 
     fn group(&mut self, n: &af::Node, children: Vec<Layer>) -> Layer {
         // Pass-through and Normal (isolated) groups map one to one.
-        self.base(n, LayerContent::Group(Group { children, expanded: false, artboard: None }))
+        self.base(n, LayerContent::Group(Group { children, expanded: false, artboard: None, frame_stroke: None }))
     }
 
     /// One Affinity node and its subtree; `to_doc` maps Affinity document pixels to the canvas.
diff --git a/crates/io/src/camera_raw_xmp.rs b/crates/io/src/camera_raw_xmp.rs
index a2e63322d0..65df97e898 100644
--- a/crates/io/src/camera_raw_xmp.rs
+++ b/crates/io/src/camera_raw_xmp.rs
@@ -228,7 +228,7 @@ pub fn load(params: &mut CameraRaw, bytes: &[u8]) -> Result<LoadReport, String>
     let text = std::str::from_utf8(bytes).map_err(|_| "not a Camera Raw settings file (not UTF-8 text)".to_string())?;
     // Some writers put a byte order mark or an `<?xpacket?>` wrapper first; roxmltree takes both.
     let text = text.trim_start_matches('\u{feff}');
-    let doc = roxmltree::Document::parse(text).map_err(|e| format!("not a Camera Raw settings file ({e})"))?;
+    let doc = crate::xml::parse(text, roxmltree::ParsingOptions::default()).map_err(|e| format!("not a Camera Raw settings file ({e})"))?;
     let mut next = params.clone();
     let mut report = LoadReport::default();
     let mut found = false;
@@ -389,6 +389,16 @@ mod tests {
         assert_eq!(p.calibration_hue[0], -5.0);
     }
 
+    /// A settings file nested 20 000 deep overflowed the XML parser's recursion (an abort nothing
+    /// can catch); it is an error now. The small stack makes a regression abort instead of passing.
+    #[test]
+    fn deeply_nested_settings_are_an_error_not_a_stack_overflow() {
+        let xml = format!("<x:xmpmeta xmlns:x=\"adobe:ns:meta/\">{}{}</x:xmpmeta>", "<a>".repeat(20_000), "</a>".repeat(20_000));
+        let e =
+            std::thread::Builder::new().stack_size(512 * 1024).spawn(move || load(&mut CameraRaw::default(), xml.as_bytes()).err()).unwrap().join().unwrap();
+        assert!(e.as_deref().is_some_and(|m| m.contains("nested")), "{e:?}");
+    }
+
     #[test]
     fn save_then_load_round_trips() {
         let mut p = CameraRaw {
diff --git a/crates/io/src/kra.rs b/crates/io/src/kra.rs
index af9b238971..d8b3f9a36d 100644
--- a/crates/io/src/kra.rs
+++ b/crates/io/src/kra.rs
@@ -283,10 +283,10 @@ pub(crate) fn import(name: &str, bytes: &[u8], ctl: &Interrupt<'_>) -> Result<Im
     }
     let xml = zip.read_by_name("maindoc.xml", MAX_MAINDOC).map_err(|e| invalid(e.to_string()))?;
     let xml = std::str::from_utf8(&xml).map_err(|_| invalid("maindoc.xml is not UTF-8"))?;
-    // maindoc.xml declares Krita's DTD by public id; roxmltree only reads internal subsets and
-    // guards entity expansion.
+    // maindoc.xml declares Krita's DTD by public id; Krita writes no internal subset, which
+    // `xml::parse` refuses (its entities could hide nesting from the depth check).
     let opts = roxmltree::ParsingOptions { allow_dtd: true, ..Default::default() };
-    let tree = roxmltree::Document::parse_with_options(xml, opts).map_err(|e| invalid(format!("maindoc.xml: {e}")))?;
+    let tree = crate::xml::parse(xml, opts).map_err(|e| invalid(format!("maindoc.xml: {e}")))?;
     let image = tree.root_element().children().find(|n| n.has_tag_name("IMAGE")).ok_or_else(|| invalid("maindoc.xml has no IMAGE"))?;
     let side = |a: &str| -> Result<u32> {
         let v = number(image, a, 0.0)?;
diff --git a/crates/io/src/kra/tests.rs b/crates/io/src/kra/tests.rs
index 92e951cdb8..214ccdc9c6 100644
--- a/crates/io/src/kra/tests.rs
+++ b/crates/io/src/kra/tests.rs
@@ -200,6 +200,23 @@ fn export_is_refused() {
     }
 }
 
+/// maindoc.xml nested 20 000 deep, directly or through an internal-subset entity the depth check
+/// can't see, overflowed the XML parser's recursion (an abort nothing can catch). Both are errors
+/// now; the small stack makes a regression abort instead of passing.
+#[test]
+fn deeply_nested_maindoc_is_an_error_not_a_stack_overflow() {
+    let (open, close) = ("<layers>".repeat(20_000), "</layers>".repeat(20_000));
+    let direct = maindoc("RGBA", &format!("{open}{close}"));
+    let entity = format!("<!DOCTYPE DOC [<!ENTITY e \"{open}{close}\">]><DOC><IMAGE width=\"4\" height=\"4\">&e;</IMAGE></DOC>");
+    // A quoted `?>` in the XML declaration must not hide the DOCTYPE behind it.
+    let declared = format!("<?xml version=\"?>\"?>{entity}");
+    for (xml, why) in [(direct, "nested"), (entity, "internal DTD"), (declared, "internal DTD")] {
+        let bytes = archive(&xml, &[]);
+        let e = std::thread::Builder::new().stack_size(512 * 1024).spawn(move || crate::import("deep.kra", &bytes).err()).unwrap().join().unwrap();
+        assert!(matches!(&e, Some(IoError::Kra(m)) if m.contains(why)), "{why}: {e:?}");
+    }
+}
+
 #[test]
 fn lzf_decodes_literals_and_overlapping_references() {
     // "abc" then a 6-byte back-reference 3 back: abcabcabc.
diff --git a/crates/io/src/lib.rs b/crates/io/src/lib.rs
index 44beb59d47..0a184bda79 100644
--- a/crates/io/src/lib.rs
+++ b/crates/io/src/lib.rs
@@ -75,6 +75,7 @@ pub mod text_styles_map;
 pub mod tiff_layers;
 pub mod vector_map;
 mod xcf;
+pub mod xml;
 
 use photocraft_codecs::{CodecError, EncodeOptions};
 pub use photocraft_codecs::{DdsCompression, DdsOptions, DpxBits};
@@ -125,6 +126,9 @@ pub enum IoError {
     /// An SVG that does not parse (or is too large to rasterise).
     #[error("SVG: {0}")]
     Svg(String),
+    /// The file could not be read.
+    #[error("{0}")]
+    Read(String),
     /// A background import or save was cancelled ([`import_with`], [`export_with`]).
     #[error("cancelled")]
     Cancelled,
@@ -373,26 +377,82 @@ pub fn import_for_open_with(name: &str, bytes: &[u8], opts: &ImportOptions, ctl:
     Ok((result, damaged))
 }
 
-fn import_psd(name: &str, bytes: &[u8], ctl: &photocraft_raster::Interrupt, damaged: &mut bool) -> Result<ImportResult, IoError> {
+/// The PSD/PSB part of an import, from a parse that takes [`PsdFile::from_bytes_and_merged_recovering`]'s
+/// `want` and `recover`: of the file's bytes, or of the file itself ([`import_file_for_open_with`]).
+fn import_psd(
+    name: &str,
+    ctl: &photocraft_raster::Interrupt,
+    damaged: &mut bool,
+    parse: impl FnOnce(&dyn Fn(&PsdFile) -> bool, &dyn Fn(&PsdFile) -> bool) -> photocraft_psd::Result<(PsdFile, Option<photocraft_psd::Result<Vec<u8>>>)>,
+) -> Result<ImportResult, IoError> {
     // A merged image the import reads is decoded with the parse: a ZIP one is inflated once.
-    let (file, merged) = PsdFile::from_bytes_and_merged_recovering(
-        bytes,
-        |f| psd_import::check_group_depth(f).is_ok() && psd_import::merged_needed(f),
-        psd_import::can_recover_layers,
-    )?;
+    // A failed read of the file (one parsed from its source) is a read error, as reading the
+    // whole file first would report it.
+    let (file, merged) =
+        parse(&|f| psd_import::check_group_depth(f).is_ok() && psd_import::merged_needed(f), &psd_import::can_recover_layers).map_err(|e| match e {
+            photocraft_psd::PsdError::Read(msg) => IoError::Read(msg),
+            e => e.into(),
+        })?;
     // Nesting past the document model's cap could never be saved; reject the file with the
     // actionable limit.
     psd_import::check_group_depth(&file)?;
     ctl.check().map_err(|_| IoError::Cancelled)?;
     ctl.progress(0.05);
-    let (mut document, warnings, psd_damaged) = psd_import::psd_to_document_decoded_integrity(&file, ctl, merged).ok_or(IoError::Cancelled)?;
+    // Read before the conversion, which moves the global blocks into the document.
+    let txt2 = file.global_blocks.iter().find(|b| &b.key == b"Txt2").and_then(|b| photocraft_text::psd::parse_txt2(&b.data));
+    let (mut document, warnings, psd_damaged, read_error) = psd_import::psd_to_document_owned(file, ctl, merged).ok_or(IoError::Cancelled)?;
+    // The file became unreadable while its layers were read from it (`import_file_for_open_with`):
+    // the open fails, rather than opening with those layers empty.
+    if let Some(e) = read_error {
+        return Err(IoError::Read(e.to_string()));
+    }
     *damaged = psd_damaged;
     document.name = name.to_string();
-    let txt2 = file.global_blocks.iter().find(|b| &b.key == b"Txt2").and_then(|b| photocraft_text::psd::parse_txt2(&b.data));
     text_import::prepare(&mut document, txt2.as_ref());
     Ok(ImportResult { document, warnings, source_read_only: false, preview_only: false })
 }
 
+/// [`import_for_open_with`] for the file at `path`. A PSD/PSB is parsed from the open file
+/// ([`PsdFile::from_source`]) rather than read whole: its channel data is read layer by layer as
+/// it is decoded, so opening it needs memory for the document, not for the document plus the
+/// file. A read that fails meanwhile (the file is truncated or rewritten, its drive goes away)
+/// fails the open. Other formats are read whole.
+#[cfg(any(unix, windows))]
+pub fn import_file_for_open_with(
+    name: &str,
+    path: &std::path::Path,
+    opts: &ImportOptions,
+    ctl: &photocraft_raster::Interrupt,
+) -> Result<(ImportResult, bool), IoError> {
+    let read_failed = |e: std::io::Error| IoError::Read(format!("{}: {e}", path.display()));
+    ctl.check().map_err(|_| IoError::Cancelled)?;
+    let source = photocraft_psd::FileSource::open(path).map_err(read_failed)?;
+    let mut magic = [0u8; 4];
+    let psd = !has_extension(name, photocraft_format::EXTENSION) && photocraft_psd::ReadAt::read_at(&source, 0, &mut magic).is_ok() && is_psd(&magic);
+    if !psd {
+        drop(source);
+        let bytes = photocraft_format::read_file(path).map_err(read_failed)?;
+        return import_for_open_with(name, &bytes, opts, ctl);
+    }
+    import_source_for_open_with(name, photocraft_psd::Source::new(source), ctl)
+}
+
+/// [`import_file_for_open_with`] for a PSD/PSB in any [`photocraft_psd::ReadAt`] source.
+pub fn import_source_for_open_with(name: &str, source: photocraft_psd::Source, ctl: &photocraft_raster::Interrupt) -> Result<(ImportResult, bool), IoError> {
+    ctl.check().map_err(|_| IoError::Cancelled)?;
+    let mut damaged = false;
+    let r = import_psd(name, ctl, &mut damaged, |want, recover| PsdFile::from_source_and_merged_recovering(source, want, recover))?;
+    ctl.check().map_err(|_| IoError::Cancelled)?;
+    ctl.progress(1.0);
+    Ok((r, damaged))
+}
+
+/// [`import_file_for_open_with`] without the damage flag.
+#[cfg(any(unix, windows))]
+pub fn import_file(name: &str, path: &std::path::Path, opts: &ImportOptions, ctl: &photocraft_raster::Interrupt) -> Result<ImportResult, IoError> {
+    import_file_for_open_with(name, path, opts, ctl).map(|(result, _)| result)
+}
+
 /// Dispatches format-specific importers and propagates a structured PSD damage
 /// flag alongside the ordinary best-effort import result.
 fn import_stages(name: &str, bytes: &[u8], ctl: &photocraft_raster::Interrupt, opts: &ImportOptions, damaged: &mut bool) -> Result<ImportResult, IoError> {
@@ -404,7 +464,7 @@ fn import_stages(name: &str, bytes: &[u8], ctl: &photocraft_raster::Interrupt, o
     // Magic first: an Affinity file renamed .psd is still Affinity (#5258 corpus
     // preview_never_saves_back_to_its_native_or_renamed_source).
     if is_psd(bytes) {
-        return import_psd(name, bytes, ctl, damaged);
+        return import_psd(name, ctl, damaged, |want, recover| PsdFile::from_bytes_and_merged_recovering(bytes, want, recover));
     }
     if affinity::is_affinity(bytes) || affinity::has_extension(name) {
         return affinity::import(name, bytes);
@@ -437,7 +497,7 @@ fn import_stages(name: &str, bytes: &[u8], ctl: &photocraft_raster::Interrupt, o
     // A `.psd`/`.psb`/`.psdt` with no raster signature keeps the PSD error instead of
     // `codec: unrecognized image format` (#5258). Magic already returned above.
     if is_psd_input(name, bytes) {
-        return import_psd(name, bytes, ctl, damaged);
+        return import_psd(name, ctl, damaged, |want, recover| PsdFile::from_bytes_and_merged_recovering(bytes, want, recover));
     }
     flat::import_flat(name, bytes)
 }
diff --git a/crates/io/src/linked.rs b/crates/io/src/linked.rs
index e200b875ea..dcf7ecd98d 100644
--- a/crates/io/src/linked.rs
+++ b/crates/io/src/linked.rs
@@ -118,7 +118,30 @@ pub fn find_in_blocks<'a>(blocks: impl IntoIterator<Item = (&'a [u8; 4], &'a [u8
     if uuid.is_empty() {
         return None;
     }
-    blocks.into_iter().filter(|(k, _)| matches!(*k, b"lnk2" | b"lnk3" | b"lnkD")).flat_map(|(_, d)| parse_linked_files(d)).find(|f| f.uuid == uuid)
+    let (uuid, file_name, bytes) = find_slice_in_blocks(blocks, uuid)?;
+    Some(LinkedFile { uuid, file_name, bytes: bytes.to_vec() })
+}
+
+/// [`find_in_blocks`] without copying: the uuid, file name and bytes of the embedded file, as a
+/// slice of the block. Only the matching item's header is parsed beyond the uuid, and no other
+/// embedded file is copied (a `lnk2` block can hold gigabytes of them).
+fn find_slice_in_blocks<'a>(blocks: impl IntoIterator<Item = (&'a [u8; 4], &'a [u8])>, uuid: &str) -> Option<(String, String, &'a [u8])> {
+    if uuid.is_empty() {
+        return None;
+    }
+    blocks.into_iter().filter(|(k, _)| matches!(*k, b"lnk2" | b"lnk3" | b"lnkD")).find_map(|(_, d)| {
+        let mut r = Rd { d, p: 0 };
+        while let Some(len) = r.u64() {
+            let Ok(len) = usize::try_from(len) else { return None };
+            let item = r.take(len)?;
+            let found = item_header(item).filter(|h| h.0 == uuid).and_then(|(id, name, start, n)| Some((id, name, item.get(start..start.checked_add(n)?)?)));
+            if found.is_some() {
+                return found;
+            }
+            r.p = r.p.next_multiple_of(4);
+        }
+        None
+    })
 }
 
 /// The size of embedded file `uuid` among PSD global blocks given as (key, data), when it is there
@@ -128,11 +151,11 @@ pub(crate) fn source_size_in_blocks<'a>(
     uuid: &str,
     ctl: &photocraft_raster::Interrupt,
 ) -> Option<(f64, f64)> {
-    let f = find_in_blocks(blocks, uuid)?;
+    let (_, _, bytes) = find_slice_in_blocks(blocks, uuid)?;
     if ctl.cancelled() {
         return None;
     }
-    source_size_probe(&f.bytes).filter(|(w, h)| *w > 0.0 && *h > 0.0)
+    source_size_probe(bytes).filter(|(w, h)| *w > 0.0 && *h > 0.0)
 }
 
 /// Pixel size of an embedded source file from its header: PSD/PSB, TIFF (the default page's
diff --git a/crates/io/src/multichannel_map.rs b/crates/io/src/multichannel_map.rs
index e9437deb6c..2b6f4b9b54 100644
--- a/crates/io/src/multichannel_map.rs
+++ b/crates/io/src/multichannel_map.rs
@@ -73,7 +73,9 @@ pub(crate) fn import(file: &PsdFile, all: &[u8], doc: &mut Document, names: &[St
 }
 
 /// Writes a Multichannel document as a mode-7 PSD (no layer section; every channel a plane).
-pub(crate) fn document_to_psd(doc: &Document, force_psb: bool) -> (PsdFile, Vec<String>) {
+/// A file past `size_limit` bytes is written as PSB (see `psd_export::fit_psd_size`); `None` keeps
+/// the version whatever the size.
+pub(crate) fn document_to_psd(doc: &Document, force_psb: bool, size_limit: Option<u64>) -> (PsdFile, Vec<String>) {
     let mut warnings = Vec::new();
     // Photoshop's Multichannel mode is 8 or 16 bits per channel.
     let sample = match doc.depth {
@@ -106,17 +108,14 @@ pub(crate) fn document_to_psd(doc: &Document, force_psb: bool) -> (PsdFile, Vec<
         }
     }
     let big = doc.size.width > 30_000 || doc.size.height > 30_000;
-    let size_exceeds_limit = !force_psb && !big && crate::psd_export::psd_size_exceeds_limit(doc);
-    let version = crate::psd_export::psd_version(doc, force_psb, size_exceeds_limit);
+    let version = crate::psd_export::psd_version(doc, force_psb);
     if big && !force_psb {
         warnings.push("document exceeds 30000 px; written as PSB".into());
-    } else if size_exceeds_limit && !force_psb {
-        warnings.push("estimated encoded size exceeds 2 GB; written as PSB".into());
     }
     let header = Header::new(version, doc.size.width, doc.size.height, channels.len().max(1) as u16, psd_depth(sample), PsdMode::Multichannel);
     let image_data = ImageData::encode(Compression::Rle, &planes, &header)
         .or_else(|_| ImageData::encode(Compression::Raw, &planes, &header))
-        .unwrap_or(ImageData { compression: Compression::Raw, data: planes });
+        .unwrap_or(ImageData::new(Compression::Raw, planes));
     let mut resources = vec![
         ImageResource::new(ids::RESOLUTION_INFO, ResolutionInfo::from_dpi(f64::from(doc.resolution_dpi)).to_bytes()),
         ImageResource::new(ids::GLOBAL_ANGLE, (doc.global_light.angle.round() as i32).to_be_bytes().to_vec()),
@@ -133,14 +132,16 @@ pub(crate) fn document_to_psd(doc: &Document, force_psb: bool) -> (PsdFile, Vec<
     // Alpha identifiers: one u32 per channel, only while they still match the channels.
     let keep = |id: u16, data: &[u8]| id != ALPHA_IDENTIFIERS || data.len() == channels.len().saturating_mul(4);
     let color_mode_data = photocraft_psd::hdr::color_mode_data_for_depth(header.depth);
-    let file = layerless_file(doc, header, image_data, color_mode_data, resources, keep, &mut warnings);
+    let file = layerless_file(doc, header, image_data, color_mode_data, resources, keep, size_limit, &mut warnings);
     (file, warnings)
 }
 
 /// A PSD without layers around `image_data`: `resources` (the mode's own) plus the paths, XMP,
 /// EXIF and every other imported resource `keep` accepts (except the ones that only describe
 /// layers and any already in `resources`), and the document-level tagged blocks. Shared by the
-/// modes that have no layers in Photoshop: Multichannel, Indexed Color and Bitmap.
+/// modes that have no layers in Photoshop: Multichannel, Indexed Color and Bitmap. A file past
+/// `size_limit` bytes is written as PSB (see `psd_export::fit_psd_size`); `None` keeps the version.
+#[allow(clippy::too_many_arguments)]
 pub(crate) fn layerless_file(
     doc: &Document,
     header: Header,
@@ -148,6 +149,7 @@ pub(crate) fn layerless_file(
     color_mode_data: Vec<u8>,
     mut resources: Vec<ImageResource>,
     keep: impl Fn(u16, &[u8]) -> bool,
+    size_limit: Option<u64>,
     warnings: &mut Vec<String>,
 ) -> PsdFile {
     resources.extend(crate::psd_export::path_resources(doc, warnings));
@@ -175,13 +177,14 @@ pub(crate) fn layerless_file(
     }
     resources.push(version_info_resource(true));
     // Document-level tagged blocks (patterns, notes, ...) are valid without a layer section; a
-    // kept layer block would describe layers the document doesn't have.
+    // kept layer block would describe layers the document doesn't have. Their signatures follow
+    // the version the file is written as, known once its size is.
     let global_blocks: Vec<TaggedBlock> = crate::annotations_map::export_blocks(doc, crate::pattern_map::export_global_blocks(doc))
         .into_iter()
         .filter(|(_, key, _)| !matches!(key, b"Layr" | b"Lr16" | b"Lr32"))
-        .map(|(sig, key, data)| crate::psd_export::global_block(crate::psd_export::block_signature(sig, key, header.version), key, &data))
+        .map(|(sig, key, data)| crate::psd_export::global_block(sig, key, &data))
         .collect();
-    PsdFile {
+    let mut file = PsdFile {
         header,
         color_mode_data,
         resources,
@@ -191,5 +194,13 @@ pub(crate) fn layerless_file(
         global_blocks,
         layer_mask_trailing: Vec::new(),
         image_data,
+        write_as_psb: false,
+    };
+    if let Some(limit) = size_limit
+        && let Some(warning) = crate::psd_export::fit_psd_size(&mut file, limit)
+    {
+        warnings.push(warning);
     }
+    crate::psd_export::sign_global_blocks(&mut file);
+    file
 }
diff --git a/crates/io/src/ora.rs b/crates/io/src/ora.rs
index 193680d31e..fb7968fbcc 100644
--- a/crates/io/src/ora.rs
+++ b/crates/io/src/ora.rs
@@ -414,7 +414,7 @@ pub(crate) fn import(name: &str, bytes: &[u8], ctl: &Interrupt<'_>) -> Result<Im
     }
     let xml = zip.read_by_name("stack.xml", MAX_STACK_XML).map_err(|e| invalid(e.to_string()))?;
     let xml = std::str::from_utf8(&xml).map_err(|_| invalid("stack.xml is not UTF-8"))?;
-    let tree = roxmltree::Document::parse(xml).map_err(|e| invalid(format!("stack.xml: {e}")))?;
+    let tree = crate::xml::parse(xml, roxmltree::ParsingOptions::default()).map_err(|e| invalid(format!("stack.xml: {e}")))?;
     let image = tree.root_element();
     if image.tag_name().name() != "image" {
         return Err(invalid("stack.xml has no <image> root"));
diff --git a/crates/io/src/ora/tests.rs b/crates/io/src/ora/tests.rs
index c5576ce0ef..e4797fc52d 100644
--- a/crates/io/src/ora/tests.rs
+++ b/crates/io/src/ora/tests.rs
@@ -195,6 +195,16 @@ fn archive(stack: &str, images: &[(&str, Vec<u8>)]) -> Vec<u8> {
     z.finish().unwrap()
 }
 
+/// A stack.xml nested 20 000 deep overflowed the XML parser's recursion (an abort nothing can
+/// catch); it is an error now. The small stack makes a regression abort instead of passing.
+#[test]
+fn deeply_nested_stack_xml_is_an_error_not_a_stack_overflow() {
+    let stack = format!("<image w=\"4\" h=\"4\">{}{}</image>", "<stack>".repeat(20_000), "</stack>".repeat(20_000));
+    let bytes = archive(&stack, &[]);
+    let e = std::thread::Builder::new().stack_size(512 * 1024).spawn(move || crate::import("deep.ora", &bytes).err()).unwrap().join().unwrap();
+    assert!(matches!(&e, Some(IoError::Ora(m)) if m.contains("nested")), "{e:?}");
+}
+
 fn solid_png(w: u32, h: u32, rgba: [u8; 4]) -> Vec<u8> {
     let data = rgba.iter().copied().cycle().take((w * h * 4) as usize).collect();
     codecs::encode(&Image::from_raw(w, h, ChannelLayout::Rgba, CSample::U8, data).unwrap(), Format::Png, &Default::default()).unwrap()
diff --git a/crates/io/src/palette_map.rs b/crates/io/src/palette_map.rs
index 45b8168f1c..e1729dcce0 100644
--- a/crates/io/src/palette_map.rs
+++ b/crates/io/src/palette_map.rs
@@ -21,7 +21,9 @@ const CHANNEL_RESOURCES: [u16; 4] = [1006, 1045, 1053, crate::channel_map::DISPL
 /// opaque, or a Bitmap document; None for any other document (it is written like the others). A
 /// document with alpha channels or a Quick Mask is written like the others too: the importer does
 /// not read the extra channels of these modes back, so they would be lost.
-pub(crate) fn document_to_psd(doc: &Document, force_psb: bool) -> Option<(PsdFile, Vec<String>)> {
+/// A file past `size_limit` bytes is written as PSB (see `psd_export::fit_psd_size`); `None` keeps
+/// the version whatever the size.
+pub(crate) fn document_to_psd(doc: &Document, force_psb: bool, size_limit: Option<u64>) -> Option<(PsdFile, Vec<String>)> {
     if !doc.channels.is_empty() || doc.quick_mask.is_some() {
         return None;
     }
@@ -38,14 +40,12 @@ pub(crate) fn document_to_psd(doc: &Document, force_psb: bool) -> Option<(PsdFil
     if !flattens_losslessly(doc) {
         warnings.push(format!("{:?} documents have no layers in Photoshop: written flattened", doc.mode));
     }
-    let big = doc.size.width > 30_000 || doc.size.height > 30_000;
-    let size_exceeds_limit = !force_psb && !big && crate::psd_export::psd_size_exceeds_limit(doc);
-    let version = crate::psd_export::psd_version(doc, force_psb, size_exceeds_limit);
+    let version = crate::psd_export::psd_version(doc, force_psb);
     let depth = if mode == PsdMode::Bitmap { 1 } else { 8 };
     let header = Header::new(version, doc.size.width, doc.size.height, 1, depth, mode);
     let image_data = ImageData::encode(Compression::Rle, &plane, &header)
         .or_else(|_| ImageData::encode(Compression::Raw, &plane, &header))
-        .unwrap_or(ImageData { compression: Compression::Raw, data: plane });
+        .unwrap_or(ImageData::new(Compression::Raw, plane));
     let mut resources = vec![
         ImageResource::new(ids::RESOLUTION_INFO, ResolutionInfo::from_dpi(f64::from(doc.resolution_dpi)).to_bytes()),
         ImageResource::new(ids::GLOBAL_ANGLE, (doc.global_light.angle.round() as i32).to_be_bytes().to_vec()),
@@ -65,7 +65,7 @@ pub(crate) fn document_to_psd(doc: &Document, force_psb: bool) -> Option<(PsdFil
     }
     // An imported transparency index that no longer applies is not copied either.
     let keep = |id: u16, _: &[u8]| !CHANNEL_RESOURCES.contains(&id) && id != TRANSPARENCY_INDEX && id != COLOR_TABLE_COUNT;
-    let file = crate::multichannel_map::layerless_file(doc, header, image_data, color_mode_data, resources, keep, &mut warnings);
+    let file = crate::multichannel_map::layerless_file(doc, header, image_data, color_mode_data, resources, keep, size_limit, &mut warnings);
     Some((file, warnings))
 }
 
@@ -162,7 +162,7 @@ mod tests {
     }
 
     fn round_trip(doc: &Document) -> (PsdFile, Document) {
-        let (file, _) = document_to_psd(doc, false).unwrap();
+        let (file, _) = document_to_psd(doc, false, None).unwrap();
         let bytes = file.to_bytes().unwrap();
         let file = PsdFile::from_bytes(&bytes).unwrap();
         let back = crate::import("test.psd", &bytes).unwrap().document;
@@ -214,17 +214,17 @@ mod tests {
         assert_eq!(back.color_table, doc.color_table);
         for count in [0, 257] {
             doc.color_table = Some(ColorTable { colors: vec![[0, 0, 0]; count], transparent: None });
-            assert!(document_to_psd(&doc, false).is_none(), "{count}");
+            assert!(document_to_psd(&doc, false, None).is_none(), "{count}");
         }
         doc.color_table = None;
-        assert!(document_to_psd(&doc, false).is_none());
+        assert!(document_to_psd(&doc, false, None).is_none());
     }
 
     #[test]
     fn indexed_import_bounds_malformed_count_and_transparency_resources() {
         let mut doc = document(1, 1, SampleType::U8, ColorMode::Indexed, &[0.0, 0.0, 0.0, 1.0]);
         doc.color_table = Some(ColorTable { colors: vec![[0, 0, 0], [255, 255, 255]], transparent: None });
-        let (original, _) = document_to_psd(&doc, false).unwrap();
+        let (original, _) = document_to_psd(&doc, false, None).unwrap();
         for (count, expected) in [(vec![0, 0], 1), (vec![1, 1], 256), (vec![255, 255], 256), (vec![0], 256)] {
             let mut file = original.clone();
             file.resources.retain(|r| r.id != COLOR_TABLE_COUNT);
diff --git a/crates/io/src/pdf.rs b/crates/io/src/pdf.rs
index 4f992bc8fd..92a5a05850 100644
--- a/crates/io/src/pdf.rs
+++ b/crates/io/src/pdf.rs
@@ -59,8 +59,10 @@ fn pdf_string(s: &str) -> String {
 }
 
 fn deflate(data: &[u8]) -> Vec<u8> {
-    // Fast: print PDFs are transient and large; level 1 is ~4× quicker than the default.
-    let mut e = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::fast());
+    // Fast: print PDFs are transient and large. Level 3, not 1: zlib-rs level 1 writes static
+    // Huffman blocks only (13-30% bigger on photos); level 3 is the lowest that is never bigger
+    // than miniz's level 1 was, at about twice its time.
+    let mut e = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::new(3));
     let _ = e.write_all(data);
     e.finish().unwrap_or_default()
 }
diff --git a/crates/io/src/pixels.rs b/crates/io/src/pixels.rs
index 15e648df1a..9dff11fcce 100644
--- a/crates/io/src/pixels.rs
+++ b/crates/io/src/pixels.rs
@@ -93,11 +93,30 @@ pub fn deinterleave(bytes: &[u8], ch: usize, s: SampleType, invert: &[bool]) ->
     let bps = s.bytes();
     let n = bytes.len() / (ch * bps).max(1);
     if s == SampleType::U8 {
-        // Fast path: one plane per thread, no per-sample copies.
-        return par_map((0..ch).collect(), |c| {
-            let it = bytes.iter().skip(c).step_by(ch).take(n);
-            if invert[c] { it.map(|v| 255 - v).collect() } else { it.copied().collect() }
+        // Fast path: one band of pixels per core, written straight into every plane.
+        let mut planes = vec![vec![0u8; n]; ch];
+        let bs = bands(n);
+        let mut slots: Vec<Vec<&mut [u8]>> = bs.iter().map(|_| Vec::with_capacity(ch)).collect();
+        for plane in &mut planes {
+            let mut rest = plane.as_mut_slice();
+            for (slot, band) in slots.iter_mut().zip(&bs) {
+                let Some((part, tail)) = rest.split_at_mut_checked(band.len()) else { break };
+                slot.push(part);
+                rest = tail;
+            }
+        }
+        par_map(bs.into_iter().zip(slots).collect(), |(band, mut outs)| {
+            let src = bytes.get(band.start * ch..band.end * ch).unwrap_or(&[]);
+            for (c, out) in outs.iter_mut().enumerate() {
+                let px = src.chunks_exact(ch).filter_map(|p| p.get(c).copied());
+                if invert.get(c).copied().unwrap_or(false) {
+                    out.iter_mut().zip(px).for_each(|(o, v)| *o = 255 - v);
+                } else {
+                    out.iter_mut().zip(px).for_each(|(o, v)| *o = v);
+                }
+            }
         });
+        return planes;
     }
     // One band of rows per core, appended in band order into pre-grown planes.
     let row = ch * bps;
diff --git a/crates/io/src/psd_export.rs b/crates/io/src/psd_export.rs
index 0c809273a9..c6f8539106 100644
--- a/crates/io/src/psd_export.rs
+++ b/crates/io/src/psd_export.rs
@@ -22,13 +22,11 @@ mod resources;
 mod smart;
 
 pub(crate) use document::document_to_psd_interruptible;
+#[cfg(test)]
+use document::document_to_psd_sized;
 pub use document::{document_to_psd, document_to_psd_with};
 use document::{document_to_psd_nested, mask_parameters};
-#[cfg(test)]
-pub(crate) use estimate::estimate_psd_size;
-pub(crate) use estimate::{block_signature, psd_size_exceeds_limit, psd_version};
-#[cfg(test)]
-use estimate::{estimate_encoded_size, exceeds_psd_size_limit};
+pub(crate) use estimate::{fit_psd_size, psd_version, sign_global_blocks};
 pub(crate) use resources::{global_block, guides_resource, keep_imported_resource, legacy_name, pascal_names_resource, path_resources, unicode_names_resource};
 use smart::{LINK_KEYS, SmartOut, Source, contents_uuid, effects_unchanged, masked, size_from_layer, smart_keys, upsert};
 
@@ -37,24 +35,25 @@ use smart::{LINK_KEYS, SmartOut, Source, contents_uuid, effects_unchanged, maske
 /// A raster layer never writes them, nor adjustment blocks.
 const RASTER_STALE_KEYS: [&[u8; 4]; 8] = [b"SoCo", b"GdFl", b"PtFl", b"SoLd", b"PlLd", b"SoLE", b"TySh", b"vscg"];
 
+/// The largest file written as PSD: past it, the document is saved as PSB (Large Document Format),
+/// as Photoshop does.
 const PSD_MAX_FILE_SIZE: u64 = 2 * 1024 * 1024 * 1024;
+/// Room kept under [`PSD_MAX_FILE_SIZE`] for what the save adds after the conversion (the image
+/// preview resource, a few KB).
+const PSD_SAVE_HEADROOM: u64 = 1024 * 1024;
 /// Most bytes of one layer's interleaved samples the exporter gathers. The interleaved bytes and
 /// the channel planes made from them (or the band parts and the joined buffer) are alive together,
 /// so the peak is about twice this; it is also what fits in a file of at most [`PSD_MAX_FILE_SIZE`].
 const MAX_LAYER_GATHER_BYTES: u64 = if cfg!(target_pointer_width = "64") { 1 << 30 } else { 256 << 20 };
-const PSD_ESTIMATE_FIXED_OVERHEAD: u64 = 1024 * 1024;
-const PSD_ESTIMATE_LAYER_OVERHEAD: u64 = 64 * 1024;
 
 /// Options for [`document_to_psd_with`].
 #[derive(Debug, Clone)]
 pub struct PsdExportOptions {
     /// Write PSB even when the document fits PSD limits.
     pub force_psb: bool,
-    /// Switch to PSB when the estimated encoded size exceeds PSD's 2 GB limit. The estimate
-    /// counts every layer plane uncompressed, so a document with many canvas-sized layers can
-    /// pass it while its real file is far smaller. A writer that can measure the real size
-    /// instead turns this off: the layered TIFF writes PSD-style layer data and falls back to
-    /// PSB only when a length really overflows 32 bits.
+    /// Switch to PSB when the encoded file exceeds PSD's 2 GB limit (`fit_psd_size`). A writer
+    /// that embeds the layer data elsewhere turns this off: the layered TIFF writes PSD-style
+    /// layer data and falls back to PSB only when a length really overflows 32 bits.
     pub size_limit_psb: bool,
     /// Matte the merged image against white where it is translucent, as Photoshop does
     /// (`false` keeps straight colour under the alpha: for containers that store the composite
@@ -189,7 +188,7 @@ impl Ex {
         let compression = if w == 0 || h == 0 { Compression::Raw } else { self.compression() };
         ChannelData::encode(id, compression, plane, w, h, depth, self.version)
             .or_else(|_| ChannelData::encode(id, Compression::Raw, plane, w, h, depth, self.version))
-            .unwrap_or(ChannelData { id, compression: Some(Compression::Raw), data: plane.to_vec() })
+            .unwrap_or(ChannelData::new(id, Some(Compression::Raw), plane.to_vec()))
     }
 
     fn empty_channels(&self) -> Vec<ChannelData> {
@@ -543,7 +542,23 @@ impl Ex {
                 let masked = l.vector_mask.is_some();
                 raw.retain(|(k, _)| !(RASTER_STALE_KEYS.contains(&k) || adjust_map::ADJUSTMENT_KEYS.contains(&k) || k == b"CgEd" || (k == b"vstk" && masked)));
             }
-            LayerContent::Group(_) => {}
+            // A Frame's stroke (`vstk`), kept byte-identical while it still decodes to the model.
+            LayerContent::Group(g) => {
+                let pos = raw.iter().position(|(k, _)| k == b"vstk");
+                let old = pos.and_then(|i| raw.get(i)).and_then(|(_, d)| crate::vector_map::parse_vstk(d, self.dpi));
+                // One we can't decode stays as it was unless the model has a stroke to write.
+                let stale = match &old {
+                    Some(v) => v.stroke != g.frame_stroke,
+                    None => g.frame_stroke.is_some(),
+                };
+                if stale {
+                    let data = crate::vector_map::vstk_bytes(g.frame_stroke.as_ref(), old.is_none_or(|v| v.fill_enabled), self.dpi);
+                    match pos.and_then(|i| raw.get_mut(i)) {
+                        Some(e) => e.1 = data,
+                        None => raw.push((*b"vstk", data)),
+                    }
+                }
+            }
         }
         // Effects reference point: written from the field (in place, keeping block order).
         match l.effects.reference {
diff --git a/crates/io/src/psd_export/document.rs b/crates/io/src/psd_export/document.rs
index 0ad7188a58..c9e68fd028 100644
--- a/crates/io/src/psd_export/document.rs
+++ b/crates/io/src/psd_export/document.rs
@@ -1,8 +1,13 @@
-use super::estimate::{MERGED_RENDERED, MERGED_WEIGHT, block_signature, psd_size_exceeds_limit, psd_version};
+use super::PSD_MAX_FILE_SIZE;
+use super::estimate::{MERGED_RENDERED, MERGED_WEIGHT, fit_psd_size, psd_version, sign_global_blocks};
 use super::merged::{cmyk_of, merged_planes, placeholder_planes};
 use super::resources::{global_block, guides_resource, keep_imported_resource, legacy_name, pascal_names_resource, path_resources, unicode_names_resource};
 use super::smart::{SmartOut, link_group_resource};
-use super::*;
+use super::{
+    ColorMode, Compression, Document, Ex, GlobalLayerMask, Header, ImageData, ImageResource, Interrupt, LayerContent, LayerInfo, LayerInfoPlacement,
+    MaskParameters, PixelFormat, PsdExportOptions, PsdFile, PsdMode, ResolutionInfo, SampleType, TaggedBlock, deinterleave, ids, psd_background, psd_depth,
+    psd_mode, q255, version_info_resource,
+};
 
 /// Converts a document to a PSD file model (see [`document_to_psd_with`]).
 pub fn document_to_psd(doc: &Document) -> PsdFile {
@@ -13,25 +18,42 @@ pub fn document_to_psd(doc: &Document) -> PsdFile {
 /// anything that could not be represented. The merged composite is rendered
 /// with `photocraft_compose::flatten`.
 pub fn document_to_psd_with(doc: &Document, opts: &PsdExportOptions) -> (PsdFile, Vec<String>) {
-    document_to_psd_nested(doc, opts, 0, &Interrupt::NONE)
+    document_to_psd_sized(doc, opts, 0, &Interrupt::NONE, PSD_MAX_FILE_SIZE)
 }
 
 /// [`document_to_psd_with`] for a background save (#3389): reports progress through `ctl` after
 /// each layer record and each band of the merged composite. Once `ctl` is cancelled it stops
 /// early and returns an **incomplete** model: callers check `ctl` and discard it.
 pub(crate) fn document_to_psd_interruptible(doc: &Document, opts: &PsdExportOptions, ctl: &Interrupt) -> (PsdFile, Vec<String>) {
-    document_to_psd_nested(doc, opts, 0, ctl)
+    document_to_psd_sized(doc, opts, 0, ctl, PSD_MAX_FILE_SIZE)
 }
 
 /// [`document_to_psd_with`] for a document embedded `depth` smart objects deep.
 pub(super) fn document_to_psd_nested(doc: &Document, opts: &PsdExportOptions, depth: u32, ctl: &Interrupt) -> (PsdFile, Vec<String>) {
+    document_to_psd_sized(doc, opts, depth, ctl, PSD_MAX_FILE_SIZE)
+}
+
+/// Export with a caller-selected PSD size limit; the test suite lowers it to exercise promotion.
+pub(super) fn document_to_psd_sized(doc: &Document, opts: &PsdExportOptions, depth: u32, ctl: &Interrupt, size_limit: u64) -> (PsdFile, Vec<String>) {
+    let layerless_limit = opts.size_limit_psb.then_some(size_limit);
     if doc.mode == ColorMode::Multichannel {
-        return crate::multichannel_map::document_to_psd(doc, opts.force_psb);
+        return crate::multichannel_map::document_to_psd(doc, opts.force_psb, layerless_limit);
     }
-    if let Some(file) = crate::palette_map::document_to_psd(doc, opts.force_psb) {
+    if let Some(file) = crate::palette_map::document_to_psd(doc, opts.force_psb, layerless_limit) {
         return file;
     }
     let fmt = doc.pixel_format();
+    export_supported_document(doc, opts, depth, ctl, fmt, size_limit)
+}
+
+fn export_supported_document(
+    doc: &Document,
+    opts: &PsdExportOptions,
+    depth: u32,
+    ctl: &Interrupt,
+    fmt: PixelFormat,
+    size_limit: u64,
+) -> (PsdFile, Vec<String>) {
     // A Duotone is written over its grey plate with its inks: the block it was imported with,
     // verbatim, while the inks are unedited, else one made from them (`duotone_map`). Photoshop
     // has only 8-bit Duotone: it refuses to open a 16-bit one.
@@ -43,8 +65,7 @@ pub(super) fn document_to_psd_nested(doc: &Document, opts: &PsdExportOptions, de
     let sample = fmt.sample;
     let cc = fmt.mode.color_channels();
     let big = doc.size.width > 30_000 || doc.size.height > 30_000;
-    let size_exceeds_limit = opts.size_limit_psb && !opts.force_psb && !big && psd_size_exceeds_limit(doc);
-    let version = psd_version(doc, opts.force_psb, size_exceeds_limit);
+    let version = psd_version(doc, opts.force_psb);
     let mut ex = Ex {
         fmt,
         dpi: doc.resolution_dpi,
@@ -68,72 +89,8 @@ pub(super) fn document_to_psd_nested(doc: &Document, opts: &PsdExportOptions, de
         patterns: doc.patterns.clone(),
         background: psd_background(doc),
     };
-    if big && !opts.force_psb {
-        ex.warnings.push("document exceeds 30000 px; written as PSB".into());
-    } else if size_exceeds_limit && !opts.force_psb {
-        ex.warnings.push("estimated encoded size exceeds 2 GB; written as PSB".into());
-    }
-    if fmt.mode != doc.mode && duotone_inks.is_none() {
-        ex.warnings.push(format!("{:?} document written as {:?}", doc.mode, fmt.mode));
-    }
-    // Assign layer ids up front (stable across round trips): keep unique
-    // `psd_id`s, number the rest after them; dividers come after all.
-    {
-        let walk = doc.walk();
-        let mut used = std::collections::HashSet::new();
-        for (_, _, l) in &walk {
-            if let Some(id) = l.psd_id
-                && used.insert(id)
-            {
-                ex.layer_ids.insert(l.id, id);
-            }
-        }
-        let mut next = 1u32;
-        for (_, _, l) in &walk {
-            if let std::collections::hash_map::Entry::Vacant(e) = ex.layer_ids.entry(l.id) {
-                while used.contains(&next) {
-                    next += 1;
-                }
-                used.insert(next);
-                e.insert(next);
-            }
-        }
-        ex.next_id = used.iter().copied().max().unwrap_or(0);
-        ex.used_ids = used;
-        // Text objects' number in the generated `Txt2` (#1348): a preserved `TySh` keeps the
-        // number it already names — its `Txt2` object must sit at that slot for `apply_txt2` —
-        // and new layers get numbers past every kept one and every object in the file's `Txt2`.
-        // Kept numbers are claimed first: a layer added below others must not take a number a
-        // layer above it keeps, or each of those would be renumbered onto its neighbour's object
-        // and take its style (#7773); nor may it land on a deleted layer's object.
-        let mut used_txt = std::collections::HashSet::new();
-        ex.text_index = Default::default();
-        let mut fresh = Vec::new();
-        for (_, _, l) in &walk {
-            let LayerContent::Text(t) = &l.content else {
-                continue;
-            };
-            match t.psd_raw.as_deref().and_then(|d| photocraft_text::psd::text_index(d)) {
-                Some(i) if used_txt.insert(i) => {
-                    ex.text_index.insert(l.id, i);
-                }
-                _ => fresh.push(l.id),
-            }
-        }
-        let objects =
-            doc.metadata.psd_global_blocks.iter().find(|(_, key, _)| key == b"Txt2").map_or(0, |(_, _, d)| photocraft_text::psd::txt2_object_count(d));
-        let mut next_txt = used_txt.iter().max().map_or(0, |m| m + 1).max(i32::try_from(objects).unwrap_or(i32::MAX));
-        if next_txt.saturating_add(fresh.len() as i32) > photocraft_text::psd::MAX_TEXT_INDEX + 1 {
-            next_txt = 0;
-        }
-        for id in fresh {
-            while used_txt.contains(&next_txt) {
-                next_txt += 1;
-            }
-            used_txt.insert(next_txt);
-            ex.text_index.insert(id, next_txt);
-        }
-    }
+    add_format_warnings(doc, opts, fmt, big, duotone_inks.is_some(), &mut ex.warnings);
+    index_layer_ids_and_text(doc, &mut ex);
     // Progress: one unit per layer record, then the merged composite (#3389).
     let records = doc.walk().len() as f32;
     let units = records + MERGED_WEIGHT;
@@ -146,66 +103,11 @@ pub(super) fn document_to_psd_nested(doc: &Document, opts: &PsdExportOptions, de
     };
     let space = photocraft_compose::cmyk_space(doc);
     photocraft_color::convert::with_cmyk_space(space.as_ref(), || ex.emit(&doc.layers, &mut tick));
+    drop(tick);
+    ctl.progress(layers_share);
 
-    // Without Maximize Compatibility the merged image is a white placeholder and the composite
-    // isn't rendered at all. A document without layer records keeps the real image: its pixels
-    // live nowhere else. So does a Duotone: it opens flattened from that image (its layer records
-    // are not read back).
-    let real_merged = opts.maximize_compatibility || ex.records.is_empty() || duotone_inks.is_some();
-    let (mut planes, has_alpha) = if real_merged {
-        // Merged composite, rendered and encoded in bands (no full-size float composite). Matting
-        // against white only changes pixels with alpha < 1; if some are slightly translucent but
-        // all round to opaque (so no alpha channel is written), encode once more without the matte.
-        let merged_end = layers_share + (1.0 - layers_share) * MERGED_RENDERED;
-        let (mut planes, has_alpha, translucent) =
-            crate::with_span(ctl, layers_share, merged_end, |ctl| merged_planes(doc, &fmt, cmyk_of(&fmt), opts.merged_matte, ctl));
-        if !has_alpha && translucent && opts.merged_matte {
-            planes = merged_planes(doc, &fmt, cmyk_of(&fmt), false, &Interrupt::cancel_only(&|| ctl.cancelled())).0;
-        }
-        (planes, has_alpha)
-    } else {
-        (placeholder_planes(doc, &fmt), false)
-    };
-    let n = doc.size.area() as usize;
-    if !has_alpha {
-        planes.truncate(cc * n * sample.bytes());
-    }
-    let canvas = doc.bounds();
-    let max_extra = 56 - cc - usize::from(has_alpha);
-    if doc.channels.len() > max_extra {
-        ex.warnings.push(format!("only {max_extra} alpha channels fit in PSD; the rest were dropped"));
-    }
-    let mut extra: Vec<_> = doc.channels.iter().take(max_extra).collect();
-    // Saved in Quick Mask mode: the mask is written as the last extra channel and flagged by
-    // resource 1022 (quick mask info: channel id, initially-empty flag), as Photoshop does.
-    let quick_mask_id = match &doc.quick_mask {
-        Some(q) if extra.len() < max_extra => {
-            extra.push(q);
-            Some((cc + usize::from(has_alpha) + extra.len() - 1) as u16)
-        }
-        Some(_) => {
-            ex.warnings.push("Quick Mask was dropped because the PSD channel limit was reached".into());
-            None
-        }
-        None => None,
-    };
-    for a in &extra {
-        let s = if a.surface.format() != ex.mask_fmt { a.surface.convert(ex.mask_fmt) } else { a.surface.clone() };
-        let mut bytes = s.to_interleaved(canvas);
-        // Spot ink as Photoshop stores it (0 = solid); an alpha channel stays straight.
-        if a.spot.is_some() {
-            crate::channel_map::photoshop_spot_plane(&mut bytes, sample);
-        }
-        planes.extend(deinterleave(&bytes, 1, sample, &[false]).remove(0));
-    }
-    let channels = (cc + usize::from(has_alpha) + extra.len()) as u16;
-    let mode = if duotone_inks.is_some() { PsdMode::Duotone } else { psd_mode(fmt.mode) };
-    let header = Header::new(version, doc.size.width, doc.size.height, channels, psd_depth(sample), mode);
-    let mcomp = if sample == SampleType::F32 { Compression::Raw } else { opts.merged_compression };
-    let image_data = ImageData::encode(mcomp, &planes, &header)
-        .or_else(|_| ImageData::encode(Compression::Raw, &planes, &header))
-        .unwrap_or(ImageData { compression: Compression::Raw, data: planes });
-    ctl.progress(1.0);
+    let merged = prepare_merged_planes(doc, &mut ex, opts, ctl, fmt, duotone_inks.is_some(), layers_share);
+    let MergedExport { header, image_data, extra, has_alpha, quick_mask_id, real_merged } = merged;
 
     // Resources.
     let mut resources = vec![
@@ -281,7 +183,7 @@ pub(super) fn document_to_psd_nested(doc: &Document, opts: &PsdExportOptions, de
         if !ex.records.is_empty() && matches!(&key, b"Lr16" | b"Lr32" | b"Layr") {
             continue;
         }
-        let block = global_block(block_signature(sig, key, version), key, &data);
+        let block = global_block(sig, key, &data);
         // A kept merged-transparency marker describes the opened file's composite. Over an opaque
         // one it would make the first alpha channel read back as the transparency, and vanish.
         if !has_alpha && block.is_merged_transparency_marker() {
@@ -362,7 +264,7 @@ pub(super) fn document_to_psd_nested(doc: &Document, opts: &PsdExportOptions, de
         Some(raw) => raw,
         None => photocraft_psd::hdr::color_mode_data_for_depth(header.depth),
     };
-    let file = PsdFile {
+    let mut file = PsdFile {
         header,
         color_mode_data,
         resources,
@@ -372,10 +274,178 @@ pub(super) fn document_to_psd_nested(doc: &Document, opts: &PsdExportOptions, de
         global_blocks,
         layer_mask_trailing: Vec::new(),
         image_data,
+        write_as_psb: false,
     };
+    if opts.size_limit_psb
+        && let Some(warning) = fit_psd_size(&mut file, size_limit)
+    {
+        ex.warnings.push(warning);
+    }
+    sign_global_blocks(&mut file);
     (file, ex.warnings)
 }
 
+fn add_format_warnings(doc: &Document, opts: &PsdExportOptions, fmt: PixelFormat, big: bool, has_duotone: bool, warnings: &mut Vec<String>) {
+    if big && !opts.force_psb {
+        warnings.push("document exceeds 30000 px; written as PSB".into());
+    }
+    if fmt.mode != doc.mode && !has_duotone {
+        warnings.push(format!("{:?} document written as {:?}", doc.mode, fmt.mode));
+    }
+}
+
+struct MergedExport<'a> {
+    header: Header,
+    image_data: ImageData,
+    extra: Vec<&'a photocraft_doc::AlphaChannel>,
+    has_alpha: bool,
+    quick_mask_id: Option<u16>,
+    real_merged: bool,
+}
+
+fn prepare_merged_planes<'a>(
+    doc: &'a Document,
+    ex: &mut Ex,
+    opts: &PsdExportOptions,
+    ctl: &Interrupt,
+    fmt: PixelFormat,
+    duotone: bool,
+    layers_share: f32,
+) -> MergedExport<'a> {
+    let sample = fmt.sample;
+    let cc = fmt.mode.color_channels();
+    let real_merged = opts.maximize_compatibility || ex.records.is_empty() || duotone;
+    let (mut planes, has_alpha) = merged_image(doc, opts, ctl, &fmt, real_merged, layers_share);
+    if !has_alpha {
+        planes.truncate(cc * doc.size.area() as usize * sample.bytes());
+    }
+    let (extra, quick_mask_id) = append_extra_channels(doc, ex, &mut planes, has_alpha, sample);
+    let channels = (cc + usize::from(has_alpha) + extra.len()) as u16;
+    let mode = if duotone { PsdMode::Duotone } else { psd_mode(fmt.mode) };
+    let header = Header::new(ex.version, doc.size.width, doc.size.height, channels, psd_depth(sample), mode);
+    let compression = if sample == SampleType::F32 { Compression::Raw } else { opts.merged_compression };
+    let image_data = ImageData::encode(compression, &planes, &header).or_else(|_| ImageData::encode(Compression::Raw, &planes, &header)).unwrap_or(ImageData {
+        compression: Compression::Raw,
+        data: planes,
+        stored: None,
+    });
+    ctl.progress(1.0);
+    MergedExport { header, image_data, extra, has_alpha, quick_mask_id, real_merged }
+}
+
+fn append_extra_channels<'a>(
+    doc: &'a Document,
+    ex: &mut Ex,
+    planes: &mut Vec<u8>,
+    has_alpha: bool,
+    sample: SampleType,
+) -> (Vec<&'a photocraft_doc::AlphaChannel>, Option<u16>) {
+    let cc = ex.cc;
+    let max_extra = 56 - cc - usize::from(has_alpha);
+    if doc.channels.len() > max_extra {
+        ex.warnings.push(format!("only {max_extra} alpha channels fit in PSD; the rest were dropped"));
+    }
+    let mut extra: Vec<_> = doc.channels.iter().take(max_extra).collect();
+    let quick_mask_id = match &doc.quick_mask {
+        Some(q) if extra.len() < max_extra => {
+            extra.push(q);
+            Some((cc + usize::from(has_alpha) + extra.len() - 1) as u16)
+        }
+        Some(_) => {
+            ex.warnings.push("Quick Mask was dropped because the PSD channel limit was reached".into());
+            None
+        }
+        None => None,
+    };
+    let canvas = doc.bounds();
+    for channel in &extra {
+        let surface = if channel.surface.format() != ex.mask_fmt { channel.surface.convert(ex.mask_fmt) } else { channel.surface.clone() };
+        let mut bytes = surface.to_interleaved(canvas);
+        if channel.spot.is_some() {
+            crate::channel_map::photoshop_spot_plane(&mut bytes, sample);
+        }
+        planes.extend(deinterleave(&bytes, 1, sample, &[false]).remove(0));
+    }
+    (extra, quick_mask_id)
+}
+
+fn merged_image(doc: &Document, opts: &PsdExportOptions, ctl: &Interrupt, fmt: &PixelFormat, real_merged: bool, layers_share: f32) -> (Vec<u8>, bool) {
+    if !real_merged {
+        return (placeholder_planes(doc, fmt), false);
+    }
+    // Merged composite, rendered and encoded in bands (no full-size float composite). Matting
+    // against white only changes pixels with alpha < 1; if some are slightly translucent but
+    // all round to opaque (so no alpha channel is written), encode once more without the matte.
+    let merged_end = layers_share + (1.0 - layers_share) * MERGED_RENDERED;
+    let (mut planes, has_alpha, translucent) =
+        crate::with_span(ctl, layers_share, merged_end, |ctl| merged_planes(doc, fmt, cmyk_of(fmt), opts.merged_matte, ctl));
+    if !has_alpha && translucent && opts.merged_matte {
+        planes = merged_planes(doc, fmt, cmyk_of(fmt), false, &Interrupt::cancel_only(&|| ctl.cancelled())).0;
+    }
+    (planes, has_alpha)
+}
+
+fn index_layer_ids_and_text(doc: &Document, ex: &mut Ex) {
+    // Assign layer ids up front (stable across round trips): keep unique
+    // `psd_id`s, number the rest after them; dividers come after all.
+    {
+        let walk = doc.walk();
+        let mut used = std::collections::HashSet::new();
+        for (_, _, l) in &walk {
+            if let Some(id) = l.psd_id
+                && used.insert(id)
+            {
+                ex.layer_ids.insert(l.id, id);
+            }
+        }
+        let mut next = 1u32;
+        for (_, _, l) in &walk {
+            if let std::collections::hash_map::Entry::Vacant(e) = ex.layer_ids.entry(l.id) {
+                while used.contains(&next) {
+                    next += 1;
+                }
+                used.insert(next);
+                e.insert(next);
+            }
+        }
+        ex.next_id = used.iter().copied().max().unwrap_or(0);
+        ex.used_ids = used;
+        // Text objects' number in the generated `Txt2` (#1348): a preserved `TySh` keeps the
+        // number it already names — its `Txt2` object must sit at that slot for `apply_txt2` —
+        // and new layers get numbers past every kept one and every object in the file's `Txt2`.
+        // Kept numbers are claimed first: a layer added below others must not take a number a
+        // layer above it keeps, or each of those would be renumbered onto its neighbour's object
+        // and take its style (#7773); nor may it land on a deleted layer's object.
+        let mut used_txt = std::collections::HashSet::new();
+        ex.text_index = Default::default();
+        let mut fresh = Vec::new();
+        for (_, _, l) in &walk {
+            let LayerContent::Text(t) = &l.content else {
+                continue;
+            };
+            match t.psd_raw.as_deref().and_then(|d| photocraft_text::psd::text_index(d)) {
+                Some(i) if used_txt.insert(i) => {
+                    ex.text_index.insert(l.id, i);
+                }
+                _ => fresh.push(l.id),
+            }
+        }
+        let objects =
+            doc.metadata.psd_global_blocks.iter().find(|(_, key, _)| key == b"Txt2").map_or(0, |(_, _, d)| photocraft_text::psd::txt2_object_count(d));
+        let mut next_txt = used_txt.iter().max().map_or(0, |m| m + 1).max(i32::try_from(objects).unwrap_or(i32::MAX));
+        if next_txt.saturating_add(fresh.len() as i32) > photocraft_text::psd::MAX_TEXT_INDEX + 1 {
+            next_txt = 0;
+        }
+        for id in fresh {
+            while used_txt.contains(&next_txt) {
+                next_txt += 1;
+            }
+            used_txt.insert(next_txt);
+            ex.text_index.insert(id, next_txt);
+        }
+    }
+}
+
 /// PSD mask parameters for a user mask's and a vector mask's (density, feather); `None` when
 /// every value is the default (density 1, feather 0).
 pub(super) fn mask_parameters(user: Option<(f32, f32)>, vector: Option<(f32, f32)>) -> Option<MaskParameters> {
diff --git a/crates/io/src/psd_export/estimate.rs b/crates/io/src/psd_export/estimate.rs
index 83c2388a1e..bb2d9b1c59 100644
--- a/crates/io/src/psd_export/estimate.rs
+++ b/crates/io/src/psd_export/estimate.rs
@@ -1,115 +1,5 @@
-use super::*;
-
-/// How much of a PSD conversion the merged composite weighs, in layer records: rendering it
-/// (all layers composited) and encoding its planes cost about two full-canvas layers.
-pub(super) const MERGED_WEIGHT: f32 = 2.0;
-
-/// The part of the merged composite's share filled once its bands are rendered and converted; the
-/// rest is compressing its planes.
-pub(super) const MERGED_RENDERED: f32 = 0.8;
-
-/// Adds headroom for compressed channel streams and their per-row length tables.
-pub(super) fn estimate_encoded_size(raw_bytes: u64, rows: u64, structural_bytes: u64) -> Option<u64> {
-    raw_bytes.checked_add(raw_bytes.checked_add(63)?.checked_div(64)?)?.checked_add(rows.checked_mul(8)?)?.checked_add(structural_bytes)
-}
-
-fn add_plane_estimate(raw_bytes: &mut u64, rows: &mut u64, width: u64, height: u64, channels: u64, bytes_per_sample: u64) -> Option<()> {
-    let plane_bytes = width.checked_mul(height)?.checked_mul(channels)?.checked_mul(bytes_per_sample)?;
-    let plane_rows = height.checked_mul(channels)?;
-    *raw_bytes = raw_bytes.checked_add(plane_bytes)?;
-    *rows = rows.checked_add(plane_rows)?;
-    Some(())
-}
-
-pub(super) fn exceeds_psd_size_limit(estimated_size: Option<u64>) -> bool {
-    estimated_size.is_none_or(|size| size > PSD_MAX_FILE_SIZE)
-}
-
-fn surface_dimensions(surface: &Surface) -> Option<(u64, u64)> {
-    let bounds = surface.content_bounds();
-    Some((u64::from(bounds.width()), u64::from(bounds.height())))
-}
-
-pub(crate) fn estimate_psd_size(doc: &Document) -> Option<u64> {
-    let mut raw_bytes = 0;
-    let mut rows = 0;
-    let mut structural_bytes = PSD_ESTIMATE_FIXED_OVERHEAD;
-
-    let width = u64::from(doc.size.width);
-    let height = u64::from(doc.size.height);
-
-    if doc.mode == ColorMode::Multichannel {
-        let channels = u64::try_from(doc.channels.len().clamp(1, 56)).ok()?;
-        let sample_bytes = u64::try_from(if doc.depth == SampleType::F32 { SampleType::U16.bytes() } else { doc.depth.bytes() }).ok()?;
-        add_plane_estimate(&mut raw_bytes, &mut rows, width, height, channels, sample_bytes)?;
-    } else {
-        let format = doc.pixel_format();
-        let color_channels = u64::try_from(format.mode.color_channels()).ok()?;
-        let bytes_per_sample = u64::try_from(format.sample.bytes()).ok()?;
-        let layer_channels = color_channels.checked_add(1)?;
-
-        for (_, _, layer) in doc.walk() {
-            structural_bytes = structural_bytes.checked_add(PSD_ESTIMATE_LAYER_OVERHEAD)?.checked_add(u64::try_from(layer.name.len()).ok()?)?;
-            for (_, data) in &layer.psd_blocks {
-                structural_bytes = structural_bytes.checked_add(u64::try_from(data.len()).ok()?)?;
-            }
-
-            let surface = match &layer.content {
-                LayerContent::Fill(fill) => {
-                    let mut fill_width = width;
-                    let mut fill_height = height;
-                    if let Some(cache) = &layer.fill_cache
-                        && cache.fill == *fill
-                    {
-                        let (cache_width, cache_height) = surface_dimensions(&cache.surface)?;
-                        fill_width = fill_width.max(cache_width);
-                        fill_height = fill_height.max(cache_height);
-                    }
-                    add_plane_estimate(&mut raw_bytes, &mut rows, fill_width, fill_height, layer_channels, bytes_per_sample)?;
-                    None
-                }
-                _ => layer.surface(),
-            };
-            if let Some(surface) = surface {
-                let (surface_width, surface_height) = surface_dimensions(surface)?;
-                add_plane_estimate(&mut raw_bytes, &mut rows, surface_width, surface_height, layer_channels, bytes_per_sample)?;
-            }
-            if let Some(mask) = &layer.mask {
-                let (mask_width, mask_height) = surface_dimensions(&mask.surface)?;
-                add_plane_estimate(&mut raw_bytes, &mut rows, mask_width, mask_height, 1, bytes_per_sample)?;
-            }
-            if let LayerContent::Smart(smart) = &layer.content
-                && let photocraft_doc::SmartSource::Embedded { bytes, .. } = &smart.source
-            {
-                structural_bytes = structural_bytes.checked_add(u64::try_from(bytes.len()).ok()?)?;
-            }
-        }
-
-        let max_extra_channels = 56usize.saturating_sub(format.mode.color_channels() + 1);
-        let mut extra_channels = doc.channels.len().min(max_extra_channels);
-        if doc.quick_mask.is_some() && extra_channels < max_extra_channels {
-            extra_channels += 1;
-        }
-        let merged_channels = color_channels.checked_add(1)?.checked_add(u64::try_from(extra_channels).ok()?)?;
-        add_plane_estimate(&mut raw_bytes, &mut rows, width, height, merged_channels, bytes_per_sample)?;
-        for channel in doc.channels.iter().take(extra_channels) {
-            structural_bytes = structural_bytes.checked_add(u64::try_from(channel.name.len()).ok()?)?;
-        }
-    }
-
-    structural_bytes = structural_bytes
-        .checked_add(u64::try_from(doc.icc_profile.as_ref().map_or(0, |profile| profile.len())).ok()?)?
-        .checked_add(u64::try_from(doc.metadata.xmp.as_deref().map_or(0, str::len)).ok()?)?
-        .checked_add(u64::try_from(doc.metadata.exif.as_ref().map_or(0, |data| data.len())).ok()?)?;
-    for (_, name, data) in &doc.metadata.psd_resources {
-        structural_bytes = structural_bytes.checked_add(u64::try_from(name.len()).ok()?)?.checked_add(u64::try_from(data.len()).ok()?)?;
-    }
-    for (_, _, data) in &doc.metadata.psd_global_blocks {
-        structural_bytes = structural_bytes.checked_add(u64::try_from(data.len()).ok()?)?;
-    }
-
-    estimate_encoded_size(raw_bytes, rows, structural_bytes)
-}
+use super::{Document, PSD_SAVE_HEADROOM};
+use photocraft_psd::{PsdFile, Version, file::LayerInfoPlacement};
 
 /// The signature a kept tagged block is written with. `8B64` exists only in PSB files: a PSD
 /// with an `8B64` block (kept from a PSB source, e.g. its global `FMsk` or `cinf`) is refused by
@@ -125,11 +15,49 @@ pub(crate) fn block_signature(sig: [u8; 4], key: [u8; 4], version: Version) -> [
     }
 }
 
-pub(crate) fn psd_version(doc: &Document, force_psb: bool, size_exceeds_limit: bool) -> Version {
+/// How much of a PSD conversion the merged composite weighs, in layer records.
+pub(super) const MERGED_WEIGHT: f32 = 2.0;
+
+/// The part of the merged composite's share filled once its bands are rendered and converted.
+pub(super) const MERGED_RENDERED: f32 = 0.8;
+
+/// The version a document is encoded as: PSB when asked for or past PSD's 30000 px; otherwise
+/// PSD, which [`fit_psd_size`] turns into PSB once the encoded file proves too large.
+pub(crate) fn psd_version(doc: &Document, force_psb: bool) -> Version {
     let exceeds_dimensions = doc.size.width > 30_000 || doc.size.height > 30_000;
-    if force_psb || exceeds_dimensions || size_exceeds_limit { Version::Psb } else { Version::Psd }
+    if force_psb || exceeds_dimensions { Version::Psb } else { Version::Psd }
 }
 
-pub(crate) fn psd_size_exceeds_limit(doc: &Document) -> bool {
-    exceeds_psd_size_limit(estimate_psd_size(doc))
+/// Promote files that exceed the PSD limit, accounting for the preview appended by the save
+/// (#212, #5285). The decision is made on the exact length of the file as it will be written,
+/// not on the raw pixel size: RLE usually packs the channels far below it.
+pub(crate) fn fit_psd_size(file: &mut PsdFile, limit: u64) -> Option<String> {
+    if file.written_version() == Version::Psb {
+        return None;
+    }
+    if file.encoded_len().is_ok_and(|len| len.saturating_add(PSD_SAVE_HEADROOM) <= limit) {
+        return None;
+    }
+    match file.promote_to_psb() {
+        Ok(()) => {
+            let padded = file.layer_info.as_ref().is_some_and(|info| info.padding.is_some());
+            if matches!(file.layer_info_placement, LayerInfoPlacement::Section)
+                && padded
+                && file.pad_layer_info_to(4).is_err()
+                && let Some(info) = &mut file.layer_info
+            {
+                info.padding = None;
+            }
+            Some("encoded size exceeds 2 GB; written as PSB".into())
+        }
+        Err(error) => Some(format!("encoded size exceeds 2 GB, but the file could not be written as PSB: {error}")),
+    }
+}
+
+/// Signs every global block for the version the file is written as.
+pub(crate) fn sign_global_blocks(file: &mut PsdFile) {
+    let version = file.written_version();
+    for block in &mut file.global_blocks {
+        block.signature = block_signature(block.signature, block.key, version);
+    }
 }
diff --git a/crates/io/src/psd_export/merged.rs b/crates/io/src/psd_export/merged.rs
index da3afe0597..94b7bc4014 100644
--- a/crates/io/src/psd_export/merged.rs
+++ b/crates/io/src/psd_export/merged.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{ColorMode, Document, Interrupt, PixelFormat, SampleType, encode_be, q255};
 
 pub(super) fn cmyk_of(fmt: &PixelFormat) -> bool {
     fmt.mode == ColorMode::Cmyk
@@ -29,39 +29,58 @@ pub(super) fn merged_planes(doc: &Document, fmt: &PixelFormat, cmyk: bool, matte
         if ctl.cancelled() {
             return Err(());
         }
-        // Retain alpha whenever it differs from opaque at the stored precision.
-        has_alpha |= band.px.iter().any(|p| match sample {
-            SampleType::U8 => q255(p[3]) < 255,
-            SampleType::U16 => (p[3].clamp(0.0, 1.0) * 65535.0 + 0.5) as u16 != u16::MAX,
-            SampleType::F32 => p[3] != 1.0,
-        });
-        translucent |= band.px.iter().any(|p| p[3] < 1.0);
         let start = (band.rect.y0 - canvas.y0) as usize * w;
-        // Converted and encoded on all cores, then copied into each plane.
-        let parts = crate::pixels::par_map(crate::pixels::bands(band.px.len()), |range| {
-            // The composite came through the document's CMYK profile: convert back through it too.
-            photocraft_color::convert::with_cmyk_space(space.as_ref(), || {
-                let mut out: Vec<Vec<u8>> = vec![Vec::with_capacity(range.len() * bps); cc + 1];
-                let mut v = [0.0f32; 5];
-                for p in &band.px[range.clone()] {
-                    photocraft_raster::from_rgba_into(fmt, *p, &mut v);
-                    for c in 0..=cc {
-                        // Matte against white like Photoshop (see `pixels::matte`).
-                        let m = if c < cc && matte { crate::pixels::matte(v[c], v[cc], white[c]) } else { v[c] };
-                        let x = if cmyk && c < cc { 1.0 - m } else { m };
-                        // 16-bit Lab a*/b* use Photoshop's 0..65280 scale (`pixels::lab16_chroma`).
-                        let x = if lab16 && (c == 1 || c == 2) { x * (crate::pixels::LAB16_CHROMA_MAX / 65535.0) } else { x };
-                        encode_be(x, sample, &mut out[c]);
-                    }
-                }
-                (range.start, out)
+        let ranges = crate::pixels::bands(band.px.len());
+        let mut slots: Vec<Vec<&mut [u8]>> = ranges.iter().map(|_| Vec::with_capacity(cc + 1)).collect();
+        for chunk in planes.chunks_mut(plane.max(1)).take(cc + 1) {
+            let Some(mut rest) = chunk.get_mut(start * bps..(start + band.px.len()) * bps) else { continue };
+            for (slot, range) in slots.iter_mut().zip(&ranges) {
+                let Some((part, tail)) = rest.split_at_mut_checked(range.len() * bps) else { break };
+                slot.push(part);
+                rest = tail;
+            }
+        }
+        // Converted and encoded on all cores. The composite came through the document's CMYK
+        // profile: convert back through it too.
+        let flags = crate::pixels::par_map(ranges.into_iter().zip(slots).collect(), |(range, mut out)| {
+            let px = band.px.get(range).unwrap_or(&[]);
+            let k = Encode { fmt, cc, matte, cmyk, lab16, white: &white };
+            photocraft_color::convert::with_cmyk_space(space.as_ref(), || match sample {
+                SampleType::U8 => k.run(
+                    px,
+                    &mut out,
+                    |a| q255(a) < 255,
+                    |x, d, i| {
+                        if let Some(b) = d.get_mut(i) {
+                            *b = (x.clamp(0.0, 1.0) * 255.0 + 0.5) as u8;
+                        }
+                    },
+                ),
+                SampleType::U16 => k.run(
+                    px,
+                    &mut out,
+                    |a| (a.clamp(0.0, 1.0) * 65535.0 + 0.5) as u16 != u16::MAX,
+                    |x, d, i| {
+                        if let Some(b) = d.get_mut(i * 2..i * 2 + 2) {
+                            b.copy_from_slice(&((x.clamp(0.0, 1.0) * 65535.0 + 0.5) as u16).to_be_bytes());
+                        }
+                    },
+                ),
+                SampleType::F32 => k.run(
+                    px,
+                    &mut out,
+                    |a| a != 1.0,
+                    |x, d, i| {
+                        if let Some(b) = d.get_mut(i * 4..i * 4 + 4) {
+                            b.copy_from_slice(&x.to_be_bytes());
+                        }
+                    },
+                ),
             })
         });
-        for (at, part) in parts {
-            for (c, src) in part.iter().enumerate() {
-                let o = c * plane + (start + at) * bps;
-                planes[o..o + src.len()].copy_from_slice(src);
-            }
+        for (a, t) in flags {
+            has_alpha |= a;
+            translucent |= t;
         }
         ctl.progress((band.rect.y1 - canvas.y0) as f32 / rows);
         Ok(())
@@ -69,6 +88,38 @@ pub(super) fn merged_planes(doc: &Document, fmt: &PixelFormat, cmyk: bool, matte
     (planes, has_alpha, translucent)
 }
 
+struct Encode<'a> {
+    fmt: &'a PixelFormat,
+    cc: usize,
+    matte: bool,
+    cmyk: bool,
+    lab16: bool,
+    white: &'a [f32],
+}
+
+impl Encode<'_> {
+    fn run(&self, px: &[[f32; 4]], out: &mut [&mut [u8]], stored_translucent: impl Fn(f32) -> bool, put: impl Fn(f32, &mut [u8], usize)) -> (bool, bool) {
+        let Self { fmt, cc, matte, cmyk, lab16, white } = *self;
+        let (mut has_alpha, mut translucent) = (false, false);
+        let mut v = [0.0f32; 5];
+        for (i, p) in px.iter().enumerate() {
+            // Retain alpha whenever it differs from opaque at the stored precision.
+            has_alpha |= stored_translucent(p[3]);
+            translucent |= p[3] < 1.0;
+            photocraft_raster::from_rgba_into(fmt, *p, &mut v);
+            for (c, dst) in out.iter_mut().enumerate() {
+                // Matte against white like Photoshop (see `pixels::matte`).
+                let m = if c < cc && matte { crate::pixels::matte(v[c], v[cc], white.get(c).copied().unwrap_or(1.0)) } else { v[c] };
+                let x = if cmyk && c < cc { 1.0 - m } else { m };
+                // 16-bit Lab a*/b* use Photoshop's 0..65280 scale (`pixels::lab16_chroma`).
+                let x = if lab16 && (c == 1 || c == 2) { x * (crate::pixels::LAB16_CHROMA_MAX / 65535.0) } else { x };
+                put(x, dst, i);
+            }
+        }
+        (has_alpha, translucent)
+    }
+}
+
 /// [`merged_planes`] of a CMYK document whose layers are mixed on their ink values
 /// (`photocraft_compose::cmyk`), so opaque pixels keep their exact inks; `None` for documents
 /// that composite in RGB. Reports progress and stops on cancel like [`merged_planes`].
@@ -141,3 +192,82 @@ pub(super) fn placeholder_planes(doc: &Document, fmt: &PixelFormat) -> Vec<u8> {
     }
     planes
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use photocraft_doc::{Layer, LayerContent};
+    use photocraft_raster::Surface;
+
+    fn previous_merged_planes(doc: &Document, fmt: &PixelFormat, cmyk: bool, matte: bool) -> (Vec<u8>, bool, bool) {
+        if cmyk && let Some(planes) = merged_ink_planes(doc, fmt.sample, matte, &Interrupt::NONE) {
+            return planes;
+        }
+        let sample = fmt.sample;
+        let cc = fmt.mode.color_channels();
+        let bps = sample.bytes();
+        let plane = doc.size.area() as usize * bps;
+        let mut planes = vec![0u8; plane * (cc + 1)];
+        let (mut has_alpha, mut translucent) = (false, false);
+        let white = photocraft_raster::from_rgba(fmt, [1.0, 1.0, 1.0, 1.0]);
+        let canvas = doc.bounds();
+        let w = canvas.width() as usize;
+        let space = photocraft_compose::cmyk_space(doc);
+        let lab16 = fmt.mode == ColorMode::Lab && sample == SampleType::U16;
+        let _ = photocraft_compose::render_bands(doc, canvas, 0, |band| -> Result<(), ()> {
+            has_alpha |= band.px.iter().any(|p| match sample {
+                SampleType::U8 => q255(p[3]) < 255,
+                SampleType::U16 => (p[3].clamp(0.0, 1.0) * 65535.0 + 0.5) as u16 != u16::MAX,
+                SampleType::F32 => p[3] != 1.0,
+            });
+            translucent |= band.px.iter().any(|p| p[3] < 1.0);
+            let start = (band.rect.y0 - canvas.y0) as usize * w;
+            photocraft_color::convert::with_cmyk_space(space.as_ref(), || {
+                let mut v = [0.0f32; 5];
+                for (i, p) in band.px.iter().enumerate() {
+                    photocraft_raster::from_rgba_into(fmt, *p, &mut v);
+                    for c in 0..=cc {
+                        let m = if c < cc && matte { crate::pixels::matte(v[c], v[cc], white[c]) } else { v[c] };
+                        let x = if cmyk && c < cc { 1.0 - m } else { m };
+                        let x = if lab16 && (c == 1 || c == 2) { x * (crate::pixels::LAB16_CHROMA_MAX / 65535.0) } else { x };
+                        let mut b = Vec::new();
+                        encode_be(x, sample, &mut b);
+                        let o = c * plane + (start + i) * bps;
+                        planes[o..o + bps].copy_from_slice(&b);
+                    }
+                }
+            });
+            Ok(())
+        });
+        (planes, has_alpha, translucent)
+    }
+
+    #[test]
+    fn merged_planes_match_the_per_band_reference() {
+        let size = photocraft_geom::Size::new(37, 23);
+        for mode in [ColorMode::Rgb, ColorMode::Grayscale, ColorMode::Lab, ColorMode::Cmyk] {
+            for sample in SampleType::ALL {
+                for alpha_floor in [0.0f32, 0.999_9, 1.0] {
+                    let mut doc = Document::new("merged", size, mode, sample);
+                    let fmt = doc.pixel_format();
+                    let mut s = Surface::new(fmt);
+                    for y in 0..23 {
+                        for x in 0..37 {
+                            let a = (alpha_floor + (1.0 - alpha_floor) * ((x * 7 + y * 3) % 11) as f32 / 10.0).min(1.0);
+                            let rgba = [x as f32 / 36.0, y as f32 / 22.0, ((x + y) % 5) as f32 / 4.0, a];
+                            let mut v = [0.0f32; 5];
+                            let n = photocraft_raster::from_rgba_into(&fmt, rgba, &mut v);
+                            s.write_pixel(x, y, &v[..n]);
+                        }
+                    }
+                    doc.layers.push(Layer::new("pixels", LayerContent::Raster(s)));
+                    for matte in [false, true] {
+                        let got = merged_planes(&doc, &fmt, cmyk_of(&fmt), matte, &Interrupt::NONE);
+                        let want = previous_merged_planes(&doc, &fmt, cmyk_of(&fmt), matte);
+                        assert_eq!(got, want, "{mode:?} {sample:?} alpha >= {alpha_floor} matte {matte}");
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/crates/io/src/psd_export/resources.rs b/crates/io/src/psd_export/resources.rs
index 4ab5210e94..09d9e67d22 100644
--- a/crates/io/src/psd_export/resources.rs
+++ b/crates/io/src/psd_export/resources.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Document, ImageResource, TaggedBlock};
 
 pub(crate) fn legacy_name(s: &str) -> Vec<u8> {
     s.chars().map(|c| if c.is_ascii() && !c.is_ascii_control() { c as u8 } else { b'?' }).take(255).collect()
diff --git a/crates/io/src/psd_export/smart.rs b/crates/io/src/psd_export/smart.rs
index 264a2ab8ab..10833c7033 100644
--- a/crates/io/src/psd_export/smart.rs
+++ b/crates/io/src/psd_export/smart.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Document, Layer, LayerContent, SmartContentsId, Surface};
 
 /// An embedded smart-object source as written to `lnk2`.
 #[derive(Clone, Debug)]
diff --git a/crates/io/src/psd_export/tests.rs b/crates/io/src/psd_export/tests.rs
index 9688dfeac2..af7c8a2241 100644
--- a/crates/io/src/psd_export/tests.rs
+++ b/crates/io/src/psd_export/tests.rs
@@ -337,33 +337,161 @@ fn light_adjustment_is_kept_verbatim_and_warned() {
     assert!(!crate::adjust_map::is_extended_brit(Some(&plain[1].1)));
 }
 
-#[test]
-fn size_limit_boundary_keeps_limit_and_switches_above_it() {
-    assert!(!exceeds_psd_size_limit(Some(PSD_MAX_FILE_SIZE)));
-    assert!(exceeds_psd_size_limit(Some(PSD_MAX_FILE_SIZE + 1)));
-    assert!(exceeds_psd_size_limit(None));
+/// A 1024² RGB document with one full-canvas layer: flat colour (packs to a few KB) or noise
+/// (RLE can't pack it). Its raw planes (layer RGBA + merged RGB) are 7 MiB either way.
+fn sized_document(noise: bool, depth: SampleType) -> Document {
+    const SIDE: u32 = 1024;
+    let mut doc = Document::new("size limit", photocraft_geom::Size::new(SIDE, SIDE), ColorMode::Rgb, depth);
+    let mut layer = Layer::raster("Layer 1", doc.pixel_format());
+    let rect = photocraft_geom::Rect::new(0, 0, SIDE as i32, SIDE as i32);
+    let surface = layer.surface_mut().unwrap();
+    if noise {
+        let mut state = 0x2545_f491_u32;
+        let data: Vec<f32> = (0..SIDE * SIDE * 4)
+            .map(|i| {
+                state ^= state << 13;
+                state ^= state >> 17;
+                state ^= state << 5;
+                if i % 4 == 3 { 1.0 } else { (state >> 24) as f32 / 255.0 }
+            })
+            .collect();
+        surface.write_region(rect, &data);
+    } else {
+        surface.fill_rect(rect, &[0.2, 0.4, 0.6, 1.0]);
+    }
+    doc.layers.push(layer);
+    doc
 }
 
-#[test]
-fn encoded_size_estimator_rejects_arithmetic_overflow() {
-    assert_eq!(estimate_encoded_size(u64::MAX, 0, 0), None);
-    assert_eq!(estimate_encoded_size(0, u64::MAX, 0), None);
-    assert_eq!(estimate_encoded_size(0, 0, u64::MAX), Some(u64::MAX));
-    assert!(exceeds_psd_size_limit(estimate_psd_size(&document(u32::MAX, u32::MAX))));
+const SIZED_RAW_BYTES: u64 = 1024 * 1024 * (4 + 3);
+/// Under the raw size, so only the encoded size can keep a document PSD.
+const SIZED_LIMIT: u64 = 4 * 1024 * 1024;
+const _: () = assert!(SIZED_RAW_BYTES > SIZED_LIMIT);
+
+fn export_sized(doc: &Document, limit: u64) -> (PsdFile, Vec<String>) {
+    document_to_psd_sized(doc, &PsdExportOptions::default(), 0, &Interrupt::NONE, limit)
 }
 
+/// #5285: a document whose raw pixels are over the PSD limit but whose encoded file fits is
+/// saved as PSD (the raw-size estimate used to make it a PSB).
 #[test]
-fn large_encoded_size_selects_psb_without_changing_explicit_choice() {
-    let large = document(30_000, 30_000);
-    assert!(estimate_psd_size(&large).is_some_and(|size| size > PSD_MAX_FILE_SIZE));
-    let large_size_exceeds_limit = psd_size_exceeds_limit(&large);
-    assert_eq!(psd_version(&large, false, large_size_exceeds_limit), Version::Psb);
+fn a_file_that_fits_after_compression_stays_psd() {
+    let doc = sized_document(false, SampleType::U8);
+    let (file, warnings) = export_sized(&doc, SIZED_LIMIT);
+    assert_eq!(file.written_version(), Version::Psd);
+    assert!(warnings.iter().all(|w| !w.contains("PSB")), "{warnings:?}");
+    let bytes = file.to_bytes().unwrap();
+    assert!(bytes.len() as u64 + PSD_SAVE_HEADROOM <= SIZED_LIMIT, "{} bytes", bytes.len());
+    let (back, _) = crate::psd_to_document(&PsdFile::from_bytes(&bytes).unwrap());
+    assert_eq!(back.layers[0].surface().unwrap().pixel(700, 300), doc.layers[0].surface().unwrap().pixel(700, 300));
+}
 
+/// #5285: a document whose encoded file is over the limit becomes a PSB, byte for byte the
+/// one a forced PSB save writes, and reads back. 8 bits keep the layers in the layer section,
+/// 16 bits in a global `Lr16` block.
+#[test]
+fn a_file_over_the_limit_after_compression_is_psb() {
+    for depth in [SampleType::U8, SampleType::U16] {
+        let doc = sized_document(true, depth);
+        let (file, warnings) = export_sized(&doc, SIZED_LIMIT);
+        assert_eq!(file.written_version(), Version::Psb, "{depth:?}");
+        assert!(warnings.iter().any(|w| w == "encoded size exceeds 2 GB; written as PSB"), "{warnings:?}");
+        let bytes = file.to_bytes().unwrap();
+        assert!(bytes.len() as u64 > SIZED_LIMIT);
+        let forced = document_to_psd_with(&doc, &PsdExportOptions { force_psb: true, ..Default::default() }).0;
+        let forced = forced.to_bytes().unwrap();
+        assert!(bytes == forced, "{depth:?}: the promoted PSB differs from a PSB written directly");
+        assert_eq!(PsdFile::from_bytes(&bytes).unwrap(), PsdFile::from_bytes(&forced).unwrap(), "{depth:?}");
+        // The promoted model itself stays a consistent PSD for every reader.
+        assert_eq!(file.header.version, Version::Psd);
+        assert_eq!(crate::psd_to_document(&file).0.layers[0].surface().unwrap().pixel(511, 777), doc.layers[0].surface().unwrap().pixel(511, 777));
+        let (back, _) = crate::psd_to_document(&PsdFile::from_bytes(&bytes).unwrap());
+        for (x, y) in [(0, 0), (1023, 0), (511, 777), (1023, 1023)] {
+            assert_eq!(back.layers[0].surface().unwrap().pixel(x, y), doc.layers[0].surface().unwrap().pixel(x, y), "{depth:?} ({x}, {y})");
+        }
+    }
+}
+
+/// The limit is the exact written length plus the save's headroom: one byte less is a PSB.
+#[test]
+fn the_size_limit_is_the_exact_encoded_length() {
+    let doc = sized_document(false, SampleType::U8);
+    let len = export_sized(&doc, u64::MAX).0.to_bytes().unwrap().len() as u64;
+    assert_eq!(export_sized(&doc, len + PSD_SAVE_HEADROOM).0.written_version(), Version::Psd);
+    assert_eq!(export_sized(&doc, len + PSD_SAVE_HEADROOM - 1).0.written_version(), Version::Psb);
+    // The real limit: a small document stays PSD, a forced one is PSB.
     let small = document(1, 1);
-    let small_size_exceeds_limit = psd_size_exceeds_limit(&small);
-    assert_eq!(psd_version(&small, false, small_size_exceeds_limit), Version::Psd);
-    assert_eq!(psd_version(&small, true, small_size_exceeds_limit), Version::Psb);
+    assert_eq!(document_to_psd(&small).written_version(), Version::Psd);
+    assert_eq!(document_to_psd_with(&small, &PsdExportOptions { force_psb: true, ..Default::default() }).0.written_version(), Version::Psb);
+    assert_eq!(psd_version(&document(30_001, 1), false), Version::Psb);
 }
+
+/// A Multichannel document follows the same rule.
+#[test]
+fn a_multichannel_file_over_the_limit_is_psb() {
+    let mut doc = document(64, 64);
+    doc.mode = ColorMode::Multichannel;
+    doc.channels.push(photocraft_doc::AlphaChannel::new("Cyan", photocraft_raster::Surface::new(PixelFormat::GRAY8)));
+    let (file, _) = export_sized(&doc, u64::MAX);
+    assert_eq!(file.written_version(), Version::Psd);
+    let len = file.to_bytes().unwrap().len() as u64;
+    let (file, warnings) = export_sized(&doc, len + PSD_SAVE_HEADROOM - 1);
+    assert_eq!(file.written_version(), Version::Psb);
+    assert!(warnings.iter().any(|w| w.contains("written as PSB")), "{warnings:?}");
+    let back = PsdFile::from_bytes(&file.to_bytes().unwrap()).unwrap();
+    assert_eq!(back.header.version, Version::Psb);
+    assert_eq!(back.decode_merged().unwrap(), PsdFile::from_bytes(&export_sized(&doc, u64::MAX).0.to_bytes().unwrap()).unwrap().decode_merged().unwrap());
+}
+
+/// Indexed Color and Bitmap (written without layers, #4816), Multichannel and RGB follow the
+/// encoded-size rule, and a file turned into PSB by its size writes its global blocks with
+/// 8-byte lengths as `8B64` (#7937), whatever signature they were kept with; a file that fits
+/// stays a PSD with `8BIM` throughout.
+#[test]
+fn every_mode_promoted_by_size_signs_long_blocks_8b64() {
+    let white = photocraft_color::Color::rgba(1.0, 1.0, 1.0, 1.0);
+    let mut docs = Vec::new();
+    for (mode, psd_mode) in [(ColorMode::Indexed, PsdMode::Indexed), (ColorMode::Bitmap, PsdMode::Bitmap), (ColorMode::Rgb, PsdMode::Rgb)] {
+        let mut doc = Document::with_background("modes", photocraft_geom::Size::new(64, 64), ColorMode::Rgb, SampleType::U8, white);
+        doc.mode = mode;
+        doc.color_table = Some(photocraft_doc::ColorTable { colors: vec![[255, 255, 255], [0, 0, 0]], transparent: None });
+        docs.push((doc, psd_mode));
+    }
+    let mut multichannel = document(64, 64);
+    multichannel.mode = ColorMode::Multichannel;
+    multichannel.channels.push(photocraft_doc::AlphaChannel::new("Cyan", photocraft_raster::Surface::new(PixelFormat::GRAY8)));
+    docs.push((multichannel, PsdMode::Multichannel));
+    for (mut doc, psd_mode) in docs {
+        doc.metadata.psd_global_blocks = vec![
+            (*b"8BIM", *b"cinf", std::sync::Arc::new(vec![0, 0, 0, 16, 0, 0, 0, 0])),
+            (*b"8BIM", *b"pths", std::sync::Arc::new(vec![0, 0, 0, 16, 0, 0, 0, 0])),
+            (*b"8B64", *b"FMsk", std::sync::Arc::new(vec![0xff, 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, 50])),
+            (*b"8BIM", *b"Patt", std::sync::Arc::new(Vec::new())),
+        ];
+        let written = |limit| {
+            let (file, warnings) = export_sized(&doc, limit);
+            let bytes = file.to_bytes().unwrap();
+            let back = PsdFile::from_bytes(&bytes).unwrap();
+            let blocks = back.global_blocks.iter().map(|b| (b.signature, b.key)).collect::<Vec<_>>();
+            (bytes.len() as u64, back, blocks, warnings)
+        };
+        let (len, small, blocks, _) = written(u64::MAX);
+        assert_eq!((small.header.version, small.header.color_mode), (Version::Psd, psd_mode), "{psd_mode:?}");
+        assert_eq!(blocks, vec![(*b"8BIM", *b"cinf"), (*b"8BIM", *b"pths"), (*b"8BIM", *b"FMsk"), (*b"8BIM", *b"Patt")], "{psd_mode:?}: a PSD keeps 8BIM");
+        // One byte short of the encoded length: the same document is written as PSB.
+        let (_, big, blocks, warnings) = written(len + PSD_SAVE_HEADROOM - 1);
+        assert_eq!((big.header.version, big.header.color_mode), (Version::Psb, psd_mode), "{psd_mode:?}: {warnings:?}");
+        assert!(warnings.iter().any(|w| w == "encoded size exceeds 2 GB; written as PSB"), "{psd_mode:?}: {warnings:?}");
+        assert_eq!(blocks, vec![(*b"8B64", *b"cinf"), (*b"8B64", *b"pths"), (*b"8B64", *b"FMsk"), (*b"8BIM", *b"Patt")], "{psd_mode:?}: a PSB signs 8B64");
+        assert_eq!(big.decode_merged().unwrap(), small.decode_merged().unwrap(), "{psd_mode:?}");
+        // Without `size_limit_psb` no mode is promoted by its size, the layerless ones included.
+        let opts = PsdExportOptions { size_limit_psb: false, ..PsdExportOptions::default() };
+        let (kept, warnings) = document_to_psd_sized(&doc, &opts, 0, &Interrupt::NONE, len + PSD_SAVE_HEADROOM - 1);
+        assert_eq!((kept.written_version(), kept.header.color_mode), (Version::Psd, psd_mode), "{psd_mode:?}: {warnings:?}");
+        assert!(!warnings.iter().any(|w| w.contains("written as PSB")), "{psd_mode:?}: {warnings:?}");
+    }
+}
+
 #[test]
 fn kept_psb_blocks_are_written_as_8bim_in_a_psd() {
     // Photoshop 27.11 refuses a PSD holding `8B64` blocks ("not compatible with this
diff --git a/crates/io/src/psd_import.rs b/crates/io/src/psd_import.rs
index d06cd3c335..a88773e05c 100644
--- a/crates/io/src/psd_import.rs
+++ b/crates/io/src/psd_import.rs
@@ -4,7 +4,8 @@ use std::sync::Arc;
 
 use photocraft_color::{BlendMode, ColorMode, PixelFormat, SampleType};
 use photocraft_doc::{
-    AlphaChannel, Document, Effects, FillCache, Group, Layer, LayerContent, LayerMask, ShapeLayer, SmartContentsId, SmartObject, SmartSource, TextLayer,
+    AlphaChannel, Document, Effects, FillCache, Group, Layer, LayerContent, LayerMask, PsdGlobalBlock, ShapeLayer, SmartContentsId, SmartObject, SmartSource,
+    TextLayer,
 };
 use photocraft_geom::{Rect, Size, TILE_SIZE};
 use photocraft_psd::layer::{CHANNEL_REAL_USER_MASK, CHANNEL_TRANSPARENCY, CHANNEL_USER_MASK};
@@ -46,6 +47,8 @@ pub(crate) const REGENERATED: [&[u8; 4]; 9] = [b"luni", b"lyid", b"lsct", b"lsdk
 
 pub(crate) struct Ctx<'a> {
     pub file: &'a PsdFile,
+    /// Global blocks shared with the document.
+    pub global: Vec<PsdGlobalBlock>,
     pub fmt: PixelFormat,
     pub mask_fmt: PixelFormat,
     pub cc: usize,
@@ -53,6 +56,8 @@ pub(crate) struct Ctx<'a> {
     pub warnings: Vec<String>,
     /// Decoding encountered damaged PSD data; interactive opens ask whether to continue.
     pub damaged: bool,
+    /// Failure to read source channel data, which must fail the open.
+    pub read_error: Option<String>,
     /// Document resolution (type sizes are converted to points with it).
     pub dpi: f32,
     /// The parsed `Txt2` block (type settings EngineData lacks, e.g. optical kerning).
@@ -74,9 +79,43 @@ pub(crate) struct Ctx<'a> {
     pub ctl: photocraft_raster::Interrupt<'a>,
     /// Layer records decoded so far, out of `total` (progress).
     pub done: usize,
+    /// Uniform tiles shared across imported layers.
+    pub uniform: photocraft_raster::TileInterner,
     pub total: usize,
 }
 
+/// Bytes of interleaved pixels a band decoded into tiles at once aims at: whole layers up to this
+/// size decode in one band, larger ones in bands of whole tile rows.
+const BAND_BYTES: usize = 32 << 20;
+
+/// Row ranges (`0..h`, relative to a layer whose first row is at document row `top`) to decode a
+/// layer in: each ends on a tile row boundary, so no tile is written by two bands, and holds
+/// about [`BAND_BYTES`] of `row_bytes`-byte rows.
+fn band_rows(top: i32, h: usize, row_bytes: usize) -> Vec<(usize, usize)> {
+    let tile = TILE_SIZE as usize;
+    let rows = (BAND_BYTES / row_bytes.max(1)).max(tile) / tile * tile;
+    // The first band ends at the first tile boundary at least `rows` rows in.
+    let into_tile = usize::try_from(top.rem_euclid(TILE_SIZE)).unwrap_or(0);
+    let mut out = Vec::new();
+    let mut r0 = 0;
+    let mut r1 = rows - into_tile;
+    while r0 < h {
+        let end = r1.min(h);
+        out.push((r0, end));
+        r0 = end;
+        r1 = end + rows;
+    }
+    out
+}
+
+fn import_format(file: &PsdFile) -> (ColorMode, bool, bool, SampleType) {
+    let mode = doc_mode(file.header.color_mode).unwrap_or(ColorMode::Rgb);
+    let layered = matches!(mode, ColorMode::Grayscale | ColorMode::Rgb | ColorMode::Cmyk | ColorMode::Lab) && file.header.depth != 1;
+    let multichannel = mode == ColorMode::Multichannel && file.header.depth != 1;
+    let depth = if layered || multichannel { sample_for_depth(file.header.depth) } else { SampleType::U8 };
+    (mode, layered, multichannel, depth)
+}
+
 fn doc_mode(m: PsdMode) -> Option<ColorMode> {
     Some(match m {
         PsdMode::Bitmap => ColorMode::Bitmap,
@@ -126,6 +165,18 @@ fn soft_shape_fill(rec: &LayerRecord, has_vector: bool, fill_key: Option<&[u8; 4
     pattern.then_some((fill, soft))
 }
 
+#[derive(Clone, Copy)]
+struct DecodedImport<'a> {
+    file: &'a PsdFile,
+    merged: &'a Option<photocraft_psd::Result<Vec<u8>>>,
+    sizes: Option<(usize, usize)>,
+    canvas: Rect,
+    layered: bool,
+    multichannel: bool,
+    depth: SampleType,
+    fmt: PixelFormat,
+}
+
 /// Where a placed layer's source goes: read from `SoLd`/`SoLE`, or from a CS2 `PlLd` record.
 /// An empty `id` leaves the contents unavailable (the stored pixels stay the rendering).
 #[derive(Default)]
@@ -148,6 +199,17 @@ impl Ctx<'_> {
         self.warn(s);
     }
 
+    /// A channel that failed to decode: a failed read of the file is kept to fail the open
+    /// (`true`); damaged data is warned about, its layer left empty (`false`).
+    fn channel_failed(&mut self, name: &str, id: i16, e: &photocraft_psd::PsdError) -> bool {
+        if let photocraft_psd::PsdError::Read(msg) = e {
+            self.read_error.get_or_insert_with(|| format!("layer \"{name}\": {msg}"));
+            return true;
+        }
+        self.warn_unreadable_data(format!("layer \"{name}\": channel {id} could not be decoded ({e}); treated as empty"));
+        false
+    }
+
     /// Source id, transform, (Distort/Perspective) projective placement and warp of a placed
     /// layer that has only a `PlLd` block, as Photoshop CS2 and older write it (#2465). `PlLd`
     /// stores the placed corners but not the source size, which comes from the embedded file.
@@ -168,11 +230,11 @@ impl Ctx<'_> {
                 return Placement::default();
             }
         };
-        let (file, ctl) = (self.file, self.ctl);
+        let (global, ctl) = (&self.global, self.ctl);
         let size = *self
             .plld_sizes
             .entry(id.clone())
-            .or_insert_with(|| crate::linked::source_size_in_blocks(file.global_blocks.iter().map(|b| (&b.key, b.data.as_slice())), &id, &ctl));
+            .or_insert_with(|| crate::linked::source_size_in_blocks(global.iter().map(|(_, k, d)| (k, d.as_slice())), &id, &ctl));
         // Without the source (missing or unreadable), it is taken as placed at 100 %.
         let (transform, perspective) = blocks::plld_transform(&p, size, warp.as_ref());
         Placement { id, transform, perspective, warp }
@@ -181,72 +243,83 @@ impl Ctx<'_> {
     /// Decodes a PSD layer channel, marking the document damaged if its data is unreadable.
     fn channel_plane(&mut self, rec: &LayerRecord, id: i16, name: &str) -> Option<Vec<u8>> {
         rec.channel(id)?;
+        if self.read_error.is_some() {
+            return None;
+        }
         match rec.decode_channel(id, self.file.header.depth, self.file.header.version) {
             Ok(p) => Some(p),
             Err(e) => {
-                self.warn_unreadable_data(format!("layer \"{name}\": channel {id} could not be decoded ({e}); treated as empty"));
+                self.channel_failed(name, id, &e);
                 None
             }
         }
     }
 
-    /// [`Self::channel_plane`] without the warnings sink, so a layer's channels decode
-    /// concurrently (their RLE rows are the bulk of the open time on full-canvas layers).
-    fn channel_plane_decoded(&self, rec: &LayerRecord, id: i16) -> Option<Vec<u8>> {
-        rec.channel(id)?;
-        rec.decode_channel(id, self.file.header.depth, self.file.header.version).ok()
-    }
-
     /// Builds a raster surface from the layer channels, leaving the surface empty if
     /// any present channel fails to decode rather than inventing replacement pixels.
     fn record_surface(&mut self, rec: &LayerRecord, name: &str) -> Surface {
         let r = rec.rect;
-        if r.is_empty() || r.size().is_err() {
+        // Once the file couldn't be read the open fails: nothing more is decoded.
+        if r.is_empty() || r.size().is_err() || self.read_error.is_some() {
             return Surface::new(self.fmt);
         }
         let (w, h) = r.size().unwrap_or((0, 0));
         let s = self.fmt.sample;
+        let (depth, version) = (self.file.header.depth, self.file.header.version);
         let ids: Vec<i16> = (0..self.cc as i16).chain([CHANNEL_TRANSPARENCY]).collect();
-        let planes: Vec<Option<Vec<u8>>> = if cfg!(target_arch = "wasm32") {
-            ids.iter().map(|&id| self.channel_plane(rec, id, name)).collect()
-        } else {
-            // The channels decode independently; their RLE rows are the bulk of the open
-            // time for full-canvas layers, so they run side by side and the warnings land
-            // in the same order afterwards.
-            // par_map reuses the crate's worker pool (one OS thread per channel per layer
-            // would spawn thousands on a file with many layers).
-            let decoded: Vec<Option<Vec<u8>>> = crate::pixels::par_map(ids.to_vec(), |id| self.channel_plane_decoded(rec, id));
-            let mut planes: Vec<Option<Vec<u8>>> = Vec::with_capacity(decoded.len());
-            for (&id, p) in ids.iter().zip(decoded) {
-                if p.is_none() && rec.channel(id).is_some() {
-                    self.warn_unreadable_data(format!("layer \"{name}\": channel {id} could not be decoded; treated as empty"));
-                }
-                planes.push(p);
+        // A decoder per channel present (a ZIP channel is inflated here, the channels side by
+        // side); the rows are then decoded and interleaved a band at a time straight into the
+        // tiles, so no buffer of the whole layer (planes or interleaved) is ever held.
+        // par_map reuses the crate's worker pool (one OS thread per channel per layer would
+        // spawn thousands on a file with many layers).
+        let decoders: Vec<Option<photocraft_psd::Result<photocraft_psd::RowDecoder<'_>>>> =
+            crate::pixels::par_map(ids.to_vec(), |id| rec.channel(id).map(|ch| ch.row_decoder(w, h, depth, version)));
+        let mut failed = false;
+        for (&id, d) in ids.iter().zip(&decoders) {
+            if let Some(Err(e)) = d {
+                self.channel_failed(name, id, e);
+                failed = true;
             }
-            planes
-        };
+        }
         // A channel that is in the file but could not be decoded leaves the layer empty, as the
         // warning says. Filling in for it would paint an opaque black layer over the document.
-        if ids.iter().zip(planes.iter()).any(|(&id, p)| p.is_none() && rec.channel(id).is_some()) {
+        if failed {
             return Surface::new(self.fmt);
         }
         // Only decoded channel data justifies a buffer: the decoders bound their output by the
         // bytes in the file, but a bare rectangle can declare 300000² pixels in a few bytes (#755).
-        if planes.iter().all(Option::is_none) {
+        if decoders.iter().all(Option::is_none) {
             self.warn_unreadable_data(format!("layer \"{name}\": no channel data for its {w}x{h} bounds; treated as empty"));
             return Surface::new(self.fmt);
         }
-        let refs: Vec<Option<&[u8]>> = planes.iter().map(|p| p.as_deref()).collect();
         let mut fill: Vec<Vec<u8>> = vec![zero_sample(s); self.cc];
         fill.push(max_sample(s));
         let mut invert = vec![self.cmyk; self.cc];
         invert.push(false);
-        let mut bytes = interleave(&refs, &fill, w * h, s, &invert);
-        if self.fmt.mode == ColorMode::Lab && s == SampleType::U16 {
-            crate::pixels::lab16_chroma(&mut bytes, self.cc + 1, true);
+        let mut surf = Surface::new(self.fmt);
+        for (b0, b1) in band_rows(r.top, h, w * (self.cc + 1) * s.bytes()) {
+            let planes: Vec<Option<photocraft_psd::Result<Vec<u8>>>> =
+                crate::pixels::par_map(decoders.iter().collect(), |d| d.as_ref().and_then(|d| d.as_ref().ok()).map(|d| d.rows(b0, b1)));
+            let mut refs: Vec<Option<&[u8]>> = Vec::with_capacity(planes.len());
+            for (&id, p) in ids.iter().zip(&planes) {
+                match p {
+                    Some(Err(e)) => {
+                        self.channel_failed(name, id, e);
+                        return Surface::new(self.fmt);
+                    }
+                    Some(Ok(p)) => refs.push(Some(p)),
+                    None => refs.push(None),
+                }
+            }
+            let mut bytes = interleave(&refs, &fill, w * (b1 - b0), s, &invert);
+            if self.fmt.mode == ColorMode::Lab && s == SampleType::U16 {
+                crate::pixels::lab16_chroma(&mut bytes, self.cc + 1, true);
+            }
+            surf.write_interleaved(Rect::new(r.left, r.top + b0 as i32, r.right, r.top + b1 as i32), &bytes);
         }
-        let mut surf = Surface::from_interleaved(self.fmt, Rect::new(r.left, r.top, r.right, r.bottom), &bytes);
         surf.prune();
+        // A white background, a solid fill's cache: one tile per value, shared across layers.
+        surf.share_uniform_tiles(&mut self.uniform);
         surf
     }
 
@@ -270,6 +343,7 @@ impl Ctx<'_> {
             let bytes = interleave(&[Some(&plane)], &[zero_sample(s)], w * h, s, &[false]);
             surface.write_interleaved(Rect::new(rect.left, rect.top, rect.right, rect.bottom), &bytes);
             surface.prune();
+            surface.share_uniform_tiles(&mut self.uniform);
         }
         let params = m.parameters;
         Some(LayerMask {
@@ -453,69 +527,7 @@ impl Ctx<'_> {
                 LayerContent::Raster(self.record_surface(rec, &name))
             }
         } else if let Some(k) = smart_key {
-            let Placement { id, transform, perspective, warp } = match rec.block(k) {
-                Some(b) if k == b"PlLd" => self.plld_placement(&b.data, &name),
-                Some(b) => {
-                    let (id, transform) = blocks::parse_smart(k, &b.data);
-                    // Distort / Perspective: the fourth corner (the affine `transform` drops it).
-                    let perspective = blocks::parse_smart_perspective(k, &b.data);
-                    Placement { id, transform, perspective, warp: blocks::parse_placed_warp(k, &b.data) }
-                }
-                None => Placement::default(),
-            };
-            let contents_id =
-                if id.is_empty() { SmartContentsId::fresh() } else { *self.smart_contents.entry(id.clone()).or_insert_with(SmartContentsId::fresh) };
-            // Smart filters (`filterFX` in the placed-layer data) and their mask (`FEid`).
-            let placed = rec.block(b"SoLd").or_else(|| rec.block(b"SoLE")).and_then(|b| crate::smart_map::parse_sold(&b.data));
-            let stack = placed.as_ref().and_then(|p| p.stack.clone()).unwrap_or_default();
-            let filter_mask = match &placed {
-                Some(p) if !stack.filters.is_empty() => self.filter_mask(&p.placed, &stack, &name),
-                _ => None,
-            };
-            // Photoshop stores the filtered pixels without the filter mask and mixes the unfiltered
-            // ones (`FEid`) back in through it; our smart objects hold the mixed result.
-            let stored = self.record_surface(rec, &name);
-            let shown = stack.enabled && stack.filters.iter().any(|f| f.visible);
-            let cache = match (&placed, filter_mask.as_ref().filter(|m| m.enabled && shown)) {
-                (Some(p), Some(m)) => {
-                    let unfiltered = match self.unfiltered.get(&p.placed) {
-                        Some(done) => done.clone(),
-                        None => {
-                            // Every distinct source is kept until the import ends, so what they add up to is
-                            // bounded: past the limit the layer keeps its stored pixels, unmixed.
-                            let item = self.filter_effects.iter().find(|i| i.id == p.placed);
-                            let cost = item
-                                .and_then(|i| i.rect.size().ok())
-                                .map_or(0, |(w, h)| (w as u64).saturating_mul(h as u64).saturating_mul(self.fmt.bytes_per_pixel() as u64));
-                            let fits = self.unfiltered_bytes.saturating_add(cost) <= MAX_UNFILTERED_BYTES;
-                            let made = item.filter(|_| fits).and_then(|i| crate::smart_map::unfiltered_from_item(i, self.fmt));
-                            if made.is_some() {
-                                self.unfiltered_bytes += cost;
-                            }
-                            self.unfiltered.insert(p.placed.clone(), made.clone());
-                            made
-                        }
-                    };
-                    match unfiltered {
-                        Some(u) => photocraft_compose::filter_mask::mix(&u, &stored, m),
-                        None => stored,
-                    }
-                }
-                _ => stored,
-            };
-            LayerContent::Smart(SmartObject {
-                contents_id,
-                source: SmartSource::Linked { path: id },
-                transform,
-                smart_filters: stack.filters,
-                cache: Some(cache),
-                psd_raw: principal(k),
-                filters_enabled: stack.enabled,
-                filter_mask,
-                warp,
-                stack_mode: None,
-                perspective,
-            })
+            self.smart_content(rec, &name, k, &principal)
         } else if let Some((f, soft)) = soft_shape_fill(rec, vector_key.is_some(), fill_key) {
             // A pattern-filled shape is a pattern fill layer seen through its vector mask (soft
             // or not). Unless that mask is soft, the stored pixels stay its rendering (a soft
@@ -583,6 +595,71 @@ impl Ctx<'_> {
         l
     }
 
+    fn smart_content(&mut self, rec: &LayerRecord, name: &str, k: &[u8; 4], principal: &impl Fn(&[u8; 4]) -> Option<Arc<Vec<u8>>>) -> LayerContent {
+        let Placement { id, transform, perspective, warp } = match rec.block(k) {
+            Some(b) if k == b"PlLd" => self.plld_placement(&b.data, name),
+            Some(b) => {
+                let (id, transform) = blocks::parse_smart(k, &b.data);
+                // Distort / Perspective: the fourth corner (the affine `transform` drops it).
+                let perspective = blocks::parse_smart_perspective(k, &b.data);
+                Placement { id, transform, perspective, warp: blocks::parse_placed_warp(k, &b.data) }
+            }
+            None => Placement::default(),
+        };
+        let contents_id = if id.is_empty() { SmartContentsId::fresh() } else { *self.smart_contents.entry(id.clone()).or_insert_with(SmartContentsId::fresh) };
+        // Smart filters (`filterFX` in the placed-layer data) and their mask (`FEid`).
+        let placed = rec.block(b"SoLd").or_else(|| rec.block(b"SoLE")).and_then(|b| crate::smart_map::parse_sold(&b.data));
+        let stack = placed.as_ref().and_then(|p| p.stack.clone()).unwrap_or_default();
+        let filter_mask = match &placed {
+            Some(p) if !stack.filters.is_empty() => self.filter_mask(&p.placed, &stack, name),
+            _ => None,
+        };
+        // Photoshop stores the filtered pixels without the filter mask and mixes the unfiltered
+        // ones (`FEid`) back in through it; our smart objects hold the mixed result.
+        let stored = self.record_surface(rec, name);
+        let shown = stack.enabled && stack.filters.iter().any(|f| f.visible);
+        let cache = match (&placed, filter_mask.as_ref().filter(|m| m.enabled && shown)) {
+            (Some(p), Some(m)) => {
+                let unfiltered = match self.unfiltered.get(&p.placed) {
+                    Some(done) => done.clone(),
+                    None => {
+                        // Every distinct source is kept until the import ends, so what they add up to is
+                        // bounded: past the limit the layer keeps its stored pixels, unmixed.
+                        let item = self.filter_effects.iter().find(|i| i.id == p.placed);
+                        let cost = item
+                            .and_then(|i| i.rect.size().ok())
+                            .map_or(0, |(w, h)| (w as u64).saturating_mul(h as u64).saturating_mul(self.fmt.bytes_per_pixel() as u64));
+                        let fits = self.unfiltered_bytes.saturating_add(cost) <= MAX_UNFILTERED_BYTES;
+                        let made = item.filter(|_| fits).and_then(|i| crate::smart_map::unfiltered_from_item(i, self.fmt));
+                        if made.is_some() {
+                            self.unfiltered_bytes += cost;
+                        }
+                        self.unfiltered.insert(p.placed.clone(), made.clone());
+                        made
+                    }
+                };
+                match unfiltered {
+                    Some(u) => photocraft_compose::filter_mask::mix(&u, &stored, m),
+                    None => stored,
+                }
+            }
+            _ => stored,
+        };
+        LayerContent::Smart(SmartObject {
+            contents_id,
+            source: SmartSource::Linked { path: id },
+            transform,
+            smart_filters: stack.filters,
+            cache: Some(cache),
+            psd_raw: principal(k),
+            filters_enabled: stack.enabled,
+            filter_mask,
+            warp,
+            stack_mode: None,
+            perspective,
+        })
+    }
+
     /// Typed vector mask from `vsms`/`vmsk` (non-shape layers). A user mask that Photoshop
     /// rendered from the vector data (flag bit 3, no separate real mask) is dropped: the
     /// compositor rasterizes the vector mask itself.
@@ -633,7 +710,9 @@ impl Ctx<'_> {
                     let sd = rec.section_divider();
                     let expanded = sd.is_none_or(|s| s.kind != photocraft_psd::SectionType::ClosedFolder);
                     let artboard = crate::comps_map::ARTBOARD_KEYS.iter().find_map(|k| rec.block(k)).and_then(|b| crate::comps_map::parse_artboard(&b.data));
-                    let mut l = Layer::new(rec.name(), LayerContent::Group(Group { children, expanded, artboard }));
+                    // A Photoshop Frame's stroke: `vstk` on the frame group, in a shape's layout.
+                    let frame_stroke = rec.block(b"vstk").and_then(|b| crate::vector_map::parse_vstk(&b.data, self.dpi)).and_then(|v| v.stroke);
+                    let mut l = Layer::new(rec.name(), LayerContent::Group(Group { children, expanded, artboard, frame_stroke }));
                     l.psd_blocks = preserved_blocks(rec);
                     self.apply_common(&mut l, rec, sd.and_then(|s| s.blend_mode));
                     self.apply_vector_mask(&mut l, rec);
@@ -883,6 +962,28 @@ pub fn psd_to_document_with(file: &PsdFile, ctl: &photocraft_raster::Interrupt)
     psd_to_document_decoded(file, ctl, None)
 }
 
+/// [`psd_to_document_decoded_integrity`] taking the file: its global blocks move into the
+/// document rather than being copied (an embedded smart object's `lnk2` block can be most of a
+/// file). The file's channel data may still be in its source ([`PsdFile::from_source`]): the
+/// fourth value is a failure to read it, which fails the open (a layer is never left empty
+/// because its file became unreadable while it opened).
+pub(crate) fn psd_to_document_owned(
+    mut file: PsdFile,
+    ctl: &photocraft_raster::Interrupt,
+    decoded: Option<photocraft_psd::Result<Vec<u8>>>,
+) -> Option<(Document, Vec<String>, bool, Option<String>)> {
+    let global = file
+        .global_blocks
+        .iter_mut()
+        .map(|b| {
+            // A layer block is still read by `unreadable_layer_block` (to say why it failed).
+            let data = if matches!(&b.key, b"Lr16" | b"Lr32" | b"Layr") { b.data.clone() } else { std::mem::take(&mut b.data) };
+            (b.signature, b.key, Arc::new(data))
+        })
+        .collect();
+    psd_to_document_global(&file, ctl, decoded, global)
+}
+
 /// Whether `file` stores spot planes the way earlier PhotoCraft versions (releases 0.1.0 to
 /// 0.16.0) wrote them: straight (the maximum = solid ink), the opposite of Photoshop, which
 /// stores 0 = solid ink in every PSD and TIFF it saves. Their files are recognised by three
@@ -962,6 +1063,77 @@ pub(crate) fn can_recover_layers(file: &PsdFile) -> bool {
     matches!(file.header.color_mode, PsdMode::Grayscale | PsdMode::Rgb | PsdMode::Cmyk | PsdMode::Lab) && file.header.depth != 1 && !file.layers().is_empty()
 }
 
+fn read_initial_metadata(file: &PsdFile, global: &[PsdGlobalBlock], doc: &mut Document, layered: bool, multichannel: bool, warnings: &mut Vec<String>) -> bool {
+    let header = &file.header;
+    for resource in &file.resources {
+        match resource.id {
+            ids::RESOLUTION_INFO => {
+                if let Ok(info) = photocraft_psd::ResolutionInfo::from_bytes(&resource.data) {
+                    let (x, y) = (info.h_res(), info.v_res());
+                    doc.resolution_dpi = x as f32;
+                    warnings.extend(crate::unequal_resolution_warning(x, y));
+                }
+            }
+            ids::ICC_PROFILE => doc.icc_profile = Some(Arc::new(resource.data.clone())),
+            ids::XMP => doc.metadata.xmp = Some(String::from_utf8_lossy(&resource.data).into()),
+            ids::EXIF => doc.metadata.exif = Some(Arc::new(resource.data.clone())),
+            1032 => parse_guides(&resource.data, doc),
+            ids::GLOBAL_ANGLE | ids::GLOBAL_ALTITUDE => {
+                if let Some(bytes) = resource.data.get(..4) {
+                    let value = i32::from_be_bytes([bytes[0], bytes[1], bytes[2], bytes[3]]) as f32;
+                    if resource.id == ids::GLOBAL_ANGLE {
+                        doc.global_light.angle = value;
+                    } else {
+                        doc.global_light.altitude = value;
+                    }
+                }
+            }
+            id if crate::vector_map::SAVED_PATHS.contains(&id) => match crate::vector_map::path_from_resource(&resource.data, header.width, header.height) {
+                Some(path) => doc.paths.push(photocraft_doc::NamedPath {
+                    name: String::from_utf8_lossy(&resource.name).into_owned(),
+                    path,
+                    psd_raw: Some(Arc::new(resource.data.clone())),
+                }),
+                None => doc.metadata.psd_resources.push((id, String::from_utf8_lossy(&resource.name).into_owned(), Arc::new(resource.data.clone()))),
+            },
+            crate::vector_map::WORK_PATH => doc.work_path = crate::vector_map::path_from_resource(&resource.data, header.width, header.height),
+            crate::vector_map::CLIPPING_PATH => {
+                let len = usize::from(resource.data.first().copied().unwrap_or(0));
+                let name = resource.data.get(1..1 + len).map(|bytes| String::from_utf8_lossy(bytes).into_owned()).unwrap_or_default();
+                doc.clipping_path = Some(photocraft_doc::ClippingPath { name, flatness: 0.0 });
+                doc.metadata.psd_resources.push((resource.id, String::from_utf8_lossy(&resource.name).into_owned(), Arc::new(resource.data.clone())));
+            }
+            crate::channel_map::ALPHA_IDENTIFIERS if !multichannel => {}
+            id if MAPPED_RESOURCES.contains(&id) => {}
+            id => doc.metadata.psd_resources.push((id, String::from_utf8_lossy(&resource.name).into_owned(), Arc::new(resource.data.clone()))),
+        }
+    }
+    crate::guides_map::apply_colors(doc);
+    doc.metadata.psd_global_blocks.extend(global.iter().cloned());
+    // A 16/32-bit file whose layer block can't be parsed would otherwise open as a flattened
+    // file without a word (#2700). The raw block is kept, but a PSD save writes the document's
+    // own layers in its place (see `psd_export`).
+    let mut damaged = false;
+    if let Some((block, error)) = file.unreadable_layer_block() {
+        damaged = true;
+        warnings.push(format!(
+            "the layers ({} block) could not be read ({error}); only the merged image was opened. Saving as PSD replaces the unreadable layer data",
+            block.key_str()
+        ));
+    }
+    doc.patterns = crate::pattern_map::from_global_blocks(doc);
+    warnings.extend(crate::pattern_map::unpaintable_warnings(&doc.patterns));
+    doc.notes = crate::annotations_map::notes_from_blocks(doc);
+    if crate::annotations_map::anno_unreadable(doc) {
+        warnings.push("the notes (Anno block) could not be read; they are kept unchanged on PSD save unless a note is added".into());
+    }
+    if let Some(scale) = crate::annotations_map::raw_scale(doc) {
+        doc.measurement.scale = scale;
+    }
+    let _ = layered;
+    damaged
+}
+
 /// [`psd_to_document_with`] with the merged image already decoded (by
 /// [`PsdFile::from_bytes_and_merged`] with [`merged_needed`]), so it is not decoded again.
 pub(crate) fn psd_to_document_decoded(
@@ -980,107 +1152,39 @@ pub(crate) fn psd_to_document_decoded_integrity(
     ctl: &photocraft_raster::Interrupt,
     decoded: Option<photocraft_psd::Result<Vec<u8>>>,
 ) -> Option<(Document, Vec<String>, bool)> {
+    let global = file.global_blocks.iter().map(|b| (b.signature, b.key, Arc::new(b.data.clone()))).collect();
+    psd_to_document_global(file, ctl, decoded, global).map(|(doc, warnings, damaged, _)| (doc, warnings, damaged))
+}
+
+fn psd_to_document_global(
+    file: &PsdFile,
+    ctl: &photocraft_raster::Interrupt,
+    decoded: Option<photocraft_psd::Result<Vec<u8>>>,
+    global: Vec<PsdGlobalBlock>,
+) -> Option<(Document, Vec<String>, bool, Option<String>)> {
+    let (mode, layered, multichannel, depth) = import_format(file);
     let h = &file.header;
     let mut warnings = Vec::new();
-    let mode = doc_mode(h.color_mode).unwrap_or_else(|| {
+    if doc_mode(h.color_mode).is_none() {
         warnings.push(format!("unknown color mode {}; importing as RGB", h.color_mode.as_u16()));
-        ColorMode::Rgb
-    });
-    let layered = matches!(mode, ColorMode::Grayscale | ColorMode::Rgb | ColorMode::Cmyk | ColorMode::Lab) && h.depth != 1;
-    let multichannel = mode == ColorMode::Multichannel && h.depth != 1;
-    let depth = if layered || multichannel { sample_for_depth(h.depth) } else { SampleType::U8 };
+    }
     let mut doc = Document::new("Untitled", Size::new(h.width, h.height), mode, depth);
-
-    // Resources.
-    for r in &file.resources {
-        match r.id {
-            ids::RESOLUTION_INFO => {
-                if let Ok(ri) = photocraft_psd::ResolutionInfo::from_bytes(&r.data) {
-                    // Fixed 16.16 hRes/vRes are pixels per inch. The unit shorts only
-                    // say how to show that number (1 = px/in, 2 = px/cm).
-                    let (x, y) = (ri.h_res(), ri.v_res());
-                    doc.resolution_dpi = x as f32;
-                    warnings.extend(crate::unequal_resolution_warning(x, y));
-                }
-            }
-            ids::ICC_PROFILE => doc.icc_profile = Some(Arc::new(r.data.clone())),
-            ids::XMP => doc.metadata.xmp = Some(String::from_utf8_lossy(&r.data).into()),
-            ids::EXIF => doc.metadata.exif = Some(Arc::new(r.data.clone())),
-            1032 => parse_guides(&r.data, &mut doc),
-            ids::GLOBAL_ANGLE | ids::GLOBAL_ALTITUDE => {
-                if let Some(b) = r.data.get(..4) {
-                    let v = i32::from_be_bytes([b[0], b[1], b[2], b[3]]) as f32;
-                    if r.id == ids::GLOBAL_ANGLE {
-                        doc.global_light.angle = v;
-                    } else {
-                        doc.global_light.altitude = v;
-                    }
-                }
-            }
-            id if crate::vector_map::SAVED_PATHS.contains(&id) => match crate::vector_map::path_from_resource(&r.data, h.width, h.height) {
-                Some(path) => doc.paths.push(photocraft_doc::NamedPath {
-                    name: String::from_utf8_lossy(&r.name).into_owned(),
-                    path,
-                    psd_raw: Some(Arc::new(r.data.clone())),
-                }),
-                None => doc.metadata.psd_resources.push((id, String::from_utf8_lossy(&r.name).into_owned(), Arc::new(r.data.clone()))),
-            },
-            crate::vector_map::WORK_PATH => {
-                doc.work_path = crate::vector_map::path_from_resource(&r.data, h.width, h.height);
-            }
-            crate::vector_map::CLIPPING_PATH => {
-                // Kept raw (layout beyond the name is not modelled); the name is exposed.
-                let n = usize::from(r.data.first().copied().unwrap_or(0));
-                let name = r.data.get(1..1 + n).map(|b| String::from_utf8_lossy(b).into_owned()).unwrap_or_default();
-                doc.clipping_path = Some(photocraft_doc::ClippingPath { name, flatness: 0.0 });
-                doc.metadata.psd_resources.push((r.id, String::from_utf8_lossy(&r.name).into_owned(), Arc::new(r.data.clone())));
-            }
-            // Resource 1053 is written afresh with the extra channels on every save, so a kept copy
-            // would be new metadata after each round trip. Multichannel has no such rewrite: the
-            // imported bytes are the channel ids, copied back while they still match.
-            crate::channel_map::ALPHA_IDENTIFIERS if !multichannel => {}
-            id if MAPPED_RESOURCES.contains(&id) => {}
-            id => doc.metadata.psd_resources.push((id, String::from_utf8_lossy(&r.name).into_owned(), Arc::new(r.data.clone()))),
-        }
-    }
-    crate::guides_map::apply_colors(&mut doc);
-    for b in &file.global_blocks {
-        doc.metadata.psd_global_blocks.push((b.signature, b.key, Arc::new(b.data.clone())));
-    }
-    // A 16/32-bit file whose layer block can't be parsed would otherwise open as a flattened
-    // file without a word (#2700). The raw block is kept, but a PSD save writes the document's
-    // own layers in its place (see `psd_export`).
-    let mut damaged = false;
-    if let Some((b, e)) = file.unreadable_layer_block() {
-        damaged = true;
-        warnings.push(format!(
-            "the layers ({} block) could not be read ({e}); only the merged image was opened. Saving as PSD replaces the unreadable layer data",
-            b.key_str()
-        ));
-    }
-    doc.patterns = crate::pattern_map::from_global_blocks(&doc);
-    warnings.extend(crate::pattern_map::unpaintable_warnings(&doc.patterns));
-    // Notes (`Anno`) and the measurement scale (resource 1074); raw data stays for verbatim export.
-    doc.notes = crate::annotations_map::notes_from_blocks(&doc);
-    if crate::annotations_map::anno_unreadable(&doc) {
-        warnings.push("the notes (Anno block) could not be read; they are kept unchanged on PSD save unless a note is added".into());
-    }
-    if let Some(scale) = crate::annotations_map::raw_scale(&doc) {
-        doc.measurement.scale = scale;
-    }
+    let damaged = read_initial_metadata(file, &global, &mut doc, layered, multichannel, &mut warnings);
 
     let fmt = doc.pixel_format();
     let cc = fmt.mode.color_channels();
     let mut cx = Ctx {
         file,
+        global: global.clone(),
         fmt,
         mask_fmt: PixelFormat::new(ColorMode::Grayscale, depth, false),
         cc,
         cmyk: fmt.mode == ColorMode::Cmyk,
         warnings,
         damaged,
+        read_error: None,
         dpi: doc.resolution_dpi,
-        txt2: file.global_blocks.iter().find(|b| &b.key == b"Txt2").and_then(|b| photocraft_text::psd::parse_txt2(&b.data)),
+        txt2: global.iter().find(|(_, k, _)| k == b"Txt2").and_then(|(_, _, d)| photocraft_text::psd::parse_txt2(d)),
         filter_effects: Vec::new(),
         filter_masks: Default::default(),
         unfiltered: Default::default(),
@@ -1089,16 +1193,17 @@ pub(crate) fn psd_to_document_decoded_integrity(
         plld_sizes: Default::default(),
         ctl: *ctl,
         done: 0,
+        uniform: Default::default(),
         total: file.layers().len(),
     };
-    for b in file.global_blocks.iter().filter(|b| matches!(&b.key, b"FEid" | b"FXid")) {
+    for (_, key, data) in cx.global.clone().iter().filter(|(_, key, _)| matches!(key, b"FEid" | b"FXid")) {
         // Smart-filter caches can be large: a cancelled open stops between blocks.
         if ctl.cancelled() {
             return None;
         }
-        match photocraft_psd::filter_effects::FilterEffects::parse(&b.data) {
+        match photocraft_psd::filter_effects::FilterEffects::parse(data) {
             Ok(fx) => cx.filter_effects.extend(fx.items),
-            Err(e) => cx.warn(format!("smart filter masks ({}) could not be read: {e}", b.key_str())),
+            Err(e) => cx.warn(format!("smart filter masks ({}) could not be read: {e}", String::from_utf8_lossy(key))),
         }
     }
     if ctl.cancelled() {
@@ -1110,227 +1215,239 @@ pub(crate) fn psd_to_document_decoded_integrity(
     // budget while `w * hh` does not fit a 32-bit `usize` (wasm32).
     let sizes = w.checked_mul(hh).zip(h.row_bytes().checked_mul(hh));
     let canvas = Rect::new(0, 0, h.width as i32, h.height as i32);
-    // The merged composite is decoded only when something consumes it: a flattened or
-    // multichannel file (it *is* the image), or extra alpha/spot channels behind the colour
-    // ones. A normal layered Photoshop save carries a merged composite nobody reads - roughly
-    // half the file's bytes, decoded and thrown away on every open before this.
-    let merged = if merged_needed(file) {
-        let m = decoded.unwrap_or_else(|| file.decode_merged());
-        if ctl.cancelled() {
-            return None;
-        }
-        ctl.progress(0.1);
-        if let Err(e) = &m {
-            cx.warn_unreadable_data(format!("merged image could not be decoded: {e}"));
-            if can_recover_layers(file) {
-                cx.warn_unreadable_data("extra alpha/spot channels in the merged image could not be recovered");
-            }
-        }
-        Some(m)
-    } else {
-        if let Some(Err(e)) = decoded {
-            cx.warn_unreadable_data(format!("merged image could not be decoded; opened the available layers instead: {e}"));
-        }
-        None
-    };
+    let merged = decode_merged(file, decoded, ctl, &mut cx)?;
+    import_decoded_content(DecodedImport { file, merged: &merged, sizes, canvas, layered, multichannel, depth, fmt }, &mut doc, &mut cx);
+    finish_import(doc, cx, ctl)
+}
 
-    if multichannel {
-        // Ink channels only (no layers); see `multichannel_map`.
-        if let Some(Ok(all)) = &merged {
-            let names = file.resource(1045).map(|r| unicode_names(&r.data)).unwrap_or_default();
-            crate::multichannel_map::import(file, all, &mut doc, &names, &mut cx.warnings);
-        }
-        if !file.layers().is_empty() {
-            cx.warn(format!("Multichannel documents have no layers: {} layer records were not imported", file.layers().len()));
-        }
-    } else if layered {
-        // Capped like `build` (#2940): a group past the document's nesting cap keeps no children,
-        // so no file can make this tree, or anything walking or dropping it, recurse deeper.
-        let tree = file.layer_tree_max_depth(photocraft_doc::MAX_GROUP_DEPTH);
-        // Colours stored in the document's CMYK space (Gradient Map stops…) convert through
-        // its own profile, as the compositor and the PSD writer read them.
-        let space = photocraft_compose::cmyk_space(&doc);
-        doc.layers = photocraft_color::convert::with_cmyk_space(space.as_ref(), || cx.build(&tree, 0));
-        // Photoshop's Background: the bottom record stored without a transparency channel (-1),
-        // locked whatever its (localized) name and whether or not the file carries an `lspf`
-        // block. Its name is kept.
-        mark_background(file, &mut doc.layers);
-        // Layer › Link Layers: resource 1026 holds one group id per layer record (0 = unlinked).
-        if let Some(Ok(photocraft_psd::resources::ResourceData::LayerGroupInfo(groups))) =
-            file.resources.iter().find(|r| r.id == ids::LAYER_GROUP_INFO).and_then(photocraft_psd::resources::ImageResource::parsed)
-        {
-            apply_link_groups(&tree, &mut doc.layers, &groups);
-        }
-        if doc.layers.is_empty()
-            && let Some(Ok(all)) = &merged
-            // Always `Some` here: a decoded 8/16/32-bit plane holds at least `w * hh` bytes.
-            && let Some((n, plane)) = sizes
-        {
-            // Flattened file: the merged image becomes the background layer.
-            let alpha_idx = if file.merged_has_alpha() { Some(cc) } else { None };
-            let mut planes: Vec<Option<&[u8]>> = (0..cc).map(|c| merged_plane(all, c, plane)).collect();
-            planes.push(alpha_idx.and_then(|a| merged_plane(all, a, plane)));
-            let mut fill = vec![zero_sample(depth); cc];
-            fill.push(max_sample(depth));
-            let mut inv = vec![cx.cmyk; cc];
-            inv.push(false);
-            let mut bytes = interleave(&planes, &fill, n, depth, &inv);
-            if fmt.mode == ColorMode::Lab && depth == SampleType::U16 {
-                crate::pixels::lab16_chroma(&mut bytes, cc + 1, true);
-            }
-            let mut s = Surface::from_interleaved(fmt, canvas, &bytes);
-            if alpha_idx.is_some() {
-                // Undo Photoshop's white matting of the merged image.
-                // A band of tile rows at a time (no full-size float copy of the image).
-                let white = photocraft_raster::from_rgba(&fmt, [1.0, 1.0, 1.0, 1.0]);
-                let mut vals = Vec::new();
-                let mut y = canvas.y0;
-                while y < canvas.y1 {
-                    let band = Rect::new(canvas.x0, y, canvas.x1, y.saturating_add(TILE_SIZE).min(canvas.y1));
-                    s.read_region_into(band, &mut vals);
-                    for px in vals.chunks_exact_mut(cc + 1) {
-                        let a = px[cc];
-                        for c in 0..cc {
-                            px[c] = if a <= 0.0 { 0.0 } else { crate::pixels::unmatte(px[c], a, white[c]) };
-                        }
-                    }
-                    s.write_region(band, &vals);
-                    y = band.y1;
-                }
-            }
-            s.prune();
-            let mut bg = Layer::new("Background", LayerContent::Raster(s));
-            if alpha_idx.is_none() {
-                bg.locks.transparency = true;
-                bg.locks.position = true;
-            }
-            doc.layers.push(bg);
-        }
-    } else {
-        if !file.layers().is_empty() {
-            cx.warn(format!("{:?} documents are imported flattened: {} layer records were not imported", h.color_mode, file.layers().len()));
-        } else {
-            cx.warn(format!("{:?} {}-bit document converted to {:?} 8-bit for editing", h.color_mode, h.depth, fmt.mode));
-        }
-        if h.color_mode == PsdMode::Indexed && file.color_mode_data.len() >= 768 {
-            // Planar palette: 256 reds, 256 greens, 256 blues (the Color Table).
-            let m = &file.color_mode_data;
-            // Resource 1046 says how many entries are used, 1047 which one is transparent.
-            let u16_of = |id: u16| file.resource(id).and_then(|r| r.data.get(..2)).map(|b| u16::from_be_bytes([b[0], b[1]]));
-            let count = u16_of(crate::palette_map::COLOR_TABLE_COUNT).map_or(256, usize::from).clamp(1, 256);
-            let colors = (0..count).map(|i| [m[i], m[256 + i], m[512 + i]]).collect();
-            let transparent = u16_of(crate::palette_map::TRANSPARENCY_INDEX).filter(|&i| usize::from(i) < count).map(|i| i as u8);
-            doc.color_table = Some(photocraft_doc::ColorTable { colors, transparent });
-        } else if h.color_mode == PsdMode::Duotone && !file.color_mode_data.is_empty() {
-            // The inks (`duotone_map`); the block is also kept raw, written back while they stay
-            // unedited. An ink whose colour is unknown (a colour book without its Lab equivalent)
-            // would show black and darken the image: the grey plate is shown instead, as before.
-            let mut unknown = false;
-            let alternate = file.resource(crate::duotone_map::ALTERNATE_DUOTONE_COLORS).map(|r| r.data.as_slice());
-            let inks = crate::duotone_map::parse(&file.color_mode_data, alternate, &mut unknown).filter(|_| !unknown);
-            if inks.is_none() {
-                cx.warn("duotone inks are not interpreted (shown as grayscale)");
-            }
-            let inks = inks.unwrap_or_else(|| vec![photocraft_doc::DuotoneInk::new("Black", [0.0; 3])]);
-            doc.duotone = Some(photocraft_doc::Duotone { inks, psd_raw: Some(file.color_mode_data.as_slice().into()) });
-        } else if !file.color_mode_data.is_empty() {
-            cx.warn("color mode data is not preserved");
-        }
-        match flat_composite(file, merged.as_ref(), photocraft_psd::compression::MAX_DECODED_BYTES) {
-            Ok(mut img) => {
-                // Resource 1047: pixels of the transparent entry are transparent.
-                if h.color_mode == PsdMode::Indexed
-                    && let Some(t) = doc.color_table.as_ref().and_then(|t| t.transparent)
-                    && let Some(Ok(all)) = &merged
-                    && let Some(indices) = sizes.and_then(|(_, plane)| merged_plane(all, 0, plane))
-                {
-                    for (px, &i) in img.data.as_chunks_mut::<4>().0.iter_mut().zip(indices) {
-                        if i == t {
-                            px[3] = 0;
-                        }
-                    }
-                }
-                let mut s = Surface::new(fmt);
-                write_rgba8(&mut s, canvas, &img.data);
-                drop(img);
-                s.prune();
-                doc.layers.push(flat_background(s));
-            }
-            // A merged image that failed to decode was reported above.
-            Err(_) if matches!(merged, Some(Err(_))) => {}
-            Err(e) => cx.warn_unreadable_data(format!("the image could not be read: {e}")),
-        }
-    }
-
-    // Extra (alpha / spot) channels of the merged image.
-    if layered
-        && let Some(Ok(all)) = &merged
-        && let Some((n, plane)) = sizes
-    {
-        let first = cc + usize::from(file.merged_has_alpha());
-        let names = file.resource(1045).map(|r| unicode_names(&r.data)).unwrap_or_default();
-        // Photoshop lists every extra channel, the merged transparency first when there is one.
-        let skip = usize::from(file.merged_has_alpha() && names.len() == usize::from(h.channels).saturating_sub(cc));
-        let names = names.get(skip..).unwrap_or_default();
-        // Which planes hold spot ink in Photoshop's polarity (0 = solid): the DisplayInfo records
-        // the channel options are read from below, the transparency's first when `skip` is 1.
-        // A file from an earlier PhotoCraft stores them straight and is read as it was written,
-        // past the channels of the Photoshop file it opened, if any.
-        let straight_from = if earlier_photocraft_spot_planes(file) { photoshop_identified_channels(file) } else { usize::MAX };
-        let photoshop_spots = if let Some(r) = file.resource(crate::channel_map::DISPLAY_INFO) {
-            crate::channel_map::spot_flags(&r.data, true, skip)
-        } else if let Some(r) = file.resource(crate::channel_map::DISPLAY_INFO_OLD) {
-            crate::channel_map::spot_flags(&r.data, false, skip)
-        } else {
-            Vec::new()
-        };
-        for (k, idx) in (first..usize::from(h.channels)).enumerate() {
-            let Some(p) = merged_plane(all, idx, plane) else {
-                cx.warn_unreadable_data(format!("merged extra channel {idx} is incomplete and was not imported"));
-                break;
-            };
-            let mut raw = be_to_ne_plane(p, depth, n);
-            if k < straight_from && photoshop_spots.get(k).copied().unwrap_or(false) {
-                crate::channel_map::photoshop_spot_plane(&mut raw, depth);
-            }
-            let mut s = Surface::new(cx.mask_fmt);
-            s.write_interleaved(canvas, &raw);
-            s.prune();
-            let name = names.get(k).cloned().unwrap_or_else(|| format!("Alpha {}", k + 1));
-            doc.channels.push(AlphaChannel::new(name, s));
-        }
-        // Channel options (overlay colour, opacity, colour indicates) and spot inks.
-        if let Some(r) = file.resource(crate::channel_map::DISPLAY_INFO) {
-            crate::channel_map::apply_display_info(&r.data, true, skip, &mut doc.channels);
-        } else if let Some(r) = file.resource(crate::channel_map::DISPLAY_INFO_OLD) {
-            crate::channel_map::apply_display_info(&r.data, false, skip, &mut doc.channels);
-        }
-        // Saved in Quick Mask mode: that channel becomes the document's Quick Mask again.
-        if let Some(r) = file.resource(crate::channel_map::QUICK_MASK_INFO)
-            && r.data.len() >= 2
-            && let Some(k) = usize::from(u16::from_be_bytes([r.data[0], r.data[1]])).checked_sub(first)
-            && k < doc.channels.len()
-        {
-            doc.quick_mask = Some(doc.channels.remove(k));
-        }
-    }
-
-    // Layer comps (resource 1065 + per-layer `cmls`); the raw data stays for verbatim export.
-    let raw_comps = doc.metadata.psd_resources.iter().find(|(id, _, _)| *id == crate::comps_map::LAYER_COMPS).map(|(_, _, d)| d.clone());
-    let comp_warnings;
-    (doc.layer_comps, doc.last_applied_comp, doc.last_document_state, comp_warnings) =
-        crate::comps_map::decode_comps(raw_comps.as_deref().map(Vec::as_slice), &doc);
-    cx.warnings.extend(comp_warnings);
-    // Slices (resource 1050), after layer ids are known; the raw data stays for verbatim export.
+fn finish_import(mut doc: Document, mut cx: Ctx<'_>, ctl: &photocraft_raster::Interrupt) -> Option<(Document, Vec<String>, bool, Option<String>)> {
+    let raw_comps = doc.metadata.psd_resources.iter().find(|(id, _, _)| *id == crate::comps_map::LAYER_COMPS).map(|(_, _, data)| data.clone());
+    let (comps, applied, state, warnings) = crate::comps_map::decode_comps(raw_comps.as_deref().map(Vec::as_slice), &doc);
+    (doc.layer_comps, doc.last_applied_comp, doc.last_document_state) = (comps, applied, state);
+    cx.warnings.extend(warnings);
     crate::slices_map::import(&mut doc);
-    // Character and paragraph styles from the type layers' engine data.
     cx.warnings.extend(crate::text_styles_map::import(&mut doc));
-
     if ctl.cancelled() {
         return None;
     }
     ctl.progress(1.0);
-    Some((doc, cx.warnings, cx.damaged))
+    Some((doc, cx.warnings, cx.damaged, cx.read_error))
+}
+
+fn decode_merged(
+    file: &PsdFile,
+    decoded: Option<photocraft_psd::Result<Vec<u8>>>,
+    ctl: &photocraft_raster::Interrupt,
+    cx: &mut Ctx<'_>,
+) -> Option<Option<photocraft_psd::Result<Vec<u8>>>> {
+    if merged_needed(file) {
+        let merged = decoded.unwrap_or_else(|| file.decode_merged());
+        if ctl.cancelled() {
+            return None;
+        }
+        ctl.progress(0.1);
+        if let Err(error) = &merged {
+            cx.warn_unreadable_data(format!("merged image could not be decoded: {error}"));
+            if can_recover_layers(file) {
+                cx.warn_unreadable_data("extra alpha/spot channels in the merged image could not be recovered");
+            }
+        }
+        Some(Some(merged))
+    } else {
+        if let Some(Err(error)) = decoded {
+            cx.warn_unreadable_data(format!("merged image could not be decoded; opened the available layers instead: {error}"));
+        }
+        Some(None)
+    }
+}
+
+fn import_decoded_content(import: DecodedImport<'_>, doc: &mut Document, cx: &mut Ctx<'_>) {
+    if import.multichannel {
+        import_multichannel(import.file, import.merged, doc, cx);
+    } else if import.layered {
+        import_layered(import, doc, cx);
+    } else {
+        import_flattened(import.file, import.merged, import.sizes, import.canvas, import.fmt, doc, cx);
+    }
+    import_extra_channels(import, doc, cx);
+}
+
+fn import_multichannel(file: &PsdFile, merged: &Option<photocraft_psd::Result<Vec<u8>>>, doc: &mut Document, cx: &mut Ctx<'_>) {
+    if let Some(Ok(all)) = merged {
+        let names = file.resource(1045).map(|r| unicode_names(&r.data)).unwrap_or_default();
+        crate::multichannel_map::import(file, all, doc, &names, &mut cx.warnings);
+    }
+    if !file.layers().is_empty() {
+        cx.warn(format!("Multichannel documents have no layers: {} layer records were not imported", file.layers().len()));
+    }
+}
+
+fn import_layered(import: DecodedImport<'_>, doc: &mut Document, cx: &mut Ctx<'_>) {
+    let DecodedImport { file, merged, sizes, canvas, depth, fmt, .. } = import;
+    let cc = fmt.mode.color_channels();
+    let tree = file.layer_tree_max_depth(photocraft_doc::MAX_GROUP_DEPTH);
+    let space = photocraft_compose::cmyk_space(doc);
+    doc.layers = photocraft_color::convert::with_cmyk_space(space.as_ref(), || cx.build(&tree, 0));
+    mark_background(file, &mut doc.layers);
+    if let Some(Ok(photocraft_psd::resources::ResourceData::LayerGroupInfo(groups))) =
+        file.resources.iter().find(|r| r.id == ids::LAYER_GROUP_INFO).and_then(photocraft_psd::resources::ImageResource::parsed)
+    {
+        apply_link_groups(&tree, &mut doc.layers, &groups);
+    }
+    let Some((n, plane)) = sizes else { return };
+    let Some(Ok(all)) = merged else { return };
+    if !doc.layers.is_empty() {
+        return;
+    }
+    let alpha_idx = file.merged_has_alpha().then_some(cc);
+    let mut planes: Vec<Option<&[u8]>> = (0..cc).map(|c| merged_plane(all, c, plane)).collect();
+    planes.push(alpha_idx.and_then(|a| merged_plane(all, a, plane)));
+    let mut fill = vec![zero_sample(depth); cc];
+    fill.push(max_sample(depth));
+    let mut inv = vec![cx.cmyk; cc];
+    inv.push(false);
+    let mut bytes = interleave(&planes, &fill, n, depth, &inv);
+    if fmt.mode == ColorMode::Lab && depth == SampleType::U16 {
+        crate::pixels::lab16_chroma(&mut bytes, cc + 1, true);
+    }
+    let mut surface = Surface::from_interleaved(fmt, canvas, &bytes);
+    if alpha_idx.is_some() {
+        let white = photocraft_raster::from_rgba(&fmt, [1.0, 1.0, 1.0, 1.0]);
+        let mut vals = Vec::new();
+        let mut y = canvas.y0;
+        while y < canvas.y1 {
+            let band = Rect::new(canvas.x0, y, canvas.x1, y.saturating_add(TILE_SIZE).min(canvas.y1));
+            surface.read_region_into(band, &mut vals);
+            for px in vals.chunks_exact_mut(cc + 1) {
+                let a = px[cc];
+                for c in 0..cc {
+                    px[c] = if a <= 0.0 { 0.0 } else { crate::pixels::unmatte(px[c], a, white[c]) };
+                }
+            }
+            surface.write_region(band, &vals);
+            y = band.y1;
+        }
+    }
+    surface.prune();
+    let mut bg = Layer::new("Background", LayerContent::Raster(surface));
+    if alpha_idx.is_none() {
+        bg.locks.transparency = true;
+        bg.locks.position = true;
+    }
+    doc.layers.push(bg);
+}
+
+fn import_flattened(
+    file: &PsdFile,
+    merged: &Option<photocraft_psd::Result<Vec<u8>>>,
+    sizes: Option<(usize, usize)>,
+    canvas: Rect,
+    fmt: PixelFormat,
+    doc: &mut Document,
+    cx: &mut Ctx<'_>,
+) {
+    let h = &file.header;
+    if !file.layers().is_empty() {
+        cx.warn(format!("{:?} documents are imported flattened: {} layer records were not imported", h.color_mode, file.layers().len()));
+    } else {
+        cx.warn(format!("{:?} {}-bit document converted to {:?} 8-bit for editing", h.color_mode, h.depth, fmt.mode));
+    }
+    if h.color_mode == PsdMode::Indexed && file.color_mode_data.len() >= 768 {
+        let m = &file.color_mode_data;
+        let u16_of = |id: u16| file.resource(id).and_then(|r| r.data.get(..2)).map(|b| u16::from_be_bytes([b[0], b[1]]));
+        let count = u16_of(crate::palette_map::COLOR_TABLE_COUNT).map_or(256, usize::from).clamp(1, 256);
+        let colors = (0..count).map(|i| [m[i], m[256 + i], m[512 + i]]).collect();
+        let transparent = u16_of(crate::palette_map::TRANSPARENCY_INDEX).filter(|&i| usize::from(i) < count).map(|i| i as u8);
+        doc.color_table = Some(photocraft_doc::ColorTable { colors, transparent });
+    } else if h.color_mode == PsdMode::Duotone && !file.color_mode_data.is_empty() {
+        let mut unknown = false;
+        let alternate = file.resource(crate::duotone_map::ALTERNATE_DUOTONE_COLORS).map(|r| r.data.as_slice());
+        let inks = crate::duotone_map::parse(&file.color_mode_data, alternate, &mut unknown).filter(|_| !unknown);
+        if inks.is_none() {
+            cx.warn("duotone inks are not interpreted (shown as grayscale)");
+        }
+        let inks = inks.unwrap_or_else(|| vec![photocraft_doc::DuotoneInk::new("Black", [0.0; 3])]);
+        doc.duotone = Some(photocraft_doc::Duotone { inks, psd_raw: Some(file.color_mode_data.as_slice().into()) });
+    } else if !file.color_mode_data.is_empty() {
+        cx.warn("color mode data is not preserved");
+    }
+    match flat_composite(file, merged.as_ref(), photocraft_psd::compression::MAX_DECODED_BYTES) {
+        Ok(mut img) => {
+            if h.color_mode == PsdMode::Indexed
+                && let Some(t) = doc.color_table.as_ref().and_then(|t| t.transparent)
+                && let Some(Ok(all)) = merged
+                && let Some(indices) = sizes.and_then(|(_, plane)| merged_plane(all, 0, plane))
+            {
+                for (px, &i) in img.data.as_chunks_mut::<4>().0.iter_mut().zip(indices) {
+                    if i == t {
+                        px[3] = 0;
+                    }
+                }
+            }
+            let mut surface = Surface::new(fmt);
+            write_rgba8(&mut surface, canvas, &img.data);
+            drop(img);
+            surface.prune();
+            doc.layers.push(flat_background(surface));
+        }
+        Err(_) if matches!(merged, Some(Err(_))) => {}
+        Err(error) => cx.warn_unreadable_data(format!("the image could not be read: {error}")),
+    }
+}
+
+fn import_extra_channels(import: DecodedImport<'_>, doc: &mut Document, cx: &mut Ctx<'_>) {
+    // Extra (alpha / spot) channels of the merged image.
+    if !import.layered {
+        return;
+    }
+    let DecodedImport { file, merged, sizes, canvas, depth, .. } = import;
+    let Some(Ok(all)) = merged else { return };
+    let Some((n, plane)) = sizes else { return };
+    let cc = cx.cc;
+    let first = cc + usize::from(file.merged_has_alpha());
+    let names = file.resource(1045).map(|r| unicode_names(&r.data)).unwrap_or_default();
+    // Photoshop lists every extra channel, the merged transparency first when there is one.
+    let skip = usize::from(file.merged_has_alpha() && names.len() == usize::from(file.header.channels).saturating_sub(cc));
+    let names = names.get(skip..).unwrap_or_default();
+    // Which planes hold spot ink in Photoshop's polarity (0 = solid): the DisplayInfo records
+    // the channel options are read from below, the transparency's first when `skip` is 1.
+    // A file from an earlier PhotoCraft stores them straight as it was written,
+    // past the channels of the Photoshop file it opened, if any.
+    let straight_from = if earlier_photocraft_spot_planes(file) { photoshop_identified_channels(file) } else { usize::MAX };
+    let photoshop_spots = if let Some(r) = file.resource(crate::channel_map::DISPLAY_INFO) {
+        crate::channel_map::spot_flags(&r.data, true, skip)
+    } else if let Some(r) = file.resource(crate::channel_map::DISPLAY_INFO_OLD) {
+        crate::channel_map::spot_flags(&r.data, false, skip)
+    } else {
+        Vec::new()
+    };
+    for (k, idx) in (first..usize::from(file.header.channels)).enumerate() {
+        let Some(p) = merged_plane(all, idx, plane) else {
+            cx.warn_unreadable_data(format!("merged extra channel {idx} is incomplete and was not imported"));
+            break;
+        };
+        let mut raw = be_to_ne_plane(p, depth, n);
+        if k < straight_from && photoshop_spots.get(k).copied().unwrap_or(false) {
+            crate::channel_map::photoshop_spot_plane(&mut raw, depth);
+        }
+        let mut s = Surface::new(cx.mask_fmt);
+        s.write_interleaved(canvas, &raw);
+        s.prune();
+        let name = names.get(k).cloned().unwrap_or_else(|| format!("Alpha {}", k + 1));
+        doc.channels.push(AlphaChannel::new(name, s));
+    }
+    if let Some(r) = file.resource(crate::channel_map::DISPLAY_INFO) {
+        crate::channel_map::apply_display_info(&r.data, true, skip, &mut doc.channels);
+    } else if let Some(r) = file.resource(crate::channel_map::DISPLAY_INFO_OLD) {
+        crate::channel_map::apply_display_info(&r.data, false, skip, &mut doc.channels);
+    }
+    if let Some(r) = file.resource(crate::channel_map::QUICK_MASK_INFO)
+        && r.data.len() >= 2
+        && let Some(k) = usize::from(u16::from_be_bytes([r.data[0], r.data[1]])).checked_sub(first)
+        && k < doc.channels.len()
+    {
+        doc.quick_mask = Some(doc.channels.remove(k));
+    }
 }
 
 #[cfg(test)]
diff --git a/crates/io/src/psd_import/tests.rs b/crates/io/src/psd_import/tests.rs
index 66c3bb3cdd..3bb19e3ef8 100644
--- a/crates/io/src/psd_import/tests.rs
+++ b/crates/io/src/psd_import/tests.rs
@@ -367,3 +367,24 @@ fn a_complete_alpha_identifiers_resource_keeps_photoshop_polarity() {
     assert_eq!(photoshop_identified_channels(&file), 0, "0 is the transparency's");
     assert!(!earlier_photocraft_spot_planes(&file), "no channel left unlisted");
 }
+
+#[test]
+fn layer_bands_end_on_tile_rows_and_cover_the_layer() {
+    let t = TILE_SIZE as usize;
+    for (top, h, row_bytes) in [(0, 2000, 8000), (-37, 15000, 80_000), (100, 5, 4), (255, 1, 4), (-256, 40_000, 1 << 20), (7, 0, 4)] {
+        let bands = band_rows(top, h, row_bytes);
+        let mut next = 0;
+        for &(a, b) in &bands {
+            assert_eq!(a, next);
+            assert!(b > a);
+            if b < h {
+                assert_eq!((top + b as i32).rem_euclid(TILE_SIZE), 0, "{top} {h}: band ends inside a tile row");
+                assert!((b - a) * row_bytes <= BAND_BYTES + t * row_bytes || b - a <= t);
+            }
+            next = b;
+        }
+        assert_eq!(next, h);
+    }
+    // A small layer is one band.
+    assert_eq!(band_rows(0, 2000, 8000), vec![(0, 2000)]);
+}
diff --git a/crates/io/src/smart_map/export.rs b/crates/io/src/smart_map/export.rs
index ab1340fa17..e057a7032f 100644
--- a/crates/io/src/smart_map/export.rs
+++ b/crates/io/src/smart_map/export.rs
@@ -5,7 +5,10 @@ use super::import::{
     colour_rgbc, enum_param, from_hex, gallery_item, known_by_command, pf_range, pi_range, seed_param,
 };
 use super::placed::enumv;
-use super::*;
+use super::{
+    Class, Descriptor, FilterStack, Id, J, ReferenceItem, SmartFilter, UNSUPPORTED_FILTER, UnicodeString, Value, camera_raw, displace, hue_sat,
+    perspective_warp,
+};
 
 // ---------- writing ----------
 
@@ -111,7 +114,8 @@ fn enum_out(p: &J, key: &str, default: &str, type_id: &str, table: &[(&str, &str
     Ok(enumv(type_id, psd))
 }
 
-/// `key` rounded to a `long` in `lo..=hi`.
+/// `key` rounded to a `long` in `lo..=hi` (clamped, and a non-number is the default, as the
+/// engine reads Extrude, Tiles, Trace Contour, Crystallize and Pointillize).
 fn pi_in(p: &J, key: &str, default: f64, lo: i32, hi: i32) -> Value {
     Value::Integer(pf(p, key, default).round().clamp(f64::from(lo), f64::from(hi)) as i32)
 }
diff --git a/crates/io/src/smart_map/halftone_tests.rs b/crates/io/src/smart_map/halftone_tests.rs
index beae1725a7..d4f67dbfec 100644
--- a/crates/io/src/smart_map/halftone_tests.rs
+++ b/crates/io/src/smart_map/halftone_tests.rs
@@ -1,4 +1,5 @@
-//! Halftone Pattern descriptors measured in Photoshop 27.11.0 (#8940).
+//! Halftone Pattern descriptors with the keys from the reference application's Filter Gallery plug-in terminology (#8940):
+//! `HlSz` size, `Cntr` contrast and a `ScrT` enum (`ScrD` dot, `ScrC` circle, `ScrL` line).
 use super::import::{GALLERY_CLASS, GALLERY_COMMAND, colour_rgbc};
 use super::*;
 
@@ -16,13 +17,13 @@ fn filter(pattern: &str, size: i32, contrast: i32) -> SmartFilter {
     }
 }
 
-/// Builds the inline Halftone descriptor measured in Photoshop.
+/// Builds the inline Halftone descriptor as the reference application writes it.
 fn native_effect(pattern: &str, size: i32, contrast: i32) -> Descriptor {
     let mut d = Descriptor::new("GEfc")
         .with("GEfk", enumv("GEft", "HlfS"))
-        .with("Sz  ", Value::Integer(size))
+        .with("HlSz", Value::Integer(size))
         .with("Cntr", Value::Integer(contrast))
-        .with("Ptrn", enumv("HlfT", pattern));
+        .with("ScrT", enumv("ScrT", pattern));
     d.name = UnicodeString::new_nul("Filter Gallery");
     d
 }
@@ -41,10 +42,10 @@ fn native_item(effect: Descriptor) -> Descriptor {
         .with("filterID", Value::Integer(code(b"GEfc")))
 }
 
-/// Checks the measured pattern enums and editable settings in both mapping directions.
+/// Checks the pattern enums and editable settings in both mapping directions.
 #[test]
 fn halftone_pattern_reads_and_writes_photoshop_inline_descriptors() {
-    for (pattern, native) in [("dot", "Dt  "), ("circle", "Crc "), ("line", "Ln  ")] {
+    for (pattern, native) in [("dot", "ScrD"), ("circle", "ScrC"), ("line", "ScrL")] {
         for (size, contrast) in [(1, 0), (2, 5), (7, 31), (12, 50)] {
             let expected = filter(pattern, size, contrast);
             let native = native_item(native_effect(native, size, contrast));
@@ -72,22 +73,49 @@ fn halftone_pattern_defaults_and_mixed_hidden_stack_round_trip() {
     assert_eq!(filter_from_item(&Descriptor::from_bytes(&item.to_bytes()).unwrap()), f);
 }
 
+/// A default Halftone Pattern as the reference application saves it (size 1, contrast 5, Dot) opens editable.
+#[test]
+fn halftone_pattern_photoshop_default_imports_editable() {
+    let f = filter_from_item(&native_item(native_effect("ScrD", 1, 5)));
+    assert_eq!(f.command, GALLERY_COMMAND);
+    assert_eq!(f.params["effects"][0]["filter"], json!("halftonePattern"));
+    assert_eq!(f.params["effects"][0]["params"], json!({"size": 1, "contrast": 5, "patternType": "dot"}));
+}
+
+/// Keys the reference application's Filter Gallery doesn't use (`Sz  `, `Ptrn` of type `HlfT`) are not taken for
+/// Halftone settings: the item stays opaque and is written back as it was read.
+#[test]
+fn halftone_pattern_foreign_keys_stay_verbatim() {
+    for (pattern, shape) in [("Dt  ", "dot"), ("Crc ", "circle"), ("Ln  ", "line")] {
+        let mut d = Descriptor::new("GEfc")
+            .with("GEfk", enumv("GEft", "HlfS"))
+            .with("Sz  ", Value::Integer(2))
+            .with("Cntr", Value::Integer(5))
+            .with("Ptrn", enumv("HlfT", pattern));
+        d.name = UnicodeString::new_nul("Filter Gallery");
+        let item = native_item(d);
+        let f = filter_from_item(&item);
+        assert_eq!(f.command, UNSUPPORTED_FILTER, "{shape}");
+        assert_eq!(item_for_filter(&f).unwrap(), item, "{shape}");
+    }
+}
+
 /// Preserves unfamiliar and malformed settings instead of substituting editable defaults.
 #[test]
 fn halftone_pattern_unknown_or_malformed_descriptors_stay_verbatim() {
-    let valid = native_effect("Dt  ", 2, 5);
+    let valid = native_effect("ScrD", 2, 5);
     let mut invalid = vec![
         valid.clone().with("futureSetting", Value::Integer(1)),
-        valid.clone().with("Sz  ", Value::Integer(3)), // repeated key
+        valid.clone().with("HlSz", Value::Integer(3)), // repeated key
     ];
     for (key, value) in [
         ("GEfk", enumv("wrong", "HlfS")),
-        ("Ptrn", enumv("HlfT", "????")),
-        ("Ptrn", enumv("wrong", "Dt  ")),
-        ("Ptrn", Value::Integer(0)),
-        ("Sz  ", Value::Integer(0)),
-        ("Sz  ", Value::Integer(13)),
-        ("Sz  ", Value::Double(2.0)),
+        ("ScrT", enumv("ScrT", "????")),
+        ("ScrT", enumv("wrong", "ScrD")),
+        ("ScrT", Value::Integer(0)),
+        ("HlSz", Value::Integer(0)),
+        ("HlSz", Value::Integer(13)),
+        ("HlSz", Value::Double(2.0)),
         ("Cntr", Value::Integer(-1)),
         ("Cntr", Value::Integer(51)),
         ("GELv", Value::Integer(1)),
@@ -97,7 +125,7 @@ fn halftone_pattern_unknown_or_malformed_descriptors_stay_verbatim() {
         effect.items.push((Id::new(key), value));
         invalid.push(effect);
     }
-    for missing in ["Sz  ", "Cntr", "Ptrn"] {
+    for missing in ["HlSz", "Cntr", "ScrT"] {
         let mut effect = valid.clone();
         effect.items.retain(|(id, _)| !id.is(missing));
         invalid.push(effect);
@@ -113,7 +141,7 @@ fn halftone_pattern_unknown_or_malformed_descriptors_stay_verbatim() {
 /// Keeps a whole Gallery stack opaque when a Halftone entry has an unfamiliar class ID.
 #[test]
 fn halftone_pattern_unknown_nested_class_stays_verbatim() {
-    let valid = native_effect("Dt  ", 2, 5);
+    let valid = native_effect("ScrD", 2, 5);
     let mut unknown = valid.clone();
     unknown.class_id = Id::new("Xxxx");
     for effects in [vec![unknown.clone()], vec![valid.clone(), unknown.clone()], vec![unknown, valid]] {
@@ -130,7 +158,7 @@ fn halftone_pattern_unknown_nested_class_stays_verbatim() {
 /// which a save would otherwise drop.
 #[test]
 fn halftone_pattern_unknown_outer_setting_stays_verbatim() {
-    let valid = native_effect("Dt  ", 2, 5);
+    let valid = native_effect("ScrD", 2, 5);
     let gallery = Descriptor::new(GALLERY_CLASS).with("GEfs", Value::List(vec![Value::Descriptor(valid)])).with("futureSetting", Value::Integer(7));
     let item = native_item(gallery);
     let parsed = Descriptor::from_bytes(&item.to_bytes()).unwrap();
diff --git a/crates/io/src/smart_map/import.rs b/crates/io/src/smart_map/import.rs
index f59cf94638..f8f3f50e3f 100644
--- a/crates/io/src/smart_map/import.rs
+++ b/crates/io/src/smart_map/import.rs
@@ -1,6 +1,9 @@
 use super::export::{CELL_SIZE, blend_options, is_meta, pi, rgbc, whole};
 use super::placed::enumv;
-use super::*;
+use super::{
+    BlendMode, Descriptor, Id, J, Map, ReferenceItem, SmartFilter, UNSUPPORTED_FILTER, UnicodeString, Value, bool_or, camera_raw, displace, enum_of, get_desc,
+    hue_sat, json, num, perspective_warp, text_of,
+};
 
 // ---------- the filters we model ----------
 
@@ -464,12 +467,20 @@ const WAVE_KEYS: [&str; 10] = ["Wvtp", "NmbG", "WLMn", "WLMx", "AmMn", "AmMx", "
 /// Tiles its colours).
 pub(super) fn known_params(class: &str, f: Option<&Descriptor>, item: &Descriptor) -> Option<(&'static str, J)> {
     let k = KNOWN.iter().find(|k| k.class == class)?;
-    let params = match (class, f) {
-        ("adaptCorrect" | "Invr", None) => json!({}),
-        (c, None) if NO_OPTIONS.contains(&c) => json!({}),
-        (_, None) => return None,
-        // Exactly the settings Photoshop writes (and we write back); an extra or repeated one keeps
-        // the filter verbatim rather than lose it on save.
+    let params = match f {
+        None if class == "adaptCorrect" || class == "Invr" || NO_OPTIONS.contains(&class) => json!({}),
+        None => return None,
+        Some(f) => distort_filter_params(class, f)
+            .or_else(|| blur_filter_params(class, f))
+            .or_else(|| pixel_filter_params(class, f, item))
+            .or_else(|| stylize_filter_params(class, f, item))
+            .or_else(|| other_filter_params(class, f))?,
+    };
+    Some((k.command, params))
+}
+
+fn distort_filter_params(class: &str, f: &Descriptor) -> Option<J> {
+    Some(match (class, Some(f)) {
         ("Pnch", Some(f)) if exact_keys(f, &["Amnt"]) => json!({"amount": int(f, "Amnt")?}),
         ("Twrl", Some(f)) if exact_keys(f, &["Angl"]) => json!({"angle": int(f, "Angl")?}),
         ("Rple", Some(f)) if exact_keys(f, &["Amnt", "RplS"]) => json!({"amount": int(f, "Amnt")?, "size": enum_name(f, "RplS", "RplS", &RIPPLE_SIZE)?}),
@@ -499,6 +510,12 @@ pub(super) fn known_params(class: &str, f: Option<&Descriptor>, item: &Descripto
                 "seed": (int(f, "RndS")? as u32),
             })
         }
+        _ => return None,
+    })
+}
+
+fn blur_filter_params(class: &str, f: &Descriptor) -> Option<J> {
+    Some(match (class, Some(f)) {
         ("GsnB" | "boxblur" | "Mdn " | "HghP" | "Mxm " | "Mnm ", Some(f)) => json!({"radius": px(f, "Rds ")?}),
         ("MtnB", Some(f)) => json!({"angle": int(f, "Angl")?, "distance": px(f, "Dstn")?}),
         ("UnsM", Some(f)) => json!({"amount": px(f, "Amnt")?, "radius": px(f, "Rds ")?, "threshold": int(f, "Thsh")?}),
@@ -529,6 +546,12 @@ pub(super) fn known_params(class: &str, f: Option<&Descriptor>, item: &Descripto
             "method": enum_name(f, "BlrM", "BlrM", &RADIAL_METHOD)?,
             "quality": enum_name(f, "BlrQ", "BlrQ", &RADIAL_QUALITY)?,
         }),
+        _ => return None,
+    })
+}
+
+fn pixel_filter_params(class: &str, f: &Descriptor, item: &Descriptor) -> Option<J> {
+    Some(match (class, Some(f)) {
         ("Msc ", Some(f)) => json!({"cellSize": px(f, "ClSz")?}),
         ("Mztn", Some(f)) if only_keys(f, &["MztT"]) => json!({"type": enum_name(f, "MztT", "MztT", &MEZZOTINT_TYPES)?}),
         ("ClrH", Some(f)) => color_halftone_params(f)?,
@@ -551,6 +574,12 @@ pub(super) fn known_params(class: &str, f: Option<&Descriptor>, item: &Descripto
             }
             p
         }
+        _ => return None,
+    })
+}
+
+fn stylize_filter_params(class: &str, f: &Descriptor, item: &Descriptor) -> Option<J> {
+    Some(match (class, Some(f)) {
         ("Wnd ", Some(f)) => json!({
             "method": enum_from(f, "WndM", "WndM", &WIND_METHODS)?,
             "direction": enum_from(f, "Drct", "Drct", &WIND_DIRECTIONS)?,
@@ -564,6 +593,12 @@ pub(super) fn known_params(class: &str, f: Option<&Descriptor>, item: &Descripto
             "maskIncompleteBlocks": bool_at(f, "ExtM")?,
         }),
         ("Tls ", Some(f)) => tiles_params(f, item)?,
+        _ => return None,
+    })
+}
+
+fn other_filter_params(class: &str, f: &Descriptor) -> Option<J> {
+    Some(match (class, Some(f)) {
         ("Ofst", Some(f)) if only_keys(f, &["Hrzn", "Vrtc", "Fl  "]) => {
             json!({"horizontal": int(f, "Hrzn")?, "vertical": int(f, "Vrtc")?, "undefinedAreas": enum_from(f, "Fl  ", "FlMd", &OFFSET_FILL)?})
         }
@@ -578,10 +613,8 @@ pub(super) fn known_params(class: &str, f: Option<&Descriptor>, item: &Descripto
         ("Lvls", Some(f)) => levels_params(f)?,
         ("Crvs", Some(f)) => curves_params(f)?,
         _ => return None,
-    };
-    Some((k.command, params))
+    })
 }
-
 // ---------- Filter Gallery ----------
 //
 // Filter › Filter Gallery stores its effect stack in a `GEfc` filter (filterID `GEfc`). Photoshop
@@ -611,11 +644,11 @@ pub(super) struct GalleryCode {
 
 pub(super) const GALLERY_EFFECTS: [GalleryCode; 2] = [
     GalleryCode { key: "chrome", code: "Chrm", settings: &[("Dtl ", "detail"), ("Smth", "smoothness")] },
-    GalleryCode { key: "halftonePattern", code: "HlfS", settings: &[("Sz  ", "size"), ("Cntr", "contrast")] },
+    GalleryCode { key: "halftonePattern", code: "HlfS", settings: &[("HlSz", "size"), ("Cntr", "contrast")] },
 ];
 
-// Photoshop 27.11 writes Halftone Pattern's shape as an enum, not a numeric choice index.
-const HALFTONE_PATTERNS: [(&[u8; 4], &str); 3] = [(b"Dt  ", "dot"), (b"Crc ", "circle"), (b"Ln  ", "line")];
+// Halftone Pattern's shape is a `ScrT` enum (Filter Gallery terminology: Dot, Circle, Line).
+const HALFTONE_PATTERNS: [(&[u8; 4], &str); 3] = [(b"ScrD", "dot"), (b"ScrC", "circle"), (b"ScrL", "line")];
 
 /// An `RGBC` descriptor (0–255 channels) as straight `[r, g, b, a]`, 0–1.
 fn rgbc_colour(d: &Descriptor) -> Option<J> {
@@ -683,18 +716,18 @@ fn gallery_params(item: &Descriptor, f: &Descriptor) -> Option<J> {
                 return None;
             }
             if !e.class_id.is(GALLERY_CLASS)
-                || !only_keys(e, &["GEfk", "Sz  ", "Cntr", "Ptrn", "GELv"])
+                || !only_keys(e, &["GEfk", "HlSz", "Cntr", "ScrT", "GELv"])
                 || !matches!(e.get("GEfk"), Some(Value::Enumerated { type_id, .. }) if type_id.is("GEft"))
                 || e.get("GELv").is_some_and(|v| !matches!(v, Value::Boolean(_)))
             {
                 return None;
             }
-            int_in(e, "Sz  ", 1, 12)?;
+            int_in(e, "HlSz", 1, 12)?;
             int_in(e, "Cntr", 0, 50)?;
-            params.insert("patternType".into(), json!(enum_name(e, "Ptrn", "HlfT", &HALFTONE_PATTERNS)?));
+            params.insert("patternType".into(), json!(enum_name(e, "ScrT", "ScrT", &HALFTONE_PATTERNS)?));
         }
         for (k, v) in &e.items {
-            if k.is("GEfk") || k.is("GELv") || g.key == "halftonePattern" && k.is("Ptrn") {
+            if k.is("GEfk") || k.is("GELv") || g.key == "halftonePattern" && k.is("ScrT") {
                 continue;
             }
             let (_, ours) = g.settings.iter().find(|(psd, _)| k.is(psd))?;
@@ -759,9 +792,9 @@ pub(super) fn gallery_item(f: &SmartFilter) -> Result<Descriptor, String> {
         let defaults = photocraft_algo::GalleryFilter::from_key(key).map(photocraft_algo::GalleryEffect::new);
         let settings: Vec<(&str, Value)> = if key == "halftonePattern" {
             vec![
-                ("Sz  ", whole(pf_range(params, "size", 1.0, 1.0, 12.0)?, (1, 12), "size")?),
+                ("HlSz", whole(pf_range(params, "size", 1.0, 1.0, 12.0)?, (1, 12), "size")?),
                 ("Cntr", whole(pf_range(params, "contrast", 5.0, 0.0, 50.0)?, (0, 50), "contrast")?),
-                ("Ptrn", enum_param(params, "patternType", "dot", "HlfT", &HALFTONE_PATTERNS)?),
+                ("ScrT", enum_param(params, "patternType", "dot", "ScrT", &HALFTONE_PATTERNS)?),
             ]
         } else {
             g.settings.iter().map(|(psd, ours)| (*psd, pi(params, ours, defaults.as_ref().map_or(0.0, |x| f64::from(x.get(ours)))))).collect()
diff --git a/crates/io/src/smart_map/placed.rs b/crates/io/src/smart_map/placed.rs
index 9bdb52bc1c..20079f9840 100644
--- a/crates/io/src/smart_map/placed.rs
+++ b/crates/io/src/smart_map/placed.rs
@@ -1,5 +1,5 @@
 use super::export::{set, set_before, unit};
-use super::*;
+use super::{Affine, BezierMesh, Descriptor, Id, ObjectArray, UnicodeString, Value, VersionedDescriptor, Warp, WarpStyle, get_desc, num, text_of};
 
 /// Everything needed to write the placed-layer blocks of a smart object.
 #[derive(Clone, Debug)]
diff --git a/crates/io/src/smart_map/tests.rs b/crates/io/src/smart_map/tests.rs
index 1bbd5bd094..22808b08a2 100644
--- a/crates/io/src/smart_map/tests.rs
+++ b/crates/io/src/smart_map/tests.rs
@@ -1470,7 +1470,8 @@ fn stylize_and_pixelate_filters_open_from_photoshop_shapes() {
         fltr("filter.stylize.diffuse", json!({"mode": "normal", "seed": 7})),
         Some(Value::Descriptor(Descriptor::new("Dfs ").with("Md  ", enumv("DfsM", "Nrml"))))
     );
-    // Defaults and out-of-range values are written in Photoshop's ranges.
+    // Defaults and out-of-range values are written as the engine renders them: clamped to
+    // Photoshop's ranges, and a non-number as the default.
     assert_eq!(
         fltr("filter.stylize.traceContour", json!({})),
         Some(Value::Descriptor(Descriptor::new("TrcC").with("Lvl ", Value::Integer(128)).with("Edg ", enumv("CntE", "Lwr "))))
@@ -1478,17 +1479,28 @@ fn stylize_and_pixelate_filters_open_from_photoshop_shapes() {
     assert_eq!(fltr("filter.pixelate.crystallize", json!({})), Some(Value::Descriptor(Descriptor::new("Crst").with("ClSz", Value::Integer(10)))));
     assert_eq!(fltr("filter.pixelate.pointillize", json!({})), Some(Value::Descriptor(Descriptor::new("Pntl").with("ClSz", Value::Integer(5)))));
     assert_eq!(
-        fltr("filter.pixelate.crystallize", json!({"cellSize": 1e9})),
+        fltr("filter.pixelate.crystallize", json!({"cellSize": 300})),
         Some(Value::Descriptor(Descriptor::new("Crst").with("ClSz", Value::Integer(300))))
     );
+    assert_eq!(fltr("filter.pixelate.pointillize", json!({"cellSize": 2.6})), Some(Value::Descriptor(Descriptor::new("Pntl").with("ClSz", Value::Integer(3)))));
     assert_eq!(
-        fltr("filter.pixelate.pointillize", json!({"cellSize": "big"})),
-        Some(Value::Descriptor(Descriptor::new("Pntl").with("ClSz", Value::Integer(5))))
-    );
-    assert_eq!(
-        fltr("filter.stylize.traceContour", json!({"level": -40, "edge": "upper"})),
+        fltr("filter.stylize.traceContour", json!({"level": 0, "edge": "upper"})),
         Some(Value::Descriptor(Descriptor::new("TrcC").with("Lvl ", Value::Integer(0)).with("Edg ", enumv("CntE", "Upr "))))
     );
+    assert_eq!(
+        fltr("filter.stylize.traceContour", json!({"level": 255.4})),
+        Some(Value::Descriptor(Descriptor::new("TrcC").with("Lvl ", Value::Integer(255)).with("Edg ", enumv("CntE", "Lwr "))))
+    );
+    let crst = |v: i32| Some(Value::Descriptor(Descriptor::new("Crst").with("ClSz", Value::Integer(v))));
+    let pntl = |v: i32| Some(Value::Descriptor(Descriptor::new("Pntl").with("ClSz", Value::Integer(v))));
+    let trcc = |v: i32, e: &str| Some(Value::Descriptor(Descriptor::new("TrcC").with("Lvl ", Value::Integer(v)).with("Edg ", enumv("CntE", e))));
+    assert_eq!(fltr("filter.pixelate.crystallize", json!({"cellSize": 1e9})), crst(300));
+    assert_eq!(fltr("filter.pixelate.crystallize", json!({"cellSize": 2.4})), crst(3));
+    assert_eq!(fltr("filter.pixelate.pointillize", json!({"cellSize": "big"})), pntl(5));
+    assert_eq!(fltr("filter.pixelate.pointillize", json!({"cellSize": null})), pntl(5));
+    assert_eq!(fltr("filter.stylize.traceContour", json!({"level": -40, "edge": "upper"})), trcc(0, "Upr "));
+    assert_eq!(fltr("filter.stylize.traceContour", json!({"level": 255.5})), trcc(255, "Lwr "));
+    assert_eq!(fltr("filter.stylize.traceContour", json!({"level": [128]})), trcc(128, "Lwr "));
 }
 
 #[test]
diff --git a/crates/io/src/svg.rs b/crates/io/src/svg.rs
index 98161732de..27b536d996 100644
--- a/crates/io/src/svg.rs
+++ b/crates/io/src/svg.rs
@@ -286,32 +286,40 @@ fn font_resolver() -> usvg::FontResolver<'static> {
 /// Parse options for an untrusted drawing. `<image href>` resolves only `data:` URLs: a file path
 /// or relative href is never read, so opening an SVG cannot pull local files (`/etc/...`,
 /// `~/.ssh/...`) into the document. Embedded SVG images get no `<image>` resolution at all
-/// (`usvg` already blanks it for sub-SVGs).
-fn options(fontdb: Arc<usvg::fontdb::Database>) -> usvg::Options<'static> {
+/// (`usvg` already blanks it for sub-SVGs). An embedded SVG may nest `depth_left` levels: it is
+/// parsed on top of the drawing's own recursion, so the two depths share [`MAX_XML_DEPTH`].
+fn options(fontdb: Arc<usvg::fontdb::Database>, depth_left: usize) -> usvg::Options<'static> {
     let default_resolver = usvg::ImageHrefResolver::default_data_resolver();
     let resolve_data: usvg::ImageHrefDataResolverFn<'static> = Box::new(move |mime, data, opts| {
         // Reject embedded images whose decoded RGBA storage would exceed the budget before
         // resvg (which allocates the full intrinsic image before any destination scaling) ever
         // sees them. Formats without a cheap header probe fall through unchanged; their decode
         // path is bounded elsewhere or accepted as-is, matching the previous behavior.
-        if let Some(probed) = embedded_image_dimensions(mime, &data) {
+        let probed = embedded_image_dimensions(mime, &data);
+        if let Some(probed) = probed {
             let (w, h) = probed?;
             let decoded = u64::from(w).saturating_mul(u64::from(h)).saturating_mul(4);
             if decoded > MAX_EMBEDDED_IMAGE_BYTES {
                 return None;
             }
         }
-        // An embedded `image/svg+xml` value can itself be gzip-compressed (SVGZ-in-data-URL).
-        // The default resolver's sub-SVG loader checks for the gzip magic and decompresses
-        // again with no byte limit of its own. Apply our bounded inflate first: if the data is
-        // gzip-compressed, hand the default resolver the already-decompressed (and
-        // size-checked) bytes, which no longer start with the gzip magic, so it parses them
-        // directly instead of decompressing a second time.
-        if (mime == "image/svg+xml" || mime == "text/plain") && data.starts_with(&[0x1f, 0x8b]) {
-            return match inflate(&data) {
-                Ok(xml) if !xml.starts_with(&[0x1f, 0x8b]) => default_resolver("image/svg+xml", std::sync::Arc::new(xml.into_owned()), opts),
-                _ => None,
+        // An embedded SVG (`image/svg+xml`, or `text/plain` that isn't one of the raster
+        // formats probed above) is parsed by the default resolver with none of `parse_with`'s
+        // checks, so they run here. It can itself be gzip-compressed (SVGZ-in-data-URL), and the
+        // default resolver's sub-SVG loader would decompress again with no byte limit of its
+        // own: hand it our bounded inflate's output instead, which no longer starts with the
+        // gzip magic. Nesting deeper than `depth_left` drops the image rather than overflowing
+        // the parser's stack.
+        if mime == "image/svg+xml" || (mime == "text/plain" && probed.is_none()) {
+            let (mime, xml) = match inflate(&data) {
+                Ok(std::borrow::Cow::Borrowed(_)) => (mime, Arc::clone(&data)),
+                Ok(std::borrow::Cow::Owned(xml)) if !xml.starts_with(&[0x1f, 0x8b]) => ("image/svg+xml", Arc::new(xml)),
+                _ => return None,
             };
+            if nesting_depth(&xml, depth_left) > depth_left {
+                return None;
+            }
+            return default_resolver(mime, xml, opts);
         }
         default_resolver(mime, data, opts)
     });
@@ -344,13 +352,14 @@ fn parse(bytes: &[u8]) -> Result<Parsed, IoError> {
 /// [`parse`] with the font database `fonts` supplies (the tests hand in an empty one).
 fn parse_with(bytes: &[u8], fonts: fn() -> Arc<usvg::fontdb::Database>) -> Result<Parsed, IoError> {
     let xml = inflate(bytes)?;
-    if nesting_depth(&xml, MAX_XML_DEPTH) > MAX_XML_DEPTH {
+    let depth = nesting_depth(&xml, MAX_XML_DEPTH);
+    if depth > MAX_XML_DEPTH {
         return Err(IoError::Svg(format!("elements are nested more than {MAX_XML_DEPTH} levels deep")));
     }
     let has_text = xml.windows(4).any(|w| w == b"text");
     let fontdb = if has_text { fonts() } else { Arc::new(usvg::fontdb::Database::new()) };
     let fontless_text = has_text && fontdb.faces().next().is_none();
-    let opt = options(fontdb);
+    let opt = options(fontdb, MAX_XML_DEPTH.saturating_sub(depth));
     // Parse the already-bounded-and-decoded text with from_str, not from_data: from_data
     // re-checks the gzip magic and would decompress a second time without our size limit if
     // the inflated content happened to start with a nested gzip stream.
@@ -367,7 +376,7 @@ fn inflate(bytes: &[u8]) -> Result<std::borrow::Cow<'_, [u8]>, IoError> {
         return Ok(std::borrow::Cow::Borrowed(bytes));
     }
     let mut out = Vec::new();
-    let mut reader = flate2::read::MultiGzDecoder::new(bytes).take(MAX_INFLATED_BYTES.saturating_add(1));
+    let mut reader = flate2::bufread::MultiGzDecoder::new(bytes).take(MAX_INFLATED_BYTES.saturating_add(1));
     reader.read_to_end(&mut out).map_err(|e| IoError::Svg(format!("the compressed SVG couldn't be inflated: {e}")))?;
     if u64::try_from(out.len()).unwrap_or(u64::MAX) > MAX_INFLATED_BYTES {
         return Err(IoError::Svg(format!("the compressed SVG inflates past {} MB", MAX_INFLATED_BYTES >> 20)));
@@ -379,7 +388,7 @@ fn inflate(bytes: &[u8]) -> Result<std::borrow::Cow<'_, [u8]>, IoError> {
 /// then `limit + 1`). Comments, CDATA sections, processing instructions and the DOCTYPE add
 /// nothing; quoted attribute values may hold `>` or `/>`. Malformed markup is only counted
 /// loosely: the parser rejects it afterwards.
-fn nesting_depth(xml: &[u8], limit: usize) -> usize {
+pub(crate) fn nesting_depth(xml: &[u8], limit: usize) -> usize {
     let after = |from: usize, pat: &[u8]| -> usize {
         xml.get(from..).and_then(|s| s.windows(pat.len()).position(|w| w == pat)).map_or(xml.len(), |p| from.saturating_add(p).saturating_add(pat.len()))
     };
@@ -498,14 +507,47 @@ fn import_parsed_with_budget(name: &str, parsed: Parsed, max_group_depth: usize,
 pub fn rasterize(bytes: &[u8], scale: f32) -> Result<photocraft_compose::Buffer, IoError> {
     let tree = parse(bytes)?.tree;
     let cv = canvas(&tree, &mut Vec::new());
-    let k = cv.scale * scale.clamp(1.0 / 64.0, 64.0);
+    let pixmap = render(&tree, cv.scale * scale.clamp(1.0 / 64.0, 64.0))?;
+    let rect = Rect::new(0, 0, pixmap.width() as i32, pixmap.height() as i32);
+    let px = pixmap.pixels().iter().map(|p| rgba(p.demultiply())).collect();
+    Ok(photocraft_compose::Buffer { rect, px })
+}
+
+/// The whole drawing at one pixel per SVG unit, scaled down to fit [`MAX_SIDE`] a side and
+/// [`MAX_RASTER_PIXELS`] in all: its width, height and straight-alpha RGBA8 pixels. Paste uses it
+/// for a drawing copied as SVG markup.
+pub fn rasterize_rgba8(bytes: &[u8]) -> Result<(u32, u32, Vec<u8>), IoError> {
+    let tree = parse(bytes)?.tree;
+    let cv = canvas(&tree, &mut Vec::new());
+    let (w, h) = (f64::from(tree.size().width() * cv.scale), f64::from(tree.size().height() * cv.scale));
+    // The largest k ≤ 1 with (w·k + 2)(h·k + 2) ≤ the limit: `render` rounds each side up, and
+    // f32 rounding can add one more pixel.
+    let max = MAX_RASTER_PIXELS as f64;
+    let fit = if (w + 2.0) * (h + 2.0) <= max {
+        1.0
+    } else {
+        let (a, b) = (w * h, 2.0 * (w + h));
+        (-b + (b * b - 4.0 * a * (4.0 - max)).sqrt()) / (2.0 * a)
+    };
+    let pixmap = render(&tree, cv.scale * fit as f32)?;
+    let px = pixmap
+        .pixels()
+        .iter()
+        .flat_map(|p| {
+            let c = p.demultiply();
+            [c.red(), c.green(), c.blue(), c.alpha()]
+        })
+        .collect();
+    Ok((pixmap.width(), pixmap.height(), px))
+}
+
+/// `tree` drawn at `k` pixels per SVG unit on a transparent pixmap whose sides round up.
+fn render(tree: &usvg::Tree, k: f32) -> Result<tiny_skia::Pixmap, IoError> {
     let side = |v: f32| ((v * k).ceil() as u32).max(1);
     let (w, h) = (side(tree.size().width()), side(tree.size().height()));
     let mut pixmap = pixmap(w, h).ok_or_else(|| IoError::Svg(format!("{w} × {h} px is too large to rasterise")))?;
-    resvg::render(&tree, tiny_skia::Transform::from_scale(k, k), &mut pixmap.as_mut());
-    let rect = Rect::new(0, 0, w as i32, h as i32);
-    let px = pixmap.pixels().iter().map(|p| rgba(p.demultiply())).collect();
-    Ok(photocraft_compose::Buffer { rect, px })
+    resvg::render(tree, tiny_skia::Transform::from_scale(k, k), &mut pixmap.as_mut());
+    Ok(pixmap)
 }
 
 /// A transparent pixmap, or `None` past [`MAX_RASTER_PIXELS`].
@@ -672,7 +714,7 @@ impl Conv {
                     }
                     return;
                 }
-                let mut l = Layer::new(self.name(g.id(), 1), LayerContent::Group(Group { children, expanded: false, artboard: None }));
+                let mut l = Layer::new(self.name(g.id(), 1), LayerContent::Group(Group { children, expanded: false, artboard: None, frame_stroke: None }));
                 l.opacity = g.opacity().get();
                 l.blend = blend(g.blend_mode());
                 l.vector_mask = clip;
@@ -699,7 +741,7 @@ impl Conv {
                 } else {
                     t.id().to_string()
                 };
-                out.push(Layer::new(name, LayerContent::Group(Group { children, expanded: false, artboard: None })));
+                out.push(Layer::new(name, LayerContent::Group(Group { children, expanded: false, artboard: None, frame_stroke: None })));
             }
         }
     }
diff --git a/crates/io/src/svg/tests.rs b/crates/io/src/svg/tests.rs
index 7127738daa..426962fa9c 100644
--- a/crates/io/src/svg/tests.rs
+++ b/crates/io/src/svg/tests.rs
@@ -414,9 +414,31 @@ fn huge_drawings_scale_to_the_side_limit() {
     assert_eq!(w.len(), 1);
 }
 
+/// A pasted drawing is one pixel per SVG unit, and a drawing past the pixel limit is scaled
+/// down to fit it, keeping its proportions, instead of failing.
+#[test]
+fn rgba8_renders_at_its_own_size_within_the_pixel_limit() {
+    let svg = br##"<svg xmlns="http://www.w3.org/2000/svg" width="40" height="20"><rect width="20" height="20" fill="#ff0000"/></svg>"##;
+    let (w, h, px) = rasterize_rgba8(svg).unwrap();
+    assert_eq!((w, h, px.len()), (40, 20, 40 * 20 * 4));
+    assert_eq!(px[..4], [255, 0, 0, 255], "the rectangle");
+    assert_eq!(px[(10 * 40 + 30) * 4..][..4], [0, 0, 0, 0], "transparent beside it");
+    for (side_w, side_h) in [(10_000u32, 5_000u32), (20_000, 20_000), (20_000, 2_000)] {
+        let svg = format!("<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"{side_w}\" height=\"{side_h}\"/>");
+        let (w, h, px) = rasterize_rgba8(svg.as_bytes()).unwrap();
+        let pixels = u64::from(w) * u64::from(h);
+        assert!(pixels <= MAX_RASTER_PIXELS && pixels > MAX_RASTER_PIXELS / 2, "{side_w} × {side_h} became {w} × {h}");
+        assert!(w <= MAX_SIDE && h <= MAX_SIDE, "{w} × {h}");
+        let (aspect, want) = (f64::from(w) / f64::from(h), f64::from(side_w) / f64::from(side_h));
+        assert!((aspect / want - 1.0).abs() < 0.01, "{w} × {h} keeps {side_w} × {side_h}");
+        assert_eq!(px.len() as u64, pixels * 4);
+    }
+    assert!(rasterize_rgba8(b"<svg xmlns=\"http://www.w3.org/2000/svg\"><rect").is_err(), "malformed markup is an error");
+}
+
 #[test]
 fn resolve_data_rejects_oversized_and_malformed_embedded_png_and_webp() {
-    let opt = options(Arc::new(usvg::fontdb::Database::new()));
+    let opt = options(Arc::new(usvg::fontdb::Database::new()), MAX_XML_DEPTH);
     let resolve = &opt.image_href_resolver.resolve_data;
     let img = photocraft_codecs::Image::from_u8(2, 2, photocraft_codecs::ChannelLayout::Rgb, vec![255; 12]).unwrap();
     let valid_png = photocraft_codecs::encode(&img, photocraft_codecs::Format::Png, &Default::default()).unwrap();
@@ -448,7 +470,7 @@ fn jpeg_dimensions_come_from_the_frame_header_and_oversized_jpegs_are_refused()
     assert_eq!(jpeg_dimensions(&jpeg(40_000, 30_000)), Some((30_000, 40_000)));
     assert_eq!(jpeg_dimensions(&[0xFF, 0xD8, 0xFF, 0xDA, 0, 2]), None);
     assert_eq!(jpeg_dimensions(&[0xFF, 0xD8]), None);
-    let opt = options(Arc::new(usvg::fontdb::Database::new()));
+    let opt = options(Arc::new(usvg::fontdb::Database::new()), MAX_XML_DEPTH);
     let resolve = &opt.image_href_resolver.resolve_data;
     // 1.2 billion pixels would be 4.8 GB of RGBA before resvg scaled anything down.
     assert!(resolve("image/jpeg", Arc::new(jpeg(40_000, 30_000)), &opt).is_none());
@@ -463,7 +485,7 @@ fn resolve_data_rejects_nested_gzip_and_handles_text_plain_svgz() {
         e.write_all(bytes).unwrap();
         e.finish().unwrap()
     }
-    let opt = options(Arc::new(usvg::fontdb::Database::new()));
+    let opt = options(Arc::new(usvg::fontdb::Database::new()), MAX_XML_DEPTH);
     let resolve = &opt.image_href_resolver.resolve_data;
     let svg = b"<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"4\" height=\"4\"><rect width=\"4\" height=\"4\"/></svg>";
     let once = gz(svg);
diff --git a/crates/io/src/tiff_layers.rs b/crates/io/src/tiff_layers.rs
index 2949a551cc..ba35e53fed 100644
--- a/crates/io/src/tiff_layers.rs
+++ b/crates/io/src/tiff_layers.rs
@@ -118,7 +118,7 @@ pub(crate) fn import_layered(name: &str, img: &Image, layers: &[u8]) -> Result<I
     }
     let channels = u16::try_from(img.layout().channels().saturating_add(added)).map_err(|_| IoError::Unsupported("too many channels".into()))?;
     let header = Header::new(isd.version, w, h, channels, depth, mode);
-    let image_data = ImageData { compression: Compression::Raw, data };
+    let image_data = ImageData::new(Compression::Raw, data);
     let mut file = isd.into_psd(header, resources, image_data);
     // Empty `Patt` and the default filter mask are written so Photoshop's block list matches
     // a file it saved. They carry nothing the document stores, so they are not kept: a
@@ -233,10 +233,9 @@ pub(crate) fn export_layered(doc: &Document, opts: &ExportOptions, ctl: &photocr
     // TIFF already round-trips as.
     // Layer data is written PSD-style ("Adobe Photoshop Document Data Block", 4-byte lengths), as
     // Photoshop writes it: Photoshop does not read the PSB-style header ("... Data V0002") in a
-    // TIFF and opens only the composite, as one locked Background. The exporter's size estimate
-    // counts layer planes uncompressed, so a document with many canvas-sized layers passes 2 GB
-    // while its real layer data is a small fraction of that; it is not used here. PSB-style data
-    // is written only past 30000 px, when asked for, or when a length really overflows 32 bits.
+    // TIFF and opens only the composite, as one locked Background. The exporter's switch to PSB
+    // on the encoded file size is not used here: PSB-style data is written only past 30000 px,
+    // when asked for, or when a length really overflows 32 bits.
     let user_channels = !doc.channels.is_empty() || doc.quick_mask.is_some();
     let force_psb = opts.force_psb || big;
     let psd_opts = PsdExportOptions {
@@ -970,11 +969,11 @@ mod tests {
 
     use crate::{ExportOptions, export};
 
-    /// Hidden solid fills on a 2048² canvas: the PSD size estimate counts each one as a
-    /// canvas-sized plane (16 MiB at 8 bits), so 140 of them pass 2 GB, while their real pixels
-    /// (the cached rendering, pruned to nothing) take almost no space. A layered TIFF of such a
-    /// document must still carry PSD-style layer data: Photoshop does not read the PSB-style
-    /// header in a TIFF and opens only the composite, as one locked Background.
+    /// Hidden solid fills on a 2048² canvas: counted as canvas-sized planes (16 MiB each at 8
+    /// bits), 140 of them pass 2 GB, while their real pixels (the cached rendering, pruned to
+    /// nothing) take almost no space. A layered TIFF of such a document must still carry
+    /// PSD-style layer data: Photoshop does not read the PSB-style header in a TIFF and opens only
+    /// the composite, as one locked Background.
     fn many_cheap_fills() -> Document {
         let mut doc = Document::new("many fills", photocraft_geom::Size::new(2048, 2048), photocraft_color::ColorMode::Rgb, photocraft_color::SampleType::U8);
         for i in 0..140 {
@@ -990,7 +989,6 @@ mod tests {
     #[test]
     fn layered_tiff_ignores_the_uncompressed_size_estimate() {
         let doc = many_cheap_fills();
-        assert!(crate::psd_export::psd_size_exceeds_limit(&doc), "the fixture must pass the 2 GB estimate");
 
         let r = export(&doc, "x.tif", &ExportOptions { tiff_layers: true, ..Default::default() }).unwrap();
         let (_, layers) = photocraft_codecs::tiff_photoshop_tags(&r.bytes);
@@ -1000,9 +998,9 @@ mod tests {
         let back = crate::import("x.tif", &r.bytes).unwrap().document;
         assert_eq!(back.layers.len(), doc.layers.len());
 
-        // A .psd save still switches to PSB on the estimate, as before.
+        // A .psd save switches to PSB on the encoded size, which is small here: it stays PSD.
         let psd = export(&doc, "x.psd", &ExportOptions::default()).unwrap();
-        assert_eq!(psd.bytes.get(4..6), Some(&[0u8, 2][..]), "PSD saves keep the size-estimate switch");
+        assert_eq!(psd.bytes.get(4..6), Some(&[0u8, 1][..]), "PSD saves switch on the encoded size");
     }
 
     #[test]
diff --git a/crates/io/src/xcf.rs b/crates/io/src/xcf.rs
index 5ec8b5edb2..e9a6b92a21 100644
--- a/crates/io/src/xcf.rs
+++ b/crates/io/src/xcf.rs
@@ -593,49 +593,19 @@ fn write_pixels(surface: &mut Surface, px: &Pixels, x: i32, y: i32) -> Result<()
     Ok(())
 }
 
-/// Imports an XCF file (already inflated when it was gzipped).
-pub(crate) fn import(name: &str, bytes: &[u8], ctl: &Interrupt<'_>) -> Result<ImportResult> {
-    if !is_xcf(bytes) {
-        return Err(invalid("not an XCF file"));
-    }
-    let mut c = Cursor { b: bytes, pos: MAGIC.len(), wide: false };
-    let tag = c.take(5)?;
-    let version = match tag {
-        b"file\0" => 0,
-        [b'v', a, b, d, 0] if a.is_ascii_digit() && b.is_ascii_digit() && d.is_ascii_digit() => {
-            u32::from(a - b'0') * 100 + u32::from(b - b'0') * 10 + u32::from(d - b'0')
-        }
-        _ => return Err(invalid("unknown XCF version tag")),
-    };
-    c.wide = version >= 11;
-    let mut warnings = Warnings::default();
-    if version > KNOWN_VERSION {
-        warnings.note(&format!("XCF version {version} is newer than this reader (version {KNOWN_VERSION}); unknown parts were skipped"));
-    }
-    let (w, h, base_type) = (c.u32()?, c.u32()?, c.u32()?);
-    if w == 0 || h == 0 || w > MAX_SIDE || h > MAX_SIDE {
-        return Err(invalid(format!("canvas {w}x{h} must be 1 to {MAX_SIDE} pixels a side")));
-    }
-    if (w as usize).saturating_mul(h as usize).saturating_mul(16) > MAX_PIXEL_BYTES {
-        return Err(invalid("the canvas exceeds the 1 GiB pixel limit"));
-    }
-    let precision = if version >= 4 { Precision::from_header(version, c.u32()?)? } else { Precision::GAMMA8 };
-    let mode = match base_type {
-        0 => ColorMode::Rgb,
-        1 => ColorMode::Grayscale,
-        2 => ColorMode::Rgb,
-        t => return Err(invalid(format!("unknown image type {t}"))),
-    };
-    let depth = precision.depth();
-    if base_type == 2 {
-        warnings.note("the indexed image opens as RGB");
-    }
-    if !precision.float && precision.bytes == 4 {
-        warnings.note("32-bit integer samples open as 16-bit");
-    }
+struct ImageMetadata {
+    compression: Compression,
+    colormap: Vec<[u8; 3]>,
+    resolution: Option<(f32, f32)>,
+    guides: Vec<(i32, u8)>,
+    icc: Option<Vec<u8>>,
+    comment: Option<String>,
+    path_count: usize,
+}
 
+fn read_image_metadata(c: &mut Cursor<'_>) -> Result<ImageMetadata> {
     // Image properties.
-    let image_props = props(&mut c)?;
+    let image_props = props(c)?;
     let mut compression = Compression::None;
     let mut colormap = Vec::new();
     let mut resolution = None;
@@ -683,6 +653,52 @@ pub(crate) fn import(name: &str, bytes: &[u8], ctl: &Interrupt<'_>) -> Result<Im
         }
     }
 
+    Ok(ImageMetadata { compression, colormap, resolution, guides, icc, comment, path_count })
+}
+
+/// Imports an XCF file (already inflated when it was gzipped).
+pub(crate) fn import(name: &str, bytes: &[u8], ctl: &Interrupt<'_>) -> Result<ImportResult> {
+    if !is_xcf(bytes) {
+        return Err(invalid("not an XCF file"));
+    }
+    let mut c = Cursor { b: bytes, pos: MAGIC.len(), wide: false };
+    let tag = c.take(5)?;
+    let version = match tag {
+        b"file\0" => 0,
+        [b'v', a, b, d, 0] if a.is_ascii_digit() && b.is_ascii_digit() && d.is_ascii_digit() => {
+            u32::from(a - b'0') * 100 + u32::from(b - b'0') * 10 + u32::from(d - b'0')
+        }
+        _ => return Err(invalid("unknown XCF version tag")),
+    };
+    c.wide = version >= 11;
+    let mut warnings = Warnings::default();
+    if version > KNOWN_VERSION {
+        warnings.note(&format!("XCF version {version} is newer than this reader (version {KNOWN_VERSION}); unknown parts were skipped"));
+    }
+    let (w, h, base_type) = (c.u32()?, c.u32()?, c.u32()?);
+    if w == 0 || h == 0 || w > MAX_SIDE || h > MAX_SIDE {
+        return Err(invalid(format!("canvas {w}x{h} must be 1 to {MAX_SIDE} pixels a side")));
+    }
+    if (w as usize).saturating_mul(h as usize).saturating_mul(16) > MAX_PIXEL_BYTES {
+        return Err(invalid("the canvas exceeds the 1 GiB pixel limit"));
+    }
+    let precision = if version >= 4 { Precision::from_header(version, c.u32()?)? } else { Precision::GAMMA8 };
+    let mode = match base_type {
+        0 => ColorMode::Rgb,
+        1 => ColorMode::Grayscale,
+        2 => ColorMode::Rgb,
+        t => return Err(invalid(format!("unknown image type {t}"))),
+    };
+    let depth = precision.depth();
+    if base_type == 2 {
+        warnings.note("the indexed image opens as RGB");
+    }
+    if !precision.float && precision.bytes == 4 {
+        warnings.note("32-bit integer samples open as 16-bit");
+    }
+
+    let ImageMetadata { compression, colormap, resolution, guides, icc, comment, mut path_count } = read_image_metadata(&mut c)?;
+
     let mut layer_ptrs = Vec::new();
     loop {
         let p = c.ptr()?;
@@ -814,6 +830,12 @@ pub(crate) fn import(name: &str, bytes: &[u8], ctl: &Interrupt<'_>) -> Result<Im
     if path_count > 0 {
         image.warnings.note(&format!("{path_count} path(s) were not imported"));
     }
+    add_document_warnings(&mut image, &document, precision, linear_compositing);
+    ctl.progress(1.0);
+    Ok(ImportResult { document, warnings: image.warnings.finish(), source_read_only: true, preview_only: false })
+}
+
+fn add_document_warnings(image: &mut Image<'_>, document: &Document, precision: Precision, linear_compositing: bool) {
     // GIMP clips a layer in any mode but Normal to the layers beneath it, so it shows nothing where
     // they are transparent; PhotoCraft (like Photoshop) shows it there. Only tell when there is
     // transparency to show through: a bottom layer that is not opaque.
@@ -832,8 +854,6 @@ pub(crate) fn import(name: &str, bytes: &[u8], ctl: &Interrupt<'_>) -> Result<Im
     if document.layers.is_empty() {
         image.warnings.note("the XCF file has no layers");
     }
-    ctl.progress(1.0);
-    Ok(ImportResult { document, warnings: image.warnings.finish(), source_read_only: true, preview_only: false })
 }
 
 /// Puts `node` where its item path says, under the groups already placed; a path that leads
diff --git a/crates/io/src/xml.rs b/crates/io/src/xml.rs
new file mode 100644
index 0000000000..13e02004d1
--- /dev/null
+++ b/crates/io/src/xml.rs
@@ -0,0 +1,156 @@
+//! XML parsing with a nesting cap. roxmltree recurses once per element level, so a few thousand
+//! nested tags (a 30 KB file or command param) overflow a 2 MB thread stack, an abort no guard
+//! can catch. Every roxmltree caller that reads a file or a param goes through [`parse`].
+
+use roxmltree::{Document, ParsingOptions};
+
+/// Deepest element nesting accepted, the same as for SVG drawings: real files stay far below.
+pub const MAX_DEPTH: usize = crate::svg::MAX_XML_DEPTH;
+
+/// Parses `text`, refusing nesting deeper than [`MAX_DEPTH`] before roxmltree sees it.
+///
+/// With `opts.allow_dtd` an internal DTD subset is refused too: its entities can expand into
+/// markup the depth check never sees. An external DOCTYPE (a public or system id) still parses.
+pub fn parse<'i>(text: &'i str, opts: ParsingOptions<'i>) -> Result<Document<'i>, String> {
+    if opts.allow_dtd && internal_subset(text.as_bytes()) {
+        return Err("internal DTD subsets aren't supported".into());
+    }
+    if crate::svg::nesting_depth(text.as_bytes(), MAX_DEPTH) > MAX_DEPTH {
+        return Err(format!("elements are nested more than {MAX_DEPTH} levels deep"));
+    }
+    Document::parse_with_options(text, opts).map_err(|e| e.to_string())
+}
+
+/// Does a DOCTYPE have an internal subset (`<!DOCTYPE x [ … ]>`)? Every `<!DOCTYPE` in the text
+/// is checked, not only the one a walk over the prolog reaches: a quoted `?>` in the XML
+/// declaration must not hide it. One inside a comment may be refused needlessly; that fails safe.
+///
+/// Each `<!DOCTYPE` starts a scan over what follows: the name and the quoted public/system ids
+/// come first, a `[` outside quotes opens the subset, a `>` ends a DOCTYPE without one. Scans in
+/// the same quote state go on alike, so one pass keeps just three flags (outside quotes, in `"`,
+/// in `'`) and stays linear however many `<!DOCTYPE`s a comment holds.
+fn internal_subset(xml: &[u8]) -> bool {
+    const DOCTYPE: &[u8] = b"<!DOCTYPE";
+    let (mut bare, mut double, mut single) = (false, false, false);
+    for (at, &b) in xml.iter().enumerate() {
+        if at.checked_sub(DOCTYPE.len()).and_then(|start| xml.get(start..at)) == Some(DOCTYPE) {
+            bare = true;
+        }
+        if bare && b == b'[' {
+            return true;
+        }
+        (bare, double, single) = (
+            (bare && !matches!(b, b'"' | b'\'' | b'>')) || (double && b == b'"') || (single && b == b'\''),
+            (double && b != b'"') || (bare && b == b'"'),
+            (single && b != b'\'') || (bare && b == b'\''),
+        );
+    }
+    false
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn nested(levels: usize) -> String {
+        format!("<a>{}{}</a>", "<g>".repeat(levels), "</g>".repeat(levels))
+    }
+
+    fn dtd<'a>() -> ParsingOptions<'a> {
+        ParsingOptions { allow_dtd: true, ..Default::default() }
+    }
+
+    #[test]
+    fn nesting_past_the_cap_is_an_error_not_a_stack_overflow() {
+        let deep = nested(20_000);
+        std::thread::Builder::new()
+            .stack_size(512 * 1024)
+            .spawn(move || {
+                for opts in [ParsingOptions::default(), dtd()] {
+                    let e = parse(&deep, opts).err().unwrap_or_else(|| panic!("parsed"));
+                    assert!(e.contains("nested") && e.contains(&MAX_DEPTH.to_string()), "{e}");
+                }
+            })
+            .unwrap()
+            .join()
+            .unwrap();
+        // The root plus MAX_DEPTH - 1 levels is exactly MAX_DEPTH deep.
+        assert!(parse(&nested(MAX_DEPTH - 1), ParsingOptions::default()).is_ok());
+        assert!(parse(&nested(MAX_DEPTH), ParsingOptions::default()).is_err());
+    }
+
+    #[test]
+    fn markup_in_comments_cdata_pis_and_attributes_adds_no_depth() {
+        let g = "<g>".repeat(2 * MAX_DEPTH);
+        let xml = format!("<?xml version=\"1.0\"?><!-- {g} --><a t=\"&lt;&gt; /&gt; >\"><![CDATA[ {g} ]]><?pi {g} ?><b/></a>");
+        assert!(parse(&xml, ParsingOptions::default()).is_ok());
+    }
+
+    /// The scan per `<!DOCTYPE` that [`internal_subset`] folds into one pass.
+    fn internal_subset_per_doctype(xml: &[u8]) -> bool {
+        const DOCTYPE: &[u8] = b"<!DOCTYPE";
+        xml.windows(DOCTYPE.len()).enumerate().filter(|(_, w)| *w == DOCTYPE).any(|(at, _)| {
+            let mut quote = None;
+            for &b in &xml[at + DOCTYPE.len()..] {
+                match quote {
+                    Some(q) if b == q => quote = None,
+                    Some(_) => {}
+                    None if b == b'"' || b == b'\'' => quote = Some(b),
+                    None if b == b'[' => return true,
+                    None if b == b'>' => return false,
+                    None => {}
+                }
+            }
+            false
+        })
+    }
+
+    #[test]
+    fn the_one_pass_doctype_scan_agrees_with_a_scan_per_doctype() {
+        let parts: [&[u8]; 7] = [b"<!DOCTYPE", b"\"", b"'", b"[", b">", b"a", b"<!-- "];
+        // Every sequence of up to six parts, so the scans overlap in each quote state.
+        let mut checked = 0;
+        for len in 0..=6u32 {
+            for mut code in 0..parts.len().pow(len) {
+                let mut xml = Vec::new();
+                for _ in 0..len {
+                    xml.extend_from_slice(parts[code % parts.len()]);
+                    code /= parts.len();
+                }
+                assert_eq!(internal_subset(&xml), internal_subset_per_doctype(&xml), "{}", String::from_utf8_lossy(&xml));
+                checked += 1;
+            }
+        }
+        assert!(checked > 100_000);
+    }
+
+    #[test]
+    fn many_doctypes_in_a_comment_scan_in_linear_time() {
+        // A scan per `<!DOCTYPE` reads on to the end from each of the ~1.9 million here, some
+        // 10^13 steps; one pass reads the 16 MiB once.
+        let xml = format!("<!-- {} --><a/>", "<!DOCTYPE".repeat((16 << 20) / 9));
+        let started = std::time::Instant::now();
+        assert!(parse(&xml, dtd()).is_ok());
+        assert!(started.elapsed() < std::time::Duration::from_secs(20), "{:?}", started.elapsed());
+    }
+
+    #[test]
+    fn an_internal_subset_is_refused_an_external_doctype_parses() {
+        let krita = "<?xml version=\"1.0\"?>\n<!-- c --><!DOCTYPE DOC PUBLIC '-//KDE//DTD krita 2.0//EN' 'http://www.calligra.org/DTD/[krita].dtd'>\n<DOC/>";
+        assert!(parse(krita, dtd()).is_ok());
+        let g = ("<g>".repeat(20_000), "</g>".repeat(20_000));
+        for xml in [
+            "<!DOCTYPE a [<!ENTITY e \"x\">]><a>&e;</a>".to_string(),
+            "\u{feff}<?xml version=\"1.0\"?><!-- ' --> <!DOCTYPE a SYSTEM \"a.dtd\" [<!-- ' -->]><a/>".to_string(),
+            format!("<!DOCTYPE a [<!ENTITY e \"{}{}\">]><a>&e;</a>", g.0, g.1),
+            // roxmltree reads the declaration's values as quoted attributes, so they may hold `?>`.
+            format!("<?xml version=\"?>\"?><!DOCTYPE a [<!ENTITY e \"{}{}\">]><a>&e;</a>", g.0, g.1),
+            format!("<?xml version=\"?>\"?><!DOCTYPE a [<!-- ' -->]><a>{}{}</a><!-- ' -->", g.0, g.1),
+        ] {
+            let e = parse(&xml, dtd()).err().unwrap_or_else(|| panic!("parsed {xml:.60}"));
+            assert!(e.contains("internal DTD"), "{e}");
+        }
+        // Without allow_dtd roxmltree refuses any DOCTYPE itself.
+        assert!(parse(krita, ParsingOptions::default()).is_err());
+    }
+}
diff --git a/crates/io/tests/it/adjust_blend_roundtrip.rs b/crates/io/tests/it/adjust_blend_roundtrip.rs
index 1159836047..bab904f58c 100644
--- a/crates/io/tests/it/adjust_blend_roundtrip.rs
+++ b/crates/io/tests/it/adjust_blend_roundtrip.rs
@@ -80,9 +80,20 @@ fn adjustments() -> Vec<(Adjustment, bool)> {
         (Adjustment::PhotoFilter { color: [q16(0), q16(39321), q16(65535)], density: 0.3, preserve_luminosity: false }, true),
         (Adjustment::ChannelMixer { matrix: [[0.5, 0.3, 0.2, 0.0], [0.1, 0.8, 0.1, 0.05], [0.0, 0.2, 0.9, -0.05]], monochrome: false }, true),
         (Adjustment::ChannelMixer { matrix: [[0.4, 0.4, 0.2, 0.0], [0.0, 1.0, 0.0, 0.0], [0.0, 0.0, 1.0, 0.0]], monochrome: true }, true),
-        (Adjustment::ColorLookup { name: "Look.cube".into(), lut: Some(Arc::new(lut.data)), size: 5, tetrahedral: false, dither: false }, true),
+        // The LUT file is embedded as loaded (here a .cube), so it reads back with its source.
+        (
+            Adjustment::ColorLookup {
+                name: "Look.cube".into(),
+                source: Some(adjust::LutSource { format: adjust::LutFormat::Cube, bytes: Arc::new(photocraft_cms::lutfile::write_cube(&lut).into_bytes()) }),
+                lut: Some(Arc::new(lut.data)),
+                size: 5,
+                tetrahedral: false,
+                dither: false,
+            },
+            true,
+        ),
         // No table chosen: written as an identity cube (renders the same, comes back with a table).
-        (Adjustment::ColorLookup { name: String::new(), lut: None, size: 0, tetrahedral: false, dither: false }, false),
+        (Adjustment::ColorLookup { name: String::new(), lut: None, size: 0, tetrahedral: false, dither: false, source: None }, false),
         (Adjustment::Invert, true),
         (Adjustment::Posterize { levels: 4 }, true),
         (Adjustment::Threshold { level: g(140) }, true),
@@ -207,7 +218,8 @@ fn every_adjustment_kind_round_trips_16bit() {
 fn color_lookup_tetrahedral_warns_on_psd_save() {
     let lut = photocraft_cms::lutfile::LutFile::from_fn("t", 2, |c| if c == [1.0; 3] { [1.0; 3] } else { [0.0; 3] });
     for tetrahedral in [true, false] {
-        let adj = Adjustment::ColorLookup { name: "test.cube".into(), lut: Some(Arc::new(lut.data.clone())), size: 2, tetrahedral, dither: false };
+        let adj =
+            Adjustment::ColorLookup { name: "test.cube".into(), lut: Some(Arc::new(lut.data.clone())), size: 2, tetrahedral, dither: false, source: None };
         let mut d = Document::new("lut", photocraft_geom::Size::new(8, 8), ColorMode::Rgb, SampleType::U8);
         let fmt = d.pixel_format();
         d.layers.push(raster("Background", fmt, d.bounds(), 1, false));
diff --git a/crates/io/tests/it/adjust_warnings.rs b/crates/io/tests/it/adjust_warnings.rs
index c9199835d2..0e4e822527 100644
--- a/crates/io/tests/it/adjust_warnings.rs
+++ b/crates/io/tests/it/adjust_warnings.rs
@@ -36,7 +36,8 @@ fn unreadable_adjustments_warn_on_open() {
 #[test]
 fn readable_adjustments_open_without_warnings() {
     let lut: Vec<f32> = (0..8).flat_map(|i| [(i & 1) as f32, ((i >> 1) & 1) as f32, ((i >> 2) & 1) as f32]).collect();
-    let lookup = Adjustment::ColorLookup { name: "id.cube".into(), size: 2, lut: Some(std::sync::Arc::new(lut)), tetrahedral: false, dither: false };
+    let lookup =
+        Adjustment::ColorLookup { name: "id.cube".into(), size: 2, lut: Some(std::sync::Arc::new(lut)), tetrahedral: false, dither: false, source: None };
     for adj in [lookup, Adjustment::Invert] {
         let (doc, warnings) = reopen(adj, "x.psd", &ExportOptions::default());
         assert!(!matches!(&doc.layers[0].content, LayerContent::Adjustment(Adjustment::Unsupported { .. })));
@@ -114,10 +115,15 @@ fn photoshop_layout_color_lookup_round_trips_through_psb() {
     let opts = ExportOptions { force_psb: true, ..Default::default() };
     let (doc, warnings) = reopen(Adjustment::Unsupported { psd_key: "clrL".into(), raw: raw.as_slice().into() }, "x.psb", &opts);
     assert!(warnings.iter().all(|w| !w.contains("Teal Look")), "{warnings:?}");
-    let LayerContent::Adjustment(Adjustment::ColorLookup { name, size, lut: Some(table), tetrahedral: false, dither: false }) = &doc.layers[0].content else {
+    let LayerContent::Adjustment(Adjustment::ColorLookup { name, size, lut: Some(table), tetrahedral: false, dither: false, source: Some(source) }) =
+        &doc.layers[0].content
+    else {
         panic!("{:?}", doc.layers[0].content)
     };
     assert_eq!(name, "frost.cube");
+    // The loaded `.cube` file is kept as its source, so a later save can embed it unchanged.
+    assert_eq!(source.format, photocraft_doc::adjust::LutFormat::Cube);
+    assert_eq!(source.bytes.as_slice(), b"LUT_3D_SIZE 2\n0 0 0\n0 1 1\n0 1 0\n1 1 0\n0 0 1\n1 0 1\n0 1 1\n1 1 1\n");
     assert_eq!(*size, 2);
     let want: Vec<f32> = [0.0, 0.0, 0.0, 0.0, 1.0, 1.0, 0.0, 1.0, 0.0, 1.0, 1.0, 0.0, 0.0, 0.0, 1.0, 1.0, 0.0, 1.0, 0.0, 1.0, 1.0, 1.0, 1.0, 1.0].into();
     assert_eq!(table.as_slice(), want.as_slice());
@@ -139,18 +145,32 @@ fn photoshop_layout_color_lookup_round_trips_through_psb() {
 fn short_color_lookup_table_warns_on_open() {
     // A stored table shorter than size³×3 renders as the identity; opening must say so, naming
     // the layer (#1763).
-    let short = Adjustment::ColorLookup { name: "t.cube".into(), size: 3, lut: Some(std::sync::Arc::new(vec![0.5; 7])), tetrahedral: false, dither: false };
+    let short = Adjustment::ColorLookup {
+        name: "t.cube".into(),
+        size: 3,
+        lut: Some(std::sync::Arc::new(vec![0.5; 7])),
+        tetrahedral: false,
+        dither: false,
+        source: None,
+    };
     let (doc, warnings) = reopen(short, "x.pcraft", &ExportOptions::default());
     assert!(matches!(&doc.layers[0].content, LayerContent::Adjustment(Adjustment::ColorLookup { .. })), "{:?}", doc.layers[0].content);
     let w: Vec<&String> = warnings.iter().filter(|w| w.contains("Teal Look")).collect();
     assert_eq!(w.len(), 1, "{warnings:?}");
     assert!(w[0].contains("Color Lookup") && w[0].contains("7 values") && w[0].contains("81"), "{}", w[0]);
     // A table long enough for its size opens without the note.
-    let ok = Adjustment::ColorLookup { name: "t.cube".into(), size: 2, lut: Some(std::sync::Arc::new(vec![0.5; 24])), tetrahedral: false, dither: false };
+    let ok = Adjustment::ColorLookup {
+        name: "t.cube".into(),
+        size: 2,
+        lut: Some(std::sync::Arc::new(vec![0.5; 24])),
+        tetrahedral: false,
+        dither: false,
+        source: None,
+    };
     let (_, warnings) = reopen(ok, "x.pcraft", &ExportOptions::default());
     assert!(warnings.iter().all(|w| !w.contains("Teal Look")), "{warnings:?}");
     // A missing table renders as the identity too.
-    let none = Adjustment::ColorLookup { name: "t.cube".into(), size: 2, lut: None, tetrahedral: false, dither: false };
+    let none = Adjustment::ColorLookup { name: "t.cube".into(), size: 2, lut: None, tetrahedral: false, dither: false, source: None };
     let (_, warnings) = reopen(none, "x.pcraft", &ExportOptions::default());
     assert!(warnings.iter().any(|w| w.contains("Teal Look") && w.contains("no usable table")), "{warnings:?}");
 }
diff --git a/crates/io/tests/it/cmyk_composite_export.rs b/crates/io/tests/it/cmyk_composite_export.rs
index 83e6b37818..0fea33695d 100644
--- a/crates/io/tests/it/cmyk_composite_export.rs
+++ b/crates/io/tests/it/cmyk_composite_export.rs
@@ -99,6 +99,30 @@ fn tiff_keeps_true_zero_alpha_when_composited() {
 
 #[test]
 fn flat_and_layered_tiff_agree_for_mixed_cmyk_regions() {
+    compare_flat_and_layered_mixed_cmyk_regions();
+}
+
+fn assert_tiff_layout(image: &photocraft_codecs::Image, bytes: &[u8], opaque: bool, sample: CodecSample, context: &str) {
+    assert_eq!(image.dimensions(), (48, 16), "{context}");
+    assert_eq!(image.layout(), if opaque { ChannelLayout::Cmyk } else { ChannelLayout::CmykA }, "{context}");
+    assert_eq!(image.sample_type(), sample, "{context}");
+    assert_eq!(image.meta.dpi, Some((300.0, 300.0)), "{context}");
+    assert_eq!(tag(bytes, 262), Some(5), "{context}");
+    assert_eq!(tag(bytes, 277), Some(if opaque { 4 } else { 5 }), "{context}");
+    assert_eq!(tag(bytes, 338), if opaque { None } else { Some(2) }, "{context}");
+}
+
+fn assert_mixed_region_alpha(samples: &[f32], tolerance: f32, context: &str) {
+    for (i, px) in samples.as_chunks::<5>().0.iter().enumerate() {
+        match i % 48 {
+            0..16 => assert_eq!(px[4], 1.0, "{context}: opaque region"),
+            16..32 => assert!((px[4] - 0.5).abs() <= tolerance, "{context}: translucent region: {px:?}"),
+            _ => assert_eq!(px[4], 0.0, "{context}: empty region"),
+        }
+    }
+}
+
+fn compare_flat_and_layered_mixed_cmyk_regions() {
     let custom = photocraft_cms::synth::cmyk_profile(&photocraft_cms::synth::CmykParams {
         description: "Mixed regions uncoated".into(),
         tvi: [0.26, 0.26, 0.26, 0.3],
@@ -123,15 +147,8 @@ fn flat_and_layered_tiff_agree_for_mixed_cmyk_regions() {
                 assert_eq!(reference.icc.as_deref(), profile.as_deref().map(Vec::as_slice), "{context}");
                 assert!(image.meta.photoshop_layers.is_none(), "{context}");
                 assert!(reference.meta.photoshop_layers.is_some(), "{context}");
-                for (decoded, bytes) in [(&image, &flat.bytes), (&reference, &layered.bytes)] {
-                    assert_eq!(decoded.dimensions(), (48, 16), "{context}");
-                    assert_eq!(decoded.layout(), if opaque { ChannelLayout::Cmyk } else { ChannelLayout::CmykA }, "{context}");
-                    assert_eq!(decoded.sample_type(), sample, "{context}");
-                    assert_eq!(decoded.meta.dpi, Some((300.0, 300.0)), "{context}");
-                    assert_eq!(tag(bytes, 262), Some(5), "{context}");
-                    assert_eq!(tag(bytes, 277), Some(if opaque { 4 } else { 5 }), "{context}");
-                    assert_eq!(tag(bytes, 338), if opaque { None } else { Some(2) }, "{context}");
-                }
+                assert_tiff_layout(&image, &flat.bytes, opaque, sample, &context);
+                assert_tiff_layout(&reference, &layered.bytes, opaque, sample, &context);
                 // The PSD-backed layered path inverts CMYK samples twice, so allow one stored level.
                 let tolerance = match depth {
                     SampleType::U8 => 1.0 / 255.0,
@@ -144,13 +161,7 @@ fn flat_and_layered_tiff_agree_for_mixed_cmyk_regions() {
                 let difference = actual.iter().zip(&expected).map(|(a, b)| (a - b).abs()).fold(0.0f32, f32::max);
                 assert!(difference <= tolerance + 1e-6, "{context}: maximum sample difference {difference}");
                 if !opaque {
-                    for (i, px) in actual.as_chunks::<5>().0.iter().enumerate() {
-                        match i % 48 {
-                            0..16 => assert_eq!(px[4], 1.0, "{context}: opaque region"),
-                            16..32 => assert!((px[4] - 0.5).abs() <= tolerance, "{context}: translucent region: {px:?}"),
-                            _ => assert_eq!(px[4], 0.0, "{context}: empty region"),
-                        }
-                    }
+                    assert_mixed_region_alpha(&actual, tolerance, &context);
                 }
                 let back = photocraft_io::import("regions.tiff", &flat.bytes).unwrap().document;
                 assert_eq!((back.mode, back.depth), (ColorMode::Cmyk, depth), "{context}");
diff --git a/crates/io/tests/it/common/mod.rs b/crates/io/tests/it/common/mod.rs
index c964b08b82..7bb010f1be 100644
--- a/crates/io/tests/it/common/mod.rs
+++ b/crates/io/tests/it/common/mod.rs
@@ -236,6 +236,12 @@ fn color_close(a: &Color, b: &Color, ctx: &str) {
 
 pub fn assert_layers_eq(a: &Layer, b: &Layer, path: &str) {
     let ctx = format!("{path}/{}", a.name);
+    assert_layer_properties(a, b, &ctx);
+    assert_layer_mask_eq(a, b, &ctx);
+    assert_layer_content_eq(a, b, &ctx);
+}
+
+fn assert_layer_properties(a: &Layer, b: &Layer, ctx: &str) {
     assert_eq!(a.name, b.name, "{ctx}: name");
     assert_eq!(a.visible, b.visible, "{ctx}: visible");
     assert_eq!(a.locks, b.locks, "{ctx}: locks");
@@ -259,6 +265,9 @@ pub fn assert_layers_eq(a: &Layer, b: &Layer, path: &str) {
         let other = b.fill_cache.as_ref().expect("fill cache kept");
         surface_eq(&fc.surface, &other.surface, &format!("{ctx}: fill cache"));
     }
+}
+
+fn assert_layer_mask_eq(a: &Layer, b: &Layer, ctx: &str) {
     match (&a.mask, &b.mask) {
         (None, None) => {}
         (Some(x), Some(y)) => {
@@ -270,28 +279,27 @@ pub fn assert_layers_eq(a: &Layer, b: &Layer, path: &str) {
         }
         _ => panic!("{ctx}: mask presence differs"),
     }
+}
+
+fn assert_layer_content_eq(a: &Layer, b: &Layer, ctx: &str) {
     match (&a.content, &b.content) {
-        (LayerContent::Raster(x), LayerContent::Raster(y)) => surface_eq(x, y, &ctx),
+        (LayerContent::Raster(x), LayerContent::Raster(y)) => surface_eq(x, y, ctx),
         (LayerContent::Group(x), LayerContent::Group(y)) => {
             assert_eq!(x.expanded, y.expanded, "{ctx}: expanded");
             assert_eq!(x.children.len(), y.children.len(), "{ctx}: child count");
             for (p, q) in x.children.iter().zip(&y.children) {
-                assert_layers_eq(p, q, &ctx);
+                assert_layers_eq(p, q, ctx);
             }
         }
         (LayerContent::Adjustment(x), LayerContent::Adjustment(y)) => assert_eq!(x, y, "{ctx}: adjustment"),
-        (LayerContent::Fill(Fill::Solid(x)), LayerContent::Fill(Fill::Solid(y))) => color_close(x, y, &ctx),
+        (LayerContent::Fill(Fill::Solid(x)), LayerContent::Fill(Fill::Solid(y))) => color_close(x, y, ctx),
         (LayerContent::Fill(x), LayerContent::Fill(y)) => assert_eq!(x, y, "{ctx}: fill"),
         (LayerContent::Text(x), LayerContent::Text(y)) => {
             assert_eq!(x.text, y.text, "{ctx}: text");
-            surface_eq(x.cache.as_ref().unwrap(), y.cache.as_ref().unwrap(), &ctx);
-        }
-        (LayerContent::Shape(x), LayerContent::Shape(y)) => {
-            surface_eq(x.cache.as_ref().unwrap(), y.cache.as_ref().unwrap(), &ctx);
-        }
-        (LayerContent::Smart(x), LayerContent::Smart(y)) => {
-            surface_eq(x.cache.as_ref().unwrap(), y.cache.as_ref().unwrap(), &ctx);
+            surface_eq(x.cache.as_ref().unwrap(), y.cache.as_ref().unwrap(), ctx);
         }
+        (LayerContent::Shape(x), LayerContent::Shape(y)) => surface_eq(x.cache.as_ref().unwrap(), y.cache.as_ref().unwrap(), ctx),
+        (LayerContent::Smart(x), LayerContent::Smart(y)) => surface_eq(x.cache.as_ref().unwrap(), y.cache.as_ref().unwrap(), ctx),
         (x, y) => panic!("{ctx}: kind {} vs {}", x.kind_name(), y.kind_name()),
     }
 }
diff --git a/crates/io/tests/it/deflate_compatibility.rs b/crates/io/tests/it/deflate_compatibility.rs
new file mode 100644
index 0000000000..b6f4331b07
--- /dev/null
+++ b/crates/io/tests/it/deflate_compatibility.rs
@@ -0,0 +1,145 @@
+//! Backend compatibility, including native-format tile data rather than ZIP assembly alone.
+use crate::common;
+
+use std::io::Read;
+
+use photocraft_codecs::{ChannelLayout, Format, Image, SampleType as CodecSample};
+use photocraft_color::{ColorMode, SampleType};
+use photocraft_doc::{Document, Layer, LayerContent};
+use photocraft_format::{SaveOptions, load_from_bytes, read_thumbnail, save_to_bytes};
+use photocraft_geom::Size;
+use photocraft_io::{PsdExportOptions, document_to_psd_with, import};
+use photocraft_psd::Compression;
+use photocraft_raster::Rgba8Image;
+
+fn document(depth: SampleType, size: Size) -> Document {
+    let mut doc = Document::new("compatibility", size, ColorMode::Rgb, depth);
+    doc.layers.push(Layer::new("pixels", LayerContent::Raster(common::pattern(doc.pixel_format(), doc.bounds(), 3, false))));
+    doc
+}
+
+/// Compare both decoders and generate a legacy stream without flate2 compression.
+fn old_and_new_inflate(bytes: &[u8]) -> (Vec<u8>, Vec<u8>) {
+    let old = miniz_oxide::inflate::decompress_to_vec_zlib(bytes)
+        .unwrap_or_else(|e| panic!("old decoder: {:?}, header {:?}", e.status, &bytes[..bytes.len().min(8)]));
+    let legacy = miniz_oxide::deflate::compress_to_vec_zlib(&old, 6);
+    for stream in [bytes, legacy.as_slice()] {
+        let mut new = Vec::new();
+        flate2::read::ZlibDecoder::new(stream).read_to_end(&mut new).unwrap();
+        assert_eq!(new, old);
+    }
+    (old, legacy)
+}
+
+/// Read new PNGs and PNGs with legacy-miniz IDAT data through the codec.
+fn check_png(bytes: &[u8], image: &Image) {
+    assert_eq!(photocraft_codecs::decode(bytes).unwrap().data(), image.data());
+    let mut idat = Vec::new();
+    let mut legacy_png = bytes[..8].to_vec();
+    let mut idat_offset = None;
+    let mut offset = 8;
+    while offset < bytes.len() {
+        let len = u32::from_be_bytes(bytes[offset..offset + 4].try_into().unwrap()) as usize;
+        let end = offset + 12 + len;
+        if &bytes[offset + 4..offset + 8] == b"IDAT" {
+            idat_offset.get_or_insert(legacy_png.len());
+            idat.extend_from_slice(&bytes[offset + 8..offset + 8 + len]);
+        } else {
+            legacy_png.extend_from_slice(&bytes[offset..end]);
+        }
+        offset = end;
+    }
+    let (_, legacy) = old_and_new_inflate(&idat);
+    let mut chunk = (legacy.len() as u32).to_be_bytes().to_vec();
+    chunk.extend_from_slice(b"IDAT");
+    chunk.extend_from_slice(&legacy);
+    chunk.extend_from_slice(&crc32fast::hash(&chunk[4..]).to_be_bytes());
+    let at = idat_offset.unwrap();
+    legacy_png.splice(at..at, chunk);
+    assert_eq!(photocraft_codecs::decode(&legacy_png).unwrap().data(), image.data());
+}
+
+/// New zlib-rs streams and legacy-miniz streams preserve the same document samples.
+#[test]
+fn png_psd_and_pcraft_decode_identically() {
+    for depth in [SampleType::U8, SampleType::U16, SampleType::F32] {
+        let doc = document(depth, Size::new(257, 131));
+        let pixels = doc.layers[0].surface().unwrap().read_region(doc.bounds());
+        if depth != SampleType::F32 {
+            let sample = if depth == SampleType::U8 { CodecSample::U8 } else { CodecSample::U16 };
+            let image = Image::from_normalized(257, 131, ChannelLayout::Rgba, sample, &pixels).unwrap();
+            check_png(&photocraft_codecs::encode(&image, Format::Png, &Default::default()).unwrap(), &image);
+        }
+        let raw_opts = PsdExportOptions { merged_compression: Compression::Raw, merged_matte: false, ..Default::default() };
+        let merged = document_to_psd_with(&doc, &raw_opts).0.image_data.data;
+        for compression in [Compression::Zip, Compression::ZipPrediction] {
+            let opts = PsdExportOptions { merged_compression: compression, merged_matte: false, ..Default::default() };
+            let mut file = document_to_psd_with(&doc, &opts).0;
+            // The IO exporter normally chooses Raw for float composites; also cover ZIP here.
+            if depth == SampleType::F32 {
+                file.image_data = photocraft_psd::ImageData::encode(compression, &merged, &file.header).unwrap();
+            }
+            let bytes = file.to_bytes().unwrap();
+            let parsed = photocraft_psd::PsdFile::from_bytes(&bytes).unwrap();
+            assert_eq!(parsed.image_data.compression, compression);
+            let (inflated, legacy) = old_and_new_inflate(&parsed.image_data.data);
+            // The PSD streaming helper uses a different flate2 reader from plane decoding.
+            assert_eq!(photocraft_psd::compression::zip_decompress(&legacy, inflated.len()).unwrap(), inflated);
+            file.image_data.data = legacy;
+            for fixture in [bytes, file.to_bytes().unwrap()] {
+                let parsed = photocraft_psd::PsdFile::from_bytes(&fixture).unwrap();
+                assert_eq!(parsed.image_data.decode(&parsed.header).unwrap(), merged);
+                let back = import("compatibility.psd", &fixture).unwrap().document;
+                assert_eq!(back.layers[0].surface().unwrap().read_region(doc.bounds()), pixels);
+            }
+        }
+        let mut thumbnail = Rgba8Image::new(7, 3);
+        thumbnail.pixels = (0..84).map(|i| (i * 37) as u8).collect();
+        let opts = SaveOptions { thumbnail: Some(thumbnail.clone()), ..Default::default() };
+        let bytes = save_to_bytes(&doc, &opts).unwrap();
+        assert!(load_from_bytes(&bytes).unwrap() == doc, "all tile bytes, {depth:?}");
+        let image = Image::from_u8(7, 3, ChannelLayout::Rgba, thumbnail.pixels).unwrap();
+        check_png(&read_thumbnail(&bytes).unwrap().unwrap(), &image);
+    }
+}
+
+/// PDF export writes its image at the old backend's size or smaller: zlib-rs level 1
+/// (`Compression::fast()`) writes static Huffman blocks only, which made PDFs of photos
+/// 5-30% bigger than miniz's level 1 did.
+#[test]
+fn pdf_image_stream_is_no_bigger_than_miniz_fast() {
+    let (w, h) = (512u32, 384u32);
+    let mut doc = Document::new("photo", Size::new(w, h), ColorMode::Rgb, SampleType::U8);
+    // A noisy gradient: smooth like a photo, with sensor-like grain.
+    let mut x32 = 0x9E37_79B9u32;
+    let mut samples = Vec::with_capacity((w * h * 3) as usize);
+    let mut vals = Vec::with_capacity((w * h * 4) as usize);
+    for y in 0..h {
+        for x in 0..w {
+            for c in 0..3 {
+                x32 ^= x32 << 13;
+                x32 ^= x32 >> 17;
+                x32 ^= x32 << 5;
+                let base = (x * 160 / w + y * 80 / h + c * 20) as i32;
+                let v = (base + (x32 % 9) as i32 - 4).clamp(0, 255) as u8;
+                samples.push(v);
+                vals.push(common::g(v));
+            }
+            vals.push(1.0);
+        }
+    }
+    let mut surface = photocraft_raster::Surface::new(doc.pixel_format());
+    surface.write_region(doc.bounds(), &vals);
+    doc.layers.push(Layer::new("photo", LayerContent::Raster(surface)));
+    let pdf = photocraft_io::export(&doc, "photo.pdf", &Default::default()).unwrap().bytes;
+    let at = pdf.windows(15).position(|s| s == b"/Subtype /Image").unwrap();
+    let dict = &pdf[at..];
+    let len_at = dict.windows(8).position(|s| s == b"/Length ").unwrap() + 8;
+    let digits = dict[len_at..].iter().take_while(|b| b.is_ascii_digit()).count();
+    let len: usize = std::str::from_utf8(&dict[len_at..len_at + digits]).unwrap().parse().unwrap();
+    let start = dict.windows(7).position(|s| s == b"stream\n").unwrap() + 7;
+    let stream = &dict[start..start + len];
+    assert_eq!(miniz_oxide::inflate::decompress_to_vec_zlib(stream).unwrap(), samples);
+    let old = miniz_oxide::deflate::compress_to_vec_zlib(&samples, 1).len();
+    assert!(len <= old, "PDF image stream {len} bytes, miniz level 1 wrote {old}");
+}
diff --git a/crates/io/tests/it/main.rs b/crates/io/tests/it/main.rs
index 94f4ba715d..40154335d0 100644
--- a/crates/io/tests/it/main.rs
+++ b/crates/io/tests/it/main.rs
@@ -20,6 +20,7 @@ mod comps_artboards;
 mod corpus;
 mod corpus_regressions;
 mod cylinder_warp;
+mod deflate_compatibility;
 mod effects_multi;
 mod exif_resolution;
 mod export_progress;
@@ -50,6 +51,8 @@ mod psd_block_layout;
 mod psd_damaged_merged;
 mod psd_empty_channels;
 mod psd_font_identity;
+mod psd_frame_stroke;
+mod psd_import_file;
 mod psd_kerning;
 mod psd_layer_block_length;
 mod psd_maximize_compatibility;
diff --git a/crates/io/tests/it/psd_damaged_merged.rs b/crates/io/tests/it/psd_damaged_merged.rs
index e3d0970dd9..8e20687bb5 100644
--- a/crates/io/tests/it/psd_damaged_merged.rs
+++ b/crates/io/tests/it/psd_damaged_merged.rs
@@ -89,7 +89,7 @@ fn modes_imported_flattened_do_not_recover_from_unusable_layer_records() {
     for mode in [photocraft_psd::ColorMode::Indexed, photocraft_psd::ColorMode::Multichannel, photocraft_psd::ColorMode::Duotone] {
         let mut file = layered(SampleType::U8, "x.psd");
         file.header.color_mode = mode;
-        file.image_data = photocraft_psd::ImageData { compression: Compression::Raw, data: Vec::new() };
+        file.image_data = photocraft_psd::ImageData::new(Compression::Raw, Vec::new());
         assert!(import("flat-mode.psd", &file.to_bytes().unwrap()).is_err(), "{mode:?}");
     }
 }
@@ -98,7 +98,7 @@ fn modes_imported_flattened_do_not_recover_from_unusable_layer_records() {
 fn lost_extra_channels_are_reported_while_layers_remain_usable() {
     let mut file = layered(SampleType::U8, "x.psd");
     file.header.channels = 5;
-    file.image_data = photocraft_psd::ImageData { compression: Compression::Raw, data: Vec::new() };
+    file.image_data = photocraft_psd::ImageData::new(Compression::Raw, Vec::new());
     let result = import("extra-channel.psd", &file.to_bytes().unwrap()).unwrap();
     assert_eq!(result.document.layer_count(), 1);
     assert!(result.document.channels.is_empty());
diff --git a/crates/io/tests/it/psd_frame_stroke.rs b/crates/io/tests/it/psd_frame_stroke.rs
new file mode 100644
index 0000000000..3ae2284543
--- /dev/null
+++ b/crates/io/tests/it/psd_frame_stroke.rs
@@ -0,0 +1,117 @@
+//! A Photoshop Frame (Frame tool, K) is a layer group whose record carries the frame outline as a
+//! vector mask (`vsms`) and its Properties › Stroke as a shape-style `vstk`. The stroke draws
+//! along the outline even when nothing is placed in the frame (#4381).
+
+use photocraft_color::{Color, ColorMode, PixelFormat, SampleType};
+use photocraft_doc::{Document, Fill, Group, Layer, LayerContent, Path, ShapeStroke, Size, StrokeAlign, Subpath, VectorMask};
+use photocraft_io::vector_map::{parse_vstk, vstk_bytes};
+use photocraft_io::*;
+use photocraft_psd::{PsdFile, SectionType, TaggedBlock};
+
+fn red_inside(width: f32) -> ShapeStroke {
+    ShapeStroke { width, align: StrokeAlign::Inside, paint: Fill::Solid(Color::rgb(1.0, 0.0, 0.0)), ..ShapeStroke::default() }
+}
+
+/// An 80 × 60 white document with an empty rectangular frame over (20, 10)–(60, 50).
+fn frame_doc(depth: SampleType, stroke: Option<ShapeStroke>) -> Document {
+    let mut d = Document::with_background("f", Size::new(80, 60), ColorMode::Rgb, depth, Color::WHITE);
+    let mut g = Layer::group("Frame 1", vec![]);
+    if let LayerContent::Group(Group { frame_stroke, .. }) = &mut g.content {
+        *frame_stroke = stroke;
+    }
+    g.vector_mask = Some(VectorMask::new(Path::new(vec![Subpath::polygon(&[(20.0, 10.0), (60.0, 10.0), (60.0, 50.0), (20.0, 50.0)])])));
+    d.layers.push(g);
+    d
+}
+
+fn frame_stroke(d: &Document) -> Option<ShapeStroke> {
+    d.layers.iter().find_map(|l| match &l.content {
+        LayerContent::Group(g) => Some(g.frame_stroke.clone()),
+        _ => None,
+    })?
+}
+
+fn px(d: &Document, x: i32, y: i32) -> [f32; 4] {
+    photocraft_compose::flatten_to_surface(d, PixelFormat::RGBA8.with_sample(SampleType::F32), None).rgba(x, y)
+}
+
+/// The group's own record (its top, `lsct` 1 or 2) in a PSD file.
+fn frame_record(f: &mut PsdFile) -> &mut photocraft_psd::LayerRecord {
+    f.layers_mut()
+        .iter_mut()
+        .find(|r| r.section_divider().is_some_and(|s| matches!(s.kind, SectionType::OpenFolder | SectionType::ClosedFolder)))
+        .expect("the frame's group record")
+}
+
+#[test]
+fn a_photoshop_frames_vstk_draws_its_stroke_along_the_outline() {
+    for depth in [SampleType::U8, SampleType::U16, SampleType::F32] {
+        // A file shaped like Photoshop's: the group record carries `vsms` and a `vstk`.
+        let mut f = document_to_psd(&frame_doc(depth, None));
+        frame_record(&mut f).blocks.push(TaggedBlock::new(*b"vstk", vstk_bytes(Some(&red_inside(4.0)), true, 72.0)));
+        let (d, _) = psd_to_document(&f);
+        assert_eq!(frame_stroke(&d), Some(red_inside(4.0)), "{depth:?}");
+        // Inside the outline, 4 px wide: red on the frame's edge band, white in the middle and
+        // outside it.
+        let close = |a: [f32; 4], b: [f32; 3]| (0..3).all(|i| (a[i] - b[i]).abs() < 0.02);
+        for (x, y) in [(21, 30), (58, 30), (40, 11), (40, 48)] {
+            assert!(close(px(&d, x, y), [1.0, 0.0, 0.0]), "{depth:?} ({x}, {y}): {:?}", px(&d, x, y));
+        }
+        for (x, y) in [(40, 30), (18, 30), (62, 30), (40, 8)] {
+            assert!(close(px(&d, x, y), [1.0, 1.0, 1.0]), "{depth:?} ({x}, {y}): {:?}", px(&d, x, y));
+        }
+    }
+}
+
+#[test]
+fn a_frame_stroke_round_trips_through_psd() {
+    let stroke = ShapeStroke { dashes: vec![2.0, 1.0], opacity: 0.5, align: StrokeAlign::Outside, ..red_inside(3.0) };
+    let d = frame_doc(SampleType::U8, Some(stroke.clone()));
+    let bytes = export(&d, "f.psd", &ExportOptions::default()).unwrap().bytes;
+    let back = import("f.psd", &bytes).unwrap().document;
+    assert_eq!(frame_stroke(&back), Some(stroke.clone()));
+    // Outside the outline at half opacity: pink just outside the edge.
+    let p = px(&back, 18, 30);
+    assert!((p[1] - 0.5).abs() < 0.05 && p[0] > 0.98, "{p:?}");
+
+    // Saved again unchanged, the imported `vstk` stays byte for byte.
+    let mut f = PsdFile::from_bytes(&bytes).unwrap();
+    let first = frame_record(&mut f).block(b"vstk").unwrap().data.clone();
+    let again = export(&back, "f.psd", &ExportOptions::default()).unwrap().bytes;
+    let mut f2 = PsdFile::from_bytes(&again).unwrap();
+    assert_eq!(frame_record(&mut f2).block(b"vstk").unwrap().data, first);
+
+    // Removing the stroke writes it disabled; no stroke at all writes no `vstk`.
+    let mut cleared = back.clone();
+    if let Some(LayerContent::Group(g)) = cleared.layers.iter_mut().map(|l| &mut l.content).find(|c| matches!(c, LayerContent::Group(_))) {
+        g.frame_stroke = None;
+    }
+    let out = export(&cleared, "f.psd", &ExportOptions::default()).unwrap().bytes;
+    let mut f3 = PsdFile::from_bytes(&out).unwrap();
+    assert_eq!(parse_vstk(&frame_record(&mut f3).block(b"vstk").unwrap().data, 72.0).unwrap().stroke, None);
+    let plain = export(&frame_doc(SampleType::U8, None), "f.psd", &ExportOptions::default()).unwrap().bytes;
+    let mut f4 = PsdFile::from_bytes(&plain).unwrap();
+    assert!(frame_record(&mut f4).block(b"vstk").is_none());
+}
+
+#[test]
+fn a_frame_stroke_without_a_vector_mask_or_width_draws_nothing() {
+    let mut d = frame_doc(SampleType::U8, Some(red_inside(4.0)));
+    d.layers[1].vector_mask = None;
+    assert_eq!(px(&d, 21, 30), [1.0, 1.0, 1.0, 1.0]);
+    let d = frame_doc(SampleType::U8, Some(ShapeStroke { width: 0.0, ..red_inside(4.0) }));
+    assert_eq!(px(&d, 21, 30), [1.0, 1.0, 1.0, 1.0]);
+    // Hostile widths from a file render without panicking.
+    for width in [f32::NAN, f32::INFINITY, -5.0, 1e9] {
+        let _ = px(&frame_doc(SampleType::U8, Some(ShapeStroke { width, ..red_inside(4.0) })), 21, 30);
+    }
+}
+
+#[test]
+fn an_isolated_frame_draws_its_outside_stroke_past_the_outline() {
+    let mut d = frame_doc(SampleType::U8, Some(ShapeStroke { align: StrokeAlign::Outside, ..red_inside(3.0) }));
+    d.layers[1].blend = photocraft_color::BlendMode::Normal;
+    let p = px(&d, 18, 30);
+    assert!(p[0] > 0.98 && p[1] < 0.02, "{p:?}");
+    assert!(px(&d, 22, 30)[1] > 0.98, "inside stays white");
+}
diff --git a/crates/io/tests/it/psd_import_file.rs b/crates/io/tests/it/psd_import_file.rs
new file mode 100644
index 0000000000..f8e9243cc1
--- /dev/null
+++ b/crates/io/tests/it/psd_import_file.rs
@@ -0,0 +1,155 @@
+//! `import_file` parses a PSD/PSB from the open file (channel data read as it is decoded) and must
+//! open the same document, with the same warnings, as importing the file's bytes.
+
+use photocraft_io::{ImportResult, import, import_file};
+use photocraft_psd::testgen;
+use photocraft_raster::Interrupt;
+
+struct TempDir(std::path::PathBuf);
+
+impl TempDir {
+    fn new(tag: &str) -> Self {
+        let dir = std::env::temp_dir().join(format!("photocraft-import-file-{tag}-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        TempDir(dir)
+    }
+
+    fn write(&self, name: &str, bytes: &[u8]) -> std::path::PathBuf {
+        let path = self.0.join(name);
+        std::fs::write(&path, bytes).unwrap();
+        path
+    }
+}
+
+impl Drop for TempDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+/// The document's debug form with every `…Id(n)` number blanked.
+fn without_ids(doc: &photocraft_doc::Document) -> String {
+    let s = format!("{doc:?}");
+    let mut out = String::with_capacity(s.len());
+    let mut rest = s.as_str();
+    while let Some(at) = rest.find("Id(") {
+        out.push_str(&rest[..at + 3]);
+        rest = rest[at + 3..].trim_start_matches(|c: char| c.is_ascii_digit());
+    }
+    out.push_str(rest);
+    out
+}
+
+fn open(name: &str, path: &std::path::Path) -> Result<ImportResult, photocraft_io::IoError> {
+    import_file(name, path, &photocraft_io::ImportOptions::default(), &Interrupt::NONE)
+}
+
+#[test]
+fn import_file_opens_what_importing_the_bytes_opens() {
+    let dir = TempDir::new("same");
+    let mut checked = 0;
+    for case in testgen::all_cases() {
+        let ext = if case.file.header.version.is_psb() { "psb" } else { "psd" };
+        let name = format!("case.{ext}");
+        let bytes = case.file.to_bytes().unwrap();
+        let path = dir.write(&name, &bytes);
+        let from_bytes = import(&name, &bytes);
+        let from_file = open(&name, &path);
+        match (from_bytes, from_file) {
+            (Ok(a), Ok(b)) => {
+                // Ids come from a process-wide counter, so the two opens differ only there.
+                assert!(without_ids(&b.document) == without_ids(&a.document), "{}", case.name);
+                assert_eq!(b.warnings, a.warnings, "{}", case.name);
+                checked += 1;
+            }
+            (Err(_), Err(_)) => {}
+            (a, b) => panic!("{}: bytes {:?}, file {:?}", case.name, a.map(|r| r.warnings), b.map(|r| r.warnings)),
+        }
+    }
+    assert!(checked > 50, "only {checked} cases opened");
+}
+
+#[test]
+fn import_file_reads_other_formats_whole() {
+    let dir = TempDir::new("other");
+    let doc = photocraft_doc::Document::new("x", photocraft_geom::Size::new(3, 2), photocraft_color::ColorMode::Rgb, photocraft_color::SampleType::U8);
+    let png = photocraft_io::export(&doc, "x.png", &Default::default()).unwrap().bytes;
+    let path = dir.write("x.png", &png);
+    let r = open("x.png", &path).unwrap();
+    assert_eq!(r.document.size, doc.size);
+}
+
+#[test]
+fn import_file_fails_cleanly() {
+    let dir = TempDir::new("fail");
+    assert!(open("missing.psd", &dir.0.join("missing.psd")).is_err());
+    let bytes = testgen::small(photocraft_psd::Version::Psd, photocraft_psd::Compression::Rle).to_bytes().unwrap();
+    // Cut inside the layer records, inside the channel data, and inside the merged image.
+    for cut in [10, 60, bytes.len() / 2, bytes.len() - 5] {
+        let name = format!("cut{cut}.psd");
+        let path = dir.write(&name, &bytes[..cut]);
+        let from_bytes = import(&name, &bytes[..cut]);
+        let from_file = open(&name, &path);
+        // The merged image is not read when the layers are what opens, so a file cut inside it
+        // can open from the file where the strict parse of its bytes refused it.
+        if from_bytes.is_ok() {
+            assert!(from_file.is_ok(), "cut at {cut}");
+        }
+    }
+}
+
+#[test]
+fn a_cancelled_import_file_reports_cancelled() {
+    let dir = TempDir::new("cancel");
+    let bytes = testgen::small(photocraft_psd::Version::Psd, photocraft_psd::Compression::Zip).to_bytes().unwrap();
+    let path = dir.write("c.psd", &bytes);
+    let cancel = || true;
+    let ctl = Interrupt::cancel_only(&cancel);
+    assert!(matches!(import_file("c.psd", &path, &photocraft_io::ImportOptions::default(), &ctl), Err(photocraft_io::IoError::Cancelled)));
+}
+
+/// A read that fails while the layers are decoded from the file (it is truncated or rewritten,
+/// its drive goes away) fails the open: no layer is left empty for a save to lose.
+#[test]
+fn a_read_failing_while_layers_decode_fails_the_open() {
+    use photocraft_psd::ReadAt;
+    /// The file's bytes, failing every read of channel data (as a dropped network share or a
+    /// truncated file would) except the 2-byte compression fields the parse reads.
+    struct Failing {
+        bytes: Vec<u8>,
+        data: Vec<(u64, u64)>,
+    }
+    impl ReadAt for Failing {
+        fn len(&self) -> u64 {
+            self.bytes.len() as u64
+        }
+        fn read_at(&self, offset: u64, buf: &mut [u8]) -> photocraft_psd::Result<()> {
+            let end = offset + buf.len() as u64;
+            if self.data.iter().any(|&(a, b)| offset < b && end > a) {
+                return Err(photocraft_psd::PsdError::Read("the drive went away".into()));
+            }
+            self.bytes.as_slice().read_at(offset, buf)
+        }
+    }
+    for c in [photocraft_psd::Compression::Rle, photocraft_psd::Compression::Raw, photocraft_psd::Compression::Zip] {
+        let file = testgen::layered(photocraft_psd::Version::Psd, photocraft_psd::ColorMode::Rgb, 8, c);
+        let bytes = file.to_bytes().unwrap();
+        let lazy = photocraft_psd::PsdFile::from_source(photocraft_psd::Source::new(bytes.clone())).unwrap();
+        let data: Vec<(u64, u64)> = lazy
+            .layers()
+            .iter()
+            .flat_map(|l| &l.channels)
+            .filter_map(|ch| ch.stored.as_ref())
+            .filter(|s| s.len > 0)
+            .map(|s| (s.offset, s.offset + s.len))
+            .collect();
+        assert!(!data.is_empty());
+        // Opening the same file whole succeeds: only the failed reads fail the open.
+        assert!(import("x.psd", &bytes).is_ok());
+        let r = photocraft_io::import_source_for_open_with("x.psd", photocraft_psd::Source::new(Failing { bytes, data }), &Interrupt::NONE);
+        match r {
+            Err(photocraft_io::IoError::Read(msg)) => assert!(msg.contains("the drive went away"), "{c:?}: {msg}"),
+            r => panic!("{c:?}: the open didn't fail: {:?}", r.map(|(r, damaged)| (r.warnings, damaged))),
+        }
+    }
+}
diff --git a/crates/io/tests/it/psd_structure.rs b/crates/io/tests/it/psd_structure.rs
index a110fbd367..e263f83a6b 100644
--- a/crates/io/tests/it/psd_structure.rs
+++ b/crates/io/tests/it/psd_structure.rs
@@ -658,7 +658,7 @@ fn fill_layer_keeps_photoshop_pixels() {
         VersionedDescriptor::new(Descriptor::new("null").with("Clr ", Value::Descriptor(c))).to_bytes()
     };
     // Photoshop-rendered pixels deliberately differ from the parametric fill.
-    let plane = |v: u8| ChannelData { id: 0, compression: Some(Compression::Raw), data: vec![v; 4] };
+    let plane = |v: u8| ChannelData::new(0, Some(Compression::Raw), vec![v; 4]);
     let mut chans = vec![plane(255), plane(10), plane(20), plane(30)];
     for (i, c) in chans.iter_mut().enumerate() {
         c.id = i as i16 - 1;
@@ -762,7 +762,7 @@ fn merged_composite_unmattes_photoshop_white() {
     let mut f = testgen::merged_only(Version::Psd, ColorMode::Rgb, 8, Compression::Raw, 1, 1);
     f.header.channels = 4;
     // straight red at alpha 0.5, matted: r = 1, g = b = 0.5
-    f.image_data = photocraft_psd::ImageData { compression: Compression::Raw, data: vec![255, 128, 128, 128] };
+    f.image_data = photocraft_psd::ImageData::new(Compression::Raw, vec![255, 128, 128, 128]);
     let m = merged_composite(&f).unwrap();
     assert!((m[0][0] - 1.0).abs() < 0.01 && m[0][1] < 0.01 && m[0][2] < 0.01, "{:?}", m[0]);
     let (d, _) = psd_to_document(&f);
@@ -772,8 +772,7 @@ fn merged_composite_unmattes_photoshop_white() {
     // HDR and negative straight samples must survive the actual F32 PSD import boundary.
     let mut hdr = testgen::merged_only(Version::Psd, ColorMode::Rgb, 32, Compression::Raw, 1, 1);
     hdr.header.channels = 4;
-    hdr.image_data =
-        photocraft_psd::ImageData { compression: Compression::Raw, data: [1.5_f32, 0.25, 0.5, 0.5].into_iter().flat_map(f32::to_be_bytes).collect() };
+    hdr.image_data = photocraft_psd::ImageData::new(Compression::Raw, [1.5_f32, 0.25, 0.5, 0.5].into_iter().flat_map(f32::to_be_bytes).collect());
     assert_eq!(merged_composite(&hdr).unwrap(), vec![[2.0, -0.5, 0.0, 0.5]]);
     let mut deep = testgen::merged_only(Version::Psd, ColorMode::Rgb, 16, Compression::Raw, 1, 1);
     deep.header.channels = 4;
@@ -793,7 +792,7 @@ fn vector_rendered_mask_not_doubled_on_shapes() {
     f.layers_mut().push(LayerRecord {
         name: b"shape".to_vec(),
         mask: photocraft_psd::MaskData::Mask(mask),
-        channels: vec![photocraft_psd::ChannelData { id: -2, compression: Some(Compression::Raw), data: vec![] }],
+        channels: vec![photocraft_psd::ChannelData::new(-2, Some(Compression::Raw), vec![])],
         blocks: vec![TaggedBlock::unicode_name("shape"), TaggedBlock::new(*b"SoCo", vec![]), TaggedBlock::new(*b"vmsk", vec![0; 8])],
         ..Default::default()
     });
@@ -805,7 +804,7 @@ fn vector_rendered_mask_not_doubled_on_shapes() {
     let record = f.layers_mut().last_mut().unwrap();
     let photocraft_psd::MaskData::Mask(mask) = &mut record.mask else { panic!("fixture has a mask") };
     mask.real = Some(photocraft_psd::RealMask { flags: 0, background: 255, rect: photocraft_psd::Rect { top: 0, left: 0, bottom: 1, right: 1 } });
-    record.channels.push(photocraft_psd::ChannelData { id: -3, compression: Some(Compression::Raw), data: vec![64] });
+    record.channels.push(photocraft_psd::ChannelData::new(-3, Some(Compression::Raw), vec![64]));
     let (imported, _) = psd_to_document(&f);
     assert_eq!(imported.layers.last().unwrap().content.kind_name(), "Shape");
     let mask = imported.layers.last().unwrap().mask.as_ref().expect("selected real mask must survive synthetic cleanup");
diff --git a/crates/io/tests/it/psd_unknown_adjustment.rs b/crates/io/tests/it/psd_unknown_adjustment.rs
index 8b1f0cbdd3..58bc909c57 100644
--- a/crates/io/tests/it/psd_unknown_adjustment.rs
+++ b/crates/io/tests/it/psd_unknown_adjustment.rs
@@ -77,7 +77,7 @@ fn pixel_layers_with_unknown_blocks_stay_pixel_layers() {
     // A normal pixel layer (pixels, flag clear) carrying an unknown block.
     f.layers_mut()[0].blocks.push(extra());
     // Flagged but with pixels: never dropped for an adjustment.
-    let plane = |id: i16| ChannelData { id, compression: Some(Compression::Raw), data: vec![200; 4] };
+    let plane = |id: i16| ChannelData::new(id, Some(Compression::Raw), vec![200; 4]);
     let mut painted = adjustment_record("painted", vec![extra()]);
     painted.rect = Rect::from_xywh(0, 0, 2, 2);
     painted.channels = (-1..3).map(plane).collect();
diff --git a/crates/io/tests/it/svg.rs b/crates/io/tests/it/svg.rs
index c71bb0ae4f..5c695d1526 100644
--- a/crates/io/tests/it/svg.rs
+++ b/crates/io/tests/it/svg.rs
@@ -328,6 +328,66 @@ fn gzip_compressed_embedded_svg_decompresses_once_with_a_size_cap() {
     assert!(r.document.layers.iter().all(|l| !matches!(l.content, LayerContent::Raster(_))), "{:?}", r.document.layers);
 }
 
+/// usvg parses an SVG embedded as a `data:` image on its own, past the drawing's depth check:
+/// 20 000 nested groups in it overflowed a 2 MB thread stack, an abort nothing can catch. The
+/// embedded SVG gets the same check now, so the image is dropped and the drawing opens.
+#[test]
+fn deeply_nested_embedded_svg_is_dropped_not_a_stack_overflow() {
+    let deep = nested(20_000);
+    let percent: String = deep.bytes().map(|b| if b.is_ascii_alphanumeric() { char::from(b).to_string() } else { format!("%{b:02X}") }).collect();
+    let urls = [
+        format!("data:image/svg+xml,{percent}"),
+        base64_data_url("image/svg+xml", deep.as_bytes()),
+        base64_data_url("text/plain", deep.as_bytes()),
+        base64_data_url("image/svg+xml", &gzip(deep.as_bytes())),
+        base64_data_url("text/plain", &gzip(deep.as_bytes())),
+    ];
+    let embed = |url: &str| format!("<svg {NS} width=\"8\" height=\"8\"><image width=\"8\" height=\"8\" href=\"{url}\"/></svg>");
+    std::thread::Builder::new()
+        .stack_size(2 << 20)
+        .spawn(move || {
+            for url in &urls {
+                let r = open(&embed(url));
+                assert!(r.document.layers.iter().all(|l| !matches!(l.content, LayerContent::Raster(_))), "{}: {:?}", &url[..20], r.document.layers);
+            }
+            // Just inside the limit (the drawing's own `<svg>` takes one level) the embedded
+            // drawing still renders (its rect is black).
+            let r = open(&embed(&base64_data_url("image/svg+xml", nested(svg::MAX_XML_DEPTH - 2).as_bytes())));
+            assert!(close(px(&r.document, 4, 4), [0.0, 0.0, 0.0, 1.0]), "{:?}", px(&r.document, 4, 4));
+        })
+        .unwrap()
+        .join()
+        .unwrap();
+    // A PNG sent as `text/plain` is still an image, not markup to count.
+    let r = open(&format!(
+        "<svg {NS} width=\"8\" height=\"8\"><image width=\"8\" height=\"8\" image-rendering=\"pixelated\" href=\"{}\"/></svg>",
+        png_data_url().replace("image/png", "text/plain")
+    ));
+    assert!(close(px(&r.document, 1, 1), [1.0, 0.0, 0.0, 1.0]), "{:?}", px(&r.document, 1, 1));
+}
+
+/// The embedded SVG is parsed on top of the drawing's own recursion, so the two depths share
+/// [`svg::MAX_XML_DEPTH`]: 511 + 511 groups, each fine alone, overflowed a 1 MB thread stack.
+#[test]
+fn an_embedded_svg_gets_only_the_nesting_depth_the_drawing_left() {
+    let embed = |outer: usize, inner: usize| {
+        let url = base64_data_url("image/svg+xml", nested(inner).as_bytes());
+        format!("<svg {NS} width=\"8\" height=\"8\">{}<image width=\"8\" height=\"8\" href=\"{url}\"/>{}</svg>", "<g>".repeat(outer), "</g>".repeat(outer))
+    };
+    std::thread::Builder::new()
+        .stack_size(1 << 20)
+        .spawn(move || {
+            let r = open(&embed(svg::MAX_XML_DEPTH - 1, svg::MAX_XML_DEPTH - 1));
+            assert!(px(&r.document, 4, 4)[3] < 0.01, "{:?}", px(&r.document, 4, 4));
+            // Within the shared budget the embedded drawing renders (its rect is black).
+            let r = open(&embed(250, 250));
+            assert!(close(px(&r.document, 4, 4), [0.0, 0.0, 0.0, 1.0]), "{:?}", px(&r.document, 4, 4));
+        })
+        .unwrap()
+        .join()
+        .unwrap();
+}
+
 /// 8 000 nested groups (70 KB) overflowed the XML parser's recursion on a 2 MB thread stack, an
 /// abort nothing can catch. It is an error now, found before the parser runs; the thread here
 /// has a small stack so a regression aborts the test instead of passing by luck.
@@ -372,6 +432,9 @@ fn svgz_is_inflated_with_a_size_cap() {
     let r = import("drawing.svgz", &gzip(plain.as_bytes())).unwrap();
     assert_eq!(r.document.layers.len(), 1);
     assert!(close(px(&r.document, 4, 4), [0.0, 0.0, 1.0, 1.0]));
+    let split = plain.len() / 2;
+    let members = [gzip(&plain.as_bytes()[..split]), gzip(&plain.as_bytes()[split..])].concat();
+    assert!(close(px(&import("members.svgz", &members).unwrap().document, 4, 4), [0.0, 0.0, 1.0, 1.0]));
     // A bomb: a few hundred KB of gzip holding more than the cap of whitespace.
     let mut bomb = format!("<svg {NS} width=\"8\" height=\"8\">").into_bytes();
     bomb.resize(usize::try_from(svg::MAX_INFLATED_BYTES).unwrap() + 1024, b' ');
diff --git a/crates/io/tests/it/tiff_layers.rs b/crates/io/tests/it/tiff_layers.rs
index 11e37591bc..70ec2fef2e 100644
--- a/crates/io/tests/it/tiff_layers.rs
+++ b/crates/io/tests/it/tiff_layers.rs
@@ -468,7 +468,6 @@ fn dtf_like_spot_is_written_in_full() {
     use photocraft_color::{Color, PixelFormat};
     use photocraft_doc::{AlphaChannel, Layer};
     use photocraft_geom::{Rect, Size};
-    use photocraft_psd::tiff::resources_from_bytes;
     use photocraft_raster::Surface;
 
     let (w, h) = (900u32, 360u32);
@@ -501,77 +500,96 @@ fn dtf_like_spot_is_written_in_full() {
     channel.spot = Some((Color::rgb(1.0, 0.0, 0.0), 0.6));
     doc.channels.push(channel);
 
+    verify_dtf_exports(&doc, &spot_bytes, w, h);
+}
+
+fn assert_spot_resources(resources: &[u8], name: &str) {
+    use photocraft_psd::tiff::resources_from_bytes;
+    let (blocks, warnings) = resources_from_bytes(resources).unwrap();
+    assert!(warnings.is_empty(), "{name} {warnings:?}");
+    let block = |id: u16| blocks.iter().find(|b| b.id == id).unwrap_or_else(|| panic!("{name} missing {id}"));
+    // "Spot Color 1" is 12 characters: Photoshop stores 13 bytes and pads the 8BIM block, not the string.
+    assert_eq!(block(1006).data, b"\x0cSpot Color 1", "{name}");
+    assert_eq!(block(1045).data.len(), 30, "{name}");
+    let info = &block(1077).data;
+    assert_eq!(info.len(), 17, "{name}");
+    assert_eq!(u16::from_be_bytes([info[14], info[15]]), 60, "{name} solidity");
+    assert_eq!(info[16], 2, "{name} spot kind");
+    // Photoshop numbers a new document's channels from 3.
+    assert_eq!(block(1053).data, 3u32.to_be_bytes(), "{name} channel id");
+}
+
+fn verify_dtf_samples(bytes: &[u8], stored_spot: &[u8], w: u32, h: u32, name: &str) -> Vec<u8> {
+    let img = photocraft_codecs::decode(bytes).unwrap();
+    assert!(!img.layout().has_alpha(), "{name}: {:?}", img.layout());
+    assert_eq!(img.layout().color_channels(), 3, "{name}");
+    assert_eq!(img.meta.extra_samples.len(), 1, "{name}");
+    assert_eq!(img.meta.extra_samples[0].kind, 0, "{name}");
+    assert_eq!(img.meta.extra_samples[0].data, stored_spot, "{name} own decoder");
+    let (spp, bps, extra, rows, samples) = independent_samples(bytes);
+    assert_eq!(spp, 4, "{name}");
+    assert_eq!(bps, vec![8, 8, 8, 8], "{name}");
+    assert_eq!(extra, vec![0], "{name} ExtraSamples");
+    assert!(rows > 0 && rows < h, "{name} rows_per_strip {rows}");
+    assert_plane(&samples, 4, 3, stored_spot);
+    let at = (10 * w as usize + 10) * 4;
+    assert_eq!(&samples[at..at + 3], &[255, 255, 255], "{name} matted rgb");
+    samples
+}
+
+fn assert_dtf_channel(back: &Document, spot_bytes: &[u8], w: u32, h: u32, name: &str) {
+    use photocraft_geom::Rect;
+    assert_eq!(back.channels.len(), 1, "{name}");
+    assert_eq!(back.channels[0].name, "Spot Color 1");
+    let (ink, sol) = back.channels[0].spot.expect("spot");
+    assert_eq!(ink.to_rgb(), [1.0, 0.0, 0.0], "{name}");
+    assert!((sol - 0.6).abs() < 1e-4, "{name}");
+    let area = Rect::new(0, 0, w as i32, h as i32);
+    assert_eq!(back.channels[0].surface.to_interleaved(area), spot_bytes, "{name} reimport");
+}
+
+fn verify_dtf_layers(bytes: &[u8], layer_tag: Option<Vec<u8>>, back: &Document, layers: bool, name: &str) {
+    if layers {
+        let layer_tag = layer_tag.expect("layer tag");
+        let (isd, w) = ImageSourceData::from_bytes(&layer_tag).unwrap();
+        assert!(w.is_empty(), "{w:?}");
+        let info = isd.layer_info.expect("layers");
+        assert!(!info.merged_alpha, "{name}");
+        assert!(info.layers.iter().all(|l| l.flags.0 & 0x08 != 0), "{name} photoshop flag");
+        assert!(info.layers.iter().all(|l| l.blocks.iter().any(|b| &b.key == b"lnsr")), "{name} lnsr");
+        let mask = isd.global_layer_mask.expect("LMsk");
+        assert_eq!(mask.data.len(), 14, "{name}");
+        assert_eq!(mask.opacity(), Some(50));
+        assert_eq!(mask.kind(), Some(128));
+        assert_photoshop_layered_tiff(bytes, true);
+        assert_eq!(back.layers.len(), 2, "{name}");
+        let ink = back.layers.iter().find(|l| l.name == "Ink").expect("ink layer");
+        let px = ink.surface().expect("ink pixels").pixel(100, 100);
+        assert!((px[3] - 0.5).abs() < 0.02, "{name} layer alpha {px:?}");
+        let outside = ink.surface().expect("ink pixels").pixel(0, 0);
+        assert!(outside[3] < 0.02, "{name} transparent pixel {outside:?}");
+    } else {
+        assert!(layer_tag.is_none(), "{name}");
+    }
+}
+
+fn verify_dtf_exports(doc: &Document, spot_bytes: &[u8], w: u32, h: u32) {
     let mut seen = Vec::new();
     for (name, layers) in [("flat", false), ("layered", true)] {
         let opts = ExportOptions { tiff_layers: layers, ..ExportOptions::default() };
-        let r = export(&doc, "dtf.tif", &opts).unwrap();
+        let r = export(doc, "dtf.tif", &opts).unwrap();
         assert!(!r.warnings.iter().any(|w| w.contains("not written")), "{name}: {:?}", r.warnings);
-        let img = photocraft_codecs::decode(&r.bytes).unwrap();
-        assert!(!img.layout().has_alpha(), "{name}: {:?}", img.layout());
-        assert_eq!(img.layout().color_channels(), 3, "{name}");
-        assert_eq!(img.meta.extra_samples.len(), 1, "{name}");
-        assert_eq!(img.meta.extra_samples[0].kind, 0, "{name}");
         // Photoshop stores spot ink inverted: document 255 (solid) is file 0.
         let stored_spot: Vec<u8> = spot_bytes.iter().map(|b| 255 - b).collect();
-        assert_eq!(img.meta.extra_samples[0].data, stored_spot, "{name} own decoder");
 
-        let (spp, bps, extra, rows, samples) = independent_samples(&r.bytes);
-        assert_eq!(spp, 4, "{name}");
-        assert_eq!(bps, vec![8, 8, 8, 8], "{name}");
-        assert_eq!(extra, vec![0], "{name} ExtraSamples");
-        assert!(rows > 0 && rows < h, "{name} rows_per_strip {rows}");
-        assert_plane(&samples, 4, 3, &stored_spot);
+        let samples = verify_dtf_samples(&r.bytes, &stored_spot, w, h, name);
         seen.push(samples.clone());
-
-        // Outside the artwork the composite is matted to white (Save Transparency off). The
-        // spot at that pixel is not zero, so a reader that binds the name to the alpha fails.
-        let at = (10 * w as usize + 10) * 4;
-        assert_eq!(&samples[at..at + 3], &[255, 255, 255], "{name} matted rgb");
         let (resources, layer_tag) = tags(&r.bytes);
-        let resources = resources.expect("photoshop resources");
-        let (blocks, warnings) = resources_from_bytes(&resources).unwrap();
-        assert!(warnings.is_empty(), "{name} {warnings:?}");
-        let block = |id: u16| blocks.iter().find(|b| b.id == id).unwrap_or_else(|| panic!("{name} missing {id}"));
-        // "Spot Color 1" is 12 characters: Photoshop stores 13 bytes and pads the 8BIM block, not the string.
-        assert_eq!(block(1006).data, b"\x0cSpot Color 1", "{name}");
-        assert_eq!(block(1045).data.len(), 30, "{name}");
-        let info = &block(1077).data;
-        assert_eq!(info.len(), 17, "{name}");
-        assert_eq!(u16::from_be_bytes([info[14], info[15]]), 60, "{name} solidity");
-        assert_eq!(info[16], 2, "{name} spot kind");
-        // Photoshop numbers a new document's channels from 3.
-        assert_eq!(block(1053).data, 3u32.to_be_bytes(), "{name} channel id");
+        assert_spot_resources(&resources.expect("photoshop resources"), name);
 
         let back = import("dtf.tif", &r.bytes).unwrap().document;
-        assert_eq!(back.channels.len(), 1, "{name}");
-        assert_eq!(back.channels[0].name, "Spot Color 1");
-        let (ink, sol) = back.channels[0].spot.expect("spot");
-        assert_eq!(ink.to_rgb(), [1.0, 0.0, 0.0], "{name}");
-        assert!((sol - 0.6).abs() < 1e-4, "{name}");
-        let area = Rect::new(0, 0, w as i32, h as i32);
-        assert_eq!(back.channels[0].surface.to_interleaved(area), spot_bytes, "{name} reimport");
-        if layers {
-            let layer_tag = layer_tag.expect("layer tag");
-            let (isd, w) = ImageSourceData::from_bytes(&layer_tag).unwrap();
-            assert!(w.is_empty(), "{w:?}");
-            let info = isd.layer_info.expect("layers");
-            assert!(!info.merged_alpha, "{name}");
-            assert!(info.layers.iter().all(|l| l.flags.0 & 0x08 != 0), "{name} photoshop flag");
-            assert!(info.layers.iter().all(|l| l.blocks.iter().any(|b| &b.key == b"lnsr")), "{name} lnsr");
-            let mask = isd.global_layer_mask.expect("LMsk");
-            assert_eq!(mask.data.len(), 14, "{name}");
-            assert_eq!(mask.opacity(), Some(50));
-            assert_eq!(mask.kind(), Some(128));
-            assert_photoshop_layered_tiff(&r.bytes, true);
-            assert_eq!(back.layers.len(), 2, "{name}");
-            let ink = back.layers.iter().find(|l| l.name == "Ink").expect("ink layer");
-            let px = ink.surface().expect("ink pixels").pixel(100, 100);
-            assert!((px[3] - 0.5).abs() < 0.02, "{name} layer alpha {px:?}");
-            let outside = ink.surface().expect("ink pixels").pixel(0, 0);
-            assert!(outside[3] < 0.02, "{name} transparent pixel {outside:?}");
-        } else {
-            assert!(layer_tag.is_none(), "{name}");
-        }
+        assert_dtf_channel(&back, spot_bytes, w, h, name);
+        verify_dtf_layers(&r.bytes, layer_tag, &back, layers, name);
     }
     assert_eq!(seen[0], seen[1], "flat and layered IFD samples differ");
 }
diff --git a/crates/ops/src/lib.rs b/crates/ops/src/lib.rs
index 86c930b0e9..6dacd3ec97 100644
--- a/crates/ops/src/lib.rs
+++ b/crates/ops/src/lib.rs
@@ -33,6 +33,9 @@ pub struct HistoryState {
     pub doc: Arc<Document>,
     /// The layers targeted when this state was created.
     pub layers: LayerTarget,
+    /// The layers whose visibility the step that created this state changed, as stepping to this
+    /// state from the one before it in the list must apply it; see [`History::current_visibility`].
+    pub visibility: Vec<LayerId>,
     /// Stable while the state is held: indices shift when older states fall off, ids don't.
     pub id: u64,
 }
@@ -52,6 +55,16 @@ pub struct History {
     current_label: String,
     /// The layers targeted when the current document was created (opened or edited).
     current_layers: LayerTarget,
+    /// [`HistoryState::visibility`] of the current state.
+    current_visibility: Vec<LayerId>,
+    /// History Options › Allow Non-Linear History: a step recorded while later states exist
+    /// (after stepping back) keeps them and goes to the end of the list, instead of discarding
+    /// them; see [`History::record`] and [`History::remove`].
+    pub non_linear: bool,
+    /// The most recent [`History::record`], while it is still the latest change to the list;
+    /// `None` once anything else changed it. [`History::rollback`] needs it to take the step back
+    /// exactly.
+    last_record: Option<LastRecord>,
     /// The states History panel › Clear History took off the list, kept so the next undo puts
     /// them back (Clear History is itself undoable). Any new step drops them.
     cleared: Option<Box<Cleared>>,
@@ -63,6 +76,21 @@ pub struct History {
     brush_source: Option<u64>,
 }
 
+/// What [`History::rollback`] needs to take the most recent [`History::record`] back.
+#[derive(Clone, Debug)]
+struct LastRecord {
+    /// The document it replaced (the state a rollback makes current again).
+    before: Arc<Document>,
+    /// How many former redo states it moved onto the undo side (always 0 in linear history).
+    moved: usize,
+    /// The states it (and the [`History::trim`] after it) dropped for the state limit or the
+    /// byte budget, in the order they were taken off, each with its index in the undo list at
+    /// that moment (not always the front: the History Brush's source is never dropped).
+    /// Their tiles are no longer counted; they are only held until the next change to the
+    /// list, so a rollback can put them back where they were.
+    evicted: Vec<(usize, HistoryState)>,
+}
+
 /// The undo and redo states [`History::clear_states`] removed, and the History Brush source set
 /// before it.
 #[derive(Clone, Debug)]
@@ -91,6 +119,9 @@ impl History {
             max_bytes: 0,
             current_label: "Open".into(),
             current_layers: LayerTarget::default(),
+            current_visibility: Vec::new(),
+            non_linear: false,
+            last_record: None,
             cleared: None,
             current_id: 0,
             next_id: 1,
@@ -100,6 +131,11 @@ impl History {
 
     /// Record that `before` was replaced by a new current document via step `label`, which left
     /// `layers` targeted.
+    ///
+    /// Linear history (the default) discards the redo states, as Photoshop does when you edit
+    /// after selecting an earlier state. With [`History::non_linear`] they are kept: the list
+    /// reads `…, before, the former redo states (oldest first), the new step`, so the new step is
+    /// appended at the end and every earlier state can still be stepped to.
     pub fn record(&mut self, label: impl Into<String>, before: Arc<Document>, layers: LayerTarget) {
         if self.max_bytes == 0 {
             self.tiles = None;
@@ -113,19 +149,36 @@ impl History {
         }
         let prev_label = std::mem::replace(&mut self.current_label, label.into());
         let prev_layers = std::mem::replace(&mut self.current_layers, layers);
+        let prev_visibility = std::mem::take(&mut self.current_visibility);
         let prev_id = std::mem::replace(&mut self.current_id, self.next_id);
         self.next_id = self.next_id.wrapping_add(1);
-        self.undo.push_back(HistoryState { label: prev_label, doc: before, layers: prev_layers, id: prev_id });
-        self.clear_redo();
+        self.undo.push_back(HistoryState { label: prev_label, doc: before.clone(), layers: prev_layers, visibility: prev_visibility, id: prev_id });
+        let mut moved = 0;
+        if self.non_linear {
+            // `redo` holds the next state last; the list order is oldest first. Their tiles stay
+            // counted: they only move from the redo side to the undo side.
+            while let Some(state) = self.redo.pop() {
+                // The new step follows the last of them in the list but was made from `before`:
+                // stepping back to them walks back over their steps.
+                merge_ids(&mut self.current_visibility, &state.visibility);
+                self.undo.push_back(state);
+                moved += 1;
+            }
+        } else {
+            self.clear_redo();
+        }
+        let mut evicted = Vec::new();
         while self.undo.len() > self.max_states {
             // The History Brush's source doesn't fall off (as in Photoshop): the next oldest does.
             let pinned = self.max_states > 1 && self.undo.front().is_some_and(|s| Some(s.id) == self.brush_source);
-            if let Some(state) = self.undo.remove(usize::from(pinned))
-                && let Some(tiles) = &mut self.tiles
-            {
+            let at = usize::from(pinned);
+            let Some(state) = self.undo.remove(at) else { break };
+            if let Some(tiles) = &mut self.tiles {
                 tiles.remove(&state.doc);
             }
+            evicted.push((at, state));
         }
+        self.last_record = Some(LastRecord { before, moved, evicted });
     }
 
     pub fn can_undo(&self) -> bool {
@@ -154,6 +207,21 @@ impl History {
         self.current_layers = layers;
     }
 
+    /// The layers whose visibility the step that produced the current document changed, as the
+    /// session reported them with [`History::add_current_visibility`]. With History Options ›
+    /// Make Layer Visibility Changes Undoable off, showing or hiding a layer is not a step, so
+    /// stepping through history keeps every other layer's visibility as it is; these layers take
+    /// the visibility of the state stepped to, since a recorded step changed them.
+    pub fn current_visibility(&self) -> &[LayerId] {
+        &self.current_visibility
+    }
+
+    /// Note layers whose visibility the current step changed (after [`History::record`], and
+    /// again when a later change coalesces into the step).
+    pub fn add_current_visibility(&mut self, ids: &[LayerId]) {
+        merge_ids(&mut self.current_visibility, ids);
+    }
+
     /// Undo: `current` becomes redoable; returns the document to make current and the layers it
     /// targeted when it was created.
     pub fn undo(&mut self, current: Arc<Document>) -> Option<(Arc<Document>, LayerTarget)> {
@@ -167,28 +235,32 @@ impl History {
             return Some((current, self.current_layers.clone()));
         }
         let prev = self.undo.pop_back()?;
+        self.last_record = None;
         if let Some(tiles) = &mut self.tiles {
             tiles.remove(&prev.doc);
             tiles.add(&current);
         }
         let label = std::mem::replace(&mut self.current_label, prev.label);
         let layers = std::mem::replace(&mut self.current_layers, prev.layers.clone());
+        let visibility = std::mem::replace(&mut self.current_visibility, prev.visibility);
         let id = std::mem::replace(&mut self.current_id, prev.id);
-        self.redo.push(HistoryState { label, doc: current, layers, id });
+        self.redo.push(HistoryState { label, doc: current, layers, visibility, id });
         Some((prev.doc, prev.layers))
     }
 
     /// Redo: the mirror of [`Self::undo`].
     pub fn redo(&mut self, current: Arc<Document>) -> Option<(Arc<Document>, LayerTarget)> {
         let next = self.redo.pop()?;
+        self.last_record = None;
         if let Some(tiles) = &mut self.tiles {
             tiles.remove(&next.doc);
             tiles.add(&current);
         }
         let label = std::mem::replace(&mut self.current_label, next.label);
         let layers = std::mem::replace(&mut self.current_layers, next.layers.clone());
+        let visibility = std::mem::replace(&mut self.current_visibility, next.visibility);
         let id = std::mem::replace(&mut self.current_id, next.id);
-        self.undo.push_back(HistoryState { label, doc: current, layers, id });
+        self.undo.push_back(HistoryState { label, doc: current, layers, visibility, id });
         Some((next.doc, next.layers))
     }
 
@@ -270,6 +342,7 @@ impl History {
     /// last step can no longer be undone and its pixels are released.
     pub fn purge_last(&mut self) -> bool {
         self.clear_redo();
+        self.last_record = None;
         if self.cleared.take().is_some() {
             self.tiles = None;
             return true;
@@ -278,11 +351,118 @@ impl History {
         if let Some(tiles) = &mut self.tiles {
             tiles.remove(&state.doc);
         }
+        // The current step now starts where the purged one did.
+        merge_ids(&mut self.current_visibility, &state.visibility);
         true
     }
 
+    /// Delete the past state at entry `i` (indexed like [`History::entries`]) and nothing else,
+    /// as the History panel's Delete does in non-linear history. The current state is not held
+    /// here (the session steps back first) and the oldest state can't be removed this way
+    /// either, since every later state would lose its starting point in the list. Returns
+    /// whether a state was removed.
+    pub fn remove(&mut self, i: usize) -> bool {
+        if i == 0 {
+            return false;
+        }
+        let Some(state) = self.undo.remove(i) else { return false };
+        self.last_record = None;
+        if let Some(tiles) = &mut self.tiles {
+            tiles.remove(&state.doc);
+        }
+        // The state after it now follows the one before it.
+        match self.undo.get_mut(i) {
+            Some(next) => merge_ids(&mut next.visibility, &state.visibility),
+            None => merge_ids(&mut self.current_visibility, &state.visibility),
+        }
+        true
+    }
+
+    /// Delete the later (redo) state `j` (0 = the next redo, as [`History::redo_labels`] lists
+    /// them) and nothing else: the History panel's Delete on a dimmed state in non-linear
+    /// history. Returns whether a state was removed.
+    pub fn remove_later(&mut self, j: usize) -> bool {
+        let Some(k) = self.redo.len().checked_sub(j.saturating_add(1)) else { return false };
+        let state = self.redo.remove(k);
+        self.last_record = None;
+        if let Some(tiles) = &mut self.tiles {
+            tiles.remove(&state.doc);
+        }
+        // The state after it in the list (the one before it in `redo`) now follows the state
+        // before it.
+        if let Some(next) = k.checked_sub(1).and_then(|n| self.redo.get_mut(n)) {
+            merge_ids(&mut next.visibility, &state.visibility);
+        }
+        true
+    }
+
+    /// Step back like [`History::undo`] but drop the current document instead of making it
+    /// redoable: the current state is deleted while the redo states (later states in the
+    /// list) stay. Returns the document to make current and the layers it targeted.
+    pub fn drop_current(&mut self) -> Option<(Arc<Document>, LayerTarget)> {
+        let prev = self.undo.pop_back()?;
+        self.last_record = None;
+        if let Some(tiles) = &mut self.tiles {
+            tiles.remove(&prev.doc);
+        }
+        self.current_label = prev.label;
+        self.current_layers = prev.layers.clone();
+        self.current_id = prev.id;
+        let dropped = std::mem::replace(&mut self.current_visibility, prev.visibility);
+        // The next later state now follows `prev`.
+        if let Some(next) = self.redo.last_mut() {
+            merge_ids(&mut next.visibility, &dropped);
+        }
+        Some((prev.doc, prev.layers))
+    }
+
+    /// Take back the most recent [`History::record`] exactly, for a compound command whose later
+    /// part failed: the document it replaced becomes current again, the current document is
+    /// dropped (nothing to redo), and in non-linear history the states that record moved from
+    /// the redo side go back there, so the list reads as before the command, with the oldest
+    /// states the state limit or the byte budget dropped for it back too. Returns `None`
+    /// (changing nothing) when something else changed the list since that record, e.g. an undo;
+    /// the caller then falls back to [`History::undo`].
+    pub fn rollback(&mut self) -> Option<(Arc<Document>, LayerTarget)> {
+        let held = self.last_record.as_ref()?;
+        if self.undo.len().saturating_add(held.evicted.len()) <= held.moved {
+            return None;
+        }
+        let LastRecord { moved, evicted, .. } = self.last_record.take()?;
+        // Put each back where it was taken off, the last one taken off first.
+        for (at, state) in evicted.into_iter().rev() {
+            if let Some(tiles) = &mut self.tiles {
+                tiles.add(&state.doc);
+            }
+            self.undo.insert(at.min(self.undo.len()), state);
+        }
+        for _ in 0..moved {
+            // Tiles stay counted: they only move back to the redo side.
+            let state = self.undo.pop_back()?;
+            self.redo.push(state);
+        }
+        let prev = self.undo.pop_back()?;
+        if let Some(tiles) = &mut self.tiles {
+            tiles.remove(&prev.doc);
+        }
+        self.current_label = prev.label;
+        self.current_layers = prev.layers.clone();
+        self.current_visibility = prev.visibility;
+        self.current_id = prev.id;
+        Some((prev.doc, prev.layers))
+    }
+
+    /// The document the most recent [`History::record`] replaced, while [`History::rollback`]
+    /// can still take that record back.
+    pub fn recorded_before(&self) -> Option<Arc<Document>> {
+        self.last_record.as_ref().map(|held| held.before.clone())
+    }
+
     /// Forget the redo states, e.g. after undoing half of a compound step that failed.
     pub fn clear_redo(&mut self) {
+        if !self.redo.is_empty() {
+            self.last_record = None;
+        }
         if let Some(tiles) = &mut self.tiles {
             for state in &self.redo {
                 tiles.remove(&state.doc);
@@ -295,6 +475,8 @@ impl History {
     /// goes back to the default, the oldest state held (now the current one): a source set on a
     /// state the purge removed would otherwise leave no source.
     pub fn clear(&mut self) {
+        self.last_record = None;
+        self.current_visibility.clear();
         self.undo.clear();
         self.redo.clear();
         self.tiles = None;
@@ -320,6 +502,7 @@ impl History {
         let redo = std::mem::take(&mut self.redo);
         let brush_source = self.brush_source.take();
         self.cleared = Some(Box::new(Cleared { undo, redo, brush_source }));
+        self.last_record = None;
         self.tiles = None;
         true
     }
@@ -462,6 +645,11 @@ impl History {
             } else {
                 tiles.remove(&state.doc);
                 dropped += 1;
+                // Held for a rollback of the step that pushed them out. Taking them off from the
+                // highest index down keeps each index valid, so a rollback can insert them back.
+                if let Some(held) = &mut self.last_record {
+                    held.evicted.push((i, state));
+                }
             }
         }
         *undo = kept;
@@ -469,6 +657,15 @@ impl History {
     }
 }
 
+/// Add the ids of `from` that `into` lacks.
+fn merge_ids(into: &mut Vec<LayerId>, from: &[LayerId]) {
+    for id in from {
+        if !into.contains(id) {
+            into.push(*id);
+        }
+    }
+}
+
 /// Bytes of the pixel tiles of `doc` (layers, masks, fill caches, smart filter masks, alpha channels, selection) not already in `seen`.
 fn tile_bytes(doc: &Document, seen: &mut HashSet<usize>) -> usize {
     let mut n = 0usize;
diff --git a/crates/ops/src/tests.rs b/crates/ops/src/tests.rs
index 1bd6e3ff26..7cb1fc328a 100644
--- a/crates/ops/src/tests.rs
+++ b/crates/ops/src/tests.rs
@@ -233,6 +233,321 @@ fn new_edit_clears_redo() {
     assert_eq!(h.entries(), vec!["Open".to_string(), "B".to_string()]);
 }
 
+/// Open, A, B, C, then two steps back: A is current, B and C are redo states.
+fn stepped_back(non_linear: bool) -> (History, Arc<Document>) {
+    let mut h = History { non_linear, ..History::default() };
+    let mut cur = Arc::new(base());
+    for n in ["A", "B", "C"] {
+        edit(&mut h, &mut cur, n, |d| d.name = n.to_lowercase());
+    }
+    cur = h.undo(cur).unwrap().0;
+    cur = h.undo(cur).unwrap().0;
+    assert_eq!(cur.name, "a");
+    (h, cur)
+}
+
+#[test]
+fn non_linear_history_keeps_later_states_and_appends_the_new_step() {
+    let (mut h, mut cur) = stepped_back(true);
+    edit(&mut h, &mut cur, "D", |d| d.name = format!("{}+d", d.name));
+    assert_eq!(h.entries(), ["Open", "A", "B", "C", "D"], "B and C are kept, D goes to the end");
+    assert!(!h.can_redo());
+    assert_eq!(cur.name, "a+d", "D was made from the state selected (A), not from C");
+    // Stepping back walks the list: C, B, A, Open, each with its own document.
+    let mut names = Vec::new();
+    while let Some((d, _)) = h.undo(cur.clone()) {
+        cur = d;
+        names.push(cur.name.clone());
+    }
+    assert_eq!(names, ["c", "b", "a", "h"]);
+    // Linear history (the default) discards them.
+    let (mut h, mut cur) = stepped_back(false);
+    edit(&mut h, &mut cur, "D", |d| d.name = "d".into());
+    assert_eq!(h.entries(), ["Open", "A", "D"]);
+}
+
+#[test]
+fn non_linear_steps_respect_the_state_limit_and_the_tile_counter() {
+    let mut h = History::new(3);
+    h.non_linear = true;
+    h.max_bytes = usize::MAX;
+    let mut cur = Arc::new(base());
+    for i in 0..4 {
+        edit(&mut h, &mut cur, &format!("paint {i}"), |d| {
+            d.layers[0].surface_mut().unwrap().write_pixel(1, 1, &[i as f32 / 8.0, 0.0, 0.0, 1.0]);
+        });
+        h.trim(&cur);
+    }
+    cur = h.undo(cur).unwrap().0;
+    cur = h.undo(cur).unwrap().0;
+    edit(&mut h, &mut cur, "branch", |d| d.name = "branch".into());
+    assert_eq!(h.past_len(), 3, "the oldest states beyond the limit go");
+    assert_eq!(h.entries(), ["paint 1", "paint 2", "paint 3", "branch"]);
+    assert_counter(&h, &cur);
+}
+
+#[test]
+fn remove_deletes_one_past_state_and_drop_current_keeps_the_redo_states() {
+    let (mut h, _) = stepped_back(true);
+    assert!(!h.remove(0), "the oldest state stays");
+    assert!(!h.remove(1), "the current state (A) is not held");
+    assert!(!h.remove(99));
+    let (mut h, mut cur) = stepped_back(true);
+    edit(&mut h, &mut cur, "D", |d| d.name = "d".into());
+    assert!(h.remove(1));
+    assert_eq!(h.entries(), ["Open", "B", "C", "D"]);
+    assert_eq!(h.state(1).unwrap().name, "b", "each state keeps its own document");
+    // Deleting the current state: the one before becomes current, the later ones stay.
+    let (mut h, _) = stepped_back(true);
+    let (d, _) = h.drop_current().unwrap();
+    assert_eq!(d.name, "h");
+    assert_eq!(h.entries(), ["Open"]);
+    assert_eq!(h.redo_labels().collect::<Vec<_>>(), ["B", "C"]);
+    assert!(h.drop_current().is_none(), "nothing before Open");
+    // The tile counter follows both.
+    let mut h = History::new(50);
+    h.non_linear = true;
+    h.max_bytes = usize::MAX;
+    let mut cur = Arc::new(base());
+    for i in 0..4 {
+        edit(&mut h, &mut cur, "Paint", |d| {
+            d.layers[0].surface_mut().unwrap().write_pixel(1, 1, &[i as f32 / 8.0, 0.0, 0.0, 1.0]);
+        });
+        h.trim(&cur);
+    }
+    cur = h.undo(cur).unwrap().0;
+    assert!(h.remove(2));
+    assert_counter(&h, &cur);
+    cur = h.drop_current().unwrap().0;
+    assert_counter(&h, &cur);
+}
+
+#[test]
+fn remove_later_deletes_one_redo_state() {
+    let mut h = History::new(50);
+    h.non_linear = true;
+    h.max_bytes = usize::MAX;
+    let mut cur = Arc::new(base());
+    for (i, n) in ["A", "B", "C"].into_iter().enumerate() {
+        edit(&mut h, &mut cur, n, |d| {
+            d.layers[0].surface_mut().unwrap().write_pixel(1, 1, &[i as f32 / 8.0, 0.0, 0.0, 1.0]);
+        });
+        h.trim(&cur);
+    }
+    cur = h.undo(cur).unwrap().0;
+    cur = h.undo(cur).unwrap().0;
+    assert!(!h.remove_later(2) && !h.remove_later(usize::MAX));
+    assert!(h.remove_later(0), "B");
+    assert_eq!(h.redo_labels().collect::<Vec<_>>(), ["C"]);
+    assert_counter(&h, &cur);
+    let (c, _) = h.redo(cur).unwrap();
+    assert_eq!(h.entries(), ["Open", "A", "C"]);
+    assert_counter(&h, &c);
+}
+
+/// Each state keeps the layers whose visibility its own step changed; when a state goes
+/// (Purge, a non-linear Delete) or a step is appended after the kept later states, the step
+/// that now follows covers the changes of the steps it now spans.
+#[test]
+fn step_visibility_follows_steps_and_spans_removed_ones() {
+    let vis = |h: &History| {
+        let mut v: Vec<u64> = h.current_visibility().iter().map(|l| l.0).collect();
+        v.sort_unstable();
+        v
+    };
+    // Open, then steps A, B, C, D changing layers 1, 2, 3, 4.
+    let steps = |n: usize, non_linear: bool| {
+        let mut h = History { non_linear, ..History::default() };
+        let mut cur = Arc::new(base());
+        for (i, label) in ["A", "B", "C", "D"].into_iter().take(n).enumerate() {
+            edit(&mut h, &mut cur, label, |d| d.name = label.to_lowercase());
+            h.add_current_visibility(&[LayerId(i as u64 + 1)]);
+        }
+        (h, cur)
+    };
+    let (mut h, cur) = steps(3, false);
+    assert_eq!(vis(&h), [3]);
+    let (cur, _) = h.undo(cur).unwrap();
+    assert_eq!(vis(&h), [2]);
+    h.redo(cur).unwrap();
+    assert_eq!(vis(&h), [3]);
+    // Purge: C now starts from A.
+    h.purge_last();
+    assert_eq!(vis(&h), [2, 3]);
+    // Non-linear Delete of B (between A and C): C now follows A.
+    let (mut h, cur) = steps(4, true);
+    assert!(h.remove(2));
+    h.undo(cur).unwrap();
+    assert_eq!(vis(&h), [2, 3]);
+    // Of the later B (A current): C follows A.
+    let (mut h, mut cur) = steps(3, true);
+    cur = h.undo(cur).unwrap().0;
+    cur = h.undo(cur).unwrap().0;
+    assert!(h.remove_later(0));
+    h.redo(cur).unwrap();
+    assert_eq!(vis(&h), [2, 3]);
+    // Of the current B (C later): A is current, C follows it.
+    let (mut h, cur) = steps(3, true);
+    h.undo(cur).unwrap();
+    let cur = h.drop_current().unwrap().0;
+    assert_eq!(vis(&h), [1]);
+    h.redo(cur).unwrap();
+    assert_eq!(vis(&h), [2, 3]);
+    // A step after the kept later states B and C (made from A) follows C in the list.
+    let (mut h, mut cur) = steps(3, true);
+    cur = h.undo(cur).unwrap().0;
+    cur = h.undo(cur).unwrap().0;
+    edit(&mut h, &mut cur, "D", |d| d.name = "d".into());
+    h.add_current_visibility(&[LayerId(4)]);
+    assert_eq!(vis(&h), [2, 3, 4]);
+    h.rollback().unwrap();
+    assert_eq!(vis(&h), [1], "rollback restores A's");
+    h.clear();
+    assert_eq!(vis(&h), Vec::<u64>::new());
+}
+
+#[test]
+fn rollback_takes_the_last_record_back_exactly_in_both_modes() {
+    // Non-linear, with redo states: the moved states go back to the redo side and the
+    // document the step replaced (A) is current again, not the last former redo state (C).
+    let (mut h, mut cur) = stepped_back(true);
+    let a = cur.clone();
+    let entries = h.entries();
+    let redo: Vec<String> = h.redo_labels().map(str::to_string).collect();
+    edit(&mut h, &mut cur, "D", |d| d.name = "d".into());
+    assert_eq!(h.recorded_before().map(|d| d.name.clone()).as_deref(), Some("a"));
+    let (d, _) = h.rollback().unwrap();
+    assert!(Arc::ptr_eq(&d, &a));
+    assert_eq!(h.entries(), entries);
+    assert_eq!(h.redo_labels().map(str::to_string).collect::<Vec<_>>(), redo);
+    assert!(h.rollback().is_none(), "only once");
+    // Redoing still walks the kept states.
+    let (b, _) = h.redo(d).unwrap();
+    assert_eq!(b.name, "b");
+    // Linear: the same as an undo whose redo state is dropped.
+    let (mut h, mut cur) = stepped_back(false);
+    edit(&mut h, &mut cur, "D", |d| d.name = "d".into());
+    assert_eq!(h.rollback().unwrap().0.name, "a");
+    assert_eq!(h.entries(), ["Open", "A"]);
+    assert!(!h.can_redo());
+    // Anything else since the record: no rollback (the caller undoes instead).
+    let (mut h, mut cur) = stepped_back(true);
+    edit(&mut h, &mut cur, "D", |d| d.name = "d".into());
+    cur = h.undo(cur).unwrap().0;
+    assert!(h.recorded_before().is_none() && h.rollback().is_none());
+    h.redo(cur).unwrap();
+    assert!(h.rollback().is_none());
+    // The tile counter follows.
+    let mut h = History::new(50);
+    h.non_linear = true;
+    h.max_bytes = usize::MAX;
+    let mut cur = Arc::new(base());
+    for i in 0..3 {
+        edit(&mut h, &mut cur, "Paint", |d| {
+            d.layers[0].surface_mut().unwrap().write_pixel(1, 1, &[i as f32 / 8.0, 0.0, 0.0, 1.0]);
+        });
+        h.trim(&cur);
+    }
+    cur = h.undo(cur).unwrap().0;
+    cur = h.undo(cur).unwrap().0;
+    edit(&mut h, &mut cur, "Paint", |d| {
+        d.layers[0].surface_mut().unwrap().write_pixel(2, 2, &[1.0, 0.0, 0.0, 1.0]);
+    });
+    cur = h.rollback().unwrap().0;
+    assert_counter(&h, &cur);
+}
+
+/// A failed compound command whose first step moved more later states than the state limit
+/// leaves room for (or whose step the byte budget trimmed for) is still taken back exactly:
+/// the states the limit dropped for it come back, as in the list before the command.
+#[test]
+fn rollback_brings_back_the_states_the_limit_dropped_for_the_step() {
+    for max in 1..=4 {
+        let (mut h, mut cur) = stepped_back(true);
+        h.max_states = max;
+        let a = cur.clone();
+        edit(&mut h, &mut cur, "D", |d| d.name = "d".into());
+        assert!(h.past_len() <= max);
+        assert_eq!(h.recorded_before().map(|d| d.name.clone()).as_deref(), Some("a"), "max {max}");
+        let (d, _) = h.rollback().unwrap();
+        assert!(Arc::ptr_eq(&d, &a), "max {max}: back on A, not on an Undo of C");
+        assert_eq!(h.entries(), ["Open", "A"], "max {max}");
+        assert_eq!(h.redo_labels().collect::<Vec<_>>(), ["B", "C"], "max {max}");
+        assert!(h.rollback().is_none());
+    }
+    // Once anything else changed the list, the dropped states stay dropped.
+    let (mut h, mut cur) = stepped_back(true);
+    h.max_states = 2;
+    edit(&mut h, &mut cur, "D", |d| d.name = "d".into());
+    cur = h.undo(cur).unwrap().0;
+    h.redo(cur).unwrap();
+    assert!(h.rollback().is_none());
+    assert_eq!(h.entries(), ["B", "C", "D"]);
+    // The byte budget: the trim after the step keeps only its newest state; the rollback
+    // brings back the rest and the tile counter follows.
+    let mut h = History { non_linear: true, ..History::default() };
+    let mut cur = Arc::new(base());
+    for (i, n) in ["A", "B", "C"].into_iter().enumerate() {
+        edit(&mut h, &mut cur, n, |d| {
+            d.layers[0].surface_mut().unwrap().write_pixel(1, 1, &[i as f32 / 8.0, 0.0, 0.0, 1.0]);
+        });
+    }
+    cur = h.undo(cur).unwrap().0;
+    cur = h.undo(cur).unwrap().0;
+    h.max_bytes = 1;
+    edit(&mut h, &mut cur, "D", |d| {
+        d.layers[0].surface_mut().unwrap().write_pixel(2, 2, &[1.0, 0.0, 0.0, 1.0]);
+    });
+    assert!(h.trim(&cur) > 0);
+    assert_eq!(h.entries(), ["C", "D"]);
+    assert_counter(&h, &cur);
+    cur = h.rollback().unwrap().0;
+    assert_eq!(h.entries(), ["Open", "A"]);
+    assert_eq!(h.redo_labels().collect::<Vec<_>>(), ["B", "C"]);
+    assert_counter(&h, &cur);
+}
+
+/// The History Brush's source never falls off, so the limit and the byte budget drop states
+/// behind it, not at the front; a rollback still puts each back where it was.
+#[test]
+fn rollback_puts_states_back_behind_the_pinned_brush_source() {
+    let (mut h, mut cur) = stepped_back(true);
+    assert!(h.set_brush_source(0));
+    h.max_states = 2;
+    let a = cur.clone();
+    edit(&mut h, &mut cur, "D", |d| d.name = "d".into());
+    assert_eq!(h.entries(), ["Open", "C", "D"], "A and B go, the source (Open) stays");
+    let (d, _) = h.rollback().unwrap();
+    assert!(Arc::ptr_eq(&d, &a));
+    assert_eq!(h.entries(), ["Open", "A"]);
+    assert_eq!(h.redo_labels().collect::<Vec<_>>(), ["B", "C"]);
+    assert_eq!(h.brush_source(), Some(0));
+    assert_eq!(h.state(0).unwrap().name, "h");
+    // The byte budget, with the source on the oldest state.
+    let mut h = History { non_linear: true, ..History::default() };
+    let mut cur = Arc::new(base());
+    for (i, n) in ["A", "B", "C"].into_iter().enumerate() {
+        edit(&mut h, &mut cur, n, |d| {
+            d.layers[0].surface_mut().unwrap().write_pixel(1, 1, &[i as f32 / 8.0, 0.0, 0.0, 1.0]);
+        });
+    }
+    cur = h.undo(cur).unwrap().0;
+    cur = h.undo(cur).unwrap().0;
+    assert!(h.set_brush_source(0));
+    h.max_bytes = 1;
+    edit(&mut h, &mut cur, "D", |d| {
+        d.layers[0].surface_mut().unwrap().write_pixel(2, 2, &[1.0, 0.0, 0.0, 1.0]);
+    });
+    assert!(h.trim(&cur) > 0);
+    assert_eq!(h.entries(), ["Open", "C", "D"]);
+    cur = h.rollback().unwrap().0;
+    assert_eq!(cur.name, "h");
+    assert_eq!(h.entries(), ["Open", "A"]);
+    assert_eq!(h.redo_labels().collect::<Vec<_>>(), ["B", "C"]);
+    assert_eq!(h.state(0).unwrap().name, "h");
+    assert_counter(&h, &cur);
+}
+
 #[test]
 fn max_states_bound() {
     let mut h = History::new(3);
diff --git a/crates/paint/examples/bench_brush.rs b/crates/paint/examples/bench_brush.rs
index a9360b45fb..efd9c010f1 100644
--- a/crates/paint/examples/bench_brush.rs
+++ b/crates/paint/examples/bench_brush.rs
@@ -8,7 +8,7 @@ use std::time::Instant;
 
 use photocraft_color::{PixelFormat, SampleType};
 use photocraft_geom::Rect;
-use photocraft_paint::*;
+use photocraft_paint::{BrushSettings, Dynamic, Scattering, ShapeDynamics, StrokePoint, StrokeRenderer, Texture, presets};
 use photocraft_raster::Surface;
 
 fn run(fmt: PixelFormat, label: &str, brush: &BrushSettings) {
diff --git a/crates/paint/src/brush_tests.rs b/crates/paint/src/brush_tests.rs
index d573e7cb3f..f384d527bb 100644
--- a/crates/paint/src/brush_tests.rs
+++ b/crates/paint/src/brush_tests.rs
@@ -1887,3 +1887,38 @@ fn resizing_with_bad_sizes_leaves_the_dual_tip_alone() {
     b.resize_with_dual_brush(50.0);
     assert_eq!(b.dual_brush.size, 20.0);
 }
+
+/// `touches` is true wherever `coverage_at` can be above 0, false only where it is 0 for sure.
+#[test]
+fn touches_covers_every_pixel_with_coverage() {
+    let b = BrushSettings { size: 6.0, ..brush() };
+    let mut r = StrokeRenderer::new(&b, None, 1.0);
+    r.push(&line(100.0, 300.0, 200.0));
+    r.finish();
+    for y in (0..400).step_by(3) {
+        for x in (0..500).step_by(3) {
+            if r.coverage_at(x, y) > 0.0 {
+                assert!(r.touches(Rect::new(x, y, x + 1, y + 1)), "({x}, {y})");
+            }
+        }
+    }
+    // Across the origin and tile edges (64 px): every pixel, both sides of each edge.
+    let mut o = StrokeRenderer::new(&b, None, 1.0);
+    o.push(&[StrokePoint::new(-70.0, -70.0, 1.0), StrokePoint::new(70.0, 70.0, 1.0)]);
+    o.finish();
+    for y in -140..140 {
+        for x in -140..140 {
+            if o.coverage_at(x, y) > 0.0 {
+                assert!(o.touches(Rect::new(x, y, x + 1, y + 1)), "({x}, {y})");
+            }
+        }
+    }
+    assert!(!o.touches(Rect::new(-128, 64, -64, 128)), "a tile the diagonal misses");
+    assert!(!o.touches(Rect::new(-200, -200, -128, -128)), "ends exactly at a tile edge");
+    assert!(o.touches(Rect::new(-200, -200, -127, -127)), "one pixel into the next tile");
+    assert!(r.touches(Rect::new(150, 199, 151, 201)));
+    assert!(!r.touches(Rect::new(0, 0, 50, 50)), "far from the stroke");
+    assert!(!r.touches(Rect::new(400, 400, 400, 400)), "empty");
+    assert!(r.touches(Rect::new(i32::MIN, i32::MIN, i32::MAX, i32::MAX)), "huge, without a huge scan");
+    assert!(!r.touches(Rect::new(1_000_000, 1_000_000, i32::MAX, i32::MAX)));
+}
diff --git a/crates/paint/src/presets.rs b/crates/paint/src/presets.rs
index dd87d2554e..e40902a78f 100644
--- a/crates/paint/src/presets.rs
+++ b/crates/paint/src/presets.rs
@@ -4,7 +4,10 @@
 //! Special Effects. Every preset is plain [`BrushSettings`] data, so it serialises, journals and
 //! can be edited like any user preset.
 
-use crate::brush::*;
+use crate::brush::{
+    BrushPreset, BrushSettings, ColorDynamics, Control, DualBrush, Dynamic, MaskMode, Pattern, PatternStyle, Scattering, ShapeDynamics, Smoothing, Texture,
+    TipShape, Transfer,
+};
 use crate::procedural::{bristle_tip, chalk_tip, charcoal_tip, grass_tip, leaf_tip, rake_tip, spatter_tip, sponge_tip, star_tip};
 
 /// Preset groups, in panel order.
diff --git a/crates/paint/src/render.rs b/crates/paint/src/render.rs
index cf0835d2dd..24f7259a76 100644
--- a/crates/paint/src/render.rs
+++ b/crates/paint/src/render.rs
@@ -1044,6 +1044,21 @@ impl StrokeRenderer {
         self.ctx.stroke_mask_wet(c, self.cov.depth(x, y), self.dual.as_ref().map(|d| d.get(x, y)), x, y)
     }
 
+    /// Whether any coverage tile overlaps `r`: outside them [`coverage_at`](Self::coverage_at) is
+    /// 0, so a caller scanning a big area can skip it.
+    pub fn touches(&self, r: Rect) -> bool {
+        if r.is_empty() {
+            return false;
+        }
+        let (t0x, t0y) = (r.x0.div_euclid(COV_TILE), r.y0.div_euclid(COV_TILE));
+        let (t1x, t1y) = ((r.x1 - 1).div_euclid(COV_TILE), (r.y1 - 1).div_euclid(COV_TILE));
+        let span = (i64::from(t1x) - i64::from(t0x) + 1).saturating_mul(i64::from(t1y) - i64::from(t0y) + 1);
+        if span > self.cov.tiles.len() as i64 {
+            return self.cov.tiles.keys().any(|&(tx, ty)| (t0x..=t1x).contains(&tx) && (t0y..=t1y).contains(&ty));
+        }
+        (t0y..=t1y).any(|ty| (t0x..=t1x).any(|tx| self.cov.tiles.contains_key(&(tx, ty))))
+    }
+
     /// Dense final coverage over the stroke bounds.
     pub fn dense_coverage(&self) -> (Rect, Vec<f32>) {
         let b = self.bounds();
diff --git a/crates/plugins/src/runtime.rs b/crates/plugins/src/runtime.rs
index c82171a5ac..9f66b545ba 100644
--- a/crates/plugins/src/runtime.rs
+++ b/crates/plugins/src/runtime.rs
@@ -115,6 +115,42 @@ fn wasm_err(e: wasmi::Error) -> Error {
     if e.as_trap_code() == Some(wasmi::TrapCode::OutOfFuel) { Error::Limit("instruction budget".into()) } else { Error::Trap(e.to_string()) }
 }
 
+/// Reads an unsigned LEB128 `u32` at the start of `bytes`: the value and its length.
+fn leb_u32(bytes: &[u8]) -> Option<(u32, usize)> {
+    let mut value = 0u32;
+    for (i, &b) in bytes.iter().take(5).enumerate() {
+        value |= u32::from(b & 0x7f).checked_shl(7 * i as u32)?;
+        if b & 0x80 == 0 {
+            return Some((value, i + 1));
+        }
+    }
+    None
+}
+
+/// Refuses a code section that declares no functions but more bytes than that count. The spec
+/// makes the count the whole section then; wasmi 2.0's strict limits divide the section size by
+/// the function count before validating it, so such a module (crafted or truncated) panicked.
+/// Every code section is checked, since a duplicate one also reaches that division before
+/// validation refuses it. Anything else, malformed or not, is left to wasmi.
+fn check_code_section(bytes: &[u8]) -> Result<()> {
+    if bytes.get(4..8) != Some(&[1, 0, 0, 0][..]) {
+        return Ok(());
+    }
+    let mut pos = 8usize;
+    while let Some(&id) = bytes.get(pos) {
+        let Some((size, len)) = bytes.get(pos + 1..).and_then(leb_u32) else { return Ok(()) };
+        let start = pos + 1 + len;
+        if id == 10
+            && let Some((0, count_len)) = bytes.get(start..).and_then(leb_u32)
+            && size as usize > count_len
+        {
+            return Err(Error::Module(format!("the code section declares no functions but {size} bytes")));
+        }
+        pos = start.saturating_add(size as usize);
+    }
+    Ok(())
+}
+
 impl Plugin {
     /// Validates and loads a module: checks the ABI version and reads the manifest.
     pub fn load(bytes: &[u8], limits: Limits) -> Result<Plugin> {
@@ -124,6 +160,7 @@ impl Plugin {
         if !bytes.starts_with(b"\0asm") {
             return Err(Error::Module("not a WebAssembly binary (missing \\0asm header)".into()));
         }
+        check_code_section(bytes)?;
         let mut config = Config::default();
         config.consume_fuel(true).enforced_limits(EnforcedLimits::strict()).set_max_recursion_depth(limits.max_recursion_depth.max(16));
         let engine = Engine::new(&config);
diff --git a/crates/plugins/tests/abi.rs b/crates/plugins/tests/abi.rs
index 61ee32791f..17e352982e 100644
--- a/crates/plugins/tests/abi.rs
+++ b/crates/plugins/tests/abi.rs
@@ -219,6 +219,25 @@ fn malformed_and_oversized_modules_are_refused() {
     assert!(matches!(e, Error::Abi(_)), "{e}");
 }
 
+#[test]
+fn a_code_section_claiming_no_functions_but_many_bytes_is_refused() {
+    // Header, then a code section (id 10) declaring 2000 bytes whose function count is 0, cut off
+    // after the count (a truncated download) or padded to its full size. The spec makes the
+    // count's own byte the whole section; wasmi's strict limits divided the size by the count.
+    let truncated = b"\0asm\x01\0\0\0\x0a\xd0\x0f\x00".to_vec();
+    let mut padded = truncated.clone();
+    padded.resize(padded.len() + 1999, 0);
+    // The same section after a valid empty one: a duplicate reaches the division before validation.
+    let mut second = b"\0asm\x01\0\0\0\x0a\x01\x00".to_vec();
+    second.extend_from_slice(&padded[8..]);
+    for (name, bytes) in [("truncated", truncated), ("padded", padded), ("second", second)] {
+        assert!(matches!(Plugin::load(&bytes, Limits::default()), Err(Error::Module(_))), "{name}");
+    }
+    // An empty code section (count 0, nothing after it) is valid; it fails only for the missing ABI exports.
+    let empty = b"\0asm\x01\0\0\0\x0a\x01\x00";
+    assert!(matches!(Plugin::load(empty, Limits::default()), Err(Error::Abi(_))));
+}
+
 #[test]
 fn budgets_stop_runaway_plugins() {
     let spin = ok_module("(loop $l (br $l)) (i32.const 0)");
diff --git a/crates/psd/README.md b/crates/psd/README.md
index 421d706ab7..71d12e9f12 100644
--- a/crates/psd/README.md
+++ b/crates/psd/README.md
@@ -13,6 +13,7 @@ A standalone reader and writer for Adobe Photoshop **PSD** (version 1) and **PSB
 | `PsdFile::from_bytes(b)?.to_bytes()? == b` for unmodified files | Channel data keeps its original encoding. Unknown blocks and resources are stored raw. Exact padding is recorded wherever it can vary: tagged blocks, layer info, section trailers. |
 | `from_bytes(to_bytes(f)) == f` for any model `f` | Canonical defaults: `padding: None` means "zero-pad to even", and the parser yields `None` whenever the file used that default. |
 | Lazy decoding | The parser only copies encoded bytes. Channels are decoded when asked (`ChannelData::decode`, `ImageData::decode`). |
+| Lazy reading | `PsdFile::from_source` reads only the structure. Channel data and the merged image stay in the source as `Stored` ranges and are read when decoded, so opening a 2 GB file doesn't need 2 GB for the file itself. The model equals what `from_bytes` builds, and it writes back the same bytes. |
 | No compositing | `PsdBuilder` takes the merged image from the caller. Without one, it writes a white placeholder and sets `has_real_merged_data = false` in resource 1057. |
 
 ## Public API (overview)
@@ -22,6 +23,8 @@ A standalone reader and writer for Adobe Photoshop **PSD** (version 1) and **PSB
 PsdFile::from_bytes(&[u8]) -> Result<PsdFile>
 PsdFile::from_bytes_and_merged(&[u8], want) -> Result<(PsdFile, Option<Result<Vec<u8>>>)>
                                             // + decode_merged() when want(&file): ZIP inflated once
+PsdFile::from_source(Source) -> Result<PsdFile>   // channel data and merged image left in the source
+PsdFile::from_source_and_merged_recovering(Source, want, recover)
 PsdFile::to_bytes(&self) -> Result<Vec<u8>>
 PsdFile::open(path) / save(path)            // native only
 PsdFile { header, color_mode_data, resources, layer_info, layer_info_placement,
@@ -36,6 +39,11 @@ PsdFile::composite_rgba8() -> Result<RgbaImage>
 PsdFile::resource(id), global_block(key), icc_profile(), resolution(),
         has_real_merged_data(), merged_has_alpha(), validate()
 
+// Sources (lazy reading)
+trait ReadAt { len(), read_at(offset, buf) }   // [u8], Vec<u8>, Arc<T>, FileSource (pread / seek_read)
+Source::new(impl ReadAt) / read_vec(offset, len)   // shared handle; equal when the same source
+Stored { source, offset, len }::read() / read_part(at, len)
+
 // Header
 Header { version: Version::{Psd,Psb}, channels, width, height, depth, color_mode, reserved }
 ColorMode::{Bitmap, Grayscale, Indexed, Rgb, Cmyk, Multichannel, Duotone, Lab, Unknown(u16)}
@@ -47,7 +55,8 @@ LayerRecord { rect, channels: Vec<ChannelData>, blend_mode, opacity, clipping, f
 LayerRecord::name()            // prefers `luni`
 LayerRecord::section_divider(), section_type(), layer_id(), fill_opacity(), is_visible(),
              block(key), block_mut(key), channel(id), channel_rect(id), decode_channel(id, depth, version)
-ChannelData { id, compression: Option<Compression>, data }   // encoded bytes kept verbatim
+ChannelData { id, compression: Option<Compression>, data, stored: Option<Stored> }   // encoded bytes kept verbatim
+ChannelData::new(id, compression, data); encoded() -> Cow<[u8]>; encoded_len(); load()
 ChannelData::encode(id, compression, decoded, w, h, depth, version)
 ChannelData::decode(w, h, depth, version); set_decoded(...)
 MaskData::{None, Mask(LayerMask), Raw(Vec<u8>)}
diff --git a/crates/psd/examples/bench_layer_block.rs b/crates/psd/examples/bench_layer_block.rs
index 4d34f9b8f3..4e48f4b3dc 100644
--- a/crates/psd/examples/bench_layer_block.rs
+++ b/crates/psd/examples/bench_layer_block.rs
@@ -1,6 +1,6 @@
 //! Serialization of one 24 MP raw RGB layer in Lr16/Lr32, without compression or disk I/O.
 //! Run with `cargo run --release -p photocraft-psd --example bench_layer_block`.
-use photocraft_psd::*;
+use photocraft_psd::{ChannelData, ColorMode, Compression, Header, ImageData, LayerInfo, LayerInfoPlacement, LayerRecord, Rect, Result, Version, testgen};
 use std::hint::black_box;
 use std::time::Instant;
 
@@ -11,12 +11,12 @@ fn main() -> Result<()> {
         let plane_bytes = 6000 * 4000 * usize::from(depth / 8);
         let mut layer = LayerRecord { rect: Rect::from_xywh(0, 0, 6000, 4000), name: b"RGB".to_vec(), ..Default::default() };
         for id in 0..3 {
-            layer.channels.push(ChannelData { id, compression: Some(Compression::Raw), data: vec![0; plane_bytes] });
+            layer.channels.push(ChannelData::new(id, Some(Compression::Raw), vec![0; plane_bytes]));
         }
         file.layer_info = Some(LayerInfo { merged_alpha: false, layers: vec![layer], padding: None });
         file.layer_info_placement =
             LayerInfoPlacement::GlobalBlock { index: 0, signature: *b"8BIM", key: if depth == 16 { *b"Lr16" } else { *b"Lr32" }, padding: None };
-        file.image_data = ImageData { compression: Compression::Raw, data: vec![0; plane_bytes * 3] };
+        file.image_data = ImageData::new(Compression::Raw, vec![0; plane_bytes * 3]);
         black_box(file.to_bytes()?);
         let mut samples = Vec::new();
         let mut size = 0;
diff --git a/crates/psd/src/builder.rs b/crates/psd/src/builder.rs
index d419f8edac..6606bdb351 100644
--- a/crates/psd/src/builder.rs
+++ b/crates/psd/src/builder.rs
@@ -460,6 +460,7 @@ impl PsdBuilder {
             global_blocks: Vec::new(),
             layer_mask_trailing: Vec::new(),
             image_data,
+            write_as_psb: false,
         })
     }
 
diff --git a/crates/psd/src/compression.rs b/crates/psd/src/compression.rs
index 3ec7d64bb8..eb5d05d609 100644
--- a/crates/psd/src/compression.rs
+++ b/crates/psd/src/compression.rs
@@ -225,6 +225,28 @@ pub fn decode_planes(compression: Compression, data: &[u8], layout: &PlaneLayout
     }
 }
 
+/// Bytes a PSD RLE stream (two-byte row counts) of `rows` rows grows by when written as PSB
+/// (four-byte row counts); an error when `data` is too short to hold the count table.
+pub(crate) fn rle_widening(data: &[u8], rows: usize) -> Result<u64> {
+    let table = rows.checked_mul(2).ok_or(PsdError::LimitExceeded("row count overflow"))?;
+    if data.len() < table {
+        return Err(PsdError::UnexpectedEof { offset: data.len(), needed: table - data.len() });
+    }
+    Ok(table as u64)
+}
+
+/// Writes a PSD RLE stream (two-byte row counts) as the PSB one (four-byte row counts): the packed
+/// rows are the same in both versions, only the count table widens.
+pub(crate) fn put_widened_rle(out: &mut Vec<u8>, data: &[u8], rows: usize) -> Result<()> {
+    let table_len = usize::try_from(rle_widening(data, rows)?).map_err(|_| PsdError::LimitExceeded("row count overflow"))?;
+    let (table, packed) = data.split_at_checked(table_len).ok_or_else(|| PsdError::invalid("RLE row-count table out of range"))?;
+    for count in table.as_chunks::<2>().0 {
+        out.extend_from_slice(&[0, 0, count[0], count[1]]);
+    }
+    out.extend_from_slice(packed);
+    Ok(())
+}
+
 /// Encodes planar data (excluding the 2-byte compression field).
 pub fn encode_planes(compression: Compression, decoded: &[u8], layout: &PlaneLayout) -> Result<Vec<u8>> {
     let total = layout.decoded_len()?;
diff --git a/crates/psd/src/error.rs b/crates/psd/src/error.rs
index da519e6698..a1fc1a5c98 100644
--- a/crates/psd/src/error.rs
+++ b/crates/psd/src/error.rs
@@ -37,6 +37,9 @@ pub enum PsdError {
     /// A compressed stream could not be decoded.
     #[error("decompression failed: {0}")]
     Decompress(String),
+    /// Reading from a [`crate::source::ReadAt`] source failed.
+    #[error("read failed: {0}")]
+    Read(String),
     /// An operation is not supported for this data (e.g. unknown compression).
     #[error("unsupported: {0}")]
     Unsupported(String),
diff --git a/crates/psd/src/file.rs b/crates/psd/src/file.rs
index eec73ed072..828e7bc032 100644
--- a/crates/psd/src/file.rs
+++ b/crates/psd/src/file.rs
@@ -1,6 +1,6 @@
 //! The top-level [`PsdFile`] model, parser and writer.
 
-use crate::compression::{Compression, MAX_DECODED_BYTES, decode_planes, validate_planes};
+use crate::compression::{Compression, MAX_DECODED_BYTES, decode_planes, put_widened_rle, rle_widening, validate_planes};
 use crate::error::{PsdError, Result};
 use crate::header::{ColorMode, Header, Version};
 use crate::image_data::ImageData;
@@ -71,7 +71,8 @@ impl GlobalLayerMask {
 /// A complete PSD/PSB file.
 ///
 /// `PsdFile::from_bytes(b)?.to_bytes()? == b` for unmodified well-formed
-/// files, and `from_bytes(to_bytes(f)) == f` for any model `f`.
+/// files, and `from_bytes(to_bytes(f)) == f` for any model `f` not marked
+/// [`Self::write_as_psb`] (a marked one reads back as the PSB it was written as).
 #[derive(Debug, Clone, PartialEq)]
 #[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
 pub struct PsdFile {
@@ -94,6 +95,12 @@ pub struct PsdFile {
     pub layer_mask_trailing: Vec<u8>,
     /// Merged image data.
     pub image_data: ImageData,
+    /// Write this PSD model as PSB (set by [`Self::promote_to_psb`]). The model itself stays a
+    /// consistent PSD: its channel data keeps two-byte RLE row counts, so everything that reads
+    /// it with `header.version` decodes it as before. Only [`Self::to_bytes`] and
+    /// [`Self::encoded_len`] write version 2, long length fields and four-byte row counts.
+    #[cfg_attr(feature = "serde", serde(default))]
+    pub write_as_psb: bool,
 }
 
 impl PsdFile {
@@ -182,14 +189,37 @@ impl PsdFile {
                 layer_mask_trailing = s.peek_rest().to_vec();
             }
         }
-        let image_data = ImageData { compression: Compression::Raw, data: Vec::new() };
-        let mut file =
-            PsdFile { header, color_mode_data, resources, layer_info, layer_info_placement, global_layer_mask, global_blocks, layer_mask_trailing, image_data };
+        let image_data = ImageData::new(Compression::Raw, Vec::new());
+        let mut file = PsdFile {
+            header,
+            color_mode_data,
+            resources,
+            layer_info,
+            layer_info_placement,
+            global_layer_mask,
+            global_blocks,
+            layer_mask_trailing,
+            image_data,
+            write_as_psb: false,
+        };
+        let want = want(&file);
+        let merged = file.read_merged_section(&mut r, want, recover)?;
+        Ok((file, merged))
+    }
+
+    /// Reads the merged image section from `rest` (the bytes after the layer and mask section) as
+    /// [`Self::from_bytes_and_merged_recovering`] does, decoding it.
+    pub(crate) fn read_merged_recovering(&mut self, rest: &[u8], recover: impl FnOnce(&PsdFile) -> bool) -> Result<Option<Result<Vec<u8>>>> {
+        self.read_merged_section(&mut Reader::new(rest), true, recover)
+    }
+
+    fn read_merged_section(&mut self, r: &mut Reader<'_>, want: bool, recover: impl FnOnce(&PsdFile) -> bool) -> Result<Option<Result<Vec<u8>>>> {
+        let file = self;
         let mut encoded = r.clone();
-        let merged = if want(&file) {
-            file.read_merged_decoded(&mut r).map(Some)
+        let merged = if want {
+            file.read_merged_decoded(r).map(Some)
         } else {
-            ImageData::read(&mut r, &file.header).map(|image| {
+            ImageData::read(r, &file.header).map(|image| {
                 file.image_data = image;
                 None
             })
@@ -197,7 +227,7 @@ impl PsdFile {
         let merged = match merged {
             Ok(merged) => merged,
             Err(error) => {
-                if matches!(error, PsdError::LimitExceeded(_)) || !recover(&file) {
+                if matches!(error, PsdError::LimitExceeded(_)) || !recover(file) {
                     return Err(error);
                 }
                 let compression = Compression::from_u16(encoded.u16()?);
@@ -205,11 +235,11 @@ impl PsdFile {
                 let mut data = Vec::new();
                 data.try_reserve_exact(source.len()).map_err(|_| PsdError::LimitExceeded("not enough memory to retain the damaged merged image"))?;
                 data.extend_from_slice(source);
-                file.image_data = ImageData { compression, data };
+                file.image_data = ImageData::new(compression, data);
                 Some(Err(error))
             }
         };
-        Ok((file, merged))
+        Ok(merged)
     }
 
     /// Reads the merged image into `self.image_data` and decodes it. A ZIP stream within the
@@ -232,21 +262,31 @@ impl PsdFile {
         if decoded.is_err() {
             validate_planes(compression, data, &layout)?;
         }
-        self.image_data = ImageData { compression, data: data.to_vec() };
+        self.image_data = ImageData::new(compression, data.to_vec());
         r.skip(data.len())?;
         Ok(decoded)
     }
 
     /// Serializes the file.
     pub fn to_bytes(&self) -> Result<Vec<u8>> {
-        let v = self.header.version;
+        let (v, widen) = self.write_form();
         let psb = v.is_psb();
         // Reserve the pixel data up front: appending it to an empty Vec reallocates and copies
         // repeatedly. Everything else (headers, resources, records) is small by comparison.
-        let hint = self.layer_info.as_ref().map_or(0, LayerInfo::channel_data_len).saturating_add(self.image_data.data.len());
+        let widened = if widen { self.rle_widening()? } else { 0 };
+        let hint = self
+            .layer_info
+            .as_ref()
+            .map_or(0, LayerInfo::channel_data_len)
+            .saturating_add(usize::try_from(self.image_data.encoded_len()).unwrap_or(usize::MAX))
+            .saturating_add(usize::try_from(widened).unwrap_or(usize::MAX));
         let mut out = Vec::new();
         out.try_reserve(hint).map_err(|_| PsdError::LimitExceeded("not enough memory to serialize the file"))?;
-        self.header.write(&mut out);
+        if widen {
+            Header { version: v, ..self.header.clone() }.write(&mut out);
+        } else {
+            self.header.write(&mut out);
+        }
         out.put_len(self.color_mode_data.len() as u64, false)?;
         out.put(&self.color_mode_data);
         resources::write_section(&mut out, &self.resources)?;
@@ -261,7 +301,7 @@ impl PsdFile {
         if !section_empty {
             let li = out.begin_len(psb);
             if let (Some(info), false) = (&self.layer_info, in_block) {
-                info.write_body(&mut out, v)?;
+                info.write_body_as(&mut out, v, widen)?;
             }
             out.end_len(li, psb)?;
             let need_mask_field = self.global_layer_mask.is_some() || !self.global_blocks.is_empty() || (in_block && self.layer_info.is_some());
@@ -281,7 +321,7 @@ impl PsdFile {
                     let long = uses_long_length(v, key);
                     let at = out.begin_len(long);
                     let start = out.len();
-                    info.write_body(&mut out, v)?;
+                    info.write_body_as(&mut out, v, widen)?;
                     let len = out.len() - start;
                     out.end_len(at, long)?;
                     match padding {
@@ -297,10 +337,121 @@ impl PsdFile {
         out.end_len(at, psb)?;
 
         out.put_u16(self.image_data.compression.as_u16());
-        out.put(&self.image_data.data);
+        match self.merged_widened_rows(widen)? {
+            0 => out.put(&self.image_data.encoded()?),
+            rows => put_widened_rle(&mut out, &self.image_data.encoded()?, rows)?,
+        }
         Ok(out)
     }
 
+    /// The version the file is written as, and whether its RLE count tables widen on the way
+    /// (a PSD model marked [`Self::write_as_psb`]).
+    fn write_form(&self) -> (Version, bool) {
+        let widen = self.write_as_psb && !self.header.version.is_psb();
+        (if widen { Version::Psb } else { self.header.version }, widen)
+    }
+
+    /// The version [`Self::to_bytes`] writes: PSB for a PSD model marked [`Self::write_as_psb`],
+    /// else `header.version`.
+    pub fn written_version(&self) -> Version {
+        self.write_form().0
+    }
+
+    /// Rows of the merged image's RLE count table that widen on write (0 when nothing widens).
+    fn merged_widened_rows(&self, widen: bool) -> Result<usize> {
+        if widen && self.image_data.compression == Compression::Rle { ImageData::layout(&self.header).rows() } else { Ok(0) }
+    }
+
+    /// Bytes every RLE count table of this PSD model grows by when written as PSB; an error
+    /// when a table is too short for its rows.
+    fn rle_widening(&self) -> Result<u64> {
+        let mut n = 0u64;
+        for layer in self.layers() {
+            for c in &layer.channels {
+                match layer.widened_rows(c, true)? {
+                    0 => {}
+                    rows => n = n.saturating_add(rle_widening(&c.encoded()?, rows)?),
+                }
+            }
+        }
+        match self.merged_widened_rows(true)? {
+            0 => Ok(n),
+            rows => Ok(n.saturating_add(rle_widening(&self.image_data.encoded()?, rows)?)),
+        }
+    }
+
+    /// The number of bytes [`Self::to_bytes`] writes, computed without serializing the channel
+    /// data (only the layer records, which are small, are serialized to measure them). Lets a
+    /// writer check a file against the 2 GB PSD limit before choosing the version.
+    pub fn encoded_len(&self) -> Result<u64> {
+        let (v, widen) = self.write_form();
+        let psb = v.is_psb();
+        let len_field = |long: bool| if long { 8u64 } else { 4 };
+        let blocks_len = |blocks: &[TaggedBlock]| blocks.iter().fold(0u64, |n, b| n.saturating_add(b.encoded_len_aligned(v, 4) as u64));
+        let body_len = |info: &LayerInfo| -> Result<u64> {
+            let unpadded = info.unpadded_len_as(v, widen)?;
+            let padding = info.padding.as_ref().map_or(unpadded % 2, |p| p.len() as u64);
+            Ok(unpadded.saturating_add(padding))
+        };
+        // Header, colour mode data, resources.
+        let mut n = 26u64.saturating_add(4).saturating_add(self.color_mode_data.len() as u64).saturating_add(resources::section_len(&self.resources));
+
+        let in_block = matches!(self.layer_info_placement, LayerInfoPlacement::GlobalBlock { .. });
+        let section_empty =
+            self.layer_info.is_none() && self.global_layer_mask.is_none() && self.global_blocks.is_empty() && self.layer_mask_trailing.is_empty();
+        n = n.saturating_add(len_field(psb));
+        if !section_empty {
+            n = n.saturating_add(len_field(psb));
+            if let (Some(info), false) = (&self.layer_info, in_block) {
+                n = n.saturating_add(body_len(info)?);
+            }
+            let need_mask_field = self.global_layer_mask.is_some() || !self.global_blocks.is_empty() || (in_block && self.layer_info.is_some());
+            if need_mask_field {
+                n = n.saturating_add(4).saturating_add(self.global_layer_mask.as_ref().map_or(0, |g| g.data.len() as u64));
+            }
+            n = n.saturating_add(blocks_len(&self.global_blocks));
+            if let (Some(info), LayerInfoPlacement::GlobalBlock { key, padding, .. }) = (&self.layer_info, &self.layer_info_placement) {
+                let body = body_len(info)?;
+                let pad = padding.as_ref().map_or((4 - body % 4) % 4, |p| p.len() as u64);
+                n = n.saturating_add(8).saturating_add(len_field(uses_long_length(v, key))).saturating_add(body).saturating_add(pad);
+            }
+            n = n.saturating_add(self.layer_mask_trailing.len() as u64);
+        }
+        let merged = match self.merged_widened_rows(widen)? {
+            0 => 0,
+            rows => rle_widening(&self.image_data.encoded()?, rows)?,
+        };
+        Ok(n.saturating_add(2).saturating_add(self.image_data.encoded_len()).saturating_add(merged))
+    }
+
+    /// Marks a PSD model to be written as the equivalent PSB ([`Self::write_as_psb`]) without
+    /// touching or re-encoding any pixels: the packed RLE rows are the same in both versions, so
+    /// [`Self::to_bytes`] only widens the row-count tables of the layer channels and the merged
+    /// image (two to four bytes per row) and the length fields while it copies them out. Raw and
+    /// ZIP channel data is the same in both. A PSB model is left as is.
+    ///
+    /// Every RLE count table is checked first: an error leaves the model unmarked, and the write
+    /// cannot fail on a table later. The layer info padding is kept; a writer that pads to an
+    /// alignment re-pads with [`Self::pad_layer_info_to`].
+    pub fn promote_to_psb(&mut self) -> Result<()> {
+        if self.header.version.is_psb() || self.write_as_psb {
+            return Ok(());
+        }
+        self.rle_widening()?;
+        self.write_as_psb = true;
+        Ok(())
+    }
+
+    /// Pads the layer info body to a multiple of `align` bytes as it will be written (see
+    /// [`LayerInfo::pad_to`]), RLE count tables widened when [`Self::write_as_psb`] is set.
+    pub fn pad_layer_info_to(&mut self, align: u64) -> Result<()> {
+        let (v, widen) = self.write_form();
+        if let Some(info) = &mut self.layer_info {
+            info.padding = Some(vec![0; info.pad_len_as(v, widen, align)?]);
+        }
+        Ok(())
+    }
+
     /// Layer records in file order (bottom-most first); empty if none.
     pub fn layers(&self) -> &[LayerRecord] {
         self.layer_info.as_ref().map_or(&[], |i| &i.layers)
@@ -440,6 +591,89 @@ mod write_tests {
     use super::*;
     use crate::{Compression, testgen};
 
+    /// `encoded_len` is exactly what `to_bytes` writes, for every generated file and both layer
+    /// info placements, with and without padding (#5285).
+    #[test]
+    fn encoded_len_matches_the_written_length() {
+        for case in testgen::all_cases() {
+            assert_eq!(case.file.encoded_len().unwrap(), case.file.to_bytes().unwrap().len() as u64, "{}", case.name);
+        }
+        for version in [Version::Psd, Version::Psb] {
+            for key in [*b"Lr16", *b"Layr"] {
+                for padding in [None, Some(vec![]), Some(vec![1, 2, 3])] {
+                    for body_padding in [None, Some(vec![]), Some(vec![9])] {
+                        let mut file = testgen::small(version, Compression::Rle);
+                        file.global_blocks = vec![TaggedBlock::new(*b"zz01", vec![11]), TaggedBlock::new(*b"lnk2", vec![1; 5])];
+                        file.layer_info_placement = LayerInfoPlacement::GlobalBlock { index: 1, signature: *b"8BIM", key, padding: padding.clone() };
+                        file.layer_info.as_mut().unwrap().padding = body_padding;
+                        file.layer_mask_trailing = vec![0; 3];
+                        file.resources.push(ImageResource { name: b"odd".to_vec(), ..ImageResource::new(4000, vec![1, 2, 3]) });
+                        assert_eq!(file.encoded_len().unwrap(), file.to_bytes().unwrap().len() as u64, "{version:?} {key:?}");
+                    }
+                }
+            }
+        }
+        let mut empty = testgen::small(Version::Psd, Compression::Raw);
+        empty.layer_info = None;
+        empty.global_layer_mask = None;
+        empty.global_blocks.clear();
+        assert_eq!(empty.encoded_len().unwrap(), empty.to_bytes().unwrap().len() as u64);
+    }
+
+    /// A promoted PSD writes exactly the PSB written directly from the same pixels, and reads
+    /// back as that PSB; the model itself stays a PSD that every reader decodes as before (#5285).
+    #[test]
+    fn promote_to_psb_writes_the_psb_written_directly() {
+        let cases = testgen::all_cases();
+        let (psd, psb) = cases.split_at(cases.len() / 2);
+        for (psd, psb) in psd.iter().zip(psb) {
+            assert_eq!(psd.file.header.version, Version::Psd, "{}", psd.name);
+            let mut promoted = psd.file.clone();
+            promoted.promote_to_psb().unwrap();
+            assert!(promoted.write_as_psb);
+            assert_eq!(promoted.written_version(), Version::Psb);
+            let bytes = promoted.to_bytes().unwrap();
+            assert!(bytes == psb.file.to_bytes().unwrap(), "{}", psd.name);
+            assert_eq!(promoted.encoded_len().unwrap(), bytes.len() as u64, "{}", psd.name);
+            assert_eq!(PsdFile::from_bytes(&bytes).unwrap(), psb.file, "{}", psd.name);
+            // Unchanged as a model: same header, same (two-byte) channel data.
+            assert_eq!(PsdFile { write_as_psb: false, ..promoted.clone() }, psd.file, "{}", psd.name);
+            assert_eq!(promoted.decode_merged().ok(), psd.file.decode_merged().ok(), "{}", psd.name);
+        }
+    }
+
+    /// Re-padding a promoted model pads what is written, as `pad_to` does for a PSB.
+    #[test]
+    fn pad_layer_info_to_pads_the_written_body() {
+        let mut promoted = testgen::layered(Version::Psd, ColorMode::Rgb, 8, Compression::Rle);
+        promoted.promote_to_psb().unwrap();
+        promoted.pad_layer_info_to(4).unwrap();
+        let mut direct = testgen::layered(Version::Psb, ColorMode::Rgb, 8, Compression::Rle);
+        direct.layer_info.as_mut().unwrap().pad_to(Version::Psb, 4).unwrap();
+        assert!(promoted.to_bytes().unwrap() == direct.to_bytes().unwrap());
+    }
+
+    /// A damaged RLE table is refused before anything changes: the file stays a valid PSD.
+    #[test]
+    fn promote_to_psb_is_atomic() {
+        let mut file = testgen::small(Version::Psd, Compression::Rle);
+        // The last layer with pixels ("b", two rows): its red channel loses its row-count table.
+        let layers = &mut file.layer_info.as_mut().unwrap().layers;
+        let red = layers[2].channels.iter_mut().find(|c| c.id == 0).unwrap();
+        assert_eq!(red.compression, Some(Compression::Rle));
+        red.data.truncate(1);
+        let before = file.clone();
+        assert!(file.promote_to_psb().is_err());
+        assert_eq!(file, before);
+        assert!(!file.write_as_psb);
+        // A table damaged after promotion fails the write instead of panicking.
+        let mut file = testgen::small(Version::Psd, Compression::Rle);
+        file.promote_to_psb().unwrap();
+        file.image_data.data.truncate(3);
+        assert!(file.to_bytes().is_err());
+        assert!(file.encoded_len().is_err());
+    }
+
     #[test]
     fn global_blocks_default_to_four_byte_padding() {
         for version in [Version::Psd, Version::Psb] {
diff --git a/crates/psd/src/image_data.rs b/crates/psd/src/image_data.rs
index 864486b4ac..9e27af2917 100644
--- a/crates/psd/src/image_data.rs
+++ b/crates/psd/src/image_data.rs
@@ -1,13 +1,20 @@
 //! Merged (composite) image data section.
 
+use std::borrow::Cow;
+
 use crate::compression::{Compression, PlaneLayout, decode_planes, encode_planes, validate_planes};
 use crate::error::Result;
 use crate::header::Header;
 use crate::io::Reader;
+use crate::source::Stored;
 
 /// The merged image: compression plus the encoded bytes of all channels
 /// (to the end of the file), kept verbatim.
-#[derive(Debug, Clone, PartialEq, Eq)]
+///
+/// As with [`crate::ChannelData`], a file parsed by
+/// [`PsdFile::from_source`](crate::PsdFile::from_source) may leave the bytes in the source
+/// (`stored`, with `data` empty); equality compares the bytes wherever they are.
+#[derive(Debug, Clone)]
 #[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
 pub struct ImageData {
     /// Compression method for the whole image.
@@ -15,9 +22,50 @@ pub struct ImageData {
     /// Encoded data. For RLE: the byte-count table for every row of every
     /// channel followed by the rows.
     pub data: Vec<u8>,
+    /// Where the encoded bytes are when they were left in the source. (Not serialized.)
+    #[cfg_attr(feature = "serde", serde(skip))]
+    pub stored: Option<Stored>,
 }
 
+impl PartialEq for ImageData {
+    fn eq(&self, other: &Self) -> bool {
+        if self.compression != other.compression || self.encoded_len() != other.encoded_len() {
+            return false;
+        }
+        match (self.encoded(), other.encoded()) {
+            (Ok(a), Ok(b)) => a == b,
+            _ => false,
+        }
+    }
+}
+
+impl Eq for ImageData {}
+
 impl ImageData {
+    /// A merged image whose encoded bytes are in memory.
+    pub fn new(compression: Compression, data: Vec<u8>) -> Self {
+        ImageData { compression, data, stored: None }
+    }
+
+    /// The encoded bytes: borrowed from `data`, or read from the source.
+    pub fn encoded(&self) -> Result<Cow<'_, [u8]>> {
+        crate::source::encoded(&self.data, self.stored.as_ref())
+    }
+
+    /// Number of encoded bytes, wherever they are.
+    pub fn encoded_len(&self) -> u64 {
+        self.stored.as_ref().map_or(self.data.len() as u64, |s| s.len)
+    }
+
+    /// Reads bytes left in the source into `data`.
+    pub fn load(&mut self) -> Result<()> {
+        if let Some(s) = &self.stored {
+            self.data = s.read()?;
+            self.stored = None;
+        }
+        Ok(())
+    }
+
     /// Plane layout for the merged image described by `header`.
     pub fn layout(header: &Header) -> PlaneLayout {
         PlaneLayout {
@@ -31,12 +79,12 @@ impl ImageData {
 
     /// Encodes planar data (`channels × height × row_bytes`).
     pub fn encode(compression: Compression, decoded: &[u8], header: &Header) -> Result<Self> {
-        Ok(ImageData { compression, data: encode_planes(compression, decoded, &Self::layout(header))? })
+        Ok(ImageData::new(compression, encode_planes(compression, decoded, &Self::layout(header))?))
     }
 
     /// Decodes all channels into planar big-endian samples.
     pub fn decode(&self, header: &Header) -> Result<Vec<u8>> {
-        decode_planes(self.compression, &self.data, &Self::layout(header))
+        decode_planes(self.compression, &self.encoded()?, &Self::layout(header))
     }
 
     pub(crate) fn read(r: &mut Reader<'_>, header: &Header) -> Result<Self> {
@@ -45,6 +93,6 @@ impl ImageData {
         validate_planes(compression, data, &Self::layout(header))?;
         let data = data.to_vec();
         r.skip(data.len())?;
-        Ok(ImageData { compression, data })
+        Ok(ImageData::new(compression, data))
     }
 }
diff --git a/crates/psd/src/layer.rs b/crates/psd/src/layer.rs
index 1b5c241191..cbc4ccb424 100644
--- a/crates/psd/src/layer.rs
+++ b/crates/psd/src/layer.rs
@@ -1,10 +1,13 @@
 //! Layer records, layer masks, blending ranges and per-layer channel data.
 
+use std::borrow::Cow;
+
 use crate::blend::BlendMode;
-use crate::compression::{Compression, PlaneLayout, decode_planes, encode_planes};
+use crate::compression::{Compression, PlaneLayout, decode_planes, encode_planes, put_widened_rle, rle_widening};
 use crate::error::{PsdError, Result};
 use crate::header::{MAX_DIMENSION, Version};
 use crate::io::{Reader, WriteExt, decode_legacy_name, read_pascal, write_pascal};
+use crate::source::Stored;
 use crate::tagged::{BlockData, SectionDivider, SectionType, TaggedBlock, read_blocks, uses_long_length, write_blocks};
 
 /// Channel id of the transparency mask.
@@ -368,7 +371,12 @@ impl BlendingRanges {
 }
 
 /// Encoded image data for one layer channel.
-#[derive(Debug, Clone, PartialEq, Eq)]
+///
+/// The encoded bytes are in `data`, or, for a file parsed by
+/// [`PsdFile::from_source`](crate::PsdFile::from_source), still in the source at `stored` (and
+/// `data` is empty). Every method here reads them from wherever they are; two channels are equal
+/// when their bytes are, wherever each one keeps them.
+#[derive(Debug, Clone)]
 #[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
 pub struct ChannelData {
     /// Channel id: 0.. color channels, -1 transparency, -2 user mask,
@@ -377,22 +385,65 @@ pub struct ChannelData {
     /// Compression; `None` when the stored length was 0 (no compression
     /// field at all).
     pub compression: Option<Compression>,
-    /// Encoded bytes following the compression field, kept verbatim.
+    /// Encoded bytes following the compression field, kept verbatim (empty while `stored`).
     pub data: Vec<u8>,
+    /// Where the encoded bytes are when they were left in the source: see [`Self::load`].
+    /// (Not serialized: load the channel first.)
+    #[cfg_attr(feature = "serde", serde(skip))]
+    pub stored: Option<Stored>,
 }
 
+impl PartialEq for ChannelData {
+    fn eq(&self, other: &Self) -> bool {
+        if self.id != other.id || self.compression != other.compression || self.encoded_len() != other.encoded_len() {
+            return false;
+        }
+        match (self.encoded(), other.encoded()) {
+            (Ok(a), Ok(b)) => a == b,
+            _ => false,
+        }
+    }
+}
+
+impl Eq for ChannelData {}
+
 impl ChannelData {
     /// Encodes planar samples (`height × row_bytes`).
     pub fn encode(id: i16, compression: Compression, decoded: &[u8], width: usize, height: usize, depth: u16, version: Version) -> Result<Self> {
         let layout = PlaneLayout { planes: 1, width, height, depth, version };
-        Ok(ChannelData { id, compression: Some(compression), data: encode_planes(compression, decoded, &layout)? })
+        Ok(ChannelData::new(id, Some(compression), encode_planes(compression, decoded, &layout)?))
+    }
+
+    /// A channel whose encoded bytes are in memory.
+    pub fn new(id: i16, compression: Option<Compression>, data: Vec<u8>) -> Self {
+        ChannelData { id, compression, data, stored: None }
+    }
+
+    /// The encoded bytes (after the compression field): borrowed from `data`, or read from the
+    /// source when they were left there.
+    pub fn encoded(&self) -> Result<Cow<'_, [u8]>> {
+        crate::source::encoded(&self.data, self.stored.as_ref())
+    }
+
+    /// Number of encoded bytes, wherever they are.
+    pub fn encoded_len(&self) -> u64 {
+        self.stored.as_ref().map_or(self.data.len() as u64, |s| s.len)
+    }
+
+    /// Reads bytes left in the source into `data`, so the channel no longer needs its source.
+    pub fn load(&mut self) -> Result<()> {
+        if let Some(s) = &self.stored {
+            self.data = s.read()?;
+            self.stored = None;
+        }
+        Ok(())
     }
 
     /// Decodes into planar big-endian samples.
     pub fn decode(&self, width: usize, height: usize, depth: u16, version: Version) -> Result<Vec<u8>> {
         let layout = PlaneLayout { planes: 1, width, height, depth, version };
         match self.compression {
-            Some(c) => decode_planes(c, &self.data, &layout),
+            Some(c) => decode_planes(c, &self.encoded()?, &layout),
             None => {
                 if layout.decoded_len()? == 0 {
                     Ok(Vec::new())
@@ -412,7 +463,7 @@ impl ChannelData {
 
     fn stored_len(&self) -> u64 {
         match self.compression {
-            Some(_) => 2 + self.data.len() as u64,
+            Some(_) => 2 + self.encoded_len(),
             None => 0,
         }
     }
@@ -556,7 +607,7 @@ impl LayerRecord {
         ch.decode(w, h, depth, version)
     }
 
-    fn read(r: &mut Reader<'_>, version: Version) -> Result<(Self, Vec<u64>)> {
+    pub(crate) fn read(r: &mut Reader<'_>, version: Version) -> Result<(Self, Vec<u64>)> {
         let rect = Rect::read(r)?;
         let nch = r.u16()?;
         if nch > MAX_LAYER_CHANNELS {
@@ -567,7 +618,7 @@ impl LayerRecord {
         for _ in 0..nch {
             let id = r.i16()?;
             let len = r.len_field(version.is_psb())?;
-            channels.push(ChannelData { id, compression: None, data: Vec::new() });
+            channels.push(ChannelData::new(id, None, Vec::new()));
             lens.push(len);
         }
         let sig = r.array::<4>()?;
@@ -598,6 +649,12 @@ impl LayerRecord {
         Ok((LayerRecord { rect, channels, blend_mode, opacity, clipping, flags, filler, mask, blending_ranges, name, blocks, extra_trailing }, lens))
     }
 
+    /// Rows of a channel's RLE count table that grow when a PSD model is written as PSB
+    /// (`widen`, see [`crate::PsdFile::promote_to_psb`]); 0 for other channels.
+    pub(crate) fn widened_rows(&self, c: &ChannelData, widen: bool) -> Result<usize> {
+        if widen && c.compression == Some(Compression::Rle) { Ok(self.channel_rect(c.id).size()?.1) } else { Ok(0) }
+    }
+
     /// Bytes [`Self::write`] produces, computed without serializing. Errors where `write` would.
     fn encoded_len(&self, version: Version) -> Result<u64> {
         let too_big = || PsdError::LimitExceeded("section too large for 32-bit length (use PSB)");
@@ -628,13 +685,15 @@ impl LayerRecord {
         Ok((16 + 2 + self.channels.len() as u64 * (2 + channel_len) + 8 + 4 + 4).saturating_add(extra))
     }
 
-    fn write(&self, out: &mut Vec<u8>, version: Version) -> Result<()> {
+    fn write(&self, out: &mut Vec<u8>, version: Version, widen: bool) -> Result<()> {
         self.rect.write(out);
         let nch = u16::try_from(self.channels.len()).map_err(|_| PsdError::LimitExceeded("too many channels"))?;
         out.put_u16(nch);
         for c in &self.channels {
             out.put_i16(c.id);
-            out.put_len(c.stored_len(), version.is_psb())?;
+            let rows = self.widened_rows(c, widen)?;
+            let grown = if rows == 0 { 0 } else { rle_widening(&c.encoded()?, rows)? };
+            out.put_len(c.stored_len().saturating_add(grown), version.is_psb())?;
         }
         out.put(b"8BIM");
         out.put(&self.blend_mode.key());
@@ -709,14 +768,24 @@ impl LayerInfo {
     /// Length of the body (layer count, records and channel data) without
     /// its trailing padding.
     pub fn unpadded_len(&self, version: Version) -> Result<u64> {
+        self.unpadded_len_as(version, false)
+    }
+
+    /// [`Self::unpadded_len`] of the body written with its RLE count tables widened (`widen`).
+    pub(crate) fn unpadded_len_as(&self, version: Version, widen: bool) -> Result<u64> {
         // Computed from the field sizes: serializing the records just to measure them would copy
-        // every tagged block.
+        // every tagged block. Widening changes channel data only: the record's length fields keep
+        // their width.
         let mut n = 2u64;
         for l in &self.layers {
             n = n.saturating_add(l.encoded_len(version)?);
         }
-        for c in self.layers.iter().flat_map(|l| &l.channels).filter(|c| c.compression.is_some()) {
-            n = n.saturating_add(2).saturating_add(c.data.len() as u64);
+        for l in &self.layers {
+            for c in l.channels.iter().filter(|c| c.compression.is_some()) {
+                let rows = l.widened_rows(c, widen)?;
+                let grown = if rows == 0 { 0 } else { rle_widening(&c.encoded()?, rows)? };
+                n = n.saturating_add(2).saturating_add(c.encoded_len()).saturating_add(grown);
+            }
         }
         Ok(n)
     }
@@ -732,29 +801,47 @@ impl LayerInfo {
 
     /// Number of zero bytes [`Self::pad_to`] would set, without touching `self`.
     pub(crate) fn pad_len(&self, version: Version, align: u64) -> Result<usize> {
+        self.pad_len_as(version, false, align)
+    }
+
+    /// [`Self::pad_len`] for the body written with its RLE count tables widened (`widen`).
+    pub(crate) fn pad_len_as(&self, version: Version, widen: bool, align: u64) -> Result<usize> {
         let align = align.max(1);
-        let len = self.unpadded_len(version)?;
+        let len = self.unpadded_len_as(version, widen)?;
         Ok(((align - len % align) % align) as usize)
     }
 
     /// Bytes of channel data and their compression fields: the part of the body worth reserving up
     /// front (the records are small next to the pixels). Saturates instead of overflowing.
     pub(crate) fn channel_data_len(&self) -> usize {
-        self.layers.iter().flat_map(|l| &l.channels).filter(|c| c.compression.is_some()).fold(0usize, |n, c| n.saturating_add(2).saturating_add(c.data.len()))
+        self.layers
+            .iter()
+            .flat_map(|l| &l.channels)
+            .filter(|c| c.compression.is_some())
+            .fold(0usize, |n, c| n.saturating_add(2).saturating_add(usize::try_from(c.encoded_len()).unwrap_or(usize::MAX)))
     }
 
     /// Serializes the body without any trailing padding (the padding field is ignored).
     pub(crate) fn write_unpadded(&self, out: &mut Vec<u8>, version: Version) -> Result<()> {
+        self.write_unpadded_as(out, version, false)
+    }
+
+    /// [`Self::write_unpadded`], widening the RLE count tables of a PSD model written as PSB
+    /// (`widen`) on the way out.
+    fn write_unpadded_as(&self, out: &mut Vec<u8>, version: Version, widen: bool) -> Result<()> {
         let n = i16::try_from(self.layers.len()).map_err(|_| PsdError::LimitExceeded("more than 32767 layers"))?;
         out.put_i16(if self.merged_alpha { -n } else { n });
         for l in &self.layers {
-            l.write(out, version)?;
+            l.write(out, version, widen)?;
         }
         for l in &self.layers {
             for c in &l.channels {
                 if let Some(comp) = c.compression {
                     out.put_u16(comp.as_u16());
-                    out.put(&c.data);
+                    match l.widened_rows(c, widen)? {
+                        0 => out.put(&c.encoded()?),
+                        rows => put_widened_rle(out, &c.encoded()?, rows)?,
+                    }
                 }
             }
         }
@@ -762,9 +849,15 @@ impl LayerInfo {
     }
 
     /// Serializes the body (without a length field).
+    #[cfg(test)]
     pub(crate) fn write_body(&self, out: &mut Vec<u8>, version: Version) -> Result<()> {
+        self.write_body_as(out, version, false)
+    }
+
+    /// [`Self::write_body`], widening RLE count tables when `widen` (see [`Self::write_unpadded_as`]).
+    pub(crate) fn write_body_as(&self, out: &mut Vec<u8>, version: Version, widen: bool) -> Result<()> {
         let start = out.len();
-        self.write_unpadded(out, version)?;
+        self.write_unpadded_as(out, version, widen)?;
         match &self.padding {
             Some(p) => out.put(p),
             None => {
diff --git a/crates/psd/src/layer/tests.rs b/crates/psd/src/layer/tests.rs
index a5ad06efbb..c831b1c6d2 100644
--- a/crates/psd/src/layer/tests.rs
+++ b/crates/psd/src/layer/tests.rs
@@ -54,7 +54,7 @@ fn record_roundtrip_psd_psb() {
 #[test]
 fn psb_channel_lengths_are_8_bytes() {
     let mut rec = LayerRecord::default();
-    rec.channels.push(ChannelData { id: 0, compression: Some(Compression::Raw), data: vec![] });
+    rec.channels.push(ChannelData::new(0, Some(Compression::Raw), vec![]));
     let info = LayerInfo { layers: vec![rec], ..Default::default() };
     let psd = rt(&info, Version::Psd);
     let psb = rt(&info, Version::Psb);
@@ -294,7 +294,7 @@ fn too_many_layers_rejected() {
 #[test]
 fn zero_length_channel() {
     let mut rec = LayerRecord::default();
-    rec.channels.push(ChannelData { id: 0, compression: None, data: vec![] });
+    rec.channels.push(ChannelData::new(0, None, vec![]));
     let info = LayerInfo { layers: vec![rec], ..Default::default() };
     rt(&info, Version::Psd);
     assert_eq!(info.layers[0].decode_channel(0, 8, Version::Psd).unwrap(), Vec::<u8>::new());
diff --git a/crates/psd/src/lazy.rs b/crates/psd/src/lazy.rs
new file mode 100644
index 0000000000..d81d102d11
--- /dev/null
+++ b/crates/psd/src/lazy.rs
@@ -0,0 +1,437 @@
+//! Parsing from a [`Source`] without reading the whole file: [`PsdFile::from_source`].
+//!
+//! The structure (header, resources, layer records, global blocks) is read into memory as
+//! [`PsdFile::from_bytes`] would hold it. The bulk of a layered file is left in the source: every
+//! channel's encoded bytes and the merged image become [`Stored`] ranges, read when they are
+//! decoded. Apart from those ranges, the model is the one `from_bytes` builds from the same bytes
+//! (the parse tests hold the two to that), with one difference: a merged image the caller does
+//! not ask for is not read, so it is not checked either.
+
+use crate::compression::Compression;
+use crate::error::{PsdError, Result};
+use crate::file::{GlobalLayerMask, LayerInfoPlacement, PsdFile};
+use crate::header::{Header, Version};
+use crate::image_data::ImageData;
+use crate::io::Reader;
+use crate::layer::{LayerInfo, LayerRecord};
+use crate::resources::ImageResource;
+use crate::source::{Source, Stored};
+use crate::tagged::{TaggedBlock, is_sig, uses_long_length};
+
+/// Bytes read per attempt at the layer records; doubled until they all fit. (Small in tests, so
+/// they grow it.)
+const RECORDS_CHUNK: u64 = if cfg!(test) { 64 } else { 1 << 20 };
+
+/// A bounds-checked cursor over `start..end` of a source.
+struct Cursor<'a> {
+    src: &'a Source,
+    pos: u64,
+    end: u64,
+}
+
+impl<'a> Cursor<'a> {
+    fn new(src: &'a Source) -> Self {
+        Cursor { src, pos: 0, end: src.get().len() }
+    }
+
+    fn remaining(&self) -> u64 {
+        self.end.saturating_sub(self.pos)
+    }
+
+    fn is_empty(&self) -> bool {
+        self.remaining() == 0
+    }
+
+    fn eof(&self, needed: u64) -> PsdError {
+        PsdError::UnexpectedEof {
+            offset: usize::try_from(self.pos).unwrap_or(usize::MAX),
+            needed: usize::try_from(needed.saturating_sub(self.remaining())).unwrap_or(usize::MAX),
+        }
+    }
+
+    fn need(&self, n: u64) -> Result<()> {
+        if n > self.remaining() { Err(self.eof(n)) } else { Ok(()) }
+    }
+
+    /// Reads `n` bytes.
+    fn bytes(&mut self, n: u64) -> Result<Vec<u8>> {
+        self.need(n)?;
+        let v = self.src.read_vec(self.pos, n)?;
+        self.pos += n;
+        Ok(v)
+    }
+
+    /// Up to `n` bytes from the current position, without consuming.
+    fn peek(&self, n: u64) -> Result<Vec<u8>> {
+        self.src.read_vec(self.pos, n.min(self.remaining()))
+    }
+
+    fn array<const N: usize>(&mut self) -> Result<[u8; N]> {
+        self.need(N as u64)?;
+        let mut b = [0u8; N];
+        self.src.get().read_at(self.pos, &mut b)?;
+        self.pos += N as u64;
+        Ok(b)
+    }
+
+    fn u16(&mut self) -> Result<u16> {
+        self.array().map(u16::from_be_bytes)
+    }
+
+    fn i16(&mut self) -> Result<i16> {
+        self.array().map(i16::from_be_bytes)
+    }
+
+    fn u32(&mut self) -> Result<u32> {
+        self.array().map(u32::from_be_bytes)
+    }
+
+    fn len_field(&mut self, long: bool) -> Result<u64> {
+        if long { self.array().map(u64::from_be_bytes) } else { self.u32().map(u64::from) }
+    }
+
+    /// The next `n` bytes as a cursor of their own; this one moves past them.
+    fn sub(&mut self, n: u64) -> Result<Cursor<'a>> {
+        self.need(n)?;
+        let sub = Cursor { src: self.src, pos: self.pos, end: self.pos + n };
+        self.pos += n;
+        Ok(sub)
+    }
+
+    fn skip(&mut self, n: u64) -> Result<()> {
+        self.need(n)?;
+        self.pos += n;
+        Ok(())
+    }
+
+    fn rest(&mut self) -> Result<Vec<u8>> {
+        self.bytes(self.remaining())
+    }
+
+    /// The rest as a stored range; the cursor moves to the end.
+    fn stored_rest(&mut self) -> Stored {
+        let s = Stored { source: self.src.clone(), offset: self.pos, len: self.remaining() };
+        self.pos = self.end;
+        s
+    }
+}
+
+impl PsdFile {
+    /// Parses a file from `source`, leaving channel data and the merged image in it: see
+    /// [`crate::source`]. Decoding a channel then reads its bytes from the source, which must
+    /// stay unchanged while the model is in use.
+    pub fn from_source(source: Source) -> Result<Self> {
+        Self::from_source_and_merged_recovering(source, |_| false, |_| false).map(|(file, _)| file)
+    }
+
+    /// [`Self::from_bytes_and_merged_recovering`] for a [`Source`]: the merged image is read only
+    /// when `want` asks for it (and is then decoded as there, with the same recovery); otherwise
+    /// it stays in the source, unread and unchecked.
+    pub fn from_source_and_merged_recovering(
+        source: Source,
+        want: impl FnOnce(&PsdFile) -> bool,
+        recover: impl FnOnce(&PsdFile) -> bool,
+    ) -> Result<(Self, Option<Result<Vec<u8>>>)> {
+        let mut c = Cursor::new(&source);
+        let header = Header::read(&mut Reader::new(&c.bytes(26)?))?;
+        let version = header.version;
+        let psb = version.is_psb();
+        let cmd_len = c.u32()?;
+        let color_mode_data = c.bytes(u64::from(cmd_len))?;
+        let res_len = c.u32()?;
+        let res = c.bytes(u64::from(res_len))?;
+        let mut rr = Reader::new(&res);
+        let mut resources = Vec::new();
+        while !rr.is_empty() {
+            resources.push(ImageResource::read(&mut rr)?);
+        }
+
+        let lm_len = c.len_field(psb)?;
+        let mut s = c.sub(lm_len)?;
+        let mut layer_info = None;
+        let mut global_layer_mask = None;
+        let mut global_blocks = Vec::new();
+        let mut layer_mask_trailing = Vec::new();
+        let mut layer_info_placement = LayerInfoPlacement::Section;
+        if !s.is_empty() {
+            let li_len = s.len_field(psb)?;
+            if li_len > 0 {
+                layer_info = Some(read_layer_info(s.sub(li_len)?, version)?);
+            }
+            if s.remaining() >= 4 {
+                let n = s.u32()?;
+                global_layer_mask = Some(GlobalLayerMask { data: s.bytes(u64::from(n))? });
+                let target_key = match header.depth {
+                    16 => Some(b"Lr16"),
+                    32 => Some(b"Lr32"),
+                    _ => None,
+                };
+                let mut candidate_seen = match target_key {
+                    Some(_) => false,
+                    None => layer_info.as_ref().is_some_and(|i: &LayerInfo| !i.layers.is_empty()),
+                };
+                let trailing = read_blocks(
+                    &mut s,
+                    version,
+                    |index, signature, key, data, padding| {
+                        let is_candidate = match target_key {
+                            Some(k) => &key == k,
+                            None => matches!(&key, b"Layr" | b"Lr16" | b"Lr32"),
+                        };
+                        if candidate_seen || !is_candidate {
+                            return Ok(None);
+                        }
+                        candidate_seen = true;
+                        let info = match read_layer_info(data, version) {
+                            Ok(info) => info,
+                            // A failed read of the source is not damage: fail the parse, as
+                            // reading the whole file would.
+                            Err(e @ PsdError::Read(_)) => return Err(e),
+                            Err(_) => {
+                                if target_key.is_some() {
+                                    layer_info = None;
+                                }
+                                return Ok(None);
+                            }
+                        };
+                        layer_info = Some(info);
+                        layer_info_placement = LayerInfoPlacement::GlobalBlock { index, signature, key, padding: padding.clone() };
+                        Ok(Some(()))
+                    },
+                    &mut global_blocks,
+                )?;
+                layer_mask_trailing = trailing;
+            } else {
+                layer_mask_trailing = s.rest()?;
+            }
+        }
+        let mut file = PsdFile {
+            header,
+            color_mode_data,
+            resources,
+            layer_info,
+            layer_info_placement,
+            global_layer_mask,
+            global_blocks,
+            layer_mask_trailing,
+            image_data: ImageData::new(Compression::Raw, Vec::new()),
+            write_as_psb: false,
+        };
+        if !want(&file) {
+            let compression = Compression::from_u16(c.u16()?);
+            file.image_data = ImageData { compression, data: Vec::new(), stored: Some(c.stored_rest()) };
+            return Ok((file, None));
+        }
+        // The merged image is wanted: read it and decode it as `from_bytes` does.
+        let rest = c.rest()?;
+        let merged = file.read_merged_recovering(&rest, recover)?;
+        Ok((file, merged))
+    }
+}
+
+/// Reads tagged blocks as [`crate::tagged::read_blocks_with`] does, from a cursor: `consume`
+/// sees each block's data as a cursor and returns `Some` when it took the block; the others are
+/// read into memory and pushed to `blocks`. Returns the trailing bytes.
+fn read_blocks<'a>(
+    r: &mut Cursor<'a>,
+    version: Version,
+    mut consume: impl FnMut(usize, [u8; 4], [u8; 4], Cursor<'a>, &Option<Vec<u8>>) -> Result<Option<()>>,
+    blocks: &mut Vec<TaggedBlock>,
+) -> Result<Vec<u8>> {
+    const ALIGNMENT: usize = 4;
+    loop {
+        let head = r.peek(12)?;
+        if head.len() < 12 || !is_sig(&head) {
+            return r.rest();
+        }
+        let signature = r.array::<4>()?;
+        let key = r.array::<4>()?;
+        let len = r.len_field(uses_long_length(version, &key))?;
+        let data = r.sub(len)?;
+        // Padding as `read_blocks_with` detects it: the smallest k in 0..=3 such that the next
+        // signature (or the end of the region) follows k bytes later.
+        let rest = r.peek(7)?;
+        let mut pad = None;
+        for k in 0..=3usize {
+            if k == rest.len() || rest.get(k..).is_some_and(is_sig) {
+                pad = Some(k);
+                break;
+            }
+        }
+        let default = TaggedBlock::default_padding((len % ALIGNMENT as u64) as usize, ALIGNMENT);
+        let pad = pad.unwrap_or_else(|| if rest.get(..default).is_some_and(|p| p.iter().all(|&b| b == 0)) { default } else { 0 });
+        let pad_bytes = rest.get(..pad).map(<[u8]>::to_vec).unwrap_or_default();
+        r.skip(pad as u64)?;
+        let padding = if pad_bytes.len() == default && pad_bytes.iter().all(|&b| b == 0) { None } else { Some(pad_bytes) };
+        let (start, end) = (data.pos, data.end);
+        if consume(blocks.len(), signature, key, data, &padding)?.is_none() {
+            let data = Cursor { src: r.src, pos: start, end }.rest()?;
+            blocks.push(TaggedBlock { signature, key, data, padding });
+        }
+    }
+}
+
+/// [`LayerInfo::read_body`] from a cursor over the body: the records are read into memory, and
+/// each channel's encoded bytes become a [`Stored`] range after its compression field.
+fn read_layer_info(mut r: Cursor<'_>, version: Version) -> Result<LayerInfo> {
+    let body_start = r.pos;
+    let count = r.i16()?;
+    let merged_alpha = count < 0;
+    let n = count.unsigned_abs();
+    // Minimum record size, as `read_body` checks it.
+    if u64::from(n) * 34 > r.remaining() {
+        return Err(r.eof(u64::from(n) * 34));
+    }
+    // The records' total size is only known once they are parsed: read a chunk and grow it until
+    // they all fit (or the body is exhausted, when their error is the body's).
+    let mut chunk = RECORDS_CHUNK.min(r.remaining());
+    let (layers, all_lens, used) = loop {
+        let buf = r.peek(chunk)?;
+        let mut rr = Reader::new(&buf);
+        let mut layers = Vec::with_capacity(usize::from(n));
+        let mut all_lens = Vec::with_capacity(usize::from(n));
+        let parsed = (0..n).try_for_each(|_| {
+            let (rec, lens) = LayerRecord::read(&mut rr, version)?;
+            layers.push(rec);
+            all_lens.push(lens);
+            Ok::<_, PsdError>(())
+        });
+        match parsed {
+            Ok(()) => break (layers, all_lens, rr.pos() as u64),
+            Err(PsdError::UnexpectedEof { .. }) if chunk < r.remaining() => chunk = chunk.saturating_mul(2).min(r.remaining()),
+            Err(e) => return Err(e),
+        }
+    };
+    r.skip(used)?;
+    let mut layers = layers;
+    for (rec, lens) in layers.iter_mut().zip(all_lens) {
+        for (ch, len) in rec.channels.iter_mut().zip(lens) {
+            if len == 0 {
+                continue;
+            }
+            if len == 1 {
+                return Err(PsdError::invalid("channel data length 1"));
+            }
+            ch.compression = Some(Compression::from_u16(r.u16()?));
+            let data = r.sub(len - 2)?;
+            ch.stored = Some(Stored { source: data.src.clone(), offset: data.pos, len: data.remaining() });
+        }
+    }
+    let body_len = r.pos - body_start;
+    let rest = r.rest()?;
+    let padding = if rest.len() as u64 == body_len % 2 && rest.iter().all(|&b| b == 0) { None } else { Some(rest) };
+    Ok(LayerInfo { merged_alpha, layers, padding })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::testgen;
+
+    /// Every generated file, plus the layered 16/32-bit ones with their layers in a global block.
+    fn samples() -> Vec<Vec<u8>> {
+        let mut v = Vec::new();
+        for case in testgen::all_cases() {
+            let mut file = case.file;
+            v.push(file.to_bytes().unwrap());
+            let key = match file.header.depth {
+                16 => *b"Lr16",
+                32 => *b"Lr32",
+                _ => continue,
+            };
+            if file.layer_info.as_ref().is_some_and(|i| !i.layers.is_empty()) {
+                file.global_layer_mask.get_or_insert_with(GlobalLayerMask::default);
+                file.layer_info_placement = LayerInfoPlacement::GlobalBlock { index: 0, signature: *b"8BIM", key, padding: None };
+                v.push(file.to_bytes().unwrap());
+            }
+        }
+        v
+    }
+
+    fn same(bytes: Vec<u8>) {
+        let eager = PsdFile::from_bytes(&bytes).unwrap();
+        let lazy = PsdFile::from_source(Source::new(bytes.clone())).unwrap();
+        assert_eq!(lazy, eager);
+        assert_eq!(lazy.to_bytes().unwrap(), bytes);
+        assert!(lazy.layers().iter().flat_map(|l| &l.channels).all(|c| c.data.is_empty()));
+        assert!(lazy.image_data.data.is_empty() && lazy.image_data.stored.is_some());
+    }
+
+    #[test]
+    fn lazy_parse_matches_the_eager_one() {
+        for bytes in samples() {
+            same(bytes);
+        }
+    }
+
+    /// A PSD read lazily and written as PSB widens the RLE count tables of channels still in the
+    /// source, byte for byte as an eager read does (main's PSB promotion, #5285, on #6583's reader).
+    #[test]
+    fn a_lazy_psd_promotes_to_the_same_psb_as_an_eager_one() {
+        let bytes = testgen::layered(Version::Psd, crate::ColorMode::Rgb, 8, Compression::Rle).to_bytes().unwrap();
+        let mut eager = PsdFile::from_bytes(&bytes).unwrap();
+        let mut lazy = PsdFile::from_source(Source::new(bytes)).unwrap();
+        eager.promote_to_psb().unwrap();
+        lazy.promote_to_psb().unwrap();
+        let written = eager.to_bytes().unwrap();
+        assert_eq!(lazy.encoded_len().unwrap(), written.len() as u64);
+        assert!(lazy.to_bytes().unwrap() == written, "the lazily read PSD writes another PSB");
+    }
+
+    #[test]
+    fn lazy_parse_fails_where_the_eager_one_does() {
+        for bytes in samples() {
+            for cut in [1, 2, 7, 26, 40, bytes.len() / 3, bytes.len() / 2, bytes.len() - 3] {
+                let Some(b) = bytes.get(..cut) else { continue };
+                let eager = PsdFile::from_bytes(b);
+                let lazy = PsdFile::from_source(Source::new(b.to_vec()));
+                // A truncated merged image is only noticed when it is read.
+                match eager {
+                    Ok(eager) => assert_eq!(lazy.unwrap(), eager, "cut at {cut}"),
+                    Err(e) => {
+                        let records_ok = PsdFile::from_bytes_and_merged_recovering(b, |_| false, |_| true).is_ok();
+                        assert!(lazy.is_err() || records_ok, "cut at {cut}: eager {e:?}");
+                    }
+                }
+            }
+        }
+    }
+
+    /// A source whose `fail_at`-th read fails once.
+    struct FailOnce {
+        bytes: Vec<u8>,
+        fail_at: usize,
+        reads: std::sync::atomic::AtomicUsize,
+    }
+
+    impl crate::source::ReadAt for FailOnce {
+        fn len(&self) -> u64 {
+            self.bytes.len() as u64
+        }
+
+        fn read_at(&self, offset: u64, buf: &mut [u8]) -> Result<()> {
+            if self.reads.fetch_add(1, std::sync::atomic::Ordering::SeqCst) == self.fail_at {
+                return Err(PsdError::Read("injected".into()));
+            }
+            self.bytes.read_at(offset, buf)
+        }
+    }
+
+    #[test]
+    fn a_failed_read_fails_the_parse_instead_of_dropping_the_layers() {
+        for bytes in samples() {
+            let eager = PsdFile::from_bytes(&bytes).unwrap();
+            let clean = std::sync::Arc::new(FailOnce { bytes: bytes.clone(), fail_at: usize::MAX, reads: 0.into() });
+            PsdFile::from_source(Source::from_arc(clean.clone())).unwrap();
+            let reads = clean.reads.load(std::sync::atomic::Ordering::SeqCst);
+            for fail_at in 0..reads {
+                let src = FailOnce { bytes: bytes.clone(), fail_at, reads: 0.into() };
+                match PsdFile::from_source(Source::new(src)) {
+                    Err(PsdError::Read(_)) => {}
+                    Ok(lazy) => assert_eq!(lazy, eager, "read {fail_at} failed silently"),
+                    Err(e) => panic!("read {fail_at}: {e:?}"),
+                }
+            }
+        }
+    }
+}
diff --git a/crates/psd/src/lib.rs b/crates/psd/src/lib.rs
index 5248456d52..f5ffbed8b7 100644
--- a/crates/psd/src/lib.rs
+++ b/crates/psd/src/lib.rs
@@ -61,13 +61,16 @@ pub mod header;
 pub mod image_data;
 mod io;
 pub mod layer;
+mod lazy;
 pub mod metadata;
 pub mod path;
 pub mod patterns;
 pub mod pixels;
 pub mod resources;
+pub mod rows;
 pub mod shc;
 pub mod slices;
+pub mod source;
 pub mod tagged;
 #[cfg(any(test, feature = "testgen"))]
 // Test-data generator (tests and fuzz seeds only): failing loudly is the point.
@@ -87,5 +90,9 @@ pub use image_data::ImageData;
 pub use layer::{BlendingRanges, ChannelData, LayerFlags, LayerInfo, LayerMask, LayerRecord, MaskData, MaskParameters, RealMask, Rect};
 pub use pixels::{GrayImage, Layer, RgbaImage};
 pub use resources::{ImageResource, ResolutionInfo, ResourceData};
+pub use rows::RowDecoder;
+#[cfg(any(unix, windows))]
+pub use source::FileSource;
+pub use source::{ReadAt, Source, Stored};
 pub use tagged::{BlockData, SectionDivider, SectionType, TaggedBlock};
 pub use tree::LayerNode;
diff --git a/crates/psd/src/resources.rs b/crates/psd/src/resources.rs
index 4d78a062be..33ce147101 100644
--- a/crates/psd/src/resources.rs
+++ b/crates/psd/src/resources.rs
@@ -246,6 +246,16 @@ pub(crate) fn read_section(r: &mut Reader<'_>) -> Result<Vec<ImageResource>> {
     Ok(v)
 }
 
+/// Serialized size of the resource section [`write_section`] writes, its length field included.
+pub(crate) fn section_len(res: &[ImageResource]) -> u64 {
+    res.iter().fold(4u64, |n, r| {
+        let name = 1 + r.name.len().min(255);
+        let name = name + name % 2;
+        let data = r.data.len().saturating_add(r.data.len() % 2);
+        n.saturating_add((4 + 2 + name + 4) as u64).saturating_add(data as u64)
+    })
+}
+
 pub(crate) fn write_section(out: &mut Vec<u8>, res: &[ImageResource]) -> Result<()> {
     let at = out.begin_len(false);
     for r in res {
diff --git a/crates/psd/src/rows.rs b/crates/psd/src/rows.rs
new file mode 100644
index 0000000000..6413c801df
--- /dev/null
+++ b/crates/psd/src/rows.rs
@@ -0,0 +1,234 @@
+//! Decoding a channel a band of rows at a time: [`ChannelData::row_decoder`].
+//!
+//! [`ChannelData::decode`] returns the whole plane, so turning a layer into tiles holds every
+//! channel's plane plus an interleaved copy at once: for a 20000×15000 RGBA layer that is 2.4 GB
+//! on top of the tiles. A [`RowDecoder`] hands out any band of rows instead. RLE and raw channels
+//! are read band by band (a channel still in its [`Stored`](crate::Stored) source reads only the
+//! band's bytes: RLE's per-row byte counts give each row's offset); ZIP streams cannot be entered
+//! part way, so a ZIP channel is inflated once, when the decoder is made.
+
+use std::borrow::Cow;
+
+use crate::compression::{Compression, MAX_DECODED_BYTES, PlaneLayout, decode_planes, packbits};
+use crate::error::{PsdError, Result};
+use crate::header::Version;
+use crate::layer::ChannelData;
+use crate::source::Stored;
+
+/// Where a channel's encoded bytes are.
+enum Bytes<'a> {
+    Memory(&'a [u8]),
+    Source(&'a Stored),
+}
+
+impl Bytes<'_> {
+    fn len(&self) -> u64 {
+        match self {
+            Bytes::Memory(b) => b.len() as u64,
+            Bytes::Source(s) => s.len,
+        }
+    }
+
+    fn get(&self, at: u64, len: u64) -> Result<Cow<'_, [u8]>> {
+        match self {
+            Bytes::Memory(b) => {
+                let range = usize::try_from(at).ok().zip(usize::try_from(len).ok()).and_then(|(a, n)| b.get(a..a.checked_add(n)?));
+                range
+                    .map(Cow::Borrowed)
+                    .ok_or(PsdError::UnexpectedEof { offset: usize::try_from(at).unwrap_or(usize::MAX), needed: usize::try_from(len).unwrap_or(usize::MAX) })
+            }
+            Bytes::Source(s) => {
+                if at.checked_add(len).is_none_or(|end| end > s.len) {
+                    return Err(PsdError::UnexpectedEof {
+                        offset: usize::try_from(at).unwrap_or(usize::MAX),
+                        needed: usize::try_from(len).unwrap_or(usize::MAX),
+                    });
+                }
+                s.read_part(at, len).map(Cow::Owned)
+            }
+        }
+    }
+}
+
+enum Kind<'a> {
+    /// Rows at `row * row_bytes`.
+    Raw(Bytes<'a>),
+    /// `offsets[r]..offsets[r + 1]` are row `r`'s PackBits bytes (offsets from the start of the
+    /// data, after the count table).
+    Rle { bytes: Bytes<'a>, offsets: Vec<u64> },
+    /// The whole decoded plane.
+    Decoded(Vec<u8>),
+    /// No data and no rows.
+    Empty,
+}
+
+/// Decodes bands of rows of one channel: see the [module docs](self).
+pub struct RowDecoder<'a> {
+    kind: Kind<'a>,
+    row_bytes: usize,
+    height: usize,
+}
+
+impl ChannelData {
+    /// A decoder of this channel's rows, for a `width × height` plane. Fails where
+    /// [`Self::decode`] would on everything it can check without decoding the rows (sizes, the
+    /// RLE count table, the whole of a ZIP stream); a damaged row fails when its band is decoded.
+    pub fn row_decoder(&self, width: usize, height: usize, depth: u16, version: Version) -> Result<RowDecoder<'_>> {
+        let layout = PlaneLayout { planes: 1, width, height, depth, version };
+        let total = layout.decoded_len()?;
+        let row_bytes = layout.row_bytes();
+        let bytes = match &self.stored {
+            Some(s) => Bytes::Source(s),
+            None => Bytes::Memory(&self.data),
+        };
+        let kind = match self.compression {
+            None if total == 0 => Kind::Empty,
+            None => return Err(PsdError::invalid("channel has no data")),
+            Some(Compression::Raw) => {
+                if bytes.len() < total as u64 {
+                    return Err(PsdError::UnexpectedEof { offset: usize::try_from(bytes.len()).unwrap_or(usize::MAX), needed: total - bytes.len() as usize });
+                }
+                Kind::Raw(bytes)
+            }
+            Some(Compression::Rle) => {
+                let size: u64 = if version.is_psb() { 4 } else { 2 };
+                let table_len = (height as u64).saturating_mul(size);
+                if table_len > bytes.len() {
+                    return Err(PsdError::UnexpectedEof { offset: 0, needed: usize::try_from(table_len - bytes.len()).unwrap_or(usize::MAX) });
+                }
+                let table = bytes.get(0, table_len)?;
+                let mut offsets = Vec::new();
+                offsets.try_reserve_exact(height + 1).map_err(|_| PsdError::LimitExceeded("not enough memory for the RLE row table"))?;
+                let mut at = table_len;
+                offsets.push(at);
+                for c in table.chunks_exact(size as usize) {
+                    let n = match *c {
+                        [a, b] => u64::from(u16::from_be_bytes([a, b])),
+                        [a, b, c, d] => u64::from(u32::from_be_bytes([a, b, c, d])),
+                        _ => 0,
+                    };
+                    at = at.saturating_add(n);
+                    offsets.push(at);
+                }
+                let data_len = bytes.len() - table_len;
+                // As `decode_planes` checks: PackBits expands at most 64x.
+                if (total as u64) > data_len.saturating_mul(64) {
+                    return Err(PsdError::Decompress("RLE data too short for declared size".into()));
+                }
+                if at > bytes.len() {
+                    return Err(PsdError::UnexpectedEof {
+                        offset: usize::try_from(bytes.len()).unwrap_or(usize::MAX),
+                        needed: usize::try_from(at - bytes.len()).unwrap_or(usize::MAX),
+                    });
+                }
+                Kind::Rle { bytes, offsets }
+            }
+            Some(c) => Kind::Decoded(decode_planes(c, &self.encoded()?, &layout)?),
+        };
+        Ok(RowDecoder { kind, row_bytes, height })
+    }
+}
+
+impl RowDecoder<'_> {
+    /// Bytes per decoded row.
+    pub fn row_bytes(&self) -> usize {
+        self.row_bytes
+    }
+
+    /// Number of rows.
+    pub fn height(&self) -> usize {
+        self.height
+    }
+
+    /// Rows `r0..r1` as planar big-endian samples (`(r1 - r0) × row_bytes` bytes).
+    pub fn rows(&self, r0: usize, r1: usize) -> Result<Vec<u8>> {
+        if r0 > r1 || r1 > self.height {
+            return Err(PsdError::invalid(format!("rows {r0}..{r1} outside 0..{}", self.height)));
+        }
+        let n = (r1 - r0).checked_mul(self.row_bytes).ok_or(PsdError::LimitExceeded("band size overflow"))?;
+        if n as u64 > MAX_DECODED_BYTES {
+            return Err(PsdError::LimitExceeded("decoded channel data exceeds MAX_DECODED_BYTES"));
+        }
+        let mut out = Vec::new();
+        out.try_reserve_exact(n).map_err(|_| PsdError::LimitExceeded("not enough memory for the decoded channel data"))?;
+        match &self.kind {
+            Kind::Empty => {}
+            Kind::Raw(bytes) => out.extend_from_slice(&bytes.get((r0 * self.row_bytes) as u64, n as u64)?),
+            Kind::Decoded(plane) => {
+                out.extend_from_slice(plane.get(r0 * self.row_bytes..r1 * self.row_bytes).ok_or_else(|| PsdError::invalid("decoded plane too short"))?)
+            }
+            Kind::Rle { bytes, offsets } => {
+                let (Some(&start), Some(&end)) = (offsets.get(r0), offsets.get(r1)) else {
+                    return Err(PsdError::invalid("RLE row table too short"));
+                };
+                let band = bytes.get(start, end - start)?;
+                for r in r0..r1 {
+                    let (Some(&a), Some(&b)) = (offsets.get(r), offsets.get(r + 1)) else {
+                        return Err(PsdError::invalid("RLE row table too short"));
+                    };
+                    let row = band.get((a - start) as usize..(b - start) as usize).ok_or_else(|| PsdError::invalid("RLE row outside its band"))?;
+                    packbits::decode_into(row, self.row_bytes, &mut out)?;
+                }
+            }
+        }
+        Ok(out)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::source::Source;
+    use crate::{PsdFile, testgen};
+
+    /// Every channel of every generated file, decoded in uneven bands from memory and from a
+    /// source, is its whole-plane decode.
+    #[test]
+    fn bands_join_up_to_the_whole_plane() {
+        let mut checked = 0;
+        for case in testgen::all_cases() {
+            let bytes = case.file.to_bytes().unwrap();
+            let eager = PsdFile::from_bytes(&bytes).unwrap();
+            let lazy = PsdFile::from_source(Source::new(bytes)).unwrap();
+            let (d, v) = (eager.header.depth, eager.header.version);
+            for file in [&eager, &lazy] {
+                for rec in file.layers() {
+                    for ch in &rec.channels {
+                        let (w, h) = rec.channel_rect(ch.id).size().unwrap();
+                        let whole = ch.decode(w, h, d, v);
+                        let dec = ch.row_decoder(w, h, d, v);
+                        let (Ok(whole), Ok(dec)) = (whole, dec) else { continue };
+                        let mut joined = Vec::new();
+                        let mut r = 0;
+                        for step in [1, 3, 2, 7].iter().cycle() {
+                            if r >= h {
+                                break;
+                            }
+                            let r1 = (r + step).min(h);
+                            joined.extend(dec.rows(r, r1).unwrap());
+                            r = r1;
+                        }
+                        assert_eq!(joined, whole, "{}", case.name);
+                        assert!(dec.rows(0, h + 1).is_err());
+                        checked += 1;
+                    }
+                }
+            }
+        }
+        assert!(checked > 100, "{checked}");
+    }
+
+    #[test]
+    fn a_damaged_rle_row_fails_its_band() {
+        use crate::Compression;
+        use crate::layer::ChannelData;
+        // Two rows of 4 bytes: a valid row, then one that ends early.
+        let mut data = vec![0, 2, 0, 2];
+        data.extend([0xFD, 7]); // header -3: 1 - (-3) = 4 copies of 7
+        data.extend([0x01, 9]); // a literal of 2 bytes, only 1 present
+        let ch = ChannelData::new(0, Some(Compression::Rle), data);
+        let dec = ch.row_decoder(4, 2, 8, crate::Version::Psd).unwrap();
+        assert_eq!(dec.rows(0, 1).unwrap(), vec![7; 4]);
+        assert!(dec.rows(1, 2).is_err());
+        assert!(ch.decode(4, 2, 8, crate::Version::Psd).is_err());
+    }
+}
diff --git a/crates/psd/src/source.rs b/crates/psd/src/source.rs
new file mode 100644
index 0000000000..2e7c8039dd
--- /dev/null
+++ b/crates/psd/src/source.rs
@@ -0,0 +1,270 @@
+//! Random-access byte sources, for parsing a file without reading all of it.
+//!
+//! [`PsdFile::from_source`](crate::PsdFile::from_source) reads the structure of a file (header,
+//! resources, layer records, tagged blocks) and leaves the bulk of it, the encoded channel data
+//! and the merged image, where it is: each [`ChannelData`](crate::ChannelData) records a
+//! [`Stored`] range instead of a copy, and the bytes are read when the channel is decoded. A
+//! 2 GB layered file then never needs 2 GB of memory just to be opened.
+
+use std::borrow::Cow;
+use std::fmt;
+use std::sync::Arc;
+
+use crate::error::{PsdError, Result};
+
+/// Bytes that can be read at any offset, from any thread.
+///
+/// Implemented for byte buffers and, on native targets, for [`std::fs::File`] (as
+/// [`FileSource`]). The source must not change while a file parsed from it is in use: a
+/// [`Stored`] range is an offset into it.
+pub trait ReadAt: Send + Sync {
+    /// Total length in bytes.
+    fn len(&self) -> u64;
+
+    /// `true` when the source holds no bytes.
+    fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    /// Fills `buf` with the bytes at `offset..offset + buf.len()`. Fails, without a partial
+    /// result, when the range is not all inside the source or the read fails.
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> Result<()>;
+}
+
+fn out_of_range(offset: u64, needed: usize, len: u64) -> PsdError {
+    PsdError::UnexpectedEof {
+        offset: usize::try_from(offset).unwrap_or(usize::MAX),
+        needed: needed.saturating_sub(usize::try_from(len.saturating_sub(offset)).unwrap_or(usize::MAX)),
+    }
+}
+
+impl ReadAt for [u8] {
+    fn len(&self) -> u64 {
+        <[u8]>::len(self) as u64
+    }
+
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> Result<()> {
+        let src = usize::try_from(offset)
+            .ok()
+            .and_then(|start| self.get(start..start.checked_add(buf.len())?))
+            .ok_or_else(|| out_of_range(offset, buf.len(), ReadAt::len(self)))?;
+        buf.copy_from_slice(src);
+        Ok(())
+    }
+}
+
+impl ReadAt for Vec<u8> {
+    fn len(&self) -> u64 {
+        self.as_slice().len() as u64
+    }
+
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> Result<()> {
+        self.as_slice().read_at(offset, buf)
+    }
+}
+
+impl<T: ReadAt + ?Sized> ReadAt for Arc<T> {
+    fn len(&self) -> u64 {
+        (**self).len()
+    }
+
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> Result<()> {
+        (**self).read_at(offset, buf)
+    }
+}
+
+/// Largest single read from a [`FileSource`].
+#[cfg(any(unix, windows))]
+const MAX_READ: usize = 64 << 20;
+
+/// An open file read at offsets (`pread` on Unix, `seek_read` on Windows), with its length taken
+/// when it was opened. Reads from several threads at once need no lock.
+#[cfg(any(unix, windows))]
+#[derive(Debug)]
+pub struct FileSource {
+    file: std::fs::File,
+    len: u64,
+}
+
+#[cfg(any(unix, windows))]
+impl FileSource {
+    /// Opens `path` for reading.
+    pub fn open(path: &std::path::Path) -> std::io::Result<Self> {
+        Self::new(std::fs::File::open(path)?)
+    }
+
+    /// Wraps an open file.
+    pub fn new(file: std::fs::File) -> std::io::Result<Self> {
+        let len = file.metadata()?.len();
+        Ok(FileSource { file, len })
+    }
+
+    /// The file.
+    pub fn file(&self) -> &std::fs::File {
+        &self.file
+    }
+}
+
+#[cfg(any(unix, windows))]
+impl ReadAt for FileSource {
+    fn len(&self) -> u64 {
+        self.len
+    }
+
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> Result<()> {
+        if offset.checked_add(buf.len() as u64).is_none_or(|end| end > self.len) {
+            return Err(out_of_range(offset, buf.len(), self.len));
+        }
+        let n = buf.len();
+        let failed = |e: std::io::Error| PsdError::Read(format!("reading {n} bytes at offset {offset}: {e}"));
+        // Bounded reads, as `photocraft-format`'s `read_file` makes them: some Windows file
+        // systems reject a single read of gigabytes (#375).
+        let mut done = 0usize;
+        while done < n {
+            let Some(rest) = buf.get_mut(done..n.min(done + MAX_READ)) else { break };
+            let at = offset + done as u64;
+            #[cfg(unix)]
+            let read = {
+                use std::os::unix::fs::FileExt;
+                self.file.read_at(rest, at)
+            };
+            #[cfg(windows)]
+            let read = {
+                use std::os::windows::fs::FileExt;
+                self.file.seek_read(rest, at)
+            };
+            match read {
+                Ok(0) => return Err(failed(std::io::ErrorKind::UnexpectedEof.into())),
+                Ok(k) => done += k,
+                Err(e) if e.kind() == std::io::ErrorKind::Interrupted => {}
+                Err(e) => return Err(failed(e)),
+            }
+        }
+        Ok(())
+    }
+}
+
+/// A shared [`ReadAt`]: what [`Stored`] ranges point into. Two handles are equal when they are
+/// the same source.
+#[derive(Clone)]
+pub struct Source(Arc<dyn ReadAt>);
+
+impl Source {
+    /// Shares `source`.
+    pub fn new(source: impl ReadAt + 'static) -> Self {
+        Source(Arc::new(source))
+    }
+
+    /// Shares an already shared source.
+    pub fn from_arc(source: Arc<dyn ReadAt>) -> Self {
+        Source(source)
+    }
+
+    /// The source.
+    pub fn get(&self) -> &dyn ReadAt {
+        &*self.0
+    }
+
+    /// Reads `len` bytes at `offset` into a new buffer. The buffer is reserved fallibly: a
+    /// range larger than memory is an error, not an abort.
+    pub fn read_vec(&self, offset: u64, len: u64) -> Result<Vec<u8>> {
+        let n = usize::try_from(len).map_err(|_| PsdError::LimitExceeded("length exceeds address space"))?;
+        if offset.checked_add(len).is_none_or(|end| end > self.0.len()) {
+            return Err(out_of_range(offset, n, self.0.len()));
+        }
+        let mut out = Vec::new();
+        out.try_reserve_exact(n).map_err(|_| PsdError::LimitExceeded("not enough memory to read the data"))?;
+        out.resize(n, 0);
+        self.0.read_at(offset, &mut out)?;
+        Ok(out)
+    }
+}
+
+impl fmt::Debug for Source {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "Source({} bytes)", self.0.len())
+    }
+}
+
+impl PartialEq for Source {
+    fn eq(&self, other: &Self) -> bool {
+        Arc::ptr_eq(&self.0, &other.0)
+    }
+}
+
+impl Eq for Source {}
+
+/// Encoded bytes left in their [`Source`] by a lazy parse: `len` bytes at `offset`.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Stored {
+    /// Where the bytes are.
+    pub source: Source,
+    /// Offset of the first byte.
+    pub offset: u64,
+    /// Number of bytes.
+    pub len: u64,
+}
+
+impl Stored {
+    /// Reads the bytes.
+    pub fn read(&self) -> Result<Vec<u8>> {
+        self.source.read_vec(self.offset, self.len)
+    }
+
+    /// Reads `len` bytes starting `at` bytes into the range.
+    pub fn read_part(&self, at: u64, len: u64) -> Result<Vec<u8>> {
+        if at.checked_add(len).is_none_or(|end| end > self.len) {
+            return Err(PsdError::invalid("read past the end of stored data"));
+        }
+        self.source.read_vec(self.offset + at, len)
+    }
+}
+
+/// The bytes of a value that is either in memory (`data`) or still in its source (`stored`).
+pub(crate) fn encoded<'a>(data: &'a [u8], stored: Option<&Stored>) -> Result<Cow<'a, [u8]>> {
+    match stored {
+        Some(s) => s.read().map(Cow::Owned),
+        None => Ok(Cow::Borrowed(data)),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn slice_reads_are_bounds_checked() {
+        let v = vec![1u8, 2, 3, 4];
+        let mut b = [0u8; 2];
+        v.read_at(2, &mut b).unwrap();
+        assert_eq!(b, [3, 4]);
+        assert!(v.read_at(3, &mut b).is_err());
+        assert!(v.read_at(u64::MAX, &mut b).is_err());
+        let s = Source::new(v);
+        assert_eq!(s.read_vec(1, 2).unwrap(), vec![2, 3]);
+        assert!(s.read_vec(1, u64::MAX).is_err());
+        let st = Stored { source: s.clone(), offset: 1, len: 3 };
+        assert_eq!(st.read().unwrap(), vec![2, 3, 4]);
+        assert_eq!(st.read_part(1, 2).unwrap(), vec![3, 4]);
+        assert!(st.read_part(2, 2).is_err());
+        assert_eq!(st.source, s);
+        assert_ne!(st.source, Source::new(vec![1u8, 2, 3, 4]));
+    }
+
+    #[cfg(any(unix, windows))]
+    #[test]
+    fn file_source_reads_at_offsets() {
+        use std::io::Write;
+        let dir = std::env::temp_dir().join(format!("photocraft-psd-source-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("f.bin");
+        std::fs::File::create(&path).unwrap().write_all(&[9, 8, 7, 6, 5]).unwrap();
+        let f = FileSource::open(&path).unwrap();
+        assert_eq!(ReadAt::len(&f), 5);
+        let mut b = [0u8; 3];
+        f.read_at(2, &mut b).unwrap();
+        assert_eq!(b, [7, 6, 5]);
+        assert!(f.read_at(3, &mut b).is_err());
+        std::fs::remove_dir_all(&dir).unwrap();
+    }
+}
diff --git a/crates/psd/src/tagged.rs b/crates/psd/src/tagged.rs
index b16e158565..6fce19bbe9 100644
--- a/crates/psd/src/tagged.rs
+++ b/crates/psd/src/tagged.rs
@@ -168,7 +168,7 @@ impl TaggedBlock {
         String::from_utf8_lossy(&self.key).into_owned()
     }
 
-    fn default_padding(len: usize, alignment: usize) -> usize {
+    pub(crate) fn default_padding(len: usize, alignment: usize) -> usize {
         (alignment - len % alignment) % alignment
     }
 
@@ -360,9 +360,14 @@ impl TaggedBlock {
 
     /// Serialized size in bytes as a layer block (two-byte alignment).
     pub fn encoded_len(&self, version: Version) -> usize {
+        self.encoded_len_aligned(version, 2)
+    }
+
+    /// Serialized size in bytes as [`Self::write`] writes it with `alignment`.
+    pub(crate) fn encoded_len_aligned(&self, version: Version, alignment: usize) -> usize {
         let l = if uses_long_length(version, &self.key) { 8 } else { 4 };
-        let p = self.padding.as_ref().map_or(Self::default_padding(self.data.len(), 2), Vec::len);
-        8 + l + self.data.len() + p
+        let p = self.padding.as_ref().map_or(Self::default_padding(self.data.len(), alignment), Vec::len);
+        (8 + l + p).saturating_add(self.data.len())
     }
 }
 
@@ -444,7 +449,7 @@ fn parse_section(d: &[u8]) -> Result<SectionDivider> {
 
 /// `8BIM` / `8B64`, or the markers `MIB8` / `46B8` that [`crate::tiff`] gives a block kept
 /// verbatim from a little-endian TIFF when its layout is unknown (its data is in that order).
-fn is_sig(b: &[u8]) -> bool {
+pub(crate) fn is_sig(b: &[u8]) -> bool {
     b.starts_with(b"8BIM") || b.starts_with(b"8B64") || TaggedBlock::is_foreign_order_signature(b)
 }
 
diff --git a/crates/psd/src/testgen.rs b/crates/psd/src/testgen.rs
index d2d4784cb9..4898984445 100644
--- a/crates/psd/src/testgen.rs
+++ b/crates/psd/src/testgen.rs
@@ -113,7 +113,7 @@ pub fn merged_only(version: Version, mode: ColorMode, depth: u16, compression: C
     for c in 0..channels {
         planes.extend(pattern_plane(w as usize, h as usize, depth, u32::from(c)));
     }
-    let image_data = ImageData::encode(compression, &planes, &header).unwrap_or(ImageData { compression, data: Vec::new() });
+    let image_data = ImageData::encode(compression, &planes, &header).unwrap_or(ImageData::new(compression, Vec::new()));
     PsdFile {
         header,
         color_mode_data: color_mode_data(mode),
@@ -124,6 +124,7 @@ pub fn merged_only(version: Version, mode: ColorMode, depth: u16, compression: C
         global_blocks: Vec::new(),
         layer_mask_trailing: Vec::new(),
         image_data,
+        write_as_psb: false,
     }
 }
 
@@ -179,7 +180,7 @@ fn raster_layer(g: LayerGen<'_>) -> LayerRecord {
 
 fn group_record(header: &Header, name: &str, kind: SectionType, blend: BlendMode, id: u32) -> LayerRecord {
     let cc = mode_channels(header.color_mode) as i16;
-    let channels = (-1..cc).map(|c| ChannelData { id: c, compression: Some(Compression::Raw), data: Vec::new() }).collect();
+    let channels = (-1..cc).map(|c| ChannelData::new(c, Some(Compression::Raw), Vec::new())).collect();
     let lsct = if kind == SectionType::BoundingDivider {
         TaggedBlock::section_divider(kind, None, None)
     } else {
@@ -316,6 +317,7 @@ pub fn layered(version: Version, mode: ColorMode, depth: u16, compression: Compr
         global_blocks: blocks,
         layer_mask_trailing: Vec::new(),
         image_data,
+        write_as_psb: false,
     }
 }
 
@@ -351,6 +353,7 @@ pub fn small(version: Version, compression: Compression) -> PsdFile {
         global_blocks: vec![TaggedBlock::new(*b"Patt", vec![1, 2])],
         layer_mask_trailing: Vec::new(),
         image_data: ImageData::encode(compression, &planes, &header).expect("encode"),
+        write_as_psb: false,
     }
 }
 
diff --git a/crates/psd/src/tiff.rs b/crates/psd/src/tiff.rs
index 86373f2ed3..b669fcc637 100644
--- a/crates/psd/src/tiff.rs
+++ b/crates/psd/src/tiff.rs
@@ -217,6 +217,7 @@ impl ImageSourceData {
             global_blocks: self.global_blocks,
             layer_mask_trailing: self.trailing,
             image_data,
+            write_as_psb: false,
         }
     }
 }
diff --git a/crates/psd/src/tiff/transcode.rs b/crates/psd/src/tiff/transcode.rs
index c006dc4fa0..31d12b702f 100644
--- a/crates/psd/src/tiff/transcode.rs
+++ b/crates/psd/src/tiff/transcode.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{ByteOrder, LayerMask, MAX_DEPTH, PsdError, Reader, Result, TaggedBlock, Version, mask_parameter_bytes, uses_long_length};
 
 /// Converts the tagged blocks after the 37724 header string from `from` to `to`.
 pub fn transcode_blocks(data: &[u8], version: Version, from: ByteOrder, to: ByteOrder) -> Result<(Vec<u8>, Vec<String>)> {
diff --git a/crates/raster/src/lib.rs b/crates/raster/src/lib.rs
index 4aa50c5a60..af3c6d48e2 100644
--- a/crates/raster/src/lib.rs
+++ b/crates/raster/src/lib.rs
@@ -35,6 +35,24 @@ impl fmt::Display for AllocationError {
 
 impl std::error::Error for AllocationError {}
 
+/// One shared tile per pixel value (and tile size), for [`Surface::share_uniform_tiles`].
+#[derive(Debug, Default)]
+pub struct TileInterner {
+    tiles: std::collections::HashMap<usize, std::collections::HashMap<Vec<u8>, Arc<Tile>>>,
+}
+
+impl TileInterner {
+    /// Number of distinct uniform tiles held.
+    pub fn len(&self) -> usize {
+        self.tiles.values().map(|m| m.len()).sum()
+    }
+
+    /// `true` when no tile is held.
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+}
+
 /// Pixel storage for one tile: `TILE_SIZE² × bytes_per_pixel`, row-major, interleaved channels.
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct Tile {
@@ -465,6 +483,28 @@ impl Surface {
         out
     }
 
+    /// Makes every tile that holds one pixel value throughout share the interner's tile for that
+    /// value: a white background, an opaque mask or a solid fill then costs one tile however
+    /// large it is, and across every surface that shares `interner`. Tiles are copy-on-write, so
+    /// editing one splits it off again. Returns the bytes no longer held by this surface alone.
+    pub fn share_uniform_tiles(&mut self, interner: &mut TileInterner) -> usize {
+        let bpp = self.format.bytes_per_pixel();
+        let mut saved = 0;
+        for t in self.tiles.values_mut() {
+            let mut px = t.data.chunks_exact(bpp);
+            let Some(p0) = px.next() else { continue };
+            if !px.all(|p| p == p0) {
+                continue;
+            }
+            let shared = interner.tiles.entry(t.data.len()).or_default().entry(p0.to_vec()).or_insert_with(|| t.clone());
+            if !Arc::ptr_eq(shared, t) {
+                saved += t.data.len();
+                *t = shared.clone();
+            }
+        }
+        saved
+    }
+
     /// Drop tiles that are entirely the default pixel.
     pub fn prune(&mut self) {
         let dp = self.default_pixel.as_ref();
diff --git a/crates/raster/src/tests.rs b/crates/raster/src/tests.rs
index 1e8cf30ec7..47e78008fd 100644
--- a/crates/raster/src/tests.rs
+++ b/crates/raster/src/tests.rs
@@ -59,6 +59,38 @@ fn distinct_tiles(s: &Surface) -> usize {
     seen.len()
 }
 
+/// Uniform tiles written pixel by pixel end up as one shared tile per value, across
+/// surfaces, with every pixel unchanged; editing one splits it off.
+#[test]
+fn uniform_tiles_are_shared() {
+    let mut interner = TileInterner::default();
+    let r = Rect::new(0, 0, 1024, 600);
+    let mut bytes = Vec::new();
+    for y in 0..600 {
+        for x in 0..1024 {
+            // White, except a gradient in the tiles of column 3.
+            bytes.extend(if x >= 768 { [x as u8, y as u8, 0, 255] } else { [255, 255, 255, 255] });
+        }
+    }
+    let mut a = Surface::from_interleaved(PixelFormat::RGBA8, r, &bytes);
+    let mut b = Surface::from_interleaved(PixelFormat::RGBA8, r, &bytes);
+    let before = a.to_interleaved(r);
+    assert_eq!(distinct_tiles(&a), 12);
+    // Rows 512..600 cover only part of their tiles: the rest is the default pixel, so those
+    // tiles are not uniform.
+    let saved = a.share_uniform_tiles(&mut interner);
+    assert_eq!(distinct_tiles(&a), 1 + 3 + 3);
+    assert_eq!(saved, 5 * TILE_SIZE as usize * TILE_SIZE as usize * 4);
+    b.share_uniform_tiles(&mut interner);
+    assert_eq!(interner.len(), 1);
+    assert!(Arc::ptr_eq(a.tile(TileCoord { tx: 0, ty: 0 }).unwrap(), b.tile(TileCoord { tx: 2, ty: 1 }).unwrap()));
+    assert_eq!(a.to_interleaved(r), before);
+    a.write_pixel(5, 5, &[0.0, 0.0, 0.0, 1.0]);
+    assert_eq!(b.pixel(5, 5), vec![1.0, 1.0, 1.0, 1.0]);
+    assert_eq!(a.pixel(5, 5), vec![0.0, 0.0, 0.0, 1.0]);
+    assert_eq!(a.pixel(300, 5), vec![1.0, 1.0, 1.0, 1.0]);
+}
+
 /// Converting or tone-mapping a surface keeps a shared tile shared (#4531) and gives the
 /// same pixels as converting each pixel: a filled background is one tile across the grid,
 /// plus some distinct tiles.
diff --git a/crates/raw/src/demosaic.rs b/crates/raw/src/demosaic.rs
index fa703b2bb4..6303931811 100644
--- a/crates/raw/src/demosaic.rs
+++ b/crates/raw/src/demosaic.rs
@@ -101,6 +101,11 @@ impl Padded {
         Padded { data: vec![0.0; stride * (h + 2 * PAD)], w, h, stride }
     }
 
+    /// Whether the plane is non-empty and holds all its rows.
+    fn fits(&self) -> bool {
+        self.w != 0 && self.h != 0 && self.data.len() >= self.stride * (self.h + 2 * PAD)
+    }
+
     /// From an unpadded plane (tests and small inputs).
     #[cfg(test)]
     pub fn from_plane(plane: &[f32], w: usize, h: usize) -> Self {
@@ -190,51 +195,174 @@ fn kernels(phase: [u8; 4], method: Demosaic, stride: usize) -> [[Vec<(isize, f32
 pub(crate) fn demosaic(p: &Padded, phase: [u8; 4], method: Demosaic, to_xyz: &Mat3, ahd_jobs: usize) -> Vec<f32> {
     let (w, h, s) = (p.w, p.h, p.stride);
     let mut out = vec![0.0f32; w * h * 3];
-    if w == 0 || h == 0 || p.data.len() < s * (h + 2 * PAD) {
+    if !p.fits() {
         return out;
     }
     if method == Demosaic::Ahd {
-        ahd(p, phase, to_xyz, &mut out, ahd_jobs);
+        let (d, m, labf) = (&p.data, ahd_matrix(to_xyz), LabF::new());
+        for_bands_grouped(
+            &mut out,
+            AHD_BAND * w * 3,
+            ahd_bands(h),
+            ahd_jobs,
+            1,
+            || AhdScratch::for_image(h, s),
+            |band, chunk, sc| {
+                ahd_band(d, w, s, phase, &m, &labf, band, chunk, sc);
+            },
+        );
         return out;
     }
     let ks = kernels(phase, method, s);
     let rows = par::band_rows(w);
-    let d = &p.data;
-    par::chunks_mut(&mut out, rows * w * 3, |band, chunk| {
-        let y0 = band * rows;
-        for (r, row) in chunk.chunks_exact_mut(w * 3).enumerate() {
-            let y = y0 + r;
-            let base = (y + PAD) * s + PAD;
-            for (x, o) in row.as_chunks_mut::<3>().0.iter_mut().enumerate() {
-                let pos = (y & 1) * 2 + (x & 1);
-                let i = base + x;
-                if method == Demosaic::Bilinear {
-                    // Direct Bayer bilinear (the kernels' result without the tap loops).
-                    let own = usize::from(phase[pos]).min(2);
-                    let (n, so, e, wv) = (d[i - s], d[i + s], d[i + 1], d[i - 1]);
-                    if own == 1 {
-                        let hc = usize::from(phase[(y & 1) * 2 + ((x + 1) & 1)]).min(2);
-                        o[1] = d[i];
-                        o[hc] = (e + wv) * 0.5;
-                        o[2 - hc] = (n + so) * 0.5;
-                    } else {
-                        o[own] = d[i];
-                        o[1] = (n + so + e + wv) * 0.25;
-                        o[2 - own] = (d[i - s - 1] + d[i - s + 1] + d[i + s - 1] + d[i + s + 1]) * 0.25;
-                    }
-                    continue;
-                }
-                for (c, k) in ks[pos].iter().enumerate() {
-                    let mut v = 0.0f32;
-                    for &(off, wt) in k {
-                        v += wt * d[(i as isize + off) as usize];
-                    }
-                    o[c] = v.clamp(0.0, 1.0);
-                }
+    par::chunks_mut(&mut out, rows * w * 3, |band, chunk| linear_band(&p.data, w, s, phase, method, &ks, band * rows, 0, chunk));
+    out
+}
+
+/// [`demosaic`] without the full RGB frame and without the padded plane: every band loads the
+/// rows it reads (`fill(y, row)` writes the normalized CFA row `y` of the image, `w` samples;
+/// the mirrored borders are added here), demosaics into a band buffer, and `emit(rgb, out)`
+/// turns it into the band's `out` samples (the same rows, `w * 3` per row). Each pixel depends
+/// only on the plane around it, never on how rows are split or ordered, so the result is that
+/// of `emit` over [`demosaic`] of the filled plane.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn demosaic_fused(
+    w: usize,
+    h: usize,
+    phase: [u8; 4],
+    method: Demosaic,
+    to_xyz: &Mat3,
+    jobs: usize,
+    fill: &(impl Fn(usize, &mut [f32]) + Sync),
+    out: &mut [u16],
+    emit: &(impl Fn(&[f32], &mut [u16]) + Sync),
+) {
+    if w == 0 || h == 0 || out.len() < w * h * 3 {
+        return;
+    }
+    let s = w + 2 * PAD;
+    let out = &mut out[..w * h * 3];
+    // Padded rows of the output rows `y0..y0 + rows` (`rows + 2 * PAD` of them, row `PAD` is `y0`)
+    // with the mirror reflection `Padded::fill_borders` applies.
+    let load = |win: &mut [f32], y0: usize, rows: usize| {
+        for (j, prow) in win.chunks_exact_mut(s).take(rows + 2 * PAD).enumerate() {
+            fill(reflect((y0 + j) as isize - PAD as isize, h), &mut prow[PAD..PAD + w]);
+            for px in (0..PAD).chain(PAD + w..s) {
+                prow[px] = prow[PAD + reflect(px as isize - PAD as isize, w)];
             }
         }
+    };
+    if method == Demosaic::Ahd {
+        let (m, labf) = (ahd_matrix(to_xyz), LabF::new());
+        // The rows of the tallest band, as `develop`'s memory check counts them.
+        let rows = h.min(AHD_BAND);
+        let init = || (AhdScratch::for_image(h, s), vec![0.0f32; rows * w * 3], vec![0.0f32; (rows + 2 * PAD) * s]);
+        for_bands_grouped(out, AHD_BAND * w * 3, ahd_bands(h), jobs, 1, init, |band, chunk, (sc, buf, win)| {
+            load(win, band * AHD_BAND, chunk.len() / (w * 3));
+            let buf = &mut buf[..chunk.len()];
+            // The window starts at a multiple of AHD_BAND (even), so it is band 0 of its own rows.
+            ahd_band(win, w, s, phase, &m, &labf, 0, buf, sc);
+            emit(buf, chunk);
+        });
+        return;
+    }
+    let ks = kernels(phase, method, s);
+    let rows = h.min(FUSED_ROWS);
+    let init = || (vec![0.0f32; rows * w * 3], vec![0.0f32; (rows + 2 * PAD) * s]);
+    for_bands(out, FUSED_ROWS * w * 3, h.div_ceil(FUSED_ROWS), jobs, init, |band, chunk, (buf, win)| {
+        load(win, band * FUSED_ROWS, chunk.len() / (w * 3));
+        let buf = &mut buf[..chunk.len()];
+        linear_band(win, w, s, phase, method, &ks, band * FUSED_ROWS, band * FUSED_ROWS, buf);
+        emit(buf, chunk);
+    });
+}
+
+/// Output rows per band of the fused bilinear / MHC path (the window adds `2 * PAD` rows).
+pub(crate) const FUSED_ROWS: usize = 32;
+
+/// Rows `y0..` of bilinear or MHC output (`chunk.len() / (w * 3)` of them); `d` is the padded
+/// plane from image row `dy` on (`dy` 0: all of it).
+#[allow(clippy::too_many_arguments)]
+fn linear_band(d: &[f32], w: usize, s: usize, phase: [u8; 4], method: Demosaic, ks: &[[Vec<(isize, f32)>; 3]; 4], y0: usize, dy: usize, chunk: &mut [f32]) {
+    for (r, row) in chunk.chunks_exact_mut(w * 3).enumerate() {
+        let y = y0 + r;
+        let base = (y - dy + PAD) * s + PAD;
+        for (x, o) in row.as_chunks_mut::<3>().0.iter_mut().enumerate() {
+            let pos = (y & 1) * 2 + (x & 1);
+            let i = base + x;
+            if method == Demosaic::Bilinear {
+                // Direct Bayer bilinear (the kernels' result without the tap loops).
+                let own = usize::from(phase[pos]).min(2);
+                let (n, so, e, wv) = (d[i - s], d[i + s], d[i + 1], d[i - 1]);
+                if own == 1 {
+                    let hc = usize::from(phase[(y & 1) * 2 + ((x + 1) & 1)]).min(2);
+                    o[1] = d[i];
+                    o[hc] = (e + wv) * 0.5;
+                    o[2 - hc] = (n + so) * 0.5;
+                } else {
+                    o[own] = d[i];
+                    o[1] = (n + so + e + wv) * 0.25;
+                    o[2 - own] = (d[i - s - 1] + d[i - s + 1] + d[i + s - 1] + d[i + s + 1]) * 0.25;
+                }
+                continue;
+            }
+            for (c, k) in ks[pos].iter().enumerate() {
+                let mut v = 0.0f32;
+                for &(off, wt) in k {
+                    v += wt * d[(i as isize + off) as usize];
+                }
+                o[c] = v.clamp(0.0, 1.0);
+            }
+        }
+    }
+}
+
+/// Runs `f(band, chunk, scratch)` over the `unit`-sized chunks of `out` (`bands` of them), with
+/// at most `jobs` scratch values alive. When every worker may hold one, each band is its own
+/// rayon task and borrows a scratch from a pool (one per worker at most); otherwise a few groups
+/// of consecutive bands per job run, `jobs` at a time, each building its scratch once.
+pub(crate) fn for_bands<T: Send, S: Send>(
+    out: &mut [T],
+    unit: usize,
+    bands: usize,
+    jobs: usize,
+    init: impl Fn() -> S + Sync + Send,
+    f: impl Fn(usize, &mut [T], &mut S) + Sync + Send,
+) {
+    for_bands_grouped(out, unit, bands, jobs, 4, init, f);
+}
+
+/// Bands per group when `bands` are split into `per_worker` groups for each worker (at most `jobs`).
+fn bands_per_group(bands: usize, jobs: usize, per_worker: usize) -> usize {
+    let groups = (par::workers().min(jobs.max(1)) * per_worker).clamp(1, bands.max(1));
+    bands.div_ceil(groups).max(1)
+}
+
+/// [`for_bands`] with `per_worker` groups of consecutive bands for each of the `jobs` workers when
+/// fewer than all may hold a scratch. A large scratch (AHD: 16 planes) wants one group per job:
+/// with more groups each would build and zero its own scratch for a band or two.
+fn for_bands_grouped<T: Send, S: Send>(
+    out: &mut [T],
+    unit: usize,
+    bands: usize,
+    jobs: usize,
+    per_worker: usize,
+    init: impl Fn() -> S + Sync + Send,
+    f: impl Fn(usize, &mut [T], &mut S) + Sync + Send,
+) {
+    // One task per band keeps rayon's stealing, so a busy or slow worker doesn't hold up a
+    // static share of the bands (as `par::chunks_mut_limited` does for the same reason).
+    if jobs >= par::workers() {
+        par::chunks_mut_pooled(out, unit, init, |sc, band, chunk| f(band, chunk, sc));
+        return;
+    }
+    let per_group = bands_per_group(bands, jobs, per_worker);
+    par::chunks_mut_limited(out, per_group * unit, jobs, |group, gchunk| {
+        let mut sc = init();
+        for (j, chunk) in gchunk.chunks_mut(unit).enumerate() {
+            f(group * per_group + j, chunk, &mut sc);
+        }
     });
-    out
 }
 
 /// A CFA repeat as seen from the plane's origin: colour of plane pixel
@@ -318,10 +446,36 @@ fn phase_taps(pat: &Pattern, px: isize, py: isize) -> Taps {
 /// without the edge-directed weights it is no faster and leaves zipper
 /// artefacts along every edge of an X-Trans image.
 pub(crate) fn demosaic_cfa(p: &Padded, pat: &Pattern) -> Vec<f32> {
-    let (w, h, s) = (p.w, p.h, p.stride);
+    let (w, h) = (p.w, p.h);
     let mut out = vec![0.0f32; w * h * 3];
-    if w == 0 || h == 0 || pat.w == 0 || pat.h == 0 || pat.colors.len() < pat.w * pat.h || p.data.len() < s * (h + 2 * PAD) {
-        return out;
+    let band = par::band_rows(w);
+    cfa_with(p, pat, |rows| par::chunks_mut(&mut out, band * w * 3, |b, chunk| rows(b * band, chunk)));
+    out
+}
+
+/// [`demosaic_cfa`] without the full RGB frame (the green plane stays): see [`demosaic_fused`].
+pub(crate) fn demosaic_cfa_fused(p: &Padded, pat: &Pattern, jobs: usize, out: &mut [u16], emit: &(impl Fn(&[f32], &mut [u16]) + Sync)) {
+    let (w, h) = (p.w, p.h);
+    if out.len() < w * h * 3 {
+        return;
+    }
+    let band = par::band_rows(w);
+    let init = || vec![0.0f32; band.min(h) * w * 3];
+    cfa_with(p, pat, |rows| {
+        for_bands(&mut out[..w * h * 3], band * w * 3, h.div_ceil(band), jobs, init, |b, chunk, buf| {
+            let buf = &mut buf[..chunk.len()];
+            rows(b * band, buf);
+            emit(buf, chunk);
+        });
+    });
+}
+
+/// The generic demosaic's green plane, then `run` with a function that fills the RGB rows
+/// `y0..` of a chunk (`chunk.len() / (w * 3)` of them). Not called for an unusable plane or pattern.
+fn cfa_with(p: &Padded, pat: &Pattern, run: impl FnOnce(&(dyn Fn(usize, &mut [f32]) + Sync))) {
+    let (w, h, s) = (p.w, p.h, p.stride);
+    if !p.fits() || pat.w == 0 || pat.h == 0 || pat.colors.len() < pat.w * pat.h {
+        return;
     }
     let taps: Vec<Taps> = (0..pat.w * pat.h).map(|i| phase_taps(pat, (i % pat.w) as isize, (i / pat.w) as isize)).collect();
     let tap_at = |x: usize, y: usize| &taps[(y % pat.h) * pat.w + x % pat.w];
@@ -389,9 +543,9 @@ pub(crate) fn demosaic_cfa(p: &Padded, pat: &Pattern) -> Vec<f32> {
     // 2. Red and blue from colour differences.
     let gref = &green;
     let gat = |x: usize, y: usize, o: Off| get(gref, w, 0, x, y, o);
-    par::chunks_mut(&mut out, band * w * 3, |b, chunk| {
+    run(&|y0: usize, chunk: &mut [f32]| {
         for (r, row) in chunk.chunks_exact_mut(w * 3).enumerate() {
-            let y = b * band + r;
+            let y = y0 + r;
             for (x, o) in row.as_chunks_mut::<3>().0.iter_mut().enumerate() {
                 let t = tap_at(x, y);
                 let g = gref.get(y * w + x).copied().unwrap_or(0.0);
@@ -418,7 +572,6 @@ pub(crate) fn demosaic_cfa(p: &Padded, pat: &Pattern) -> Vec<f32> {
             }
         }
     });
-    out
 }
 
 /// Regularizes the inverse-gradient weights (normalized units, about 1/256 of full scale).
@@ -426,9 +579,10 @@ const GRAD_EPS: f32 = 1.0 / 256.0;
 /// Regularizes the green-similarity weights of the colour differences.
 const DIFF_EPS: f32 = 1.0 / 64.0;
 
-/// CIE f(t) for L*a*b*, tabulated on 0..2 with linear interpolation.
+/// CIE f(t) for L*a*b*, tabulated on 0..2 with linear interpolation. Each entry holds the
+/// sample and the step to the next one (one load per lookup; the same `a + (b - a) * f`).
 struct LabF {
-    table: Vec<f32>,
+    pairs: Vec<[f32; 2]>,
 }
 
 const LABF_STEPS: usize = 1 << 14;
@@ -436,7 +590,8 @@ const LABF_RANGE: f32 = 2.0;
 
 impl LabF {
     fn new() -> Self {
-        LabF { table: (0..=LABF_STEPS + 1).map(|i| Self::exact(i as f32 * LABF_RANGE / LABF_STEPS as f32)).collect() }
+        let table: Vec<f32> = (0..=LABF_STEPS + 1).map(|i| Self::exact(i as f32 * LABF_RANGE / LABF_STEPS as f32)).collect();
+        LabF { pairs: table.windows(2).map(|p| [p[0], p[1] - p[0]]).collect() }
     }
 
     fn exact(t: f32) -> f32 {
@@ -450,27 +605,36 @@ impl LabF {
         }
         let x = t * (LABF_STEPS as f32 / LABF_RANGE);
         let i = (x as usize).min(LABF_STEPS);
-        let a = self.table[i];
-        a + (self.table[i + 1] - a) * (x - i as f32)
+        let [a, step] = self.pairs[i];
+        a + step * (x - i as f32)
     }
 }
 
 /// Output rows per AHD band.
-const AHD_BAND: usize = 32;
+pub(crate) const AHD_BAND: usize = 32;
 /// Extra band rows above and below the output rows.
 const M: usize = 3;
 
-/// Maximum scratch allocation of one AHD band: two green, RGB and Lab float
-/// planes and two byte homogeneity planes, including their border rows.
+/// Scratch rows one AHD worker allocates: the output rows of the tallest band
+/// this image has, plus their border rows.
+fn ahd_scratch_rows(h: usize) -> usize {
+    h.min(AHD_BAND) + 2 * M
+}
+
+/// Scratch allocation of one AHD worker ([`AhdScratch::for_image`]): two green,
+/// RGB and Lab float planes and two byte homogeneity planes over
+/// [`ahd_scratch_rows`], plus the two `u32` rows of vertical sums.
 pub(crate) fn ahd_scratch(w: u64, h: u64) -> u64 {
-    w.saturating_add(2 * PAD as u64).saturating_mul(h.min(AHD_BAND as u64).saturating_add(2 * M as u64)).saturating_mul(58)
+    let s = w.saturating_add(2 * PAD as u64);
+    let rows = h.min(AHD_BAND as u64).saturating_add(2 * M as u64);
+    s.saturating_mul(rows.saturating_mul(58).saturating_add(8))
 }
 
 pub(crate) fn ahd_bands(h: usize) -> usize {
     h.div_ceil(AHD_BAND)
 }
 
-pub(crate) const AHD_TABLE_BYTES: u64 = (LABF_STEPS as u64 + 2) * 4;
+pub(crate) const AHD_TABLE_BYTES: u64 = (LABF_STEPS as u64 + 1) * 8;
 
 /// `v` limited to `lo..=hi` like `f32::clamp`, without its panic on NaN bounds (hostile black
 /// levels can put NaN in the plane): same result for every non-NaN bound.
@@ -480,7 +644,198 @@ fn clampf(v: f32, lo: f32, hi: f32) -> f32 {
     if v > hi { hi } else { v }
 }
 
-fn ahd(p: &Padded, phase: [u8; 4], to_xyz: &Mat3, out: &mut [f32], jobs: usize) {
+/// One AHD band's working planes, reused for every band a worker runs (sized for the tallest band).
+struct AhdScratch {
+    /// Green interpolated horizontally (0) and vertically (1).
+    g: [Vec<f32>; 2],
+    /// Per direction, the RGB candidate (planar).
+    rgb: [[Vec<f32>; 3]; 2],
+    /// Per direction, its CIELAB (planar).
+    lab: [[Vec<f32>; 3]; 2],
+    hom: [Vec<u8>; 2],
+    /// Vertical 3-row sums of `hom`, one output row.
+    vs: [Vec<u32>; 2],
+}
+
+impl AhdScratch {
+    fn new(len: usize, s: usize) -> Self {
+        let f = || vec![0.0f32; len];
+        AhdScratch {
+            g: [f(), f()],
+            rgb: [[f(), f(), f()], [f(), f(), f()]],
+            lab: [[f(), f(), f()], [f(), f(), f()]],
+            hom: [vec![0u8; len], vec![0u8; len]],
+            vs: [vec![0u32; s], vec![0u32; s]],
+        }
+    }
+
+    /// The scratch for an image `h` rows tall with stride `s`: the size [`ahd_scratch`] budgets.
+    fn for_image(h: usize, s: usize) -> Self {
+        AhdScratch::new(ahd_scratch_rows(h) * s, s)
+    }
+}
+
+/// The camera → XYZ matrix with the rows divided by the white point.
+fn ahd_matrix(to_xyz: &Mat3) -> [[f32; 3]; 3] {
+    let white = [0.9642f32, 1.0, 0.8249];
+    std::array::from_fn(|i| std::array::from_fn(|j| to_xyz[i][j] as f32 / white[i]))
+}
+
+/// One AHD band (see [`ahd_ref`] for the plain statement): the same arithmetic in the same
+/// order, per row on slices, planar scratch reused across a worker's bands. Every scratch cell
+/// a stage reads was written earlier in the same band, so the planes are never cleared between
+/// bands.
+#[allow(clippy::too_many_arguments)]
+fn ahd_band(d: &[f32], w: usize, s: usize, phase: [u8; 4], m: &[[f32; 3]; 3], labf: &LabF, band: usize, chunk: &mut [f32], sc: &mut AhdScratch) {
+    let rows = chunk.len() / (w * 3);
+    let n = rows + 2 * M;
+    let py = |b: usize| band * AHD_BAND + PAD - M + b;
+    let drow = |y: usize| &d[y * s..(y + 1) * s];
+    // 1. Green interpolated horizontally (0) and vertically (1), columns 2..s-2.
+    {
+        let [g0, g1] = &mut sc.g;
+        for b in 0..n {
+            let y = py(b);
+            let (rm2, rm1, r0, rp1, rp2) = (drow(y - 2), drow(y - 1), drow(y), drow(y + 1), drow(y + 2));
+            let gh_row = &mut g0[b * s..(b + 1) * s];
+            let gv_row = &mut g1[b * s..(b + 1) * s];
+            let green = [phase[(y & 1) * 2] == 1, phase[(y & 1) * 2 + 1] == 1];
+            for x in 2..s - 2 {
+                let c = r0[x];
+                if green[x & 1] {
+                    gh_row[x] = c;
+                    gv_row[x] = c;
+                    continue;
+                }
+                let (l, r) = (r0[x - 1], r0[x + 1]);
+                let gh = (l + r) * 0.5 + (2.0 * c - r0[x - 2] - r0[x + 2]) * 0.25;
+                gh_row[x] = clampf(gh, l.min(r), l.max(r));
+                let (u, dn) = (rm1[x], rp1[x]);
+                let gv = (u + dn) * 0.5 + (2.0 * c - rm2[x] - rp2[x]) * 0.25;
+                gv_row[x] = clampf(gv, u.min(dn), u.max(dn));
+            }
+        }
+    }
+    // 2. RGB candidates and their Lab, band rows 1..n-1, columns 3..s-3.
+    for dir in 0..2 {
+        let gd = &sc.g[dir];
+        let [cr, cg, cb] = &mut sc.rgb[dir];
+        let [ll, la, lb] = &mut sc.lab[dir];
+        for b in 1..n - 1 {
+            let y = py(b);
+            let (dm1, d0, dp1) = (drow(y - 1), drow(y), drow(y + 1));
+            let (gm1, g0, gp1) = (&gd[(b - 1) * s..b * s], &gd[b * s..(b + 1) * s], &gd[(b + 1) * s..(b + 2) * s]);
+            let at = b * s;
+            let (orr, org, orb) = (&mut cr[at..at + s], &mut cg[at..at + s], &mut cb[at..at + s]);
+            let (ol, oa, ob) = (&mut ll[at..at + s], &mut la[at..at + s], &mut lb[at..at + s]);
+            let pr = (y & 1) * 2;
+            for x in 3..s - 3 {
+                let own = phase[pr + (x & 1)];
+                let gv = g0[x];
+                // `va` goes to channel `ch`, `vb` to `2 - ch` (as `px[ch] = va; px[2 - ch] = vb`,
+                // built from values: an indexed store into `px` stalls store forwarding).
+                let (ch, va, vb) = if own == 1 {
+                    (
+                        phase[pr + ((x + 1) & 1)].min(2),
+                        gv + 0.5 * ((d0[x - 1] - g0[x - 1]) + (d0[x + 1] - g0[x + 1])),
+                        gv + 0.5 * ((dm1[x] - gm1[x]) + (dp1[x] - gp1[x])),
+                    )
+                } else {
+                    (
+                        own.min(2),
+                        d0[x],
+                        gv + 0.25 * ((dm1[x - 1] - gm1[x - 1]) + (dm1[x + 1] - gm1[x + 1]) + (dp1[x - 1] - gp1[x - 1]) + (dp1[x + 1] - gp1[x + 1])),
+                    )
+                };
+                let px = match ch {
+                    0 => [va, gv, vb],
+                    2 => [vb, gv, va],
+                    _ => [gv, vb, gv],
+                };
+                let px = px.map(|v| v.clamp(0.0, 1.0));
+                orr[x] = px[0];
+                org[x] = px[1];
+                orb[x] = px[2];
+                let xyz: [f32; 3] = std::array::from_fn(|k| m[k][0] * px[0] + m[k][1] * px[1] + m[k][2] * px[2]);
+                let (fx, fy, fz) = (labf.f(xyz[0]), labf.f(xyz[1]), labf.f(xyz[2]));
+                ol[x] = 116.0 * fy - 16.0;
+                oa[x] = 500.0 * (fx - fy);
+                ob[x] = 200.0 * (fy - fz);
+            }
+        }
+    }
+    // 3. Homogeneity maps, band rows 2..n-2, columns 4..s-4.
+    {
+        let [l0, a0, b0] = &sc.lab[0];
+        let [l1, a1, b1] = &sc.lab[1];
+        let [h0, h1] = &mut sc.hom;
+        for b in 2..n - 2 {
+            fn row(pl: &[f32], bb: usize, s: usize) -> &[f32] {
+                &pl[bb * s..(bb + 1) * s]
+            }
+            let (l0u, l0c, l0d) = (row(l0, b - 1, s), row(l0, b, s), row(l0, b + 1, s));
+            let (a0u, a0c, a0d) = (row(a0, b - 1, s), row(a0, b, s), row(a0, b + 1, s));
+            let (b0u, b0c, b0d) = (row(b0, b - 1, s), row(b0, b, s), row(b0, b + 1, s));
+            let (l1u, l1c, l1d) = (row(l1, b - 1, s), row(l1, b, s), row(l1, b + 1, s));
+            let (a1u, a1c, a1d) = (row(a1, b - 1, s), row(a1, b, s), row(a1, b + 1, s));
+            let (b1u, b1c, b1d) = (row(b1, b - 1, s), row(b1, b, s), row(b1, b + 1, s));
+            let (h0r, h1r) = (&mut h0[b * s..(b + 1) * s], &mut h1[b * s..(b + 1) * s]);
+            for x in 4..s - 4 {
+                // Neighbours left, right, up, down; (|ΔL|, Δa² + Δb²) from the centre.
+                let dist = |lc: f32, ac: f32, bc: f32, ln: f32, an: f32, bn: f32| ((lc - ln).abs(), (ac - an) * (ac - an) + (bc - bn) * (bc - bn));
+                let (lc, ac, bc) = (l0c[x], a0c[x], b0c[x]);
+                let dh = [
+                    dist(lc, ac, bc, l0c[x - 1], a0c[x - 1], b0c[x - 1]),
+                    dist(lc, ac, bc, l0c[x + 1], a0c[x + 1], b0c[x + 1]),
+                    dist(lc, ac, bc, l0u[x], a0u[x], b0u[x]),
+                    dist(lc, ac, bc, l0d[x], a0d[x], b0d[x]),
+                ];
+                let (lc, ac, bc) = (l1c[x], a1c[x], b1c[x]);
+                let dv = [
+                    dist(lc, ac, bc, l1c[x - 1], a1c[x - 1], b1c[x - 1]),
+                    dist(lc, ac, bc, l1c[x + 1], a1c[x + 1], b1c[x + 1]),
+                    dist(lc, ac, bc, l1u[x], a1u[x], b1u[x]),
+                    dist(lc, ac, bc, l1d[x], a1d[x], b1d[x]),
+                ];
+                let eps_l = dh[0].0.max(dh[1].0).min(dv[2].0.max(dv[3].0));
+                let eps_c = dh[0].1.max(dh[1].1).min(dv[2].1.max(dv[3].1));
+                let count = |v: &[(f32, f32); 4]| v.iter().map(|(l, c)| u8::from(*l <= eps_l && *c <= eps_c)).sum::<u8>();
+                h0r[x] = count(&dh);
+                h1r[x] = count(&dv);
+            }
+        }
+    }
+    // 4. Per pixel, the candidate with the larger 3×3 homogeneity sum.
+    let [vs0, vs1] = &mut sc.vs;
+    for r in 0..rows {
+        let b = r + M;
+        for (hm, vs) in [(&sc.hom[0], &mut *vs0), (&sc.hom[1], &mut *vs1)] {
+            let (u, c, dn) = (&hm[(b - 1) * s..b * s], &hm[b * s..(b + 1) * s], &hm[(b + 1) * s..(b + 2) * s]);
+            for x in PAD - 1..PAD + w + 1 {
+                vs[x] = u32::from(u[x]) + u32::from(c[x]) + u32::from(dn[x]);
+            }
+        }
+        let at = b * s;
+        let (r0, g0, b0) = (&sc.rgb[0][0][at..at + s], &sc.rgb[0][1][at..at + s], &sc.rgb[0][2][at..at + s]);
+        let (r1, g1, b1) = (&sc.rgb[1][0][at..at + s], &sc.rgb[1][1][at..at + s], &sc.rgb[1][2][at..at + s]);
+        let orow = &mut chunk[r * w * 3..(r + 1) * w * 3];
+        for (x, o) in orow.as_chunks_mut::<3>().0.iter_mut().enumerate() {
+            let px = x + PAD;
+            let sh = vs0[px - 1] + vs0[px] + vs0[px + 1];
+            let sv = vs1[px - 1] + vs1[px] + vs1[px + 1];
+            let (c0, c1) = ([r0[px], g0[px], b0[px]], [r1[px], g1[px], b1[px]]);
+            *o = match sh.cmp(&sv) {
+                std::cmp::Ordering::Greater => c0,
+                std::cmp::Ordering::Less => c1,
+                std::cmp::Ordering::Equal => [0.5 * (c0[0] + c1[0]), 0.5 * (c0[1] + c1[1]), 0.5 * (c0[2] + c1[2])],
+            };
+        }
+    }
+}
+
+/// The plain AHD statement the optimized [`ahd`] must match bit for bit.
+#[cfg(test)]
+fn ahd_ref(p: &Padded, phase: [u8; 4], to_xyz: &Mat3, out: &mut [f32], jobs: usize) {
     let (w, s) = (p.w, p.stride);
     let d = &p.data;
     // Colour at padded coordinates (PAD is even, so the phase is unchanged).
@@ -596,6 +951,8 @@ fn ahd(p: &Padded, phase: [u8; 4], to_xyz: &Mat3, out: &mut [f32], jobs: usize)
 mod tests {
     use super::*;
     use crate::color::IDENTITY;
+    use std::sync::atomic::{AtomicUsize, Ordering::SeqCst};
+    use std::time::{Duration, Instant};
 
     #[test]
     fn ahd_band_concurrency_does_not_change_pixels() {
@@ -614,6 +971,213 @@ mod tests {
         assert_eq!(demosaic(&p, [0, 1, 1, 2], Demosaic::Ahd, &IDENTITY, 1).len(), 192);
     }
 
+    #[test]
+    fn ahd_matches_reference_bit_for_bit() {
+        let m = [[0.41, 0.36, 0.18], [0.21, 0.72, 0.07], [0.02, 0.12, 0.95]];
+        for (w, h) in [(1, 1), (2, 3), (7, 5), (53, 103), (64, 70), (33, 31)] {
+            let cfa: Vec<f32> = (0..w * h).map(|i| ((i * 7919 + i / w * 104729) % 1013) as f32 / 1000.0 - 0.006).collect();
+            let p = Padded::from_plane(&cfa, w, h);
+            for phase in [[0, 1, 1, 2], [2, 1, 1, 0], [1, 0, 2, 1], [1, 2, 0, 1]] {
+                for jobs in [1, 3, 64] {
+                    let mut want = vec![0.0f32; w * h * 3];
+                    ahd_ref(&p, phase, &m, &mut want, jobs);
+                    let got = demosaic(&p, phase, Demosaic::Ahd, &m, jobs);
+                    assert_eq!(
+                        want.iter().map(|v| v.to_bits()).collect::<Vec<_>>(),
+                        got.iter().map(|v| v.to_bits()).collect::<Vec<_>>(),
+                        "{w}x{h} {phase:?} {jobs}"
+                    );
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn fused_demosaic_matches_the_full_frame_demosaic() {
+        let m = [[0.41, 0.36, 0.18], [0.21, 0.72, 0.07], [0.02, 0.12, 0.95]];
+        // Sizes around the bands (AHD 32 rows, bilinear / MHC 32 rows) and the padding.
+        for (w, h) in [(1, 1), (2, 3), (7, 5), (53, 103), (64, 64), (33, 31), (5, 70), (31, 65)] {
+            let cfa: Vec<f32> = (0..w * h).map(|i| ((i * 7919 + i / w * 104729) % 1013) as f32 / 1000.0 - 0.006).collect();
+            let p = Padded::from_plane(&cfa, w, h);
+            let fill = |y: usize, row: &mut [f32]| row.copy_from_slice(&cfa[y * w..(y + 1) * w]);
+            // Any per-sample map stands in for the encode.
+            let emit = |rgb: &[f32], out: &mut [u16]| {
+                for (o, v) in out.iter_mut().zip(rgb) {
+                    *o = (v.clamp(0.0, 1.0) * 65535.0 + 0.5) as u16;
+                }
+            };
+            for method in [Demosaic::Bilinear, Demosaic::Mhc, Demosaic::Ahd] {
+                for phase in [[0, 1, 1, 2], [2, 1, 1, 0], [1, 0, 2, 1], [1, 2, 0, 1]] {
+                    for jobs in [1, 3, 64] {
+                        let full = demosaic(&p, phase, method, &m, jobs);
+                        let mut want = vec![0u16; w * h * 3];
+                        emit(&full, &mut want);
+                        let mut got = vec![0u16; w * h * 3];
+                        demosaic_fused(w, h, phase, method, &m, jobs, &fill, &mut got, &emit);
+                        assert_eq!(want, got, "{w}x{h} {method:?} {phase:?} {jobs}");
+                    }
+                }
+            }
+        }
+    }
+
+    /// Bytes the scratch planes actually hold.
+    fn scratch_bytes(sc: &AhdScratch) -> u64 {
+        let f = sc.g.iter().chain(sc.rgb.iter().flatten()).chain(sc.lab.iter().flatten()).map(|v| v.capacity() * 4).sum::<usize>();
+        let b = sc.hom.iter().map(Vec::capacity).sum::<usize>();
+        let u = sc.vs.iter().map(|v| v.capacity() * 4).sum::<usize>();
+        (f + b + u) as u64
+    }
+
+    /// The memory check in `develop` admits a file on [`ahd_scratch`] per worker; the scratch
+    /// `ahd` allocates must not exceed it. A short wide strip used to allocate the 38 rows of a
+    /// full band against a budget of `h + 6` rows (5.4x at `h = 1`).
+    #[test]
+    fn ahd_scratch_fits_its_budget() {
+        for w in [1usize, 2, 33, 4000] {
+            for h in [1usize, 2, 7, 31, 32, 33, 100, 5000] {
+                let s = w + 2 * PAD;
+                let sc = AhdScratch::for_image(h, s);
+                let budget = ahd_scratch(w as u64, h as u64);
+                assert_eq!(scratch_bytes(&sc), budget, "{w}x{h}: allocated vs budgeted bytes");
+                // The tallest band `ahd` hands out (at most 32 rows, plus 3 above and below) fits.
+                assert!(sc.g[0].len() >= (h.min(32) + 6) * s, "{w}x{h}");
+            }
+        }
+    }
+
+    /// One scratch serves many bands (1100 rows are 35 bands, the last one short, over one scratch
+    /// with jobs 1 and two with jobs 2 on a bigger pool), so a stage reading a cell left over from
+    /// an earlier band would show.
+    #[test]
+    fn ahd_matches_reference_with_reused_scratch() {
+        let m = [[0.41, 0.36, 0.18], [0.21, 0.72, 0.07], [0.02, 0.12, 0.95]];
+        let (w, h) = (37, 1100);
+        let cfa: Vec<f32> = (0..w * h).map(|i| ((i * 7919 + i / w * 104729) % 1013) as f32 / 1000.0 - 0.006).collect();
+        let p = Padded::from_plane(&cfa, w, h);
+        for jobs in [1, 2] {
+            assert!(bands_per_group(ahd_bands(h), jobs, 1) >= 2, "jobs {jobs}: each scratch must serve several bands");
+            for phase in [[0, 1, 1, 2], [2, 1, 1, 0], [1, 0, 2, 1], [1, 2, 0, 1]] {
+                let mut want = vec![0.0f32; w * h * 3];
+                ahd_ref(&p, phase, &m, &mut want, jobs);
+                let got = demosaic(&p, phase, Demosaic::Ahd, &m, jobs);
+                assert_eq!(want.len(), got.len());
+                assert!(want.iter().zip(&got).all(|(a, b)| a.to_bits() == b.to_bits()), "{w}x{h} {phase:?} jobs {jobs}");
+            }
+        }
+    }
+
+    /// On a 4-worker pool with room for 3 scratches, 35 bands go in groups of 12 (the last of 11),
+    /// so groups after the first start at band `group * 12` and every scratch is reused for several
+    /// bands; with room for 4, every band is its own task and most borrow a used scratch. A wrong band
+    /// index or a stale scratch cell would change pixels. The split does not depend on the machine.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn ahd_groups_of_several_bands_match_reference() {
+        let m = [[0.41, 0.36, 0.18], [0.21, 0.72, 0.07], [0.02, 0.12, 0.95]];
+        let (w, h) = (37, 1100);
+        let cfa: Vec<f32> = (0..w * h).map(|i| ((i * 7919 + i / w * 104729) % 1013) as f32 / 1000.0 - 0.006).collect();
+        let p = Padded::from_plane(&cfa, w, h);
+        let pool = rayon::ThreadPoolBuilder::new().num_threads(4).build().unwrap();
+        pool.install(|| {
+            assert_eq!(par::workers(), 4);
+            assert_eq!(bands_per_group(ahd_bands(h), 3, 1), 12);
+            // One group per job, never more groups than jobs, however many bands there are.
+            assert_eq!(bands_per_group(126, 3, 1), 42);
+            for jobs in [3, 4] {
+                for phase in [[0, 1, 1, 2], [1, 2, 0, 1]] {
+                    let mut want = vec![0.0f32; w * h * 3];
+                    ahd_ref(&p, phase, &m, &mut want, jobs);
+                    let got = demosaic(&p, phase, Demosaic::Ahd, &m, jobs);
+                    assert!(want.iter().zip(&got).all(|(a, b)| a.to_bits() == b.to_bits()), "{phase:?} jobs {jobs}");
+                }
+            }
+        });
+    }
+
+    /// A scratch that counts how many are alive at once.
+    struct Live<'a>(&'a AtomicUsize);
+
+    impl<'a> Live<'a> {
+        fn new(now: &'a AtomicUsize, peak: &AtomicUsize) -> Self {
+            peak.fetch_max(now.fetch_add(1, SeqCst) + 1, SeqCst);
+            Live(now)
+        }
+    }
+
+    impl Drop for Live<'_> {
+        fn drop(&mut self) {
+            self.0.fetch_sub(1, SeqCst);
+        }
+    }
+
+    /// Every band runs once with its own index, and no more than `jobs` scratches (what `develop`'s
+    /// memory check admits) or one per worker are alive at once, on either side of `jobs == workers`.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn for_bands_keeps_at_most_jobs_scratches_alive() {
+        let pool = rayon::ThreadPoolBuilder::new().num_threads(8).build().unwrap();
+        pool.install(|| {
+            for jobs in [1, 2, 3, 7, 8, 9, usize::MAX] {
+                for per_worker in [1, 4] {
+                    let (now, peak) = (AtomicUsize::new(0), AtomicUsize::new(0));
+                    let mut out = vec![0usize; 37 * 10 - 4];
+                    for_bands_grouped(
+                        &mut out,
+                        10,
+                        37,
+                        jobs,
+                        per_worker,
+                        || Live::new(&now, &peak),
+                        |band, chunk, _| {
+                            std::thread::sleep(Duration::from_millis(1));
+                            chunk.iter_mut().for_each(|v| *v += band + 1);
+                        },
+                    );
+                    assert!(out.iter().enumerate().all(|(i, &v)| v == i / 10 + 1), "jobs {jobs}");
+                    let peak = peak.load(SeqCst);
+                    assert!((1..=jobs.min(8)).contains(&peak), "jobs {jobs} per_worker {per_worker}: {peak} scratches alive");
+                    assert_eq!(now.load(SeqCst), 0);
+                }
+            }
+        });
+    }
+
+    /// With room for a scratch on every worker, the bands are separate rayon tasks: a worker held up
+    /// on band 0 (by other work on the shared pool, or a slow core) leaves the bands after it to
+    /// the others. With a fixed share of 9 bands per worker, 8 of them would wait for band 0, so at
+    /// most 26 of the other 34 could finish meanwhile.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn a_slow_band_does_not_hold_up_the_bands_after_it() {
+        let pool = rayon::ThreadPoolBuilder::new().num_threads(4).build().unwrap();
+        pool.install(|| {
+            let (done, seen) = (AtomicUsize::new(0), AtomicUsize::new(0));
+            let mut out = vec![0u8; 35];
+            for_bands_grouped(
+                &mut out,
+                1,
+                35,
+                4,
+                1,
+                || (),
+                |band, _, _| {
+                    if band > 0 {
+                        done.fetch_add(1, SeqCst);
+                        return;
+                    }
+                    let start = Instant::now();
+                    while done.load(SeqCst) <= 26 && start.elapsed() < Duration::from_secs(10) {
+                        std::thread::sleep(Duration::from_millis(1));
+                    }
+                    seen.store(done.load(SeqCst), SeqCst);
+                },
+            );
+            assert_eq!(done.load(SeqCst), 34);
+            assert!(seen.load(SeqCst) > 26, "only {} bands ran while band 0 was held up", seen.load(SeqCst));
+        });
+    }
+
     /// Mosaics an RGB image with the given phase.
     fn mosaic(rgb: &[[f32; 3]], w: usize, h: usize, phase: [u8; 4]) -> Vec<f32> {
         (0..w * h).map(|i| rgb[i][phase[((i / w) & 1) * 2 + ((i % w) & 1)] as usize]).collect()
diff --git a/crates/raw/src/develop.rs b/crates/raw/src/develop.rs
index ca08846a85..aaeb390eff 100644
--- a/crates/raw/src/develop.rs
+++ b/crates/raw/src/develop.rs
@@ -5,7 +5,7 @@
 //! orientation.
 
 use crate::color::{self, Mat3};
-use crate::demosaic::{Demosaic, PAD, Padded, Pattern, demosaic, demosaic_cfa};
+use crate::demosaic::{Demosaic, PAD, Padded, Pattern, demosaic, demosaic_cfa, demosaic_cfa_fused, demosaic_fused, for_bands};
 use crate::error::{RawError, Result};
 use crate::look::{CameraLook, ToneCurve};
 use crate::sensor::Sensor;
@@ -194,6 +194,12 @@ pub(crate) fn resolve_neutral(s: &Sensor, opts: &DevelopOptions, sc: &Scale, war
 
 /// Develops sensor data.
 pub fn develop_sensor(s: &Sensor, opts: &DevelopOptions) -> Result<Developed> {
+    develop(s, opts, true)
+}
+
+/// [`develop_sensor`]; `allow_fused` false keeps the full-frame path (what the tests compare the
+/// fused one against).
+fn develop(s: &Sensor, opts: &DevelopOptions, allow_fused: bool) -> Result<Developed> {
     let c = s.crop;
     let samples = s.width.checked_mul(s.height).and_then(|n| n.checked_mul(s.samples));
     if c.is_empty()
@@ -219,7 +225,12 @@ pub fn develop_sensor(s: &Sensor, opts: &DevelopOptions) -> Result<Developed> {
         return Err(RawError::malformed("invalid sensor CFA pattern"));
     }
     let bayer = s.cfa.as_ref().is_none_or(|cfa| cfa.is_bayer());
-    let ahd_jobs = working_memory(c.width, c.height, s.cfa.is_some(), bayer, opts, par::workers())?;
+    // The default rendering (no Dehaze, no local tone, no black point) needs no statistic of
+    // the whole frame: demosaic and encode band by band, with no full RGB frame (the same
+    // condition under which `Haze::new` and `ToneMap::new` return `None`).
+    let fused = allow_fused && opts.tone.is_neutral() && s.black_point <= 0.0;
+    let orient_copy = opts.orient && (2..=8).contains(&s.orientation);
+    let jobs = working_memory(c.width, c.height, s.cfa.is_some(), bayer, Shape { fused, orient_copy }, opts, par::workers())?;
     let mut warnings = s.warnings.clone();
     let sc = Scale::new(s);
 
@@ -256,161 +267,207 @@ pub fn develop_sensor(s: &Sensor, opts: &DevelopOptions) -> Result<Developed> {
     let grey_gain = gain as f32;
     let (w, h) = (c.width, c.height);
     let band = par::band_rows(w);
-    let mut rgb: Vec<f32>;
-    let pattern: Option<String>;
-    match &s.cfa {
-        Some(cfa) => {
-            // Normalized, balanced, clipped CFA plane.
-            let mut plane = Padded::new(w, h);
-            let stride = plane.stride;
-            // Fast path: black varies at most per 2×2 position, so black and gain
-            // repeat every `period` columns (the CFA width, made even).
-            let bl = &s.black;
-            let periodic = bl.delta_h.is_empty() && bl.delta_v.is_empty() && matches!(bl.rows, 1 | 2) && matches!(bl.cols, 1 | 2) && cfa.width <= 16;
-            let period = if cfa.width % 2 == 0 { cfa.width.max(2) } else { cfa.width * 2 };
-            plane.fill_rows(band, |y0, chunk| {
-                for (r, prow) in chunk.chunks_exact_mut(stride).enumerate() {
-                    let row = &mut prow[PAD..PAD + w];
-                    let y = c.y + y0 + r;
-                    if periodic {
-                        // Per column of the period: black and the combined scale × white-balance gain.
-                        let k: Vec<(f32, f32)> = (0..period)
-                            .map(|p| {
-                                let x = c.x + p;
-                                let black = bl.at(x.saturating_sub(s.active.x), y.saturating_sub(s.active.y), 0, 1);
-                                let range = s.white[0] - black;
-                                // A non-finite black (a BlackLevel DOUBLE beyond f32) gives 0, as
-                                // `Scale::value` does, instead of (raw - inf) * 0 = NaN.
-                                if !(range >= 1.0 && black.is_finite()) {
-                                    return (0.0, 0.0);
-                                }
-                                (black, mult[usize::from(cfa.color(x, y)).min(2)] / range)
-                            })
-                            .collect();
-                        let src = &s.data[y * s.width + c.x..y * s.width + c.x + w];
-                        let ks = k.iter().cycle();
-                        match &sc.lin {
-                            None => {
-                                for ((v, &raw), &(black, gain)) in row.iter_mut().zip(src).zip(ks) {
-                                    *v = ((f32::from(raw) - black) * gain).clamp(0.0, 1.0);
-                                }
-                            }
-                            Some(l) => {
-                                for ((v, &raw), &(black, gain)) in row.iter_mut().zip(src).zip(ks) {
-                                    let lin = f32::from(l.get(usize::from(raw)).or_else(|| l.last()).copied().unwrap_or(raw));
-                                    *v = ((lin - black) * gain).clamp(0.0, 1.0);
-                                }
-                            }
-                        }
-                    } else {
-                        for (i, v) in row.iter_mut().enumerate() {
-                            let x = c.x + i;
-                            let ch = usize::from(cfa.color(x, y)).min(2);
-                            *v = (sc.value(x, y, 0) * mult[ch]).clamp(0.0, 1.0);
-                        }
-                    }
-                    // Lens-shading gain maps, after the white-balance clip so clipped
-                    // highlights stay neutral.
-                    if let Some(g) = gain_row(s, y, c.x, w, 0) {
-                        for (v, g) in row.iter_mut().zip(g) {
-                            *v = (*v * g).clamp(0.0, 1.0);
-                        }
-                    }
-                }
-            });
-            plane.fill_borders();
-            let names = |p: &[u8]| p.iter().map(|c| ['R', 'G', 'B'][usize::from(*c).min(2)]).collect::<String>();
-            if bayer {
-                let p = cfa.phase(c.x, c.y);
-                pattern = Some(names(&p));
-                rgb = demosaic(&plane, p, opts.demosaic, &to_xyz, ahd_jobs);
-            } else {
-                let pat = Pattern::of(cfa, c.x, c.y);
-                pattern = Some(pat.colors.chunks(pat.w.max(1)).map(names).collect::<Vec<_>>().join("/"));
-                rgb = demosaic_cfa(&plane, &pat);
-            }
-            drop(plane);
-        }
-        None => {
-            pattern = None;
-            rgb = vec![0.0f32; w * h * 3];
-            par::chunks_mut(&mut rgb, band * w * 3, |b, chunk| {
-                for (r, row) in chunk.chunks_exact_mut(w * 3).enumerate() {
-                    let y = c.y + b * band + r;
-                    for i in 0..w {
-                        for k in 0..3 {
-                            // Monochrome: the one sample in all three channels.
-                            let sample = k.min(s.samples.saturating_sub(1));
-                            row[i * 3 + k] = (sc.value(c.x + i, y, sample) * mult[k]).clamp(0.0, 1.0);
-                        }
-                    }
-                    for k in 0..s.samples.min(3) {
-                        if let Some(g) = gain_row(s, y, c.x, w, k) {
-                            for (i, g) in g.into_iter().enumerate() {
-                                row[i * 3 + k] = (row[i * 3 + k] * g).clamp(0.0, 1.0);
-                            }
-                        }
-                    }
-                }
-            });
-        }
-    }
-
     // Camera → ProPhoto, exposure, Dehaze, Shadows / Highlights / Clarity / Texture and the black
     // point, the look's (or the profile's) tone curve, gamma 1.8, 16 bits.
     let y_row = color::rgb_to_xyz(color::ROMM, color::D50_XY)[1].map(|v| v as f32);
     let lum = |v: &[f32; 3]| y_row[0] * v[0] + y_row[1] * v[1] + y_row[2] * v[2];
     // Monochrome: the one sample, grey; no colour matrix.
     let pro = |p: &[f32]| if mono { [grey_gain * p[0]; 3] } else { [0, 1, 2].map(|k| out_m[k][0] * p[0] + out_m[k][1] * p[1] + out_m[k][2] * p[2]) };
-    let haze = Haze::new(w, h, |i| pro(&rgb[i * 3..i * 3 + 3]), opts.tone.dehaze);
-    // Linear ProPhoto of pixel `i` after Dehaze.
-    let linear = |i: usize, p: &[f32]| {
-        let v = pro(p);
-        haze.as_ref().map_or(v, |z| z.apply(i % w, i / w, v))
-    };
-    let mut map = ToneMap::new(w, h, |i| lum(&linear(i, &rgb[i * 3..i * 3 + 3])), opts.tone, s.black_point);
-    if let (Some(m), Some(_)) = (&mut map, &haze) {
-        // The black point belongs to the default rendering: Dehaze does not move it (taken after
-        // Dehaze it fell to almost 0, and Dehaze darkened less than Photoshop's).
-        m.black = black_level(w, h, |i| lum(&pro(&rgb[i * 3..i * 3 + 3])), s.black_point);
-    }
-    let mut out = vec![0u16; w * h * 3];
     let lut = match look {
         Some(l) => GammaLut::with_tone(l.tone.as_ref()),
         None => GammaLut::with_curve(&s.tone_curve),
     };
-    // The default rendering (no Dehaze, no local tone): matrix then encode, in blocks so the
-    // encode's clamp and square root run over whole slices.
-    let plain = map.is_none() && haze.is_none();
-    par::chunks_mut(&mut out, band * w * 3, |b, chunk| {
-        let start = b * band * w * 3;
-        let src = &rgb[start..start + chunk.len()];
-        if plain {
-            let mut buf = [0.0f32; ENCODE_BLOCK];
-            for (oc, sc) in chunk.chunks_mut(ENCODE_BLOCK).zip(src.chunks(ENCODE_BLOCK)) {
-                let n = sc.len();
-                for (t, p) in buf[..n].as_chunks_mut::<3>().0.iter_mut().zip(sc.as_chunks::<3>().0) {
-                    *t = pro(p);
+    // The default rendering: matrix then encode, in blocks so the encode's clamp and square root
+    // run over whole slices.
+    let encode_plain = |src: &[f32], dst: &mut [u16]| {
+        let mut buf = [0.0f32; ENCODE_BLOCK];
+        for (oc, sc) in dst.chunks_mut(ENCODE_BLOCK).zip(src.chunks(ENCODE_BLOCK)) {
+            let n = sc.len();
+            for (t, p) in buf[..n].as_chunks_mut::<3>().0.iter_mut().zip(sc.as_chunks::<3>().0) {
+                *t = pro(p);
+            }
+            lut.encode_into(&buf[..n], oc);
+        }
+    };
+    // Rows `y0..` of a LinearRaw (3-sample or monochrome) frame, balanced and clipped.
+    let linear_rows = |y0: usize, chunk: &mut [f32]| {
+        for (r, row) in chunk.chunks_exact_mut(w * 3).enumerate() {
+            let y = c.y + y0 + r;
+            for i in 0..w {
+                for k in 0..3 {
+                    // Monochrome: the one sample in all three channels.
+                    let sample = k.min(s.samples.saturating_sub(1));
+                    row[i * 3 + k] = (sc.value(c.x + i, y, sample) * mult[k]).clamp(0.0, 1.0);
                 }
-                lut.encode_into(&buf[..n], oc);
             }
-            return;
-        }
-        for (i, (o, p)) in chunk.as_chunks_mut::<3>().0.iter_mut().zip(src.as_chunks::<3>().0).enumerate() {
-            let mut v = linear(b * band * w + i, p);
-            if let Some(m) = &map {
-                let g = m.gain(i % w, b * band + i / w, lum(&v));
-                // The black point first, as Camera Raw: lifting before it would flatten the
-                // deepest shadows' contrast.
-                v = v.map(|c| m.unblack(c) * g);
-            }
-            for k in 0..3 {
-                o[k] = lut.encode(v[k]);
+            for k in 0..s.samples.min(3) {
+                if let Some(g) = gain_row(s, y, c.x, w, k) {
+                    for (i, g) in g.into_iter().enumerate() {
+                        row[i * 3 + k] = (row[i * 3 + k] * g).clamp(0.0, 1.0);
+                    }
+                }
             }
         }
-    });
-    rgb.clear();
-    rgb.shrink_to_fit();
+    };
+    let mut rgb: Vec<f32> = Vec::new();
+    // The encoded frame, when the fused path made it.
+    let mut fused_out: Option<Vec<u16>> = None;
+    let pattern: Option<String>;
+    match &s.cfa {
+        Some(cfa) => {
+            // One normalized, balanced, clipped CFA row (image row `iy` of the crop).
+            // Fast path: black varies at most per 2×2 position, so black and gain
+            // repeat every `period` columns (the CFA width, made even).
+            let bl = &s.black;
+            let periodic = bl.delta_h.is_empty() && bl.delta_v.is_empty() && matches!(bl.rows, 1 | 2) && matches!(bl.cols, 1 | 2) && cfa.width <= 16;
+            let period = if cfa.width % 2 == 0 { cfa.width.max(2) } else { cfa.width * 2 };
+            let fill_row = |iy: usize, row: &mut [f32]| {
+                let y = c.y + iy;
+                if periodic {
+                    // Per column of the period: black and the combined scale × white-balance gain.
+                    let k: Vec<(f32, f32)> = (0..period)
+                        .map(|p| {
+                            let x = c.x + p;
+                            let black = bl.at(x.saturating_sub(s.active.x), y.saturating_sub(s.active.y), 0, 1);
+                            let range = s.white[0] - black;
+                            // A non-finite black (a BlackLevel DOUBLE beyond f32) gives 0, as
+                            // `Scale::value` does, instead of (raw - inf) * 0 = NaN.
+                            if !(range >= 1.0 && black.is_finite()) {
+                                return (0.0, 0.0);
+                            }
+                            (black, mult[usize::from(cfa.color(x, y)).min(2)] / range)
+                        })
+                        .collect();
+                    let src = &s.data[y * s.width + c.x..y * s.width + c.x + w];
+                    let ks = k.iter().cycle();
+                    match &sc.lin {
+                        None => {
+                            for ((v, &raw), &(black, gain)) in row.iter_mut().zip(src).zip(ks) {
+                                *v = ((f32::from(raw) - black) * gain).clamp(0.0, 1.0);
+                            }
+                        }
+                        Some(l) => {
+                            for ((v, &raw), &(black, gain)) in row.iter_mut().zip(src).zip(ks) {
+                                let lin = f32::from(l.get(usize::from(raw)).or_else(|| l.last()).copied().unwrap_or(raw));
+                                *v = ((lin - black) * gain).clamp(0.0, 1.0);
+                            }
+                        }
+                    }
+                } else {
+                    for (i, v) in row.iter_mut().enumerate() {
+                        let x = c.x + i;
+                        let ch = usize::from(cfa.color(x, y)).min(2);
+                        *v = (sc.value(x, y, 0) * mult[ch]).clamp(0.0, 1.0);
+                    }
+                }
+                // Lens-shading gain maps, after the white-balance clip so clipped
+                // highlights stay neutral.
+                if let Some(g) = gain_row(s, y, c.x, w, 0) {
+                    for (v, g) in row.iter_mut().zip(g) {
+                        *v = (*v * g).clamp(0.0, 1.0);
+                    }
+                }
+            };
+            let names = |p: &[u8]| p.iter().map(|c| ['R', 'G', 'B'][usize::from(*c).min(2)]).collect::<String>();
+            if bayer && fused {
+                // No padded plane either: every band normalizes its own rows.
+                let p = cfa.phase(c.x, c.y);
+                pattern = Some(names(&p));
+                let mut o = vec![0u16; w * h * 3];
+                demosaic_fused(w, h, p, opts.demosaic, &to_xyz, jobs, &fill_row, &mut o, &encode_plain);
+                fused_out = Some(o);
+            } else {
+                let mut plane = Padded::new(w, h);
+                let stride = plane.stride;
+                plane.fill_rows(band, |y0, chunk| {
+                    for (r, prow) in chunk.chunks_exact_mut(stride).enumerate() {
+                        fill_row(y0 + r, &mut prow[PAD..PAD + w]);
+                    }
+                });
+                plane.fill_borders();
+                if bayer {
+                    let p = cfa.phase(c.x, c.y);
+                    pattern = Some(names(&p));
+                    rgb = demosaic(&plane, p, opts.demosaic, &to_xyz, jobs);
+                } else {
+                    let pat = Pattern::of(cfa, c.x, c.y);
+                    pattern = Some(pat.colors.chunks(pat.w.max(1)).map(names).collect::<Vec<_>>().join("/"));
+                    if fused {
+                        let mut o = vec![0u16; w * h * 3];
+                        demosaic_cfa_fused(&plane, &pat, jobs, &mut o, &encode_plain);
+                        fused_out = Some(o);
+                    } else {
+                        rgb = demosaic_cfa(&plane, &pat);
+                    }
+                }
+            }
+        }
+        None => {
+            pattern = None;
+            if fused {
+                let mut o = vec![0u16; w * h * 3];
+                for_bands(
+                    &mut o,
+                    band * w * 3,
+                    h.div_ceil(band),
+                    jobs,
+                    || vec![0.0f32; band.min(h) * w * 3],
+                    |b, chunk, buf| {
+                        let buf = &mut buf[..chunk.len()];
+                        linear_rows(b * band, buf);
+                        encode_plain(buf, chunk);
+                    },
+                );
+                fused_out = Some(o);
+            } else {
+                rgb = vec![0.0f32; w * h * 3];
+                par::chunks_mut(&mut rgb, band * w * 3, |b, chunk| linear_rows(b * band, chunk));
+            }
+        }
+    }
+
+    let out = match fused_out {
+        Some(out) => out,
+        None => {
+            let haze = Haze::new(w, h, |i| pro(&rgb[i * 3..i * 3 + 3]), opts.tone.dehaze);
+            // Linear ProPhoto of pixel `i` after Dehaze.
+            let linear = |i: usize, p: &[f32]| {
+                let v = pro(p);
+                haze.as_ref().map_or(v, |z| z.apply(i % w, i / w, v))
+            };
+            let mut map = ToneMap::new(w, h, |i| lum(&linear(i, &rgb[i * 3..i * 3 + 3])), opts.tone, s.black_point);
+            if let (Some(m), Some(_)) = (&mut map, &haze) {
+                // The black point belongs to the default rendering: Dehaze does not move it (taken after
+                // Dehaze it fell to almost 0, and Dehaze darkened less than Photoshop's).
+                m.black = black_level(w, h, |i| lum(&pro(&rgb[i * 3..i * 3 + 3])), s.black_point);
+            }
+            let mut out = vec![0u16; w * h * 3];
+            let plain = map.is_none() && haze.is_none();
+            par::chunks_mut(&mut out, band * w * 3, |b, chunk| {
+                let start = b * band * w * 3;
+                let src = &rgb[start..start + chunk.len()];
+                if plain {
+                    encode_plain(src, chunk);
+                    return;
+                }
+                for (i, (o, p)) in chunk.as_chunks_mut::<3>().0.iter_mut().zip(src.as_chunks::<3>().0).enumerate() {
+                    let mut v = linear(b * band * w + i, p);
+                    if let Some(m) = &map {
+                        let g = m.gain(i % w, b * band + i / w, lum(&v));
+                        // The black point first, as Camera Raw: lifting before it would flatten the
+                        // deepest shadows' contrast.
+                        v = v.map(|c| m.unblack(c) * g);
+                    }
+                    for k in 0..3 {
+                        o[k] = lut.encode(v[k]);
+                    }
+                }
+            });
+            rgb.clear();
+            rgb.shrink_to_fit();
+            out
+        }
+    };
 
     let (out, ow, oh) = if opts.orient { orient(out, w, h, s.orientation) } else { (out, w, h) };
     let nmax = mult.iter().cloned().fold(f32::MAX, f32::min).max(1e-6);
@@ -433,29 +490,79 @@ pub fn develop_sensor(s: &Sensor, opts: &DevelopOptions) -> Result<Developed> {
     })
 }
 
+/// How the frame is developed, for [`working_memory`].
+#[derive(Clone, Copy)]
+struct Shape {
+    /// Demosaic and encode band by band (no full RGB frame).
+    fused: bool,
+    /// The orientation copies the encoded frame.
+    orient_copy: bool,
+}
+
+/// Bytes one worker of the fused path holds for a band of `band_rows` rows: the f32 RGB band
+/// and, for a Bayer sensor, the padded CFA window it reads.
+fn fused_band_bytes(w: usize, h: usize, band_rows: usize, window: bool) -> u64 {
+    let rows = band_rows.min(h) as u64;
+    let rgb = rows.saturating_mul(w as u64).saturating_mul(12);
+    let window = if window { (rows + 2 * PAD as u64).saturating_mul((w + 2 * PAD) as u64).saturating_mul(4) } else { 0 };
+    rgb.saturating_add(window)
+}
+
 /// Checks the peak of the two development phases. The CFA and non-Bayer green
-/// planes are freed before the u16 output is allocated; AHD scratch is bounded
-/// by reducing simultaneous bands when needed. Sensor storage belongs to the
-/// caller and is checked separately by the decoder.
-fn working_memory(w: usize, h: usize, cfa: bool, bayer: bool, opts: &DevelopOptions, workers: usize) -> Result<usize> {
+/// planes are freed before the u16 output is allocated; the AHD scratch and the fused band
+/// buffers are bounded by reducing simultaneous bands when needed. The fused path never holds
+/// the f32 RGB frame: it has the u16 output (6 bytes a pixel) next to the CFA plane, plus a band
+/// buffer and the scratch per simultaneous band, and an orientation copy of the output afterwards. Sensor storage belongs
+/// to the caller and is checked separately by the decoder.
+fn working_memory(w: usize, h: usize, cfa: bool, bayer: bool, shape: Shape, opts: &DevelopOptions, workers: usize) -> Result<usize> {
     let limits = &opts.limits;
-    limits.check(w as u64, h as u64, 18)?;
+    let Shape { fused, orient_copy } = shape;
+    limits.check(w as u64, h as u64, if fused { 6 } else { 18 })?;
     let pixels = (w as u64).saturating_mul(h as u64);
-    let output = pixels.saturating_mul(18).saturating_add((GAMMA_STEPS as u64 + 2) * 4);
-    let mut peak = output;
+    let table = (GAMMA_STEPS as u64 + 2) * 4;
+    // Encode phase: the f32 RGB frame and the output, or (fused) the output and its oriented copy.
+    let output = pixels.saturating_mul(match (fused, orient_copy) {
+        (false, _) => 18,
+        (true, false) => 6,
+        (true, true) => 12,
+    });
+    let mut peak = output.saturating_add(table);
     let mut jobs = workers.max(1);
+    // Fused: the u16 output and, per worker running a band, one band of f32 RGB.
+    let band_of = |rows: usize, window: bool| if fused { fused_band_bytes(w, h, rows, window) } else { 0 };
+    // Fewer bands at once when the bands of every worker don't fit next to `base` (at least one).
+    let with_bands = |jobs: &mut usize, base: u64, rows: usize, band: u64| {
+        let available = limits.max_alloc.saturating_sub(base) / band.max(1);
+        *jobs = (*jobs).min(h.div_ceil(rows.max(1))).min(usize::try_from(available).unwrap_or(usize::MAX)).max(1);
+        base.saturating_add(band.saturating_mul(*jobs as u64))
+    };
     if cfa {
         let plane = (w as u64).saturating_add(2 * PAD as u64).saturating_mul((h as u64).saturating_add(2 * PAD as u64)).saturating_mul(4);
-        let mut mosaic = pixels.saturating_mul(if bayer { 12 } else { 16 }).saturating_add(plane);
+        // Bytes a pixel next to the plane: the f32 RGB frame (and the non-Bayer green plane), or
+        // the u16 output (and the green plane, which the fused path keeps).
+        let frame = match (fused, bayer) {
+            (false, true) => 12,
+            (false, false) => 16,
+            (true, true) => 6,
+            (true, false) => 10,
+        };
+        // The fused Bayer path has no whole plane: each worker's window is counted with its band.
+        let plane = if fused && bayer { 0 } else { plane };
+        let mut mosaic = pixels.saturating_mul(frame).saturating_add(plane).saturating_add(table);
         if bayer && opts.demosaic == Demosaic::Ahd {
             mosaic = mosaic.saturating_add(crate::demosaic::AHD_TABLE_BYTES);
-            let scratch = crate::demosaic::ahd_scratch(w as u64, h as u64);
-            let available = limits.max_alloc.saturating_sub(mosaic) / scratch.max(1);
-            jobs = jobs.min(crate::demosaic::ahd_bands(h)).min(usize::try_from(available).unwrap_or(usize::MAX));
+            let scratch = crate::demosaic::ahd_scratch(w as u64, h as u64).saturating_add(band_of(crate::demosaic::AHD_BAND, true));
             // At least one band must fit, even when no parallelism is available.
-            mosaic = mosaic.saturating_add(scratch.saturating_mul(jobs.max(1) as u64));
+            mosaic = with_bands(&mut jobs, mosaic, crate::demosaic::AHD_BAND, scratch);
+        } else {
+            let rows = if bayer { crate::demosaic::FUSED_ROWS } else { par::band_rows(w) };
+            mosaic = with_bands(&mut jobs, mosaic, rows, band_of(rows, bayer));
         }
         peak = peak.max(mosaic);
+    } else if fused {
+        // LinearRaw: the output and the bands.
+        let rows = par::band_rows(w);
+        peak = peak.max(with_bands(&mut jobs, pixels.saturating_mul(6), rows, band_of(rows, false)));
     }
     if peak > limits.max_alloc || usize::try_from(peak).is_err() {
         return Err(RawError::LimitExceeded(format!("{peak} bytes of RAW working memory exceed {}", limits.max_alloc)));
@@ -634,6 +741,138 @@ pub(crate) fn orient(src: Vec<u16>, w: usize, h: usize, o: u16) -> (Vec<u16>, us
 mod tests {
     use super::*;
 
+    const FULL: Shape = Shape { fused: false, orient_copy: false };
+    const FUSED: Shape = Shape { fused: true, orient_copy: false };
+
+    /// A `w × h` sensor with a pseudo-random gradient, black 64, white 4000.
+    fn test_sensor(w: usize, h: usize, cfa: Option<crate::Cfa>, samples: usize) -> Sensor {
+        use crate::*;
+        let data = (0..w * h * samples).map(|i| 64 + ((i * 7919 + i / w * 104_729 + i / 5 * 31) % 4100) as u16).collect();
+        Sensor {
+            format: RawFormat::Dng,
+            make: None,
+            model: None,
+            width: w,
+            height: h,
+            samples,
+            data,
+            cfa,
+            linearization: None,
+            black: BlackLevels::uniform(64.0),
+            white: [4000.0; 3],
+            active: Rect::new(0, 0, w, h),
+            crop: Rect::new(0, 0, w, h),
+            color: ColorInfo::default(),
+            camera_wb: None,
+            orientation: 1,
+            baseline_exposure: 0.0,
+            gain_maps: Vec::new(),
+            tone_curve: vec![[0.18, 0.3], [1.0, 1.0]],
+            black_point: 0.0,
+            warnings: Vec::new(),
+        }
+    }
+
+    /// `f` on a pool of `n` threads (the browser builds have none).
+    fn with_threads<R: Send>(n: usize, f: impl FnOnce() -> R + Send) -> R {
+        #[cfg(not(target_arch = "wasm32"))]
+        return rayon::ThreadPoolBuilder::new().num_threads(n).build().unwrap().install(f);
+        #[cfg(target_arch = "wasm32")]
+        {
+            let _ = n;
+            f()
+        }
+    }
+
+    fn assert_fused_matches_full(s: &Sensor, opts: &DevelopOptions, what: &str) {
+        let full = develop(s, opts, false).unwrap();
+        for threads in [1, 3, 16] {
+            let fused = with_threads(threads, || develop(s, opts, true).unwrap());
+            assert_eq!((full.width, full.height), (fused.width, fused.height), "{what} {threads}");
+            assert!(full.rgb == fused.rgb, "{what} {threads} threads: fused output differs");
+        }
+    }
+
+    #[test]
+    fn fused_development_matches_the_full_frame_path() {
+        use crate::Cfa;
+        // Odd sizes, tiny images, band borders (AHD bands are 32 rows) and several bands.
+        let sizes = [(1, 1), (2, 3), (5, 3), (33, 31), (64, 64), (65, 97), (70, 131), (3, 300)];
+        for (w, h) in sizes {
+            for method in [Demosaic::Ahd, Demosaic::Bilinear, Demosaic::Mhc] {
+                for orientation in [1, 6] {
+                    for pattern in ["RGGB", "BGGR", "GRBG"] {
+                        let mut s = test_sensor(w, h, Cfa::bayer(pattern), 1);
+                        s.orientation = orientation;
+                        let opts = DevelopOptions { demosaic: method, ..Default::default() };
+                        assert_fused_matches_full(&s, &opts, &format!("{w}x{h} {method:?} o{orientation} {pattern}"));
+                    }
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn fused_development_matches_for_every_orientation_and_look() {
+        use crate::Cfa;
+        for orientation in 1..=8 {
+            let mut s = test_sensor(67, 45, Cfa::bayer("RGGB"), 1);
+            s.orientation = orientation;
+            s.baseline_exposure = 0.5;
+            s.linearization = Some((0..4100u32).map(|v| (v * 15 / 16) as u16).collect());
+            assert_fused_matches_full(&s, &DevelopOptions::default(), &format!("orientation {orientation}"));
+        }
+    }
+
+    #[test]
+    fn fused_development_matches_for_xtrans_and_linear_raw() {
+        use crate::Cfa;
+        // 6 × 6 X-Trans repeat.
+        let rows = ["GGRGGB", "GGBGGR", "BRGRBG", "GGBGGR", "GGRGGB", "RBGBRG"];
+        let colors: Vec<u8> = rows
+            .iter()
+            .flat_map(|r| {
+                r.bytes().map(|c| match c {
+                    b'R' => 0,
+                    b'G' => 1,
+                    _ => 2,
+                })
+            })
+            .collect();
+        // 600 samples wide: bands of 109 rows, so 350 rows are four (the last short) and 50 rows
+        // are less than one.
+        for (w, h) in [(6, 6), (37, 41), (80, 150), (600, 350), (600, 50)] {
+            let mut s = test_sensor(w, h, Some(Cfa { width: 6, height: 6, colors: colors.clone(), origin_x: 0, origin_y: 0 }), 1);
+            s.orientation = 8;
+            assert_fused_matches_full(&s, &DevelopOptions::default(), &format!("xtrans {w}x{h}"));
+        }
+        for samples in [1, 3] {
+            for (w, h) in [(1, 1), (7, 5), (90, 111), (600, 350), (600, 50)] {
+                let mut s = test_sensor(w, h, None, samples);
+                s.orientation = 3;
+                assert_fused_matches_full(&s, &DevelopOptions::default(), &format!("linear {samples} {w}x{h}"));
+            }
+        }
+    }
+
+    #[test]
+    fn fused_only_where_no_whole_frame_statistic_is_needed() {
+        use crate::Cfa;
+        // The condition for the fused path is exactly "Haze and ToneMap are None".
+        let px = |_: usize| [0.5f32; 3];
+        for tone in [Tone::NEUTRAL, Tone { shadows: 10.0, ..Tone::NEUTRAL }, Tone { dehaze: 5.0, ..Tone::NEUTRAL }, Tone { texture: 1.0, ..Tone::NEUTRAL }] {
+            for black_point in [0.0, 0.5] {
+                let none = Haze::new(8, 8, px, tone.dehaze).is_none() && ToneMap::new(8, 8, |_| 0.5, tone, black_point).is_none();
+                assert_eq!(none, tone.is_neutral() && black_point <= 0.0, "{tone:?} {black_point}");
+            }
+        }
+        // A tone slider or a black point is still developed (differently from the plain rendering).
+        let s = test_sensor(40, 40, Cfa::bayer("RGGB"), 1);
+        let plain = develop_sensor(&s, &DevelopOptions::default()).unwrap();
+        let toned = develop_sensor(&s, &DevelopOptions { tone: Tone { shadows: 50.0, ..Tone::NEUTRAL }, ..Default::default() }).unwrap();
+        assert!(plain.rgb != toned.rgb);
+    }
+
     #[test]
     fn block_encode_matches_per_sample_encode() {
         let lut = GammaLut::with_curve(&[[0.25, 0.5], [1.0, 1.0]]);
@@ -650,27 +889,86 @@ mod tests {
         let mut opts = DevelopOptions::default();
         for method in [Demosaic::Bilinear, Demosaic::Mhc, Demosaic::Ahd] {
             opts.demosaic = method;
-            for workers in [1, 10, 32, 128] {
-                let jobs = working_memory(11648, 8736, true, true, &opts, workers).unwrap();
-                assert!(jobs <= workers);
-                if method == Demosaic::Ahd && workers >= 32 {
-                    assert!(jobs < workers);
+            for (fused, orient_copy) in [(false, false), (true, false), (true, true)] {
+                let shape = Shape { fused, orient_copy };
+                for workers in [1, 10, 32, 128] {
+                    let jobs = working_memory(11648, 8736, true, true, shape, &opts, workers).unwrap();
+                    assert!(jobs <= workers);
+                    if method == Demosaic::Ahd && workers >= 32 && !fused {
+                        assert!(jobs < workers);
+                    }
                 }
             }
         }
         opts.limits.max_alloc = 1 << 30;
-        assert!(working_memory(11648, 8736, true, true, &opts, 1).is_err());
+        assert!(working_memory(11648, 8736, true, true, FULL, &opts, 1).is_err());
+        // Fused: the u16 output and the CFA plane (+ one band) is about 10 bytes a pixel.
+        opts.demosaic = Demosaic::Bilinear;
+        assert!(working_memory(11648, 8736, true, true, FUSED, &opts, 1).is_ok());
+    }
+
+    /// The fused bilinear / MHC, X-Trans and LinearRaw paths run fewer bands at once when the bands
+    /// of every worker don't fit next to the output, as AHD does. A very wide, short Bayer frame
+    /// (262144 x 455: 15 bands of 32 rows, about 147 MB a band with its window) needs 2.92 GB
+    /// with all 15 at once against the default 2 GiB, and develops with 9.
+    #[test]
+    fn fused_bands_at_once_are_capped_by_the_memory_limit() {
+        let opts = DevelopOptions { demosaic: Demosaic::Bilinear, ..Default::default() };
+        let table = (GAMMA_STEPS as u64 + 2) * 4;
+        let (w, h) = (262144usize, 455usize);
+        let band = 32 * 262144 * 12 + (32 + 2 * PAD as u64) * (262144 + 2 * PAD as u64) * 4;
+        for (workers, want) in [(1, 1), (8, 8), (9, 9), (10, 9), (16, 9), (32, 9)] {
+            assert_eq!(working_memory(w, h, true, true, FUSED, &opts, workers).unwrap(), want, "{workers} workers");
+        }
+        // Never more jobs than bands, and one when only one band fits.
+        assert_eq!(working_memory(1000, 40, true, true, FUSED, &opts, 32).unwrap(), 2);
+        let mut tight = opts.clone();
+        tight.limits.max_alloc = 262144 * 455 * 6 + table + band;
+        assert_eq!(working_memory(w, h, true, true, FUSED, &tight, 32).unwrap(), 1);
+        tight.limits.max_alloc -= 1;
+        assert!(working_memory(w, h, true, true, FUSED, &tight, 32).is_err());
+        // X-Trans (bands of `band_rows(1000)` = 65 rows next to its planes) and LinearRaw likewise.
+        let plane = (1000 + 2 * PAD as u64) * (2000 + 2 * PAD as u64) * 4;
+        let mut x = opts.clone();
+        x.limits.max_alloc = 1000 * 2000 * 10 + plane + table + 3 * 65 * 1000 * 12;
+        assert_eq!(working_memory(1000, 2000, true, false, FUSED, &x, 32).unwrap(), 3);
+        x.limits.max_alloc = 1000 * 2000 * 6 + 5 * 65 * 1000 * 12;
+        assert_eq!(working_memory(1000, 2000, false, true, FUSED, &x, 32).unwrap(), 5);
     }
 
     #[test]
     fn working_memory_accounts_for_padding_and_at_least_one_ahd_band() {
         let mut opts = DevelopOptions { demosaic: Demosaic::Ahd, ..Default::default() };
         opts.limits.max_alloc = 100 * 100 * 22;
-        assert!(working_memory(100, 100, true, true, &opts, 1).is_err());
+        assert!(working_memory(100, 100, true, true, FULL, &opts, 1).is_err());
         opts.demosaic = Demosaic::Mhc;
-        assert!(working_memory(100, 100, true, true, &opts, 1).is_ok());
+        assert!(working_memory(100, 100, true, true, FULL, &opts, 1).is_ok());
         opts.limits.max_alloc = 100 * 100 * 18;
-        assert!(working_memory(100, 100, false, true, &opts, 1).is_err());
+        assert!(working_memory(100, 100, false, true, FULL, &opts, 1).is_err());
+    }
+
+    #[test]
+    fn fused_working_memory_charges_the_output_the_window_and_the_bands() {
+        let mut opts = DevelopOptions { demosaic: Demosaic::Mhc, ..Default::default() };
+        let (w, h) = (1000u64, 1000u64);
+        let table = (GAMMA_STEPS as u64 + 2) * 4;
+        let plane = (w + 2 * PAD as u64) * (h + 2 * PAD as u64) * 4;
+        let pad = PAD as u64;
+        let exact = |opts: &mut DevelopOptions, cfa: bool, bayer: bool, shape: Shape, need: u64| {
+            opts.limits.max_alloc = need - 1;
+            assert!(working_memory(1000, 1000, cfa, bayer, shape, opts, 1).is_err(), "{need} - 1");
+            opts.limits.max_alloc = need;
+            assert!(working_memory(1000, 1000, cfa, bayer, shape, opts, 1).is_ok(), "{need}");
+        };
+        // Bayer: the u16 output and one band with its padded window, no whole plane.
+        let band = 32 * w * 12 + (32 + 2 * pad) * (w + 2 * pad) * 4;
+        exact(&mut opts, true, true, FUSED, w * h * 6 + table + band);
+        // An oriented frame needs the output twice; a monochrome sensor has no plane.
+        let mono_band = 65 * w * 12;
+        exact(&mut opts, false, true, Shape { fused: true, orient_copy: true }, w * h * 12 + table);
+        exact(&mut opts, false, true, FUSED, w * h * 6 + mono_band);
+        // X-Trans keeps its plane and its green plane.
+        exact(&mut opts, true, false, FUSED, w * h * 10 + plane + table + mono_band);
     }
 
     #[test]
diff --git a/crates/raw/src/par.rs b/crates/raw/src/par.rs
index 6d23fd70c4..d966d94f52 100644
--- a/crates/raw/src/par.rs
+++ b/crates/raw/src/par.rs
@@ -1,5 +1,7 @@
 //! Data-parallel helpers: rayon on native targets, sequential on wasm.
 
+use std::sync::{Mutex, PoisonError};
+
 /// Calls `f(index, chunk)` for each `chunk`-sized piece of `buf`.
 pub(crate) fn chunks_mut<T: Send>(buf: &mut [T], chunk: usize, f: impl Fn(usize, &mut [T]) + Sync + Send) {
     let chunk = chunk.max(1);
@@ -12,6 +14,36 @@ pub(crate) fn chunks_mut<T: Send>(buf: &mut [T], chunk: usize, f: impl Fn(usize,
     buf.chunks_mut(chunk).enumerate().for_each(|(i, c)| f(i, c));
 }
 
+/// Like [`chunks_mut`], with `f(state, index, chunk)` borrowing a state: a chunk takes a free one
+/// or makes one with `init`, and gives it back when done, so rayon keeps its fine-grained
+/// splitting and stealing while at most one state per worker is ever made (`f` must not itself
+/// wait on rayon work). Rayon's `for_each_init` would make one per stolen piece, which on an idle
+/// pool is often every chunk. A state no chunk still waiting can take is dropped at once, so
+/// near the end they go as their workers finish rather than all at the very end.
+pub(crate) fn chunks_mut_pooled<T: Send, S: Send>(
+    buf: &mut [T],
+    chunk: usize,
+    init: impl Fn() -> S + Sync + Send,
+    f: impl Fn(&mut S, usize, &mut [T]) + Sync + Send,
+) {
+    let chunk = chunk.max(1);
+    // The free states and the number of chunks that have not taken one yet.
+    let pool = Mutex::new((Vec::new(), buf.len().div_ceil(chunk)));
+    chunks_mut(buf, chunk, |i, c| {
+        let taken = {
+            let mut pool = pool.lock().unwrap_or_else(PoisonError::into_inner);
+            pool.1 = pool.1.saturating_sub(1);
+            pool.0.pop()
+        };
+        let mut state = taken.unwrap_or_else(&init);
+        f(&mut state, i, c);
+        let mut pool = pool.lock().unwrap_or_else(PoisonError::into_inner);
+        if pool.0.len() < pool.1 {
+            pool.0.push(state);
+        }
+    });
+}
+
 /// Native worker count (the browser builds run sequentially).
 pub(crate) fn workers() -> usize {
     #[cfg(not(target_arch = "wasm32"))]
@@ -56,3 +88,37 @@ pub(crate) fn map<T: Send>(n: usize, f: impl Fn(usize) -> T + Sync + Send) -> Ve
 pub(crate) fn band_rows(width: usize) -> usize {
     (65536 / width.max(1)).clamp(1, 256)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+
+    /// Every chunk is visited once with its own index (the last one short), and the chunks share
+    /// the states: a 4-worker pool makes at most 4 for 101 chunks, an empty buffer none.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn chunks_mut_pooled_makes_one_state_per_worker_at_most() {
+        let pool = rayon::ThreadPoolBuilder::new().num_threads(4).build().unwrap();
+        pool.install(|| {
+            let mut buf = vec![0usize; 1003];
+            let inits = AtomicUsize::new(0);
+            let runs = AtomicUsize::new(0);
+            let init = || {
+                inits.fetch_add(1, Ordering::Relaxed);
+                0usize
+            };
+            chunks_mut_pooled(&mut buf, 10, init, |used, i, c| {
+                *used += 1;
+                runs.fetch_add(1, Ordering::Relaxed);
+                c.iter_mut().for_each(|v| *v += i + 1);
+            });
+            assert!(buf.iter().enumerate().all(|(k, &v)| v == k / 10 + 1));
+            assert_eq!(runs.load(Ordering::Relaxed), 101);
+            let n = inits.load(Ordering::Relaxed);
+            assert!((1..=4).contains(&n), "{n} states for 101 chunks on 4 workers");
+            chunks_mut_pooled(&mut [0u8; 0], 4, init, |_, _, _| {});
+            assert_eq!(inits.load(Ordering::Relaxed), n, "no state for an empty buffer");
+        });
+    }
+}
diff --git a/crates/raw/src/testgen/dng.rs b/crates/raw/src/testgen/dng.rs
index 02a8d7b621..f9d252c391 100644
--- a/crates/raw/src/testgen/dng.rs
+++ b/crates/raw/src/testgen/dng.rs
@@ -182,6 +182,29 @@ impl DngSpec {
 
     pub fn build(&self) -> Vec<u8> {
         let mut t = TiffBuilder { big_endian: self.big_endian, ..Default::default() };
+        let mut raw = self.raw_base_tags();
+        self.push_storage_tags(&mut t, &mut raw);
+        self.push_geometry_tags(&mut raw);
+        if let Some(o) = &self.opcode_list2 {
+            raw.push((51009, Val::Undefined(o.clone())));
+        }
+        if let Some(l) = &self.linearization {
+            raw.push((50712, Val::Short(l.clone())));
+        }
+        raw.extend(self.raw_extra.iter().cloned());
+        let raw_ifd = t.ifd(raw);
+        // IFD0: a tiny RGB thumbnail plus the DNG metadata.
+        let thumb = t.blob(vec![128; 3 * 4]);
+        let mut ifd0 = self.ifd0_base_tags(thumb, raw_ifd);
+        self.push_color_tags(&mut ifd0);
+        ifd0.extend(self.ifd0_extra.iter().cloned());
+        let i0 = t.ifd(ifd0);
+        t.chain = vec![i0];
+        t.build()
+    }
+
+    /// The raw IFD's tags that don't depend on how the image is stored.
+    fn raw_base_tags(&self) -> Vec<(u16, Val)> {
         let mut raw: Vec<(u16, Val)> = vec![
             (254, Val::Long(vec![0])),
             (256, Val::Long(vec![self.width as u32])),
@@ -202,166 +225,162 @@ impl DngSpec {
             raw.push((50710, Val::Byte(vec![0, 1, 2])));
             raw.push((50711, Val::Short(vec![1])));
         }
+        raw
+    }
+
+    /// Encodes the image per `storage` into `t`'s blobs and adds the compression and
+    /// strip or tile tags that point at them.
+    fn push_storage_tags(&self, t: &mut TiffBuilder, raw: &mut Vec<(u16, Val)>) {
         match self.storage {
             DngStorage::DeflateStrips { rows, predictor } => {
-                use std::io::Write;
-                let mut offs = Vec::new();
-                let mut lens = Vec::new();
-                for y in (0..self.height).step_by(rows) {
-                    let r = (y + rows).min(self.height) - y;
-                    let n = self.width * self.samples;
-                    let mut v: Vec<u16> = self.data[y * n..(y + r) * n].to_vec();
-                    if predictor == 2 {
-                        // Horizontal differencing on the sample values, before byte packing
-                        // (the reader undoes predictor after unpacking, per row, per channel).
-                        let plane = if self.samples.is_multiple_of(3) { 3 } else { 1 };
-                        for row in v.chunks_mut(n) {
-                            for i in (plane..row.len()).rev() {
-                                row[i] = row[i].wrapping_sub(row[i - plane]);
-                            }
-                        }
-                    }
-                    // Pack the delta'd values with the file's byte order and bit depth.
-                    let bytes: Vec<u8> = match self.bits {
-                        8 => v.iter().map(|&x| x as u8).collect(),
-                        16 => v.iter().flat_map(|&x| if self.big_endian { x.to_be_bytes() } else { x.to_le_bytes() }).collect(),
-                        _ => v.iter().flat_map(|x| x.to_le_bytes()).collect(),
-                    };
-                    let mut e = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
-                    e.write_all(&bytes).expect("zlib");
-                    let z = e.finish().expect("zlib");
-                    lens.push(z.len() as u32);
-                    offs.push(t.blob(z));
-                }
+                let (offs, lens) = self.strip_blobs(t, rows, |y, r| self.deflate_strip(y, r, predictor));
                 raw.push((259, Val::Short(vec![8])));
                 raw.push((317, Val::Short(vec![predictor])));
-                raw.push((278, Val::Long(vec![rows as u32])));
-                raw.push((273, Val::Blobs(offs)));
-                raw.push((279, Val::Long(lens)));
+                push_strip_tags(raw, rows, offs, lens);
             }
             DngStorage::Strips { rows } => {
-                let mut offs = Vec::new();
-                let mut lens = Vec::new();
-                for y in (0..self.height).step_by(rows) {
-                    let b = self.pack(y..(y + rows).min(self.height));
-                    lens.push(b.len() as u32);
-                    offs.push(t.blob(b));
-                }
+                let (offs, lens) = self.strip_blobs(t, rows, |y, r| self.pack(y..y + r));
                 raw.push((259, Val::Short(vec![1])));
-                raw.push((278, Val::Long(vec![rows as u32])));
-                raw.push((273, Val::Blobs(offs)));
-                raw.push((279, Val::Long(lens)));
+                push_strip_tags(raw, rows, offs, lens);
             }
             DngStorage::LossyJpegTiles { width: tw, height: th } => {
-                let mut offs = Vec::new();
-                let mut lens = Vec::new();
                 let s = self.samples;
-                for ty in (0..self.height).step_by(th) {
-                    for tx in (0..self.width).step_by(tw) {
-                        // Edge tiles are padded by repeating the last row / column.
-                        let mut tile = vec![0u8; tw * th * s];
-                        for y in 0..th {
-                            for x in 0..tw {
-                                let sy = (ty + y).min(self.height - 1);
-                                let sx = (tx + x).min(self.width - 1);
-                                for c in 0..s {
-                                    tile[(y * tw + x) * s + c] = self.sample8(self.data[(sy * self.width + sx) * s + c]);
-                                }
-                            }
-                        }
-                        let j = self.lossy_segments.get(offs.len()).cloned().unwrap_or_else(|| baseline_jpeg(&tile, tw, th, s));
-                        lens.push(j.len() as u32);
-                        offs.push(t.blob(j));
-                    }
-                }
+                let (offs, lens) = self.tile_blobs(t, tw, th, |tile_no, tile: Vec<u8>| {
+                    self.lossy_segments.get(tile_no).cloned().unwrap_or_else(|| baseline_jpeg(&tile, tw, th, s))
+                });
                 raw.push((259, Val::Short(vec![34892])));
-                raw.push((322, Val::Long(vec![tw as u32])));
-                raw.push((323, Val::Long(vec![th as u32])));
-                raw.push((324, Val::Blobs(offs)));
-                raw.push((325, Val::Long(lens)));
+                push_tile_tags(raw, tw, th, offs, lens);
             }
             DngStorage::LossyJpegStrips { rows } => {
-                let mut offs = Vec::new();
-                let mut lens = Vec::new();
                 let n = self.width * self.samples;
-                for y in (0..self.height).step_by(rows) {
-                    let r = (y + rows).min(self.height) - y;
+                let (offs, lens) = self.strip_blobs(t, rows, |y, r| {
                     let strip: Vec<u8> = self.data[y * n..(y + r) * n].iter().map(|&v| self.sample8(v)).collect();
-                    let j = self.lossy_segments.get(offs.len()).cloned().unwrap_or_else(|| baseline_jpeg(&strip, self.width, r, self.samples));
-                    lens.push(j.len() as u32);
-                    offs.push(t.blob(j));
-                }
+                    let strip_no = y / rows;
+                    self.lossy_segments.get(strip_no).cloned().unwrap_or_else(|| baseline_jpeg(&strip, self.width, r, self.samples))
+                });
                 raw.push((259, Val::Short(vec![34892])));
-                raw.push((278, Val::Long(vec![rows as u32])));
-                raw.push((273, Val::Blobs(offs)));
-                raw.push((279, Val::Long(lens)));
+                push_strip_tags(raw, rows, offs, lens);
             }
             DngStorage::Lj92Strips { rows } => {
-                let mut offs = Vec::new();
-                let mut lens = Vec::new();
-                for y in (0..self.height).step_by(rows) {
-                    let r = (y + rows).min(self.height) - y;
-                    let n = self.width * self.samples;
-                    let j = lj92_encode(&self.data[y * n..(y + r) * n], self.width, r, self.samples, self.bits as u8, 1, None);
-                    lens.push(j.len() as u32);
-                    offs.push(t.blob(j));
-                }
+                let n = self.width * self.samples;
+                let (offs, lens) =
+                    self.strip_blobs(t, rows, |y, r| lj92_encode(&self.data[y * n..(y + r) * n], self.width, r, self.samples, self.bits as u8, 1, None));
                 raw.push((259, Val::Short(vec![7])));
-                raw.push((278, Val::Long(vec![rows as u32])));
-                raw.push((273, Val::Blobs(offs)));
-                raw.push((279, Val::Long(lens)));
+                push_strip_tags(raw, rows, offs, lens);
             }
             DngStorage::Lj92Tiles { width: tw, height: th } => {
-                let mut offs = Vec::new();
-                let mut lens = Vec::new();
                 let s = self.samples;
-                for ty in (0..self.height).step_by(th) {
-                    for tx in (0..self.width).step_by(tw) {
-                        // Edge tiles are padded by repeating the last row / column.
-                        let mut tile = vec![0u16; tw * th * s];
-                        for y in 0..th {
-                            for x in 0..tw {
-                                let sy = (ty + y).min(self.height - 1);
-                                let sx = (tx + x).min(self.width - 1);
-                                for c in 0..s {
-                                    tile[(y * tw + x) * s + c] = self.data[(sy * self.width + sx) * s + c];
-                                }
-                            }
-                        }
-                        // CFA tiles as Adobe writes them: half width, 2 components.
-                        let j = if s == 1 && tw % 2 == 0 {
-                            lj92_encode(&tile, tw / 2, th, 2, self.bits as u8, 1, None)
-                        } else {
-                            lj92_encode(&tile, tw, th, s, self.bits as u8, 1, None)
-                        };
-                        lens.push(j.len() as u32);
-                        offs.push(t.blob(j));
+                let (offs, lens) = self.tile_blobs(t, tw, th, |_, tile: Vec<u16>| {
+                    // CFA tiles as Adobe writes them: half width, 2 components.
+                    if s == 1 && tw % 2 == 0 {
+                        lj92_encode(&tile, tw / 2, th, 2, self.bits as u8, 1, None)
+                    } else {
+                        lj92_encode(&tile, tw, th, s, self.bits as u8, 1, None)
                     }
-                }
+                });
                 raw.push((259, Val::Short(vec![7])));
-                raw.push((322, Val::Long(vec![tw as u32])));
-                raw.push((323, Val::Long(vec![th as u32])));
-                raw.push((324, Val::Blobs(offs)));
-                raw.push((325, Val::Long(lens)));
+                push_tile_tags(raw, tw, th, offs, lens);
             }
             DngStorage::JxlStrips { rows } => {
-                let lens = self.jxl_segments.iter().map(|j| j.len() as u32).collect();
-                let offs = self.jxl_segments.iter().map(|j| t.blob(j.clone())).collect();
+                let (offs, lens) = self.jxl_blobs(t);
                 raw.push((259, Val::Short(vec![52546])));
-                raw.push((278, Val::Long(vec![rows as u32])));
-                raw.push((273, Val::Blobs(offs)));
-                raw.push((279, Val::Long(lens)));
+                push_strip_tags(raw, rows, offs, lens);
             }
             DngStorage::JxlTiles { width: tw, height: th } => {
-                let lens = self.jxl_segments.iter().map(|j| j.len() as u32).collect();
-                let offs = self.jxl_segments.iter().map(|j| t.blob(j.clone())).collect();
+                let (offs, lens) = self.jxl_blobs(t);
                 raw.push((259, Val::Short(vec![52546])));
-                raw.push((322, Val::Long(vec![tw as u32])));
-                raw.push((323, Val::Long(vec![th as u32])));
-                raw.push((324, Val::Blobs(offs)));
-                raw.push((325, Val::Long(lens)));
+                push_tile_tags(raw, tw, th, offs, lens);
             }
         }
+    }
+
+    /// One blob per strip of `rows` rows: `encode(first_row, rows_in_strip)` gives its bytes.
+    /// Returns the blob handles and lengths.
+    fn strip_blobs(&self, t: &mut TiffBuilder, rows: usize, mut encode: impl FnMut(usize, usize) -> Vec<u8>) -> (Vec<usize>, Vec<u32>) {
+        let mut offs = Vec::new();
+        let mut lens = Vec::new();
+        for y in (0..self.height).step_by(rows) {
+            let r = (y + rows).min(self.height) - y;
+            let bytes = encode(y, r);
+            lens.push(bytes.len() as u32);
+            offs.push(t.blob(bytes));
+        }
+        (offs, lens)
+    }
+
+    /// One blob per `tw`×`th` tile, in row-major tile order: `encode(tile_number, samples)`.
+    fn tile_blobs<T: Copy + Default + TileSample>(
+        &self,
+        t: &mut TiffBuilder,
+        tw: usize,
+        th: usize,
+        mut encode: impl FnMut(usize, Vec<T>) -> Vec<u8>,
+    ) -> (Vec<usize>, Vec<u32>) {
+        let mut offs = Vec::new();
+        let mut lens = Vec::new();
+        for ty in (0..self.height).step_by(th) {
+            for tx in (0..self.width).step_by(tw) {
+                let bytes = encode(offs.len(), self.tile_samples(tx, ty, tw, th));
+                lens.push(bytes.len() as u32);
+                offs.push(t.blob(bytes));
+            }
+        }
+        (offs, lens)
+    }
+
+    /// The samples of the tile at (`tx`, `ty`). Edge tiles are padded by repeating the last row
+    /// / column.
+    fn tile_samples<T: Copy + Default + TileSample>(&self, tx: usize, ty: usize, tw: usize, th: usize) -> Vec<T> {
+        let s = self.samples;
+        let mut tile = vec![T::default(); tw * th * s];
+        for y in 0..th {
+            for x in 0..tw {
+                let sy = (ty + y).min(self.height - 1);
+                let sx = (tx + x).min(self.width - 1);
+                for c in 0..s {
+                    tile[(y * tw + x) * s + c] = T::from_sample(self, self.data[(sy * self.width + sx) * s + c]);
+                }
+            }
+        }
+        tile
+    }
+
+    /// A deflated strip of `r` rows from row `y`, optionally with the horizontal-differencing
+    /// predictor applied.
+    fn deflate_strip(&self, y: usize, r: usize, predictor: u16) -> Vec<u8> {
+        use std::io::Write;
+        let n = self.width * self.samples;
+        let mut v: Vec<u16> = self.data[y * n..(y + r) * n].to_vec();
+        if predictor == 2 {
+            // Horizontal differencing on the sample values, before byte packing
+            // (the reader undoes predictor after unpacking, per row, per channel).
+            let plane = if self.samples.is_multiple_of(3) { 3 } else { 1 };
+            for row in v.chunks_mut(n) {
+                for i in (plane..row.len()).rev() {
+                    row[i] = row[i].wrapping_sub(row[i - plane]);
+                }
+            }
+        }
+        // Pack the delta'd values with the file's byte order and bit depth.
+        let bytes: Vec<u8> = match self.bits {
+            8 => v.iter().map(|&x| x as u8).collect(),
+            16 => v.iter().flat_map(|&x| if self.big_endian { x.to_be_bytes() } else { x.to_le_bytes() }).collect(),
+            _ => v.iter().flat_map(|x| x.to_le_bytes()).collect(),
+        };
+        let mut e = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
+        e.write_all(&bytes).expect("zlib");
+        e.finish().expect("zlib")
+    }
+
+    /// The pre-encoded JPEG XL segments as blobs.
+    fn jxl_blobs(&self, t: &mut TiffBuilder) -> (Vec<usize>, Vec<u32>) {
+        let lens = self.jxl_segments.iter().map(|j| j.len() as u32).collect();
+        let offs = self.jxl_segments.iter().map(|j| t.blob(j.clone())).collect();
+        (offs, lens)
+    }
+
+    /// Active area and default crop tags.
+    fn push_geometry_tags(&self, raw: &mut Vec<(u16, Val)>) {
         if let Some(a) = self.active_area {
             raw.push((50829, Val::Long(a.to_vec())));
         }
@@ -374,17 +393,12 @@ impl DngSpec {
         } else if let Some(size) = self.default_crop_size_only {
             raw.push((50720, Val::Long(size.to_vec())));
         }
-        if let Some(o) = &self.opcode_list2 {
-            raw.push((51009, Val::Undefined(o.clone())));
-        }
-        if let Some(l) = &self.linearization {
-            raw.push((50712, Val::Short(l.clone())));
-        }
-        raw.extend(self.raw_extra.iter().cloned());
-        let raw_ifd = t.ifd(raw);
-        // IFD0: a tiny RGB thumbnail plus the DNG metadata.
-        let thumb = t.blob(vec![128; 3 * 4]);
-        let mut ifd0: Vec<(u16, Val)> = vec![
+    }
+
+    /// IFD0's tags before the colour metadata: the thumbnail strip `thumb`, identity, orientation
+    /// and the sub-IFD `raw_ifd`.
+    fn ifd0_base_tags(&self, thumb: usize, raw_ifd: usize) -> Vec<(u16, Val)> {
+        vec![
             (254, Val::Long(vec![1])),
             (256, Val::Long(vec![2])),
             (257, Val::Long(vec![2])),
@@ -401,7 +415,11 @@ impl DngSpec {
             (330, Val::Ifds(vec![raw_ifd])),
             (50706, Val::Byte(vec![1, 4, 0, 0])),
             (50708, Val::Ascii(format!("{} {}", self.make, self.model))),
-        ];
+        ]
+    }
+
+    /// Colour matrices, white balance, exposure and the profile gain table.
+    fn push_color_tags(&self, ifd0: &mut Vec<(u16, Val)>) {
         let m = |v: &[f64; 9]| Val::SRational(v.iter().map(|&x| srat(x)).collect());
         if let Some((ill, cm)) = &self.color_matrix1 {
             ifd0.push((50721, m(cm)));
@@ -426,13 +444,41 @@ impl DngSpec {
         if let Some(m) = &self.profile_gain_table_map {
             ifd0.push((52525, Val::Undefined(m.clone())));
         }
-        ifd0.extend(self.ifd0_extra.iter().cloned());
-        let i0 = t.ifd(ifd0);
-        t.chain = vec![i0];
-        t.build()
     }
 }
 
+/// How a tile's samples are stored: raw 16-bit values, or the 8-bit samples of a lossy JPEG.
+trait TileSample {
+    fn from_sample(spec: &DngSpec, v: u16) -> Self;
+}
+
+impl TileSample for u16 {
+    fn from_sample(_: &DngSpec, v: u16) -> Self {
+        v
+    }
+}
+
+impl TileSample for u8 {
+    fn from_sample(spec: &DngSpec, v: u16) -> Self {
+        spec.sample8(v)
+    }
+}
+
+/// Strip layout tags for the blobs `offs` (lengths `lens`).
+fn push_strip_tags(raw: &mut Vec<(u16, Val)>, rows: usize, offs: Vec<usize>, lens: Vec<u32>) {
+    raw.push((278, Val::Long(vec![rows as u32])));
+    raw.push((273, Val::Blobs(offs)));
+    raw.push((279, Val::Long(lens)));
+}
+
+/// Tile layout tags for the blobs `offs` (lengths `lens`).
+fn push_tile_tags(raw: &mut Vec<(u16, Val)>, tw: usize, th: usize, offs: Vec<usize>, lens: Vec<u32>) {
+    raw.push((322, Val::Long(vec![tw as u32])));
+    raw.push((323, Val::Long(vec![th as u32])));
+    raw.push((324, Val::Blobs(offs)));
+    raw.push((325, Val::Long(lens)));
+}
+
 /// An OpcodeList2 with one GainMap over active-area rectangle `area` (top,
 /// left, bottom, right), every `pitch` rows and columns, from a 2×2 grid of
 /// gains spanning the image (relative coordinates 0..1).
diff --git a/crates/raw/tests/it/development_limits.rs b/crates/raw/tests/it/development_limits.rs
index 4e5e1636d3..394ec9db20 100644
--- a/crates/raw/tests/it/development_limits.rs
+++ b/crates/raw/tests/it/development_limits.rs
@@ -8,13 +8,25 @@ fn small_sensor() -> Sensor {
 
 #[test]
 fn checks_peak_live_buffers_instead_of_summing_disjoint_phases() {
-    let sensor = decode(&DngSpec::cfa(128, 96, vec![1000; 128 * 96]).build(), &Limits::default()).unwrap();
+    let (w, h) = (128u64, 96u64);
+    let sensor = decode(&DngSpec::cfa(w as usize, h as usize, vec![1000; (w * h) as usize]).build(), &Limits::default()).unwrap();
+    let table = (4096 + 2) * 4;
+    // Exactly `max_alloc` must work and one byte less must fail.
+    let check = |opts: &mut DevelopOptions, max_alloc: u64| {
+        let expected = develop_sensor(&sensor, opts).unwrap();
+        opts.limits.max_alloc = max_alloc;
+        assert_eq!(develop_sensor(&sensor, opts).unwrap().rgb, expected.rgb);
+        opts.limits.max_alloc -= 1;
+        assert!(matches!(develop_sensor(&sensor, opts), Err(RawError::LimitExceeded(_))));
+    };
+    // A tone slider needs the f32 RGB frame next to the output (18 bytes a pixel) ...
+    let mut opts = DevelopOptions { demosaic: Demosaic::Mhc, tone: Tone { shadows: 20.0, ..Tone::NEUTRAL }, ..Default::default() };
+    check(&mut opts, w * h * 18 + table);
+    // ... the default rendering the u16 output and, per worker, one band (32 rows) of f32 RGB with
+    // the 12 rows more of padded CFA it reads, but no whole plane.
     let mut opts = DevelopOptions { demosaic: Demosaic::Mhc, ..Default::default() };
-    opts.limits.max_alloc = 128 * 96 * 18 + (4096 + 2) * 4;
-    let expected = develop_sensor(&sensor, &DevelopOptions { demosaic: Demosaic::Mhc, ..Default::default() }).unwrap();
-    assert_eq!(develop_sensor(&sensor, &opts).unwrap().rgb, expected.rgb);
-    opts.limits.max_alloc -= 1;
-    assert!(matches!(develop_sensor(&sensor, &opts), Err(RawError::LimitExceeded(_))));
+    let band = 32 * w * 12 + (32 + 12) * (w + 12) * 4;
+    rayon::ThreadPoolBuilder::new().num_threads(1).build().unwrap().install(|| check(&mut opts, w * h * 6 + table + band));
 }
 
 #[test]
diff --git a/crates/tablet/Cargo.toml b/crates/tablet/Cargo.toml
index 83e29c4d68..c4d1c8d6bf 100644
--- a/crates/tablet/Cargo.toml
+++ b/crates/tablet/Cargo.toml
@@ -13,8 +13,11 @@ description = "Pen tablet pressure, tilt, rotation and eraser end on macOS (AppK
 unsafe_code = "deny"
 
 [lints.clippy]
-dbg_macro = "warn"
-todo = "warn"
+ cognitive_complexity = "deny"
+ too_many_arguments = "deny"
+ wildcard_imports = "deny"
+ dbg_macro = "warn"
+ todo = "warn"
 
 # Already in Cargo.lock (eframe/wgpu/fmv-macos-events and winit pull them in); pinned exactly:
 # review the diff before bumping.
diff --git a/crates/tablet/src/appkit.rs b/crates/tablet/src/appkit.rs
index 2d00c093ca..15557040c1 100644
--- a/crates/tablet/src/appkit.rs
+++ b/crates/tablet/src/appkit.rs
@@ -68,7 +68,10 @@ pub struct RawEvent {
 
 /// The mask of event types [`State::handle`] maps (`NSEventMask` bits are `1 << type`).
 pub fn event_mask() -> u64 {
-    use event_type::*;
+    use event_type::{
+        LEFT_MOUSE_DOWN, LEFT_MOUSE_DRAGGED, LEFT_MOUSE_UP, MOUSE_MOVED, OTHER_MOUSE_DOWN, OTHER_MOUSE_DRAGGED, OTHER_MOUSE_UP, RIGHT_MOUSE_DOWN,
+        RIGHT_MOUSE_DRAGGED, RIGHT_MOUSE_UP, TABLET_POINT, TABLET_PROXIMITY,
+    };
     [
         LEFT_MOUSE_DOWN,
         LEFT_MOUSE_UP,
@@ -97,7 +100,10 @@ pub struct State {
 impl State {
     /// Map one event.
     pub fn handle(&mut self, e: &RawEvent) -> Update {
-        use event_type::*;
+        use event_type::{
+            LEFT_MOUSE_DOWN, LEFT_MOUSE_DRAGGED, LEFT_MOUSE_UP, MOUSE_MOVED, OTHER_MOUSE_DOWN, OTHER_MOUSE_DRAGGED, OTHER_MOUSE_UP, RIGHT_MOUSE_DOWN,
+            RIGHT_MOUSE_DRAGGED, RIGHT_MOUSE_UP, TABLET_POINT, TABLET_PROXIMITY,
+        };
         let mouse = matches!(
             e.kind,
             LEFT_MOUSE_DOWN
diff --git a/crates/tablet/src/macos.rs b/crates/tablet/src/macos.rs
index 0dccadc0cd..746de23ccd 100644
--- a/crates/tablet/src/macos.rs
+++ b/crates/tablet/src/macos.rs
@@ -92,7 +92,10 @@ fn read(e: &NSEvent) -> RawEvent {
 }
 
 fn is_mouse(kind: usize) -> bool {
-    use crate::appkit::event_type::*;
+    use crate::appkit::event_type::{
+        LEFT_MOUSE_DOWN, LEFT_MOUSE_DRAGGED, LEFT_MOUSE_UP, MOUSE_MOVED, OTHER_MOUSE_DOWN, OTHER_MOUSE_DRAGGED, OTHER_MOUSE_UP, RIGHT_MOUSE_DOWN,
+        RIGHT_MOUSE_DRAGGED, RIGHT_MOUSE_UP,
+    };
     matches!(
         kind,
         LEFT_MOUSE_DOWN
diff --git a/crates/text/src/embolden.rs b/crates/text/src/embolden.rs
new file mode 100644
index 0000000000..a33711996d
--- /dev/null
+++ b/crates/text/src/embolden.rs
@@ -0,0 +1,397 @@
+//! Faux bold by thickening the glyph outline itself: every point moves outward along the bisector
+//! of its two edges, so the stroke grows by the same amount everywhere and curves stay curves (the
+//! approach of FreeType's `FT_Outline_EmboldenXY`). Stamping the glyph at several offsets instead
+//! leaves stair-step notches on curves and corners at large sizes.
+
+use skrifa::outline::OutlinePen;
+
+/// One recorded outline segment; its points are in [`Contour::pts`].
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Verb {
+    Line,
+    Quad,
+    Cubic,
+}
+
+/// A closed contour: `pts[0]` is its start, then each segment's points in order.
+#[derive(Clone, Debug, Default, PartialEq)]
+struct Contour {
+    verbs: Vec<Verb>,
+    pts: Vec<(f64, f64)>,
+}
+
+/// A glyph outline in font units at the drawn size (y up), recorded to be thickened and replayed.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub(crate) struct Outline {
+    contours: Vec<Contour>,
+}
+
+impl OutlinePen for Outline {
+    fn move_to(&mut self, x: f32, y: f32) {
+        self.contours.push(Contour { verbs: Vec::new(), pts: vec![(f64::from(x), f64::from(y))] });
+    }
+    fn line_to(&mut self, x: f32, y: f32) {
+        self.push(Verb::Line, &[(x, y)]);
+    }
+    fn quad_to(&mut self, cx0: f32, cy0: f32, x: f32, y: f32) {
+        self.push(Verb::Quad, &[(cx0, cy0), (x, y)]);
+    }
+    fn curve_to(&mut self, cx0: f32, cy0: f32, cx1: f32, cy1: f32, x: f32, y: f32) {
+        self.push(Verb::Cubic, &[(cx0, cy0), (cx1, cy1), (x, y)]);
+    }
+    fn close(&mut self) {}
+}
+
+impl Outline {
+    fn push(&mut self, verb: Verb, pts: &[(f32, f32)]) {
+        // A segment before any move starts a contour at the origin, as a pen would.
+        if self.contours.is_empty() {
+            self.contours.push(Contour { verbs: Vec::new(), pts: vec![(0.0, 0.0)] });
+        }
+        if let Some(c) = self.contours.last_mut() {
+            c.verbs.push(verb);
+            c.pts.extend(pts.iter().map(|&(x, y)| (f64::from(x), f64::from(y))));
+        }
+    }
+
+    /// Twice the signed area of all contours (shoelace over every point): positive when the outer
+    /// contours run counter-clockwise (y up, PostScript order), negative for TrueType's clockwise.
+    fn signed_area(&self) -> f64 {
+        let mut a = 0.0;
+        for c in &self.contours {
+            // Each point with the next, the last with the first.
+            for (p, q) in c.pts.iter().zip(c.pts.iter().cycle().skip(1)) {
+                a += p.0 * q.1 - q.0 * p.1;
+            }
+        }
+        a
+    }
+
+    /// Grow the ink by `r` on every side (the stems get `2r` heavier, counters `2r` smaller).
+    /// Points, on and off the curve, move along the bisector of their neighbouring edges by
+    /// `r / cos(half the turn)`, capped by the shorter neighbouring edge so short segments and
+    /// sharp inner corners can't spike; a pointed tip (an A apex) never moves further than `2r`,
+    /// so it grows a little instead of a long miter. Nothing moves for a non-finite or non-positive `r`, or an
+    /// outline without area.
+    pub(crate) fn embolden(&mut self, r: f64) {
+        if !(r.is_finite() && r > 0.0) {
+            return;
+        }
+        let area = self.signed_area();
+        if !area.is_finite() || area == 0.0 {
+            return;
+        }
+        // Outward is right of travel for counter-clockwise ink, left for clockwise.
+        let sign = if area > 0.0 { 1.0 } else { -1.0 };
+        for c in &mut self.contours {
+            let shifts = shifts(&c.pts, r, sign);
+            for (p, s) in c.pts.iter_mut().zip(shifts) {
+                p.0 += s.0;
+                p.1 += s.1;
+            }
+        }
+    }
+
+    /// Draw the outline into `pen`.
+    pub(crate) fn replay(&self, pen: &mut impl OutlinePen) {
+        let f = |v: f64| v as f32;
+        for c in &self.contours {
+            let Some(start) = c.pts.first() else { continue };
+            pen.move_to(f(start.0), f(start.1));
+            let mut i = 1;
+            for verb in &c.verbs {
+                let n = match verb {
+                    Verb::Line => 1,
+                    Verb::Quad => 2,
+                    Verb::Cubic => 3,
+                };
+                let Some(p) = c.pts.get(i..i + n) else { break };
+                match (verb, p) {
+                    (Verb::Line, [a]) => pen.line_to(f(a.0), f(a.1)),
+                    (Verb::Quad, [a, b]) => pen.quad_to(f(a.0), f(a.1), f(b.0), f(b.1)),
+                    (Verb::Cubic, [a, b, d]) => pen.curve_to(f(a.0), f(a.1), f(b.0), f(b.1), f(d.0), f(d.1)),
+                    _ => break,
+                }
+                i += n;
+            }
+            pen.close();
+        }
+    }
+}
+
+/// How far each point of one closed contour moves (see [`Outline::embolden`]). No point moves
+/// further than [`MAX_SHIFT`] times `r`: an uncapped miter puts a long spike on every pointed tip
+/// (an A apex), and a tip past FreeType's spike threshold would not move at all.
+fn shifts(pts: &[(f64, f64)], r: f64, sign: f64) -> Vec<(f64, f64)> {
+    let n = pts.len();
+    let mut out = vec![(0.0, 0.0); n];
+    if n < 2 {
+        return out;
+    }
+    // Runs of coincident points (or points that can't be measured) share their neighbours: the
+    // last point of the run before and the first of the run after. Found in one pass, so a
+    // contour of many repeated points (a hostile font) costs O(n), not O(n²).
+    let apart = |p: (f64, f64), q: (f64, f64)| {
+        let len = (q.0 - p.0).hypot(q.1 - p.1);
+        len > 1e-9 && len.is_finite()
+    };
+    let mut runs: Vec<(usize, usize)> = Vec::new();
+    let mut run_of = vec![0usize; n];
+    for (i, &p) in pts.iter().enumerate() {
+        match runs.last_mut() {
+            Some(run) if !pts.get(run.0).is_some_and(|&a| apart(a, p)) => run.1 = i,
+            _ => runs.push((i, i)),
+        }
+        run_of[i] = runs.len().saturating_sub(1);
+    }
+    // The contour is closed: a last run back at the start point is the first run.
+    if runs.len() > 1
+        && let (Some(&(first, _)), Some(&(last, _))) = (runs.first(), runs.last())
+        && !apart(pts[first], pts[last])
+    {
+        runs.pop();
+        for k in &mut run_of[last..] {
+            *k = 0;
+        }
+        runs[0].0 = last;
+    }
+    let m = runs.len();
+    if m < 2 {
+        return out;
+    }
+    // The edge from `pts[i]` to `pts[j]` (or from `pts[j]` when `into`), as a unit vector and length.
+    let edge = |i: usize, j: usize, into: bool| -> Option<(f64, f64, f64)> {
+        let (p, q) = (pts[i], pts[j]);
+        let (dx, dy) = if into { (p.0 - q.0, p.1 - q.1) } else { (q.0 - p.0, q.1 - p.1) };
+        let len = dx.hypot(dy);
+        (len > 1e-9 && len.is_finite()).then(|| (dx / len, dy / len, len))
+    };
+    let cap = MAX_SHIFT * r;
+    for (i, shift) in out.iter_mut().enumerate() {
+        let k = run_of[i];
+        let prev = runs[(k + m - 1) % m].1;
+        let next = runs[(k + 1) % m].0;
+        let (Some((ix, iy, l_in)), Some((ox, oy, l_out))) = (edge(i, prev, true), edge(i, next, false)) else { continue };
+        let dot = ix * ox + iy * oy;
+        let d = 1.0 + dot;
+        let (sx, sy) = (sign * (iy + oy), -sign * (ix + ox));
+        let len = sx.hypot(sy);
+        // An exact reversal has no bisector, and no side to call outward: leave it.
+        if !(len > 1e-9 && len.is_finite()) {
+            continue;
+        }
+        // How sharply the contour turns towards the ink at this point (negative: away).
+        let q = sign * (ox * iy - oy * ix);
+        let l = l_in.min(l_out);
+        let scale = if r * q <= l * d { r / d } else { l / q };
+        // A pointed tip (turning away from the ink) moves no more than the cap along the bisector
+        // (`len` is the bisector's length, √(2d)). An inner corner keeps its exact miter, already
+        // limited by the shorter edge above: capping it would thin the strokes meeting there.
+        let scale = if q < 0.0 { scale.min(cap / len) } else { scale };
+        if scale.is_finite() {
+            *shift = (sx * scale, sy * scale);
+        }
+    }
+    out
+}
+
+/// The longest move of an emboldened point, in radii: a square corner moves √2, and a tip moves
+/// `1 / sin(half its angle)`, so only tips sharper than 60° are capped.
+const MAX_SHIFT: f64 = 2.0;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn square(x0: f32, y0: f32, x1: f32, y1: f32, ccw: bool) -> Outline {
+        let mut o = Outline::default();
+        add_square(&mut o, x0, y0, x1, y1, ccw);
+        o
+    }
+
+    fn add_square(o: &mut Outline, x0: f32, y0: f32, x1: f32, y1: f32, ccw: bool) {
+        o.move_to(x0, y0);
+        if ccw {
+            o.line_to(x1, y0);
+            o.line_to(x1, y1);
+            o.line_to(x0, y1);
+        } else {
+            o.line_to(x0, y1);
+            o.line_to(x1, y1);
+            o.line_to(x1, y0);
+        }
+        o.line_to(x0, y0);
+        o.close();
+    }
+
+    fn bounds(o: &Outline) -> [f64; 4] {
+        let mut b = [f64::MAX, f64::MAX, f64::MIN, f64::MIN];
+        for c in &o.contours {
+            for p in &c.pts {
+                b = [b[0].min(p.0), b[1].min(p.1), b[2].max(p.0), b[3].max(p.1)];
+            }
+        }
+        b
+    }
+
+    fn close(a: [f64; 4], b: [f64; 4]) -> bool {
+        a.iter().zip(b).all(|(x, y)| (x - y).abs() < 1e-6)
+    }
+
+    #[test]
+    fn a_square_grows_by_the_radius_on_every_side_in_either_winding() {
+        for ccw in [true, false] {
+            let mut o = square(0.0, 0.0, 10.0, 10.0, ccw);
+            o.embolden(1.0);
+            assert!(close(bounds(&o), [-1.0, -1.0, 11.0, 11.0]), "ccw {ccw}: {:?}", bounds(&o));
+        }
+    }
+
+    #[test]
+    fn counters_shrink_while_the_outer_edge_grows() {
+        // A ring: outer counter-clockwise, hole clockwise (y up, as fonts are drawn).
+        let mut o = square(0.0, 0.0, 20.0, 20.0, true);
+        add_square(&mut o, 5.0, 5.0, 15.0, 15.0, false);
+        o.embolden(1.0);
+        let hole = &o.contours[1];
+        let xs: Vec<f64> = hole.pts.iter().map(|p| p.0).collect();
+        let (lo, hi) = (xs.iter().copied().fold(f64::MAX, f64::min), xs.iter().copied().fold(f64::MIN, f64::max));
+        assert!((lo - 6.0).abs() < 1e-6 && (hi - 14.0).abs() < 1e-6, "the hole narrows: {lo}..{hi}");
+        assert!(close(bounds(&o), [-1.0, -1.0, 21.0, 21.0]));
+    }
+
+    #[test]
+    fn curves_keep_their_segments_and_move_their_control_points() {
+        let mut o = Outline::default();
+        o.move_to(0.0, 0.0);
+        o.line_to(10.0, 0.0);
+        o.quad_to(15.0, 5.0, 10.0, 10.0);
+        o.curve_to(7.0, 12.0, 3.0, 12.0, 0.0, 10.0);
+        o.line_to(0.0, 0.0);
+        o.close();
+        let before = o.clone();
+        o.embolden(0.5);
+        assert_eq!(o.contours[0].verbs, before.contours[0].verbs, "the same segments, not stamped copies");
+        assert_ne!(o.contours[0].pts, before.contours[0].pts);
+        let mut replayed = Outline::default();
+        o.replay(&mut replayed);
+        // Pens take f32 points, so the replay matches to f32 precision.
+        let (a, b) = (&replayed.contours[0], &o.contours[0]);
+        assert_eq!(a.verbs, b.verbs, "replay draws the thickened outline's segments");
+        let near = |p: &(f64, f64), q: &(f64, f64)| (p.0 - q.0).abs() < 1e-4 && (p.1 - q.1).abs() < 1e-4;
+        assert!(a.pts.len() == b.pts.len() && a.pts.iter().zip(&b.pts).all(|(p, q)| near(p, q)));
+    }
+
+    #[test]
+    fn degenerate_outlines_and_hostile_radii_change_nothing_and_never_produce_nan() {
+        let line = {
+            let mut o = Outline::default();
+            o.move_to(0.0, 0.0);
+            o.line_to(5.0, 0.0);
+            o.line_to(0.0, 0.0);
+            o
+        };
+        let dots = {
+            let mut o = Outline::default();
+            o.move_to(3.0, 3.0);
+            o.line_to(3.0, 3.0);
+            o.line_to(3.0, 3.0);
+            o
+        };
+        for base in [line, dots, Outline::default()] {
+            for r in [1.0, 0.0, -1.0, f64::NAN, f64::INFINITY] {
+                let mut o = base.clone();
+                o.embolden(r);
+                assert_eq!(o, base, "r {r}");
+            }
+        }
+        // A square with repeated points still grows cleanly.
+        let mut o = Outline::default();
+        o.move_to(0.0, 0.0);
+        for (x, y) in [(0.0, 0.0), (10.0, 0.0), (10.0, 0.0), (10.0, 10.0), (0.0, 10.0), (0.0, 0.0)] {
+            o.line_to(x, y);
+        }
+        o.embolden(1.0);
+        assert!(close(bounds(&o), [-1.0, -1.0, 11.0, 11.0]), "{:?}", bounds(&o));
+        assert!(o.contours.iter().flat_map(|c| c.pts.iter()).all(|p| p.0.is_finite() && p.1.is_finite()));
+    }
+
+    #[test]
+    fn a_sharp_inner_corner_is_capped_by_its_short_edge() {
+        // A thin spike: its tip turns almost back on itself and stays put.
+        let mut o = Outline::default();
+        o.move_to(0.0, 0.0);
+        o.line_to(10.0, 0.0);
+        o.line_to(0.0, 0.2);
+        o.line_to(0.0, 0.0);
+        o.embolden(5.0);
+        let b = bounds(&o);
+        assert!(b.iter().all(|v| v.abs() < 60.0), "no runaway miter: {b:?}");
+    }
+
+    /// How far the tip of an isosceles triangle with a `deg`-degree tip (long sides) moves.
+    fn tip_shift(deg: f64, r: f64) -> f64 {
+        let half = (deg / 2.0).to_radians();
+        let (a, b) = ((1000.0 * half.sin()) as f32, (1000.0 * half.cos()) as f32);
+        let mut o = Outline::default();
+        o.move_to(0.0, 0.0);
+        o.line_to(a, b);
+        o.line_to(-a, b);
+        o.line_to(0.0, 0.0);
+        o.embolden(r);
+        let tip = o.contours[0].pts[0];
+        tip.0.hypot(tip.1)
+    }
+
+    #[test]
+    fn pointed_tips_grow_by_at_most_twice_the_radius_and_never_stop_growing() {
+        // 30°: an uncapped miter moves 1/sin(15°) = 3.86 r. 20.5° is just short of the spike
+        // threshold (5.6 r uncapped); 20° and 10° are past it, where the tip used to stay put.
+        for deg in [30.0, 20.5, 20.0, 10.0] {
+            let moved = tip_shift(deg, 1.0);
+            assert!(moved > 0.0 && moved <= 2.0 + 1e-9, "{deg}° tip moved {moved}");
+        }
+        // Blunt corners keep their exact miter: a square corner √2, a 90° tip too.
+        assert!((tip_shift(90.0, 1.0) - std::f64::consts::SQRT_2).abs() < 1e-3);
+    }
+
+    #[test]
+    fn inner_corners_keep_their_exact_miter() {
+        // A 40° notch (the crotch of a V) between long edges: its corner moves r / sin(20°), so the
+        // edges meeting there grow by r like the rest of the outline. The tip cap must not clip it.
+        let half = 20f64.to_radians();
+        let (a, b) = ((1000.0 * half.sin()) as f32, (1000.0 * half.cos()) as f32);
+        let mut o = Outline::default();
+        o.move_to(0.0, 0.0);
+        o.line_to(-a, b);
+        o.line_to(-a - 1000.0, b);
+        o.line_to(-a - 1000.0, -1000.0);
+        o.line_to(a + 1000.0, -1000.0);
+        o.line_to(a + 1000.0, b);
+        o.line_to(a, b);
+        o.line_to(0.0, 0.0);
+        o.embolden(1.0);
+        let corner = o.contours[0].pts[0];
+        let want = 1.0 / half.sin();
+        assert!((corner.0.hypot(corner.1) - want).abs() < 1e-2, "{corner:?}, want {want}");
+    }
+
+    #[test]
+    fn many_repeated_points_are_thickened_in_linear_time() {
+        // A hostile glyph: a contour of 50 000 copies of one point, then a square. Finding each
+        // point's neighbours by scanning past the copies cost ~10⁹ steps.
+        let mut o = Outline::default();
+        o.move_to(0.0, 0.0);
+        for _ in 0..50_000 {
+            o.line_to(0.0, 0.0);
+        }
+        for (x, y) in [(10.0, 0.0), (10.0, 10.0), (0.0, 10.0), (0.0, 0.0)] {
+            o.line_to(x, y);
+        }
+        let start = std::time::Instant::now();
+        o.embolden(1.0);
+        let took = start.elapsed();
+        assert!(took < std::time::Duration::from_secs(2), "took {took:?}");
+        assert!(close(bounds(&o), [-1.0, -1.0, 11.0, 11.0]), "{:?}", bounds(&o));
+    }
+}
diff --git a/crates/text/src/font_class.rs b/crates/text/src/font_class.rs
new file mode 100644
index 0000000000..edf518d9e7
--- /dev/null
+++ b/crates/text/src/font_class.rs
@@ -0,0 +1,295 @@
+//! What a font menu filters and sorts by: a family's classification (Serif, Sans Serif, Script…),
+//! its outline format and whether it is variable, read from the font's own tables (OS/2
+//! `sFamilyClass` and PANOSE, `post.isFixedPitch`, `fvar`, `CFF `/`glyf`) and, where those say
+//! nothing, from its name. Photoshop's font menu offers the same classes.
+
+use skrifa::raw::{FontRef, TableProvider};
+
+/// A family's classification, as the font menu's class filter lists them.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub enum FontClass {
+    Serif,
+    SlabSerif,
+    SansSerif,
+    Script,
+    Monospace,
+    Handwritten,
+    Blackletter,
+    Decorative,
+}
+
+impl FontClass {
+    /// Every class, in menu order.
+    pub const ALL: [FontClass; 8] = [
+        FontClass::Serif,
+        FontClass::SlabSerif,
+        FontClass::SansSerif,
+        FontClass::Script,
+        FontClass::Monospace,
+        FontClass::Handwritten,
+        FontClass::Blackletter,
+        FontClass::Decorative,
+    ];
+
+    /// The English menu label (translated by the UI).
+    pub fn label(self) -> &'static str {
+        match self {
+            FontClass::Serif => "Serif",
+            FontClass::SlabSerif => "Slab Serif",
+            FontClass::SansSerif => "Sans Serif",
+            FontClass::Script => "Script",
+            FontClass::Monospace => "Monospace",
+            FontClass::Handwritten => "Handwritten",
+            FontClass::Blackletter => "Blackletter",
+            FontClass::Decorative => "Decorative",
+        }
+    }
+
+    /// The stable key for commands and saved filters (`"slabSerif"`).
+    pub fn key(self) -> &'static str {
+        match self {
+            FontClass::Serif => "serif",
+            FontClass::SlabSerif => "slabSerif",
+            FontClass::SansSerif => "sansSerif",
+            FontClass::Script => "script",
+            FontClass::Monospace => "monospace",
+            FontClass::Handwritten => "handwritten",
+            FontClass::Blackletter => "blackletter",
+            FontClass::Decorative => "decorative",
+        }
+    }
+
+    /// The class with this [`Self::key`].
+    pub fn from_key(key: &str) -> Option<FontClass> {
+        Self::ALL.into_iter().find(|c| c.key() == key)
+    }
+}
+
+/// How a family's outlines are stored, as the font menu's format badge shows it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum FontFormat {
+    /// OpenType with PostScript (CFF) outlines.
+    OpenType,
+    /// TrueType outlines (`glyf`), including OpenType fonts that use them.
+    TrueType,
+    /// A variable font (`fvar`), whatever its outlines.
+    Variable,
+}
+
+impl FontFormat {
+    /// The badge text: Photoshop's "O", "TT" and "VAR".
+    pub fn badge(self) -> &'static str {
+        match self {
+            FontFormat::OpenType => "O",
+            FontFormat::TrueType => "TT",
+            FontFormat::Variable => "VAR",
+        }
+    }
+}
+
+/// What the font menu knows about a family, from its representative (regular) face.
+#[derive(Clone, Debug, PartialEq)]
+pub struct FamilyTraits {
+    pub class: Option<FontClass>,
+    pub format: FontFormat,
+    /// The 10 PANOSE digits (all 0 when the font doesn't say).
+    pub panose: [u8; 10],
+    /// `usWeightClass` (400 when absent).
+    pub weight: u16,
+}
+
+impl FamilyTraits {
+    pub fn variable(&self) -> bool {
+        self.format == FontFormat::Variable
+    }
+}
+
+/// Read a face's traits. Missing or malformed tables fall back to "unknown", never to an error.
+pub fn traits_of(family: &str, font: &FontRef) -> FamilyTraits {
+    let os2 = font.os2().ok();
+    let family_class = os2.as_ref().map_or(0, |t| t.s_family_class());
+    let mut panose = [0u8; 10];
+    if let Some(bytes) = os2.as_ref().map(|t| t.panose_10()) {
+        for (slot, b) in panose.iter_mut().zip(bytes.iter()) {
+            *slot = *b;
+        }
+    }
+    let weight = os2.as_ref().map_or(400, |t| t.us_weight_class()).clamp(1, 1000);
+    let fixed_pitch = font.post().ok().is_some_and(|p| p.is_fixed_pitch() != 0);
+    let format = if font.fvar().is_ok() {
+        FontFormat::Variable
+    } else if font.cff().is_ok() || font.cff2().is_ok() {
+        FontFormat::OpenType
+    } else {
+        FontFormat::TrueType
+    };
+    FamilyTraits { class: classify(family, family_class, panose, fixed_pitch), format, panose, weight }
+}
+
+/// Name fragments (lowercase) that mark a blackletter face; the tables have no class for it.
+const BLACKLETTER: [&str; 7] = ["fraktur", "blackletter", "black letter", "textura", "old english", "schwabacher", "rotunda"];
+
+/// Classify from the OS/2 `sFamilyClass` (high byte: the IBM class), the PANOSE digits, the
+/// `post` fixed-pitch flag and, last, the family name.
+pub fn classify(family: &str, family_class: i16, panose: [u8; 10], fixed_pitch: bool) -> Option<FontClass> {
+    let name = family.to_lowercase();
+    let has = |words: &[&str]| words.iter().any(|w| name.contains(w));
+    // Whole words of the name, so "Encode Sans" isn't read as a "code" font.
+    let words: Vec<&str> = name.split(|c: char| !c.is_alphanumeric()).filter(|w| !w.is_empty()).collect();
+    // PANOSE Latin Text proportion 9 is monospaced.
+    if fixed_pitch || (panose[0] == 2 && panose[3] == 9) {
+        return Some(FontClass::Monospace);
+    }
+    if has(&BLACKLETTER) {
+        return Some(FontClass::Blackletter);
+    }
+    // PANOSE family kind: 3 Latin Hand Written, 4 Latin Decoratives, 5 Latin Symbol.
+    match panose[0] {
+        3 => return Some(if family_class >> 8 == 10 { FontClass::Script } else { FontClass::Handwritten }),
+        4 | 5 => return Some(FontClass::Decorative),
+        _ => {}
+    }
+    match family_class >> 8 {
+        // 4 is Clarendon: bracketed serifs (Georgia), not slabs.
+        1..=4 | 7 => return Some(FontClass::Serif),
+        5 => return Some(FontClass::SlabSerif),
+        8 => return Some(FontClass::SansSerif),
+        9 | 12 => return Some(FontClass::Decorative),
+        10 => return Some(if has(&["hand", "marker", "brush", "pen", "chalk"]) { FontClass::Handwritten } else { FontClass::Script }),
+        _ => {}
+    }
+    // PANOSE Latin Text serif style: 11-15 are sans (normal, obtuse, perpendicular, flared,
+    // rounded); square (6) is a slab; the rest, the square coves (bracketed serifs, as Georgia's)
+    // included, are serifs.
+    if panose[0] == 2 {
+        match panose[1] {
+            11..=15 => return Some(FontClass::SansSerif),
+            6 => return Some(FontClass::SlabSerif),
+            2..=10 => return Some(FontClass::Serif),
+            _ => {}
+        }
+    }
+    // Last, the name.
+    if words.iter().any(|w| matches!(*w, "mono" | "monospace" | "monospaced" | "code" | "courier") || w.starts_with("consol")) {
+        Some(FontClass::Monospace)
+    } else if has(&["slab"]) {
+        Some(FontClass::SlabSerif)
+    } else if has(&["sans", "grotesk", "grotesque", "gothic"]) {
+        Some(FontClass::SansSerif)
+    } else if has(&["serif", "roman", "garamond", "times", "bodoni", "baskerville", "caslon"]) {
+        Some(FontClass::Serif)
+    } else if has(&["hand", "marker", "brush", "chalk"]) {
+        Some(FontClass::Handwritten)
+    } else if has(&["script"]) {
+        Some(FontClass::Script)
+    } else {
+        None
+    }
+}
+
+/// How unlike `b` is to `a`: 0 for the same traits, larger the more they differ. Used to list
+/// similar fonts (Photoshop's "Show similar fonts"): the class matters most, then the PANOSE
+/// digits both fonts state (serif style, weight, proportion, contrast…), then the weight.
+pub fn difference(a: &FamilyTraits, b: &FamilyTraits) -> f32 {
+    let mut d = 0.0;
+    if a.class != b.class {
+        d += 20.0;
+    }
+    // Digits 1..=9; 0 and 1 mean "any"/"no fit", so only stated digits count.
+    for (x, y) in a.panose.iter().zip(b.panose.iter()).skip(1) {
+        if *x > 1 && *y > 1 {
+            d += f32::from(x.abs_diff(*y)).min(6.0);
+        }
+    }
+    d + f32::from(a.weight.abs_diff(b.weight)) / 100.0
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const NONE: [u8; 10] = [0; 10];
+
+    #[test]
+    fn the_os2_class_wins_over_the_name() {
+        assert_eq!(classify("Georgia", 0x0105, NONE, false), Some(FontClass::Serif));
+        assert_eq!(classify("Georgia", 0x0405, NONE, false), Some(FontClass::Serif), "Clarendon is a serif");
+        assert_eq!(classify("Rockwell", 0x0501, NONE, false), Some(FontClass::SlabSerif));
+        assert_eq!(classify("Arial", 0x0805, NONE, false), Some(FontClass::SansSerif));
+        assert_eq!(classify("Edwardian Script ITC", 0x0a05, NONE, false), Some(FontClass::Script));
+        assert_eq!(classify("Wingdings", 0x0c00, NONE, false), Some(FontClass::Decorative));
+    }
+
+    #[test]
+    fn panose_classifies_fonts_without_an_os2_class() {
+        let sans = [2, 11, 6, 4, 2, 2, 2, 2, 2, 4];
+        let slab = [2, 6, 6, 3, 2, 2, 2, 2, 2, 4];
+        let serif = [2, 2, 6, 3, 5, 4, 5, 2, 3, 4];
+        let hand = [3, 1, 1, 1, 1, 1, 1, 1, 1, 1];
+        let deco = [4, 1, 1, 1, 1, 1, 1, 1, 1, 1];
+        let mono = [2, 11, 6, 9, 2, 2, 2, 2, 2, 4];
+        assert_eq!(classify("A", 0, sans, false), Some(FontClass::SansSerif));
+        assert_eq!(classify("B", 0, slab, false), Some(FontClass::SlabSerif));
+        assert_eq!(classify("C", 0, serif, false), Some(FontClass::Serif));
+        assert_eq!(classify("D", 0, hand, false), Some(FontClass::Handwritten));
+        assert_eq!(classify("E", 0, deco, false), Some(FontClass::Decorative));
+        assert_eq!(classify("F", 0, mono, false), Some(FontClass::Monospace));
+        // Georgia: square cove serifs are bracketed serifs, not slabs.
+        assert_eq!(classify("Georgia", 0, [2, 4, 5, 2, 5, 4, 5, 2, 3, 3], false), Some(FontClass::Serif));
+    }
+
+    #[test]
+    fn fixed_pitch_and_names_decide_the_rest() {
+        assert_eq!(classify("Anything", 0x0805, NONE, true), Some(FontClass::Monospace), "fixed pitch beats the class");
+        assert_eq!(classify("UnifrakturMaguntia", 0, NONE, false), Some(FontClass::Blackletter));
+        assert_eq!(classify("Old English Text MT", 0x0805, NONE, false), Some(FontClass::Blackletter));
+        assert_eq!(classify("Roboto Slab", 0, NONE, false), Some(FontClass::SlabSerif));
+        assert_eq!(classify("Noto Serif", 0, NONE, false), Some(FontClass::Serif));
+        assert_eq!(classify("Noto Sans", 0, NONE, false), Some(FontClass::SansSerif));
+        assert_eq!(classify("Fira Code", 0, NONE, false), Some(FontClass::Monospace));
+        assert_eq!(classify("Space Mono", 0, NONE, false), Some(FontClass::Monospace));
+        // "code" inside a word, or a name the tables contradict, doesn't make a monospace.
+        assert_eq!(classify("Encode Sans", 0, NONE, false), Some(FontClass::SansSerif));
+        assert_eq!(classify("Encode Sans", 0x0805, NONE, false), Some(FontClass::SansSerif));
+        assert_eq!(classify("Code Pro Sans", 0x0805, NONE, false), Some(FontClass::SansSerif), "the class beats the name");
+        assert_eq!(classify("Permanent Marker", 0, NONE, false), Some(FontClass::Handwritten));
+        assert_eq!(classify("Unknowable", 0, NONE, false), None);
+        // Out-of-range or garbage table values don't panic or misfile.
+        assert_eq!(classify("X", i16::MIN, [255; 10], false), None);
+        assert_eq!(classify("X", -1, [2, 200, 0, 0, 0, 0, 0, 0, 0, 0], false), None);
+    }
+
+    #[test]
+    fn similar_fonts_share_class_shape_and_weight() {
+        let t = |class, panose, weight| FamilyTraits { class: Some(class), format: FontFormat::TrueType, panose, weight };
+        let arial = t(FontClass::SansSerif, [2, 11, 6, 4, 2, 2, 2, 2, 2, 4], 400);
+        let helvetica = t(FontClass::SansSerif, [2, 11, 6, 4, 2, 2, 2, 2, 2, 4], 400);
+        let arial_black = t(FontClass::SansSerif, [2, 11, 10, 4, 2, 1, 2, 2, 2, 4], 900);
+        let times = t(FontClass::Serif, [2, 2, 6, 3, 5, 4, 5, 2, 3, 4], 400);
+        assert_eq!(difference(&arial, &helvetica), 0.0);
+        assert!(difference(&arial, &arial_black) < difference(&arial, &times));
+        assert!(difference(&arial, &times) >= 20.0, "another class is far away");
+    }
+
+    #[test]
+    fn bundled_families_are_read_from_their_tables() {
+        let mut db = crate::FontDb::new();
+        let mono = db.family_traits(crate::fonts::MONO_FAMILY).expect("the bundled mono font");
+        assert_eq!(mono.class, Some(FontClass::Monospace));
+        // Inter states no class or PANOSE: it is read, but left unclassified rather than guessed.
+        let sans = db.family_traits(crate::fonts::DEFAULT_FAMILY).expect("the bundled UI font");
+        assert!(sans.class.is_none() || sans.class == Some(FontClass::SansSerif), "{:?}", sans.class);
+        assert!((1..=1000).contains(&sans.weight));
+        assert_eq!(db.family_traits("No Such Family"), None);
+        assert_eq!(db.family_traits(crate::fonts::DEFAULT_FAMILY), Some(sans), "cached");
+    }
+
+    #[test]
+    fn class_keys_round_trip() {
+        for c in FontClass::ALL {
+            assert_eq!(FontClass::from_key(c.key()), Some(c));
+        }
+        assert_eq!(FontClass::from_key("slabSerif"), Some(FontClass::SlabSerif));
+        assert_eq!(FontClass::from_key("nope"), None);
+    }
+}
diff --git a/crates/text/src/fonts.rs b/crates/text/src/fonts.rs
index 506f83dacd..416ae7834c 100644
--- a/crates/text/src/fonts.rs
+++ b/crates/text/src/fonts.rs
@@ -196,6 +196,9 @@ pub struct FontDb {
     /// [`Self::fallback_stack`] (#1909). Off, only the default family shapes the text.
     missing_glyph_protection: bool,
     face_cache: HashMap<String, Vec<FaceInfo>>,
+    /// Each family's [`crate::FamilyTraits`] (font menu filters), filled lazily; `None` for a
+    /// family whose fonts can't be read.
+    traits_cache: HashMap<String, Option<crate::FamilyTraits>>,
     face_aliases: HashMap<(String, usize), String>,
     /// This is the shared engine's database: registrations also move [`shared_generation`].
     shared: bool,
@@ -218,6 +221,7 @@ impl FontDb {
             fallbacks: Vec::new(),
             missing_glyph_protection: true,
             face_cache: HashMap::new(),
+            traits_cache: HashMap::new(),
             face_aliases: HashMap::new(),
             shared: false,
         };
@@ -281,6 +285,7 @@ impl FontDb {
             }
             self.ps_cache.clear();
             self.face_cache.clear();
+            self.traits_cache.clear();
             self.refresh_generics();
         }
     }
@@ -316,6 +321,7 @@ impl FontDb {
         names.sort_by_key(|n| (is_hidden_family(n), n.to_lowercase()));
         self.ps_cache.clear();
         self.face_cache.clear();
+        self.traits_cache.clear();
         self.refresh_generics();
         GENERATION.fetch_add(1, Ordering::Relaxed);
         if self.shared {
@@ -475,6 +481,24 @@ impl FontDb {
         faces
     }
 
+    /// What the font menu filters and sorts a family by ([`crate::font_class`]), read from its
+    /// regular face (the upright face nearest weight 400). `None` when the family is unknown or
+    /// none of its fonts can be read.
+    pub fn family_traits(&mut self, family: &str) -> Option<crate::FamilyTraits> {
+        if let Some(t) = self.traits_cache.get(family) {
+            return t.clone();
+        }
+        let traits = (|| {
+            let info = self.fcx.collection.family_by_name(family)?;
+            let face = info.fonts().iter().min_by_key(|f| (!matches!(f.style(), FontStyle::Normal), (f.weight().value() - 400.0).abs() as u32))?.clone();
+            let blob = face.load(Some(&mut self.fcx.source_cache))?;
+            let font = skrifa::FontRef::from_index(blob.as_ref(), face.index()).ok()?;
+            Some(crate::font_class::traits_of(family, &font))
+        })();
+        self.traits_cache.insert(family.to_string(), traits.clone());
+        traits
+    }
+
     /// Resolve a menu style to its actual metadata instead of guessing from its spelling.
     pub fn named_face(&mut self, family: &str, style: &str) -> Option<FaceInfo> {
         self.faces(family).into_iter().find(|f| f.style.eq_ignore_ascii_case(style))
diff --git a/crates/text/src/layout.rs b/crates/text/src/layout.rs
index 7dadaf1bd5..d31b888fad 100644
--- a/crates/text/src/layout.rs
+++ b/crates/text/src/layout.rs
@@ -17,36 +17,33 @@
 use std::borrow::Cow;
 use std::ops::Range;
 
-use parley::{
-    Alignment, AlignmentOptions, FontData, FontFamily, FontFeatures, FontStyle, FontVariations, FontWeight, IndentOptions, Layout, LayoutContext,
-    PositionedLayoutItem, StyleProperty,
-};
+use parley::{FontData, FontFamily, FontFeatures, FontStyle, FontVariations, FontWeight, Layout, LayoutContext, PositionedLayoutItem, StyleProperty};
 use photocraft_doc::TextLayer;
-use photocraft_doc::text::{Caps, CharStyle, FontBaseline, Kerning, Orientation, ParagraphStyle, TextAlign, TextDirection, TextShape};
+use photocraft_doc::text::{Caps, CharStyle, FontBaseline, Kerning, Orientation, ParagraphStyle, TextShape};
 use skrifa::raw::types::Tag;
 
 use crate::fonts::FontDb;
 
 mod area;
+mod lines;
 mod navigate;
 mod paragraphs;
+mod shaping;
 mod style;
 mod vertical;
 
 #[cfg(test)]
 pub(crate) use area::AREA_PASSES;
-use area::{LineMetrics, MAX_AREA_PASSES, area_metrics, break_area, line_metrics};
 pub use navigate::{byte_index, char_index, hit_char, line_edge, line_index, line_step, text_point_inside, word_boundary};
+use paragraphs::next_tab_stop;
 pub use paragraphs::{DEFAULT_TAB_STOP_PT, split_paragraphs};
-use paragraphs::{next_tab_stop, strip_break, tab_widths};
+use shaping::{Para, resolve_run_styles, running_starts, small_caps_modes};
+use style::SmallCapsMode;
+#[cfg(test)]
+use style::{SMCP_PROBES, feature_list, small_caps_mode, variation_list};
 #[cfg(test)]
-use style::{SMCP_PROBES, variation_list};
-use style::{
-    SYNTHETIC_SMALL_CAPS_SCALE, SmallCapsMode, drawn_style, effective_horizontal_scale, feature_list, first_ascent, probe_smcp, small_caps_mode, style_props,
-};
 pub(crate) use style::{hangul_runs, squeeze_punctuation, synthetic_bold};
 pub use vertical::{VClass, vertical_class};
-use vertical::{VGlyph, VMetrics};
 
 /// Index of the run containing byte offset `off`, given each run's start offset (non-decreasing):
 /// the last run starting at or before `off`, or 0 when none does. Binary search, so a layer with
@@ -270,29 +267,6 @@ pub(crate) struct Layouter {
     optical: crate::optical::Cache,
 }
 
-/// A cluster of a line in visual order, for kerning.
-struct KernSlot {
-    /// Index of the run in the paragraph layout.
-    run: usize,
-    /// Byte offset in the paragraph text.
-    start: usize,
-    first: Option<u32>,
-    last: Option<u32>,
-    font: FontData,
-    coords: Vec<i16>,
-    size: f32,
-    rtl: bool,
-    blank: bool,
-    /// Advance along the line (px, horizontal scale included).
-    advance: f32,
-    /// What horizontal scale adds to the shaped advance (px; negative below 100%).
-    growth: f32,
-    /// A tab, shaped as a space; it advances to the next tab stop.
-    tab: bool,
-    /// Vertical type, upright glyph (its outline doesn't run along the column).
-    upright: bool,
-}
-
 impl Layouter {
     pub fn new() -> Self {
         Self { lcx: LayoutContext::new(), optical: crate::optical::Cache::default() }
@@ -304,48 +278,9 @@ impl Layouter {
         let paras = t.paragraph_runs();
         let vertical = t.orientation == Orientation::Vertical;
         let mut out = TextLayout { px_per_pt: k, vertical, ..Default::default() };
-        // Resolve families (PostScript names from PSDs, unknown families).
-        for r in &runs {
-            let mut s = r.style.clone();
-            if let Some(ps) = s.postscript_name.clone()
-                && !fonts.faces(&s.font_family).iter().any(|f| f.postscript_name.as_deref() == Some(&ps))
-            {
-                let f = fonts.resolve_postscript(&ps);
-                // An exact face match wins; a guessed family only fills a missing family.
-                if f.exact || (!fonts.has_family(&s.font_family) && fonts.has_family(&f.family)) {
-                    s.font_family = f.family;
-                    s.weight = f.weight;
-                    s.italic = f.italic;
-                }
-            }
-            // Drawn with a fallback for now; a host that serves this family fetches it (`served`).
-            if !fonts.has_family(&s.font_family) {
-                crate::served::request(&s.font_family);
-            }
-            fonts.select_named_face(&mut s);
-            drawn_style(&mut s);
-            out.styles.push(s);
-        }
-        let run_starts: Vec<usize> = runs
-            .iter()
-            .scan(0, |a, r| {
-                let s = *a;
-                *a += r.len;
-                Some(s)
-            })
-            .collect();
-        let style_at = |off: usize| run_index_at(&run_starts, off);
-        let para_starts: Vec<usize> = paras
-            .iter()
-            .scan(0, |a, r| {
-                let s = *a;
-                *a += r.len;
-                Some(s)
-            })
-            .collect();
-        let para_style_at = |off: usize| &paras[para_starts.iter().rposition(|&s| s <= off).unwrap_or(0)].style;
-
-        let text = &t.text;
+        let styles = resolve_run_styles(fonts, &runs);
+        let run_starts = running_starts(runs.iter().map(|r| r.len));
+        let para_starts = running_starts(paras.iter().map(|r| r.len));
         let (box_rect, is_box) = match t.shape {
             TextShape::Box { x, y, width, height } => ((x, y, width, height), true),
             // Path text is laid out as one point-text line, then bent onto the path. Area text
@@ -358,591 +293,93 @@ impl Layouter {
             TextShape::Area { path } => crate::area::AreaShape::new(path, vertical),
             _ => None,
         };
-        // Box and area text wrap, align within their lines and hide what doesn't fit.
-        let wraps = is_box || area.is_some();
-        let mut prev_baseline: Option<f32> = None;
-        let mut pending_space = 0.0f32;
-        let mut stop = false;
-        // Fixed for the whole layout, and the font probe only matters for styles that use small
-        // caps. A real `smcp` substitution must receive lowercase source text; only the fallback
-        // path uppercases it and scales it down.
-        let small_caps: Vec<SmallCapsMode> = out
-            .styles
-            .iter()
-            .map(|style| match style.caps {
-                Caps::SmallCaps => small_caps_mode(style.caps, probe_smcp(fonts, style)),
-                _ => SmallCapsMode::None,
-            })
-            .collect();
-        for (pi, prange) in split_paragraphs(text).into_iter().enumerate() {
-            if stop {
+        let small_caps = small_caps_modes(fonts, &styles);
+        let env = Env {
+            text: &t.text,
+            runs: &runs,
+            styles: &styles,
+            run_starts: &run_starts,
+            small_caps: &small_caps,
+            k,
+            vertical,
+            is_box,
+            // Box and area text wrap, align within their lines and hide what doesn't fit.
+            wraps: is_box || area.is_some(),
+            box_rect,
+            area,
+        };
+        let mut flow = Flow::default();
+        for (pi, prange) in split_paragraphs(&t.text).into_iter().enumerate() {
+            if flow.stop {
                 break;
             }
-            let ps = para_style_at(prange.start).clone();
-            let content_end = strip_break(text, &prange);
-            let content = &text[prange.start..content_end];
-            let prefix = match ps.direction {
-                TextDirection::Auto => "",
-                TextDirection::Ltr => LRM,
-                TextDirection::Rtl => RLM,
-            };
-            let mut ptext = String::with_capacity(prefix.len() + content.len());
-            ptext.push_str(prefix);
-            // Ranges in `ptext` for lowercase characters rendered as synthetic small caps.
-            // They have the same UTF-8 length as their uppercase form, so the layer's byte-based
-            // run and caret offsets remain unchanged.
-            let mut synthetic_small_caps: Vec<(Range<usize>, f32)> = Vec::new();
-            // Offsets in `ptext` of the spaces standing in for tabs.
-            let mut tabs: Vec<usize> = Vec::new();
-            let tab_px = DEFAULT_TAB_STOP_PT * k;
-            for (i, ch) in content.char_indices() {
-                // A forced line break ends the line but not the paragraph. The line breaker knows
-                // it as a newline, which has the same length, so text offsets don't move.
-                if ch == FORCED_LINE_BREAK {
-                    ptext.push('\n');
-                    continue;
-                }
-                // Imported PSD text can contain literal tab controls. Font shaping may
-                // render those as .notdef boxes; a space preserves the one-byte source
-                // and style/caret offsets while supplying a real whitespace advance. The space
-                // is widened to its tab stop after line breaking (`tab_px` below).
-                if ch == '\t' {
-                    tabs.push(ptext.len());
-                    ptext.push(' ');
-                    continue;
-                }
-                let style = &out.styles[style_at(prange.start + i)];
-                let caps = style.caps;
-                if caps == Caps::AllCaps || small_caps[style_at(prange.start + i)] == SmallCapsMode::Synthetic {
-                    let up: String = ch.to_uppercase().collect();
-                    if up.len() == ch.len_utf8() {
-                        ptext.push_str(&up);
-                        if caps == Caps::SmallCaps && ch.is_lowercase() {
-                            let end = ptext.len();
-                            synthetic_small_caps.push((end - up.len()..end, style.size_pt * k * SYNTHETIC_SMALL_CAPS_SCALE));
-                        }
-                        continue;
-                    }
-                }
-                ptext.push(ch);
-            }
-            let first_style = &out.styles[style_at(prange.start)];
-            let first_px = first_style.size_pt * k;
-            // Scripts the loaded fonts may lack (Arabic, Japanese, …): a host serving a font for them
-            // fetches it (`served`); it joins the fallback stack once it arrives.
-            crate::served::request_for_text(&ptext);
-            let fallback: Vec<String> = fonts.fallback_stack().map(str::to_string).collect();
-            let si0 = style_at(prange.start);
-            let si_end = run_starts.partition_point(|&rs| rs < content_end).max(si0 + 1).min(out.styles.len());
-            // Shapes the paragraph, each tab widened by its letter spacing in `tab_spacing` (px).
-            let build = |lcx: &mut LayoutContext<RunBrush>, fcx: &mut parley::FontContext, tab_spacing: &[f32]| -> Layout<RunBrush> {
-                let mut b = lcx.ranged_builder(fcx, &ptext, 1.0, false);
-                // Paragraph-start style as the default (covers the direction mark and empty
-                // paragraphs), then every run piece intersecting this paragraph.
-                for p in style_props(&out.styles[si0], k, &fallback, si0 as u32, small_caps[si0]) {
-                    b.push_default(p);
-                }
-                // Paragraph text breaks a word wider than the box at the box edge, as Photoshop
-                // does (#6694): parley's default only breaks at UAX #14 opportunities and lets the
-                // word run out of the box. Point text has no width to overflow.
-                if is_box {
-                    b.push_default(StyleProperty::OverflowWrap(parley::style::OverflowWrap::BreakWord));
-                }
-                for (ri, st) in out.styles.iter().enumerate().take(si_end).skip(si0) {
-                    let rs = run_starts[ri];
-                    let (a, z) = (rs.max(prange.start), (rs + runs[ri].len).min(content_end));
-                    if a >= z {
-                        continue;
-                    }
-                    let range = (a - prange.start + prefix.len())..(z - prange.start + prefix.len());
-                    for p in style_props(st, k, &fallback, ri as u32, small_caps[ri]) {
-                        b.push(p, range.clone());
-                    }
-                    if vertical {
-                        // Upright pieces get the vertical alternates and their class in the brush.
-                        let piece = ptext.get(range.clone()).unwrap_or("");
-                        let mut seg: Option<(usize, VClass)> = None;
-                        let flush = |b: &mut parley::RangedBuilder<'_, RunBrush>, from: usize, to: usize, cls: VClass| {
-                            if cls == VClass::Rotate || from >= to {
-                                return;
-                            }
-                            let mut feats = feature_list(st, small_caps[ri]);
-                            feats.push("\"vert\" 1".into());
-                            let r = (range.start + from)..(range.start + to);
-                            b.push(StyleProperty::FontFeatures(FontFeatures::Source(Cow::Owned(feats.join(", ")))), r.clone());
-                            b.push(StyleProperty::Brush(RunBrush(ri as u32, cls as u8)), r);
-                        };
-                        for (i, ch) in piece.char_indices() {
-                            let cls = vertical_class(ch);
-                            match seg {
-                                Some((_, c)) if c == cls => {}
-                                Some((from, c)) => {
-                                    flush(&mut b, from, i, c);
-                                    seg = Some((i, cls));
-                                }
-                                None => seg = Some((i, cls)),
-                            }
-                        }
-                        if let Some((from, c)) = seg {
-                            flush(&mut b, from, piece.len(), c);
-                        }
-                    }
-                }
-                for (range, size) in &synthetic_small_caps {
-                    b.push(StyleProperty::FontSize(*size), range.clone());
-                }
-                // Korean breaks lines at spaces, between words, as Photoshop sets it; Unicode's
-                // default rules break between any two Hangul syllables, mid-word (#5959).
-                for range in hangul_runs(&ptext) {
-                    b.push(StyleProperty::WordBreak(parley::WordBreak::KeepAll), range);
-                }
-                for (&at, &spacing) in tabs.iter().zip(tab_spacing) {
-                    b.push(StyleProperty::LetterSpacing(spacing), at..at + 1);
-                }
-                b.build(&ptext)
-            };
-            let indent_start = ps.start_indent_pt * k;
-            let indent_end = ps.end_indent_pt * k;
-            let first_indent = ps.first_line_indent_pt * k;
-            // Box extent along the lines: width, or height for vertical type (columns).
-            let (line_origin, line_len) = if vertical { (box_rect.1, box_rect.3) } else { (box_rect.0, box_rect.2) };
-            let avail = if is_box { Some((line_len - indent_start - indent_end).max(1.0)) } else { None };
-            // Horizontal scale is applied after shaping, so paragraph text breaks at the box
-            // (or area span) width divided by it (#5565). Mixed scales break at the largest, so
-            // no line overflows the box.
-            let break_scale = if wraps {
-                (si0..si_end)
-                    .filter(|&ri| {
-                        let rs = run_starts.get(ri).copied().unwrap_or(0);
-                        let end = rs.saturating_add(runs.get(ri).map_or(0, |r| r.len));
-                        ri == si0 || (rs.max(prange.start) < end.min(content_end))
-                    })
-                    .filter_map(|ri| out.styles.get(ri))
-                    .map(effective_horizontal_scale)
-                    .fold(0.0f32, f32::max)
-            } else {
-                1.0
-            };
-            let break_scale = if break_scale > 0.0 { break_scale } else { 1.0 };
-            // Area type: the first row goes no higher than one leading (plus paragraph spacing)
-            // below the previous paragraph's last line.
-            let space_before = if prev_baseline.is_some() { ps.space_before_pt * k } else { 0.0 };
-            let area_from = |m: LineMetrics| match (&area, prev_baseline) {
-                (Some(_), Some(b)) => b + m.leading + pending_space + space_before,
-                (Some(a), None) => a.bounds[1] + m.ascent,
-                (None, _) => 0.0,
-            };
-            // Line-breaking passes left for this paragraph's area type (see `break_area`).
-            let area_budget = std::cell::Cell::new(MAX_AREA_PASSES);
-            let break_lines = |layout: &mut Layout<RunBrush>| -> (Vec<Slot>, bool) {
-                if first_indent != 0.0 {
-                    layout.set_text_indent(first_indent / break_scale, IndentOptions::default());
-                }
-                let Some(a) = &area else {
-                    layout.break_all_lines(avail.map(|a| a / break_scale));
-                    return (Vec::new(), false);
-                };
-                // Plan every row with the paragraph's real line metrics (its tallest font and
-                // largest leading, measured on the unwrapped paragraph), so no wrapped line comes
-                // out taller than the row it was planned in and no second plan is needed.
-                layout.break_all_lines(None);
-                let m = area_metrics(layout, &out.styles, &ps, k, first_style, vertical);
-                break_area(layout, a, area_from(m), m, (indent_start, indent_end), first_px, break_scale, &area_budget)
-            };
-            // Paragraph text: a tab is never wider than a space plus one tab interval, so breaking
-            // lines at that width keeps the expanded tabs inside the box, but can wrap early.
-            // Break again with the tab widths that layout gives until they agree; if they don't
-            // settle, keep the safe layout.
-            let wide = if wraps { tab_px } else { 0.0 };
-            let mut layout = build(&mut self.lcx, &mut fonts.fcx, &vec![wide; tabs.len()]);
-            let (mut area_slots, mut area_full) = break_lines(&mut layout);
-            if wraps && !tabs.is_empty() {
-                let first = tab_widths(&layout, &tabs, &out.styles, indent_start, first_indent, tab_px);
-                let mut want: Vec<f32> = first.iter().map(|t| t.width).collect();
-                for _ in 0..4 {
-                    let spacing: Vec<f32> = first.iter().zip(&want).map(|(t, w)| w / t.scale - (t.advance - tab_px)).collect();
-                    let mut next = build(&mut self.lcx, &mut fonts.fcx, &spacing);
-                    let (next_slots, next_full) = break_lines(&mut next);
-                    let got: Vec<f32> = tab_widths(&next, &tabs, &out.styles, indent_start, first_indent, tab_px).iter().map(|t| t.width).collect();
-                    if got.iter().zip(&want).all(|(a, b)| (a - b).abs() < 0.01) {
-                        layout = next;
-                        area_slots = next_slots;
-                        area_full = next_full;
-                        break;
-                    }
-                    want = got;
-                }
-            }
-            let alignment = if wraps {
-                match ps.align {
-                    TextAlign::Left => Alignment::Left,
-                    TextAlign::Center => Alignment::Center,
-                    TextAlign::Right => Alignment::Right,
-                    _ => Alignment::Justify,
-                }
-            } else {
-                Alignment::Left
-            };
-            layout.align(alignment, AlignmentOptions { align_when_overflowing: !wraps });
-
-            // Stack lines.
-            if prev_baseline.is_some() {
-                pending_space += ps.space_before_pt * k;
-            }
-            let nlines = layout.len();
-            for (li, line) in layout.lines().enumerate() {
-                // Area type: the slot the breaker gave this line.
-                let slot = area_slots.get(li).copied();
-                if area.is_some() && slot.is_none() {
-                    stop = true;
-                    break;
-                }
-                let m = *line.metrics();
-                let LineMetrics { ascent, descent, leading } = line_metrics(&line, &out.styles, &ps, k, first_style, vertical);
-                let baseline = match (slot, prev_baseline) {
-                    (Some(s), _) => s.baseline,
-                    // The first column's right edge touches the box's right edge.
-                    // (In vertical type the ascent is half the column width.)
-                    (None, None) if is_box && vertical => -(box_rect.0 + box_rect.2) + ascent,
-                    // Photoshop's "first baseline: ascent": the top of the tallest ascender
-                    // (height of 'd') touches the box top, not the font's hhea ascent.
-                    (None, None) if is_box => box_rect.1 + first_ascent(&line).unwrap_or(ascent),
-                    (None, None) => 0.0,
-                    (None, Some(b)) => b + leading + pending_space,
-                };
-                pending_space = 0.0;
-                // Photoshop keeps a horizontal line whose baseline is inside the box and lets
-                // its descenders hang below the bottom edge (#1317: three 35 pt lines in a
-                // 91.3 pt box, the last baseline at 88). Requiring the descent to fit dropped
-                // that line.
-                let overflow = if vertical { baseline + descent > -box_rect.0 + 0.5 } else { baseline > box_rect.1 + box_rect.3 + 0.5 };
-                if is_box && overflow {
-                    stop = true;
-                    break;
-                }
-                prev_baseline = Some(baseline);
-                let last_line = li + 1 == nlines;
-                let adv = m.advance - m.trailing_whitespace;
-                let map = |o: usize| (prange.start + o.saturating_sub(prefix.len())).min(content_end);
-
-                // Kerning after each cluster (px), per run in visual cluster order: manual
-                // kerning plus optical pair kerning. Applied after shaping (like horizontal
-                // scale) in line space, so it moves the following glyphs, carets and the line
-                // extent; in vertical type that is along the column. Optical kerning measures
-                // horizontal outlines, so it applies to rotated (Latin) glyphs only there.
-                let mut slots: Vec<KernSlot> = Vec::new();
-                let mut line_runs: Vec<usize> = Vec::new();
-                for item in line.items() {
-                    let PositionedLayoutItem::GlyphRun(gr) = item else {
-                        continue;
-                    };
-                    let run = gr.run();
-                    if line_runs.contains(&run.index()) {
-                        continue;
-                    }
-                    line_runs.push(run.index());
-                    let hs = out.styles.get(gr.style().brush.0 as usize).map_or(1.0, |st| if st.horizontal_scale > 0.0 { st.horizontal_scale } else { 1.0 });
-                    for c in run.visual_clusters() {
-                        let mut gl = c.glyphs();
-                        let first = gl.next().map(|g| g.id);
-                        let last = gl.last().map(|g| g.id).or(first);
-                        slots.push(KernSlot {
-                            run: run.index(),
-                            start: c.text_range().start,
-                            first,
-                            last,
-                            font: run.font().clone(),
-                            coords: run.normalized_coords().to_vec(),
-                            size: run.font_size(),
-                            rtl: c.is_rtl(),
-                            blank: first.is_none() || c.is_space_or_nbsp() || c.text_range().end <= prefix.len(),
-                            upright: vertical && c.first_style().brush.1 != VClass::Rotate as u8,
-                            advance: c.advance() * hs,
-                            growth: c.advance() * (hs - 1.0),
-                            tab: tabs.binary_search(&c.text_range().start).is_ok(),
-                        });
-                    }
-                }
-                let mut kern_px: Vec<f32> = vec![0.0; slots.len()];
-                for j in 0..slots.len().saturating_sub(1) {
-                    let (a, b) = (&slots[j], &slots[j + 1]);
-                    if a.start < prefix.len() {
-                        continue;
-                    }
-                    let st = &out.styles[style_at(map(a.start))];
-                    let next = &out.styles[style_at(map(b.start))];
-                    let mut units = if st.kern.is_finite() { st.kern } else { 0.0 };
-                    // Optical pairs: both characters optical (a mode change splits shaping
-                    // runs, which ends automatic kerning, as with Metrics).
-                    if st.kerning == Kerning::Optical
-                        && next.kerning == Kerning::Optical
-                        && st.kern == 0.0
-                        && next.kern == 0.0
-                        && !a.rtl
-                        && !b.rtl
-                        && !a.blank
-                        && !b.blank
-                        && !a.upright
-                        && !b.upright
-                        && a.font.data.id() == b.font.data.id()
-                        && a.font.index == b.font.index
-                        && a.coords == b.coords
-                        && (a.size - b.size).abs() < 1e-3
-                        && let (Some(l), Some(r)) = (a.last, b.first)
-                    {
-                        let coords: Vec<skrifa::instance::NormalizedCoord> =
-                            a.coords.iter().map(|&c| skrifa::instance::NormalizedCoord::from_bits(c)).collect();
-                        if let Some(k) = self.optical.pair(a.font.data.id(), a.font.data.as_ref(), a.font.index, &coords, l, r) {
-                            units += k + crate::optical::size_adjust(st.size_pt);
-                        }
-                    }
-                    kern_px[j] = units / 1000.0 * a.size;
-                }
-                // Tabs: the "kerning" after a tab takes the pen to the next stop, measured from
-                // the anchor or the box edge as if the line were left-aligned (alignment then
-                // moves the whole line).
-                let mut pos = indent_start + if li == 0 { first_indent } else { 0.0 };
-                let mut trailing_tabs = 0.0f32;
-                let mut trailing_growth = 0.0f32;
-                for (j, s) in slots.iter().enumerate() {
-                    // Trailing whitespace is outside the line's extent (`adv`).
-                    let trailing = s.blank && slots[j + 1..].iter().all(|n| n.blank);
-                    if trailing {
-                        trailing_growth += s.growth;
-                    }
-                    if s.tab {
-                        kern_px[j] = next_tab_stop(pos, tab_px) - pos - s.advance;
-                        if slots[j + 1..].iter().all(|n| n.blank) {
-                            trailing_tabs += kern_px[j];
-                        }
-                    }
-                    pos += s.advance + kern_px.get(j).copied().unwrap_or(0.0);
-                }
-                let line_kern: f32 = kern_px.iter().sum::<f32>() - trailing_tabs;
-                // Per run on the line: (run index, glyph → slot, glyphs emitted, first slot whose
-                // kerning isn't applied yet).
-                let mut cursors: Vec<(usize, Vec<usize>, usize, usize)> = Vec::new();
-                for item in line.items() {
-                    let PositionedLayoutItem::GlyphRun(gr) = item else {
-                        continue;
-                    };
-                    let run = gr.run();
-                    if cursors.iter().any(|c| c.0 == run.index()) {
-                        continue;
-                    }
-                    let base = slots.iter().position(|s| s.run == run.index()).unwrap_or(0);
-                    let mut g2s = Vec::new();
-                    for (ci, c) in run.visual_clusters().enumerate() {
-                        g2s.extend(c.glyphs().map(|_| base + ci));
-                    }
-                    cursors.push((run.index(), g2s, 0, base));
-                }
-                // Parley aligned box lines without the kerning.
-                let kern_align = if wraps {
-                    match ps.align {
-                        TextAlign::Center => line_kern / 2.0,
-                        TextAlign::Right => line_kern,
-                        _ => 0.0,
-                    }
-                } else {
-                    0.0
-                };
-                // Box and area lines start at their box or span edge; the line's own width
-                // (`line_avail`) takes the justify-last-line slack.
-                let line_avail = slot.map(|s| s.width).or(avail);
-                let dx = if wraps {
-                    let origin = slot.map_or(line_origin, |s| s.x);
-                    let base = origin + indent_start - kern_align;
-                    let slack = line_avail.unwrap_or(0.0) - adv * break_scale - line_kern;
-                    // Parley aligned the unscaled line in `avail / break_scale`: scale its
-                    // indent and alignment offset back to the box.
-                    let scaled_offset = m.offset * (break_scale - 1.0);
-                    base + if last_line {
-                        match ps.align {
-                            TextAlign::JustifyCenter => slack * 0.5 - m.offset,
-                            TextAlign::JustifyRight => slack - m.offset,
-                            _ => scaled_offset,
-                        }
-                    } else {
-                        scaled_offset
-                    }
-                } else {
-                    let target = match ps.align {
-                        TextAlign::Center | TextAlign::JustifyCenter => -(adv + line_kern) / 2.0,
-                        TextAlign::Right | TextAlign::JustifyRight => -(adv + line_kern),
-                        _ => indent_start,
-                    };
-                    target - m.offset
-                };
-                let justify_all = wraps && last_line && ps.align == TextAlign::JustifyAll;
-                let line_index = out.lines.len();
-                let lr = line.text_range();
-                let g0 = out.glyphs.len();
-                let c0 = out.clusters.len();
-                let mut vinfo: Vec<VGlyph> = Vec::new();
-                let mut extra = 0.0f32; // horizontal-scale growth and kerning along the line
-                let mut seen_runs: Vec<usize> = Vec::new();
-                for item in line.items() {
-                    let PositionedLayoutItem::GlyphRun(gr) = item else {
-                        continue;
-                    };
-                    let run = gr.run();
-                    let si = gr.style().brush.0;
-                    let st = &out.styles[si as usize];
-                    let hs = if st.horizontal_scale > 0.0 { st.horizontal_scale } else { 1.0 };
-                    let synth = run.synthesis();
-                    let face = out.faces.len() as u32;
-                    out.faces.push(GlyphFace {
-                        font: run.font().clone(),
-                        coords: run.normalized_coords().to_vec(),
-                        size_px: run.font_size(),
-                        embolden: synthetic_bold(synth.embolden(), st.weight, run.font_attrs().weight.value()),
-                        skew_deg: synth.skew().unwrap_or(0.0),
-                    });
-                    let run_x0 = dx + gr.offset() + extra;
-                    if !seen_runs.contains(&run.index()) {
-                        seen_runs.push(run.index());
-                        let mut cx = run_x0;
-                        let base = slots.iter().position(|s| s.run == run.index()).unwrap_or(0);
-                        for (ci, c) in run.visual_clusters().enumerate() {
-                            let a = c.advance() * hs + kern_px.get(base + ci).copied().unwrap_or(0.0);
-                            let r = c.text_range();
-                            if r.end > prefix.len() || prefix.is_empty() {
-                                out.clusters.push(ClusterInfo { range: map(r.start)..map(r.end), x: cx, advance: a, line: line_index, rtl: c.is_rtl() });
-                            }
-                            cx += a;
-                        }
-                    }
-                    let rm = run.metrics();
-                    let vm = if vertical { Some(VMetrics::new(run.font(), run.normalized_coords(), run.font_size())) } else { None };
-                    let class = gr.style().brush.1;
-                    // Glyphs of the run's own characters (not substituted by `vert`).
-                    let plain: Vec<u32> = match (&vm, class) {
-                        (Some(v), 2) => ptext.get(run.text_range()).unwrap_or("").chars().filter_map(|c| v.cmap(c)).collect(),
-                        _ => Vec::new(),
-                    };
-                    let mut pen = gr.offset();
-                    let mut cursor = cursors.iter_mut().find(|c| c.0 == run.index());
-                    for g in gr.glyphs() {
-                        // Kerning of the clusters before this glyph's cluster.
-                        if let Some(c) = cursor.as_deref_mut() {
-                            if let Some(&slot) = c.1.get(c.2) {
-                                while c.3 < slot {
-                                    extra += kern_px.get(c.3).copied().unwrap_or(0.0);
-                                    c.3 += 1;
-                                }
-                            }
-                            c.2 += 1;
-                        }
-                        out.glyphs.push(PlacedGlyph {
-                            face,
-                            id: g.id,
-                            x: dx + pen + g.x + extra,
-                            y: baseline + g.y,
-                            style: si,
-                            orient: GlyphOrient::Horizontal,
-                        });
-                        if let Some(v) = &vm {
-                            let upright = class == 1 || (class == 2 && !plain.contains(&g.id));
-                            vinfo.push(VGlyph {
-                                upright,
-                                advance: g.advance * hs,
-                                origin: if upright { v.origin(g.id) } else { 0.0 },
-                                // Rotated text is centred on the column: its baseline sits
-                                // (ascent − descent) / 2 from the centre line.
-                                centre: (rm.ascent - rm.descent) * 0.5,
-                            });
-                        }
-                        extra += g.advance * (hs - 1.0);
-                        pen += g.advance;
-                    }
-                    // The run's last glyph: its remaining clusters' kerning follows it.
-                    if let Some(c) = cursor
-                        && c.2 >= c.1.len()
-                    {
-                        let end = slots.iter().rposition(|s| s.run == c.0).map_or(c.3, |p| p + 1);
-                        while c.3 < end {
-                            extra += kern_px.get(c.3).copied().unwrap_or(0.0);
-                            c.3 += 1;
-                        }
-                    }
-                    let run_x1 = dx + gr.offset() + gr.advance() + extra;
-                    let shift = st.baseline_shift_pt * k;
-                    if vertical {
-                        // Underline to the right of the column, strikethrough through its centre
-                        // (stored directly in text space).
-                        let half = run.font_size() * 0.5;
-                        let mut push = |v0: f32, v1: f32| out.decorations.push(DecorationRect { x0: -v1, y0: run_x0, x1: -v0, y1: run_x1, style: si });
-                        if gr.style().underline.is_some() {
-                            let v1 = baseline - half;
-                            push(v1 - rm.underline_size.max(1.0), v1);
-                        }
-                        if gr.style().strikethrough.is_some() {
-                            let sz = rm.strikethrough_size.max(1.0);
-                            push(baseline - sz * 0.5, baseline + sz * 0.5);
-                        }
-                    } else if gr.style().underline.is_some() {
-                        let y0 = baseline - rm.underline_offset - shift;
-                        out.decorations.push(DecorationRect { x0: run_x0, y0, x1: run_x1, y1: y0 + rm.underline_size.max(1.0), style: si });
-                    }
-                    if !vertical && gr.style().strikethrough.is_some() {
-                        let y0 = baseline - rm.strikethrough_offset - shift;
-                        out.decorations.push(DecorationRect { x0: run_x0, y0, x1: run_x1, y1: y0 + rm.strikethrough_size.max(1.0), style: si });
-                    }
-                }
-                if vertical {
-                    extra -= squeeze_punctuation(text, &mut out.clusters[c0..], &mut out.glyphs[g0..]);
-                }
-                if justify_all {
-                    let slack = line_avail.unwrap_or(0.0) - (adv + extra);
-                    let n = out.clusters.len() - c0;
-                    if n > 1 && slack > 0.0 {
-                        let step = slack / (n - 1) as f32;
-                        let starts: Vec<f32> = out.clusters[c0..].iter().map(|c| c.x).collect();
-                        for (i, c) in out.clusters[c0..].iter_mut().enumerate() {
-                            c.x += step * i as f32;
-                        }
-                        for g in &mut out.glyphs[g0..] {
-                            let i = starts.iter().rposition(|&s| s <= g.x + 1e-3).unwrap_or(0);
-                            g.x += step * i as f32;
-                        }
-                        extra += slack;
-                    }
-                }
-                if vertical {
-                    // Line space → text space (90° clockwise); upright glyphs centred on the column.
-                    for (g, v) in out.glyphs[g0..].iter_mut().zip(&vinfo) {
-                        let (u, cross) = (g.x, g.y);
-                        if v.upright {
-                            g.x = -baseline - v.advance * 0.5;
-                            g.y = u + v.origin;
-                            g.orient = GlyphOrient::Upright;
-                        } else {
-                            g.x = -(cross + v.centre);
-                            g.y = u;
-                            g.orient = GlyphOrient::Rotated;
-                        }
-                    }
-                }
-                let x0 = dx + m.offset;
-                out.lines.push(LineInfo {
-                    range: map(lr.start)..map(lr.end).min(content_end),
-                    baseline,
-                    x0,
-                    x1: x0 + adv + extra - trailing_tabs - trailing_growth,
-                    ascent,
-                    descent,
-                    paragraph: pi,
-                });
-            }
-            if area_full {
-                // The shape is full: later paragraphs are hidden too.
-                stop = true;
-            }
-            pending_space += ps.space_after_pt * k;
+            let ps = paras[para_starts.iter().rposition(|&s| s <= prange.start).unwrap_or(0)].style.clone();
+            self.layout_paragraph(fonts, &mut out, &mut flow, Para::new(&env, fonts, pi, prange, ps));
         }
+        out.styles = styles;
         out
     }
+
+    /// Breaks one paragraph and stacks its lines below the previous paragraph's.
+    fn layout_paragraph(&mut self, fonts: &mut FontDb, out: &mut TextLayout, flow: &mut Flow, para: Para<'_>) {
+        let env = para.env;
+        let (mut layout, area_slots, area_full) = para.break_paragraph(&mut self.lcx, &mut fonts.fcx, flow);
+        layout.align(para.alignment(), para.align_options());
+        if flow.prev_baseline.is_some() {
+            flow.pending_space += para.ps.space_before_pt * env.k;
+        }
+        let nlines = layout.len();
+        for (li, line) in layout.lines().enumerate() {
+            // Area type: the slot the breaker gave this line.
+            let slot = area_slots.get(li).copied();
+            if env.area.is_some() && slot.is_none() {
+                flow.stop = true;
+                break;
+            }
+            let Some(frame) = para.frame_line(&line, li, nlines, slot, flow) else {
+                flow.stop = true;
+                break;
+            };
+            para.place_line(&mut self.optical, out, &line, &frame);
+        }
+        if area_full {
+            // The shape is full: later paragraphs are hidden too.
+            flow.stop = true;
+        }
+        flow.pending_space += para.ps.space_after_pt * env.k;
+    }
+}
+
+/// What a layout run shares between its paragraphs.
+struct Env<'a> {
+    text: &'a str,
+    runs: &'a [photocraft_doc::text::TextRun],
+    styles: &'a [CharStyle],
+    /// Start offset of each run.
+    run_starts: &'a [usize],
+    small_caps: &'a [SmallCapsMode],
+    k: f32,
+    vertical: bool,
+    is_box: bool,
+    /// Box and area text wrap, align within their lines and hide what doesn't fit.
+    wraps: bool,
+    box_rect: (f32, f32, f32, f32),
+    area: Option<crate::area::AreaShape>,
+}
+
+impl Env<'_> {
+    /// Index of the run (and style) containing byte offset `off`.
+    fn style_at(&self, off: usize) -> usize {
+        run_index_at(self.run_starts, off)
+    }
+}
+
+/// Where the previous paragraph left off.
+#[derive(Default)]
+struct Flow {
+    prev_baseline: Option<f32>,
+    pending_space: f32,
+    stop: bool,
 }
 
 /// Where one line of area type goes: its baseline, the left edge of its span, and the width
diff --git a/crates/text/src/layout/area.rs b/crates/text/src/layout/area.rs
index d91d497e26..f6dbe9cf69 100644
--- a/crates/text/src/layout/area.rs
+++ b/crates/text/src/layout/area.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{CharStyle, Layout, ParagraphStyle, PositionedLayoutItem, RunBrush, Slot};
 
 /// A line's ascent, descent and leading (px); for area type, the largest over a paragraph.
 #[derive(Clone, Copy, Debug)]
diff --git a/crates/text/src/layout/lines.rs b/crates/text/src/layout/lines.rs
new file mode 100644
index 0000000000..b8943ef609
--- /dev/null
+++ b/crates/text/src/layout/lines.rs
@@ -0,0 +1,525 @@
+//! Placing one broken line of a paragraph: kerning and tab stops, glyph and cluster positions,
+//! decorations, and the line's vertical-type and justification adjustments.
+
+use parley::{PositionedLayoutItem, Run};
+use photocraft_doc::text::{CharStyle, Kerning, TextAlign};
+use skrifa::instance::NormalizedCoord;
+
+use super::area::{LineMetrics, line_metrics};
+use super::shaping::Para;
+use super::style::{first_ascent, squeeze_punctuation, synthetic_bold};
+use super::vertical::{VGlyph, VMetrics};
+use super::{ClusterInfo, DecorationRect, Flow, GlyphFace, GlyphOrient, LineInfo, PlacedGlyph, RunBrush, Slot, TextLayout, VClass};
+
+type Line<'a> = parley::Line<'a, RunBrush>;
+type GlyphRun<'a> = parley::GlyphRun<'a, RunBrush>;
+
+/// A cluster of a line in visual order, for kerning.
+struct KernSlot {
+    /// Index of the run in the paragraph layout.
+    run: usize,
+    /// Byte offset in the paragraph text.
+    start: usize,
+    first: Option<u32>,
+    last: Option<u32>,
+    font: parley::FontData,
+    coords: Vec<i16>,
+    size: f32,
+    rtl: bool,
+    blank: bool,
+    /// Advance along the line (px, horizontal scale included).
+    advance: f32,
+    /// What horizontal scale adds to the shaped advance (px; negative below 100%).
+    growth: f32,
+    /// A tab, shaped as a space; it advances to the next tab stop.
+    tab: bool,
+    /// Vertical type, upright glyph (its outline doesn't run along the column).
+    upright: bool,
+}
+
+/// Where a line sits in its paragraph and on the page.
+pub(super) struct LineFrame {
+    pub(super) index: usize,
+    pub(super) last: bool,
+    /// The slot the area breaker gave this line.
+    pub(super) slot: Option<Slot>,
+    pub(super) baseline: f32,
+    pub(super) ascent: f32,
+    pub(super) descent: f32,
+}
+
+/// The clusters of one run, for applying kerning as glyphs are emitted.
+struct KernCursor {
+    run: usize,
+    /// Slot of the cluster each glyph of the run belongs to.
+    glyph_slot: Vec<usize>,
+    /// Glyphs emitted so far.
+    emitted: usize,
+    /// First slot whose kerning isn't applied yet.
+    applied: usize,
+}
+
+impl KernCursor {
+    /// Kerning of the clusters before the next glyph's cluster.
+    fn before_glyph(&mut self, kern_px: &[f32], extra: &mut f32) {
+        if let Some(&slot) = self.glyph_slot.get(self.emitted) {
+            while self.applied < slot {
+                *extra += kern_px.get(self.applied).copied().unwrap_or(0.0);
+                self.applied += 1;
+            }
+        }
+        self.emitted += 1;
+    }
+
+    /// After the run's last glyph: its remaining clusters' kerning follows it.
+    fn after_run(&mut self, slots: &[KernSlot], kern_px: &[f32], extra: &mut f32) {
+        if self.emitted < self.glyph_slot.len() {
+            return;
+        }
+        let end = slots.iter().rposition(|s| s.run == self.run).map_or(self.applied, |p| p + 1);
+        while self.applied < end {
+            *extra += kern_px.get(self.applied).copied().unwrap_or(0.0);
+            self.applied += 1;
+        }
+    }
+}
+
+/// What is accumulated while a line's glyph runs are emitted.
+struct LineState {
+    cursors: Vec<KernCursor>,
+    seen_runs: Vec<usize>,
+    vinfo: Vec<VGlyph>,
+    /// Horizontal-scale growth and kerning along the line.
+    extra: f32,
+}
+
+/// Fixed facts about the line being emitted.
+struct LineCtx<'a> {
+    dx: f32,
+    baseline: f32,
+    slots: &'a [KernSlot],
+    kern_px: &'a [f32],
+    line_index: usize,
+}
+
+/// The horizontal extent of one glyph run on the line.
+struct RunSpan {
+    x0: f32,
+    x1: f32,
+    style: u32,
+}
+
+/// A run style's horizontal scale; unset (zero or negative) is 100%.
+fn scale_of(st: &CharStyle) -> f32 {
+    if st.horizontal_scale > 0.0 { st.horizontal_scale } else { 1.0 }
+}
+
+/// The clusters of `line` in visual order, per run.
+fn collect_kern_slots(line: &Line<'_>, para: &Para<'_>) -> Vec<KernSlot> {
+    let env = para.env;
+    let mut slots: Vec<KernSlot> = Vec::new();
+    let mut line_runs: Vec<usize> = Vec::new();
+    for item in line.items() {
+        let PositionedLayoutItem::GlyphRun(gr) = item else {
+            continue;
+        };
+        let run = gr.run();
+        if line_runs.contains(&run.index()) {
+            continue;
+        }
+        line_runs.push(run.index());
+        let hs = env.styles.get(gr.style().brush.0 as usize).map_or(1.0, scale_of);
+        for c in run.visual_clusters() {
+            let mut gl = c.glyphs();
+            let first = gl.next().map(|g| g.id);
+            let last = gl.last().map(|g| g.id).or(first);
+            slots.push(KernSlot {
+                run: run.index(),
+                start: c.text_range().start,
+                first,
+                last,
+                font: run.font().clone(),
+                coords: run.normalized_coords().to_vec(),
+                size: run.font_size(),
+                rtl: c.is_rtl(),
+                blank: first.is_none() || c.is_space_or_nbsp() || c.text_range().end <= para.prefix.len(),
+                upright: env.vertical && c.first_style().brush.1 != VClass::Rotate as u8,
+                advance: c.advance() * hs,
+                growth: c.advance() * (hs - 1.0),
+                tab: para.tabs.binary_search(&c.text_range().start).is_ok(),
+            });
+        }
+    }
+    slots
+}
+
+/// Both characters of a pair kern optically: a mode change splits shaping runs, which ends
+/// automatic kerning, as with Metrics.
+fn optical_pair(st: &CharStyle, next: &CharStyle, a: &KernSlot, b: &KernSlot) -> bool {
+    st.kerning == Kerning::Optical
+        && next.kerning == Kerning::Optical
+        && st.kern == 0.0
+        && next.kern == 0.0
+        && !a.rtl
+        && !b.rtl
+        && !a.blank
+        && !b.blank
+        && !a.upright
+        && !b.upright
+        && a.font.data.id() == b.font.data.id()
+        && a.font.index == b.font.index
+        && a.coords == b.coords
+        && (a.size - b.size).abs() < 1e-3
+}
+
+/// Optical kerning between two adjacent clusters (font units, with the size adjustment), if the
+/// font has the pair.
+fn optical_kern(optical: &mut crate::optical::Cache, st: &CharStyle, a: &KernSlot, b: &KernSlot) -> Option<f32> {
+    let (l, r) = (a.last?, b.first?);
+    let coords: Vec<NormalizedCoord> = a.coords.iter().map(|&c| NormalizedCoord::from_bits(c)).collect();
+    let k = optical.pair(a.font.data.id(), a.font.data.as_ref(), a.font.index, &coords, l, r)?;
+    Some(k + crate::optical::size_adjust(st.size_pt))
+}
+
+/// One kerning cursor per run on `line`.
+fn kern_cursors(line: &Line<'_>, slots: &[KernSlot]) -> Vec<KernCursor> {
+    let mut cursors: Vec<KernCursor> = Vec::new();
+    for item in line.items() {
+        let PositionedLayoutItem::GlyphRun(gr) = item else {
+            continue;
+        };
+        let run = gr.run();
+        if cursors.iter().any(|c| c.run == run.index()) {
+            continue;
+        }
+        let base = slots.iter().position(|s| s.run == run.index()).unwrap_or(0);
+        cursors.push(KernCursor { run: run.index(), glyph_slot: glyph_slots(run, base), emitted: 0, applied: base });
+    }
+    cursors
+}
+
+/// For each glyph of `run`, the slot of its cluster (the run's clusters start at slot `base`).
+fn glyph_slots(run: &Run<'_, RunBrush>, base: usize) -> Vec<usize> {
+    let mut g2s = Vec::new();
+    for (ci, c) in run.visual_clusters().enumerate() {
+        g2s.extend(c.glyphs().map(|_| base + ci));
+    }
+    g2s
+}
+
+/// Distributes `slack` between the clusters of the line from `c0` (and their glyphs from `g0`);
+/// returns what was added to the line's length.
+fn justify_line(out: &mut TextLayout, c0: usize, g0: usize, slack: f32) -> f32 {
+    let n = out.clusters.len() - c0;
+    if n <= 1 || slack <= 0.0 {
+        return 0.0;
+    }
+    let step = slack / (n - 1) as f32;
+    let starts: Vec<f32> = out.clusters[c0..].iter().map(|c| c.x).collect();
+    for (i, c) in out.clusters[c0..].iter_mut().enumerate() {
+        c.x += step * i as f32;
+    }
+    for g in &mut out.glyphs[g0..] {
+        let i = starts.iter().rposition(|&s| s <= g.x + 1e-3).unwrap_or(0);
+        g.x += step * i as f32;
+    }
+    slack
+}
+
+/// Line space → text space (90° clockwise); upright glyphs centred on the column.
+fn rotate_to_text_space(glyphs: &mut [PlacedGlyph], vinfo: &[VGlyph], baseline: f32) {
+    for (g, v) in glyphs.iter_mut().zip(vinfo) {
+        let (u, cross) = (g.x, g.y);
+        if v.upright {
+            g.x = -baseline - v.advance * 0.5;
+            g.y = u + v.origin;
+            g.orient = GlyphOrient::Upright;
+        } else {
+            g.x = -(cross + v.centre);
+            g.y = u;
+            g.orient = GlyphOrient::Rotated;
+        }
+    }
+}
+
+/// Underline and strikethrough rects of one run.
+fn push_decorations(out: &mut TextLayout, vertical: bool, gr: &GlyphRun<'_>, baseline: f32, shift: f32, span: &RunSpan) {
+    let rm = gr.run().metrics();
+    let (x0, x1, si) = (span.x0, span.x1, span.style);
+    if vertical {
+        // Underline to the right of the column, strikethrough through its centre
+        // (stored directly in text space).
+        let half = gr.run().font_size() * 0.5;
+        let mut push = |v0: f32, v1: f32| out.decorations.push(DecorationRect { x0: -v1, y0: x0, x1: -v0, y1: x1, style: si });
+        if gr.style().underline.is_some() {
+            let v1 = baseline - half;
+            push(v1 - rm.underline_size.max(1.0), v1);
+        }
+        if gr.style().strikethrough.is_some() {
+            let sz = rm.strikethrough_size.max(1.0);
+            push(baseline - sz * 0.5, baseline + sz * 0.5);
+        }
+        return;
+    }
+    if gr.style().underline.is_some() {
+        let y0 = baseline - rm.underline_offset - shift;
+        out.decorations.push(DecorationRect { x0, y0, x1, y1: y0 + rm.underline_size.max(1.0), style: si });
+    }
+    if gr.style().strikethrough.is_some() {
+        let y0 = baseline - rm.strikethrough_offset - shift;
+        out.decorations.push(DecorationRect { x0, y0, x1, y1: y0 + rm.strikethrough_size.max(1.0), style: si });
+    }
+}
+
+impl Para<'_> {
+    /// Kerning after each cluster (px): manual kerning plus optical pair kerning. Applied after
+    /// shaping (like horizontal scale) in line space, so it moves the following glyphs, carets and
+    /// the line extent; in vertical type that is along the column. Optical kerning measures
+    /// horizontal outlines, so it applies to rotated (Latin) glyphs only there.
+    fn kerning(&self, optical: &mut crate::optical::Cache, slots: &[KernSlot]) -> Vec<f32> {
+        let env = self.env;
+        let mut kern_px: Vec<f32> = vec![0.0; slots.len()];
+        for j in 0..slots.len().saturating_sub(1) {
+            let (a, b) = (&slots[j], &slots[j + 1]);
+            if a.start < self.prefix.len() {
+                continue;
+            }
+            let st = &env.styles[env.style_at(self.map_offset(a.start))];
+            let next = &env.styles[env.style_at(self.map_offset(b.start))];
+            let mut units = if st.kern.is_finite() { st.kern } else { 0.0 };
+            if optical_pair(st, next, a, b) {
+                units += optical_kern(optical, st, a, b).unwrap_or(0.0);
+            }
+            kern_px[j] = units / 1000.0 * a.size;
+        }
+        kern_px
+    }
+
+    /// Tabs: the "kerning" after a tab takes the pen to the next stop, measured from the anchor or
+    /// the box edge as if the line were left-aligned (alignment then moves the whole line).
+    /// Returns the tab width and horizontal-scale growth in the line's trailing whitespace, which
+    /// is outside its extent.
+    fn apply_tab_stops(&self, slots: &[KernSlot], kern_px: &mut [f32], line_index: usize) -> (f32, f32) {
+        let mut pos = self.indent_start + if line_index == 0 { self.first_indent } else { 0.0 };
+        let mut trailing_tabs = 0.0f32;
+        let mut trailing_growth = 0.0f32;
+        for (j, s) in slots.iter().enumerate() {
+            let rest_blank = slots[j + 1..].iter().all(|n| n.blank);
+            if s.blank && rest_blank {
+                trailing_growth += s.growth;
+            }
+            if s.tab {
+                kern_px[j] = super::next_tab_stop(pos, self.tab_px) - pos - s.advance;
+                if rest_blank {
+                    trailing_tabs += kern_px[j];
+                }
+            }
+            pos += s.advance + kern_px.get(j).copied().unwrap_or(0.0);
+        }
+        (trailing_tabs, trailing_growth)
+    }
+
+    /// Where the line starts along its extent: box and area lines at their box or span edge,
+    /// point lines around the anchor.
+    fn line_start(&self, f: &LineFrame, offset: f32, adv: f32, line_kern: f32) -> f32 {
+        if !self.env.wraps {
+            let target = match self.ps.align {
+                TextAlign::Center | TextAlign::JustifyCenter => -(adv + line_kern) / 2.0,
+                TextAlign::Right | TextAlign::JustifyRight => -(adv + line_kern),
+                _ => self.indent_start,
+            };
+            return target - offset;
+        }
+        // Parley aligned box lines without the kerning.
+        let kern_align = match self.ps.align {
+            TextAlign::Center => line_kern / 2.0,
+            TextAlign::Right => line_kern,
+            _ => 0.0,
+        };
+        let origin = f.slot.map_or(self.line_origin, |s| s.x);
+        let base = origin + self.indent_start - kern_align;
+        // The line's own width takes the justify-last-line slack.
+        let slack = self.line_avail(f).unwrap_or(0.0) - adv * self.break_scale - line_kern;
+        // Parley aligned the unscaled line in `avail / break_scale`: scale its
+        // indent and alignment offset back to the box.
+        let scaled_offset = offset * (self.break_scale - 1.0);
+        base + if f.last {
+            match self.ps.align {
+                TextAlign::JustifyCenter => slack * 0.5 - offset,
+                TextAlign::JustifyRight => slack - offset,
+                _ => scaled_offset,
+            }
+        } else {
+            scaled_offset
+        }
+    }
+
+    /// The width the line may fill: its area slot's, else the box's.
+    fn line_avail(&self, f: &LineFrame) -> Option<f32> {
+        f.slot.map(|s| s.width).or(self.avail)
+    }
+
+    /// Where line `index` of `nlines` goes, advancing `flow` past it; `None` if a box clips it.
+    pub(super) fn frame_line(&self, line: &Line<'_>, index: usize, nlines: usize, slot: Option<Slot>, flow: &mut Flow) -> Option<LineFrame> {
+        let env = self.env;
+        let LineMetrics { ascent, descent, leading } = line_metrics(line, env.styles, &self.ps, env.k, self.first_style(), env.vertical);
+        let (box_x, box_y, box_w, box_h) = env.box_rect;
+        let baseline = match (slot, flow.prev_baseline) {
+            (Some(s), _) => s.baseline,
+            // The first column's right edge touches the box's right edge.
+            // (In vertical type the ascent is half the column width.)
+            (None, None) if env.is_box && env.vertical => -(box_x + box_w) + ascent,
+            // Photoshop's "first baseline: ascent": the top of the tallest ascender
+            // (height of 'd') touches the box top, not the font's hhea ascent.
+            (None, None) if env.is_box => box_y + first_ascent(line).unwrap_or(ascent),
+            (None, None) => 0.0,
+            (None, Some(b)) => b + leading + flow.pending_space,
+        };
+        flow.pending_space = 0.0;
+        // Photoshop keeps a horizontal line whose baseline is inside the box and lets
+        // its descenders hang below the bottom edge (#1317: three 35 pt lines in a
+        // 91.3 pt box, the last baseline at 88). Requiring the descent to fit dropped
+        // that line.
+        // Photoshop keeps a horizontal line whose baseline is inside the box and lets its
+        // descenders hang below the bottom edge (#1317: three 35 pt lines in a 91.3 pt box, the
+        // last baseline at 88). Requiring the descent to fit dropped that line.
+        let overflow = if env.vertical { baseline + descent > -box_x + 0.5 } else { baseline > box_y + box_h + 0.5 };
+        if env.is_box && overflow {
+            return None;
+        }
+        flow.prev_baseline = Some(baseline);
+        Some(LineFrame { index, last: index + 1 == nlines, slot, baseline, ascent, descent })
+    }
+
+    /// Appends one line's clusters, glyphs, decorations and `LineInfo` to `out`.
+    pub(super) fn place_line(&self, optical: &mut crate::optical::Cache, out: &mut TextLayout, line: &Line<'_>, f: &LineFrame) {
+        let env = self.env;
+        let m = *line.metrics();
+        let adv = m.advance - m.trailing_whitespace;
+        let slots = collect_kern_slots(line, self);
+        let mut kern_px = self.kerning(optical, &slots);
+        let (trailing_tabs, trailing_growth) = self.apply_tab_stops(&slots, &mut kern_px, f.index);
+        let line_kern: f32 = kern_px.iter().sum::<f32>() - trailing_tabs;
+        let dx = self.line_start(f, m.offset, adv, line_kern);
+        let lc = LineCtx { dx, baseline: f.baseline, slots: &slots, kern_px: &kern_px, line_index: out.lines.len() };
+        let (g0, c0) = (out.glyphs.len(), out.clusters.len());
+        let mut state = LineState { cursors: kern_cursors(line, &slots), seen_runs: Vec::new(), vinfo: Vec::new(), extra: 0.0 };
+        for item in line.items() {
+            if let PositionedLayoutItem::GlyphRun(gr) = item {
+                self.emit_run(out, &lc, &mut state, &gr);
+            }
+        }
+        if env.vertical {
+            state.extra -= squeeze_punctuation(env.text, &mut out.clusters[c0..], &mut out.glyphs[g0..]);
+        }
+        if env.wraps && f.last && self.ps.align == TextAlign::JustifyAll {
+            let slack = self.line_avail(f).unwrap_or(0.0) - (adv + state.extra);
+            state.extra += justify_line(out, c0, g0, slack);
+        }
+        if env.vertical {
+            rotate_to_text_space(&mut out.glyphs[g0..], &state.vinfo, f.baseline);
+        }
+        let lr = line.text_range();
+        let x0 = dx + m.offset;
+        out.lines.push(LineInfo {
+            range: self.map_offset(lr.start)..self.map_offset(lr.end).min(self.content_end),
+            baseline: f.baseline,
+            x0,
+            x1: x0 + adv + state.extra - trailing_tabs - trailing_growth,
+            ascent: f.ascent,
+            descent: f.descent,
+            paragraph: self.index,
+        });
+    }
+
+    /// Emits one glyph run of the line: its face, clusters (once per shaping run), glyphs and
+    /// decorations.
+    fn emit_run(&self, out: &mut TextLayout, lc: &LineCtx<'_>, state: &mut LineState, gr: &GlyphRun<'_>) {
+        let env = self.env;
+        let run = gr.run();
+        let si = gr.style().brush.0;
+        let st = &env.styles[si as usize];
+        let hs = scale_of(st);
+        let synth = run.synthesis();
+        let face = out.faces.len() as u32;
+        out.faces.push(GlyphFace {
+            font: run.font().clone(),
+            coords: run.normalized_coords().to_vec(),
+            size_px: run.font_size(),
+            embolden: synthetic_bold(synth.embolden(), st.weight, run.font_attrs().weight.value()),
+            skew_deg: synth.skew().unwrap_or(0.0),
+        });
+        let run_x0 = lc.dx + gr.offset() + state.extra;
+        if !state.seen_runs.contains(&run.index()) {
+            state.seen_runs.push(run.index());
+            self.push_clusters(out, lc, run, hs, run_x0);
+        }
+        self.push_glyphs(out, lc, state, gr, face, hs);
+        let span = RunSpan { x0: run_x0, x1: lc.dx + gr.offset() + gr.advance() + state.extra, style: si };
+        push_decorations(out, env.vertical, gr, lc.baseline, st.baseline_shift_pt * env.k, &span);
+    }
+
+    /// The caret clusters of a shaping run, with kerning and horizontal scale in their advances.
+    fn push_clusters(&self, out: &mut TextLayout, lc: &LineCtx<'_>, run: &Run<'_, RunBrush>, hs: f32, run_x0: f32) {
+        let mut cx = run_x0;
+        let base = lc.slots.iter().position(|s| s.run == run.index()).unwrap_or(0);
+        for (ci, c) in run.visual_clusters().enumerate() {
+            let a = c.advance() * hs + lc.kern_px.get(base + ci).copied().unwrap_or(0.0);
+            let r = c.text_range();
+            if r.end > self.prefix.len() || self.prefix.is_empty() {
+                out.clusters.push(ClusterInfo {
+                    range: self.map_offset(r.start)..self.map_offset(r.end),
+                    x: cx,
+                    advance: a,
+                    line: lc.line_index,
+                    rtl: c.is_rtl(),
+                });
+            }
+            cx += a;
+        }
+    }
+
+    /// The glyphs of one run, with the kerning of the clusters before each.
+    fn push_glyphs(&self, out: &mut TextLayout, lc: &LineCtx<'_>, state: &mut LineState, gr: &GlyphRun<'_>, face: u32, hs: f32) {
+        let run = gr.run();
+        let rm = run.metrics();
+        let vm = if self.env.vertical { Some(VMetrics::new(run.font(), run.normalized_coords(), run.font_size())) } else { None };
+        let class = gr.style().brush.1;
+        // Glyphs of the run's own characters (not substituted by `vert`).
+        let plain: Vec<u32> = match (&vm, class) {
+            (Some(v), 2) => self.text_of(run.text_range()).chars().filter_map(|c| v.cmap(c)).collect(),
+            _ => Vec::new(),
+        };
+        let mut pen = gr.offset();
+        let mut cursor = state.cursors.iter_mut().find(|c| c.run == run.index());
+        for g in gr.glyphs() {
+            if let Some(c) = cursor.as_deref_mut() {
+                c.before_glyph(lc.kern_px, &mut state.extra);
+            }
+            out.glyphs.push(PlacedGlyph {
+                face,
+                id: g.id,
+                x: lc.dx + pen + g.x + state.extra,
+                y: lc.baseline + g.y,
+                style: gr.style().brush.0,
+                orient: GlyphOrient::Horizontal,
+            });
+            if let Some(v) = &vm {
+                let upright = class == 1 || (class == 2 && !plain.contains(&g.id));
+                state.vinfo.push(VGlyph {
+                    upright,
+                    advance: g.advance * hs,
+                    origin: if upright { v.origin(g.id) } else { 0.0 },
+                    // Rotated text is centred on the column: its baseline sits
+                    // (ascent − descent) / 2 from the centre line.
+                    centre: (rm.ascent - rm.descent) * 0.5,
+                });
+            }
+            state.extra += g.advance * (hs - 1.0);
+            pen += g.advance;
+        }
+        if let Some(c) = cursor {
+            c.after_run(lc.slots, lc.kern_px, &mut state.extra);
+        }
+    }
+}
diff --git a/crates/text/src/layout/navigate.rs b/crates/text/src/layout/navigate.rs
index e7d9c00333..e87bf9b086 100644
--- a/crates/text/src/layout/navigate.rs
+++ b/crates/text/src/layout/navigate.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::TextLayout;
 
 /// Byte offset of character `index` (the text length when `index` is past the end).
 pub fn byte_index(text: &str, index: usize) -> usize {
diff --git a/crates/text/src/layout/paragraphs.rs b/crates/text/src/layout/paragraphs.rs
index 2be1fbbc5a..9d9e017d1c 100644
--- a/crates/text/src/layout/paragraphs.rs
+++ b/crates/text/src/layout/paragraphs.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{CharStyle, Layout, PositionedLayoutItem, Range, RunBrush};
 
 /// Photoshop's default tab stops: every half inch, measured from the anchor of point text or the
 /// left edge of a paragraph box. PSD type carries no custom tab stops, so these are the only ones.
diff --git a/crates/text/src/layout/shaping.rs b/crates/text/src/layout/shaping.rs
new file mode 100644
index 0000000000..283c7e2ef3
--- /dev/null
+++ b/crates/text/src/layout/shaping.rs
@@ -0,0 +1,438 @@
+//! Per-paragraph preparation of a text layer's layout: the paragraph's shaped text (prefix, case
+//! mapping, tabs), the parley shaping pass over it, and its line breaking.
+
+use std::borrow::Cow;
+use std::cell::Cell;
+use std::ops::Range;
+
+use parley::{Alignment, AlignmentOptions, FontFeatures, Layout, LayoutContext, StyleProperty};
+use photocraft_doc::text::{CharStyle, ParagraphStyle, TextAlign, TextDirection};
+
+use super::area::{LineMetrics, MAX_AREA_PASSES, area_metrics, break_area};
+use super::paragraphs::{TabWidth, strip_break, tab_widths};
+use super::style::{
+    SYNTHETIC_SMALL_CAPS_SCALE, SmallCapsMode, drawn_style, effective_horizontal_scale, feature_list, hangul_runs, probe_smcp, small_caps_mode, style_props,
+};
+use super::vertical::vertical_class;
+use super::{Env, FORCED_LINE_BREAK, Flow, LRM, RLM, RunBrush, Slot, VClass};
+use crate::fonts::FontDb;
+use crate::layout::DEFAULT_TAB_STOP_PT;
+
+/// The character styles of `runs`, with families resolved (PostScript names from PSDs, unknown
+/// families) and drawn the way they are laid out.
+pub(super) fn resolve_run_styles(fonts: &mut FontDb, runs: &[photocraft_doc::text::TextRun]) -> Vec<CharStyle> {
+    runs.iter()
+        .map(|r| {
+            let mut s = r.style.clone();
+            adopt_postscript_face(fonts, &mut s);
+            // Drawn with a fallback for now; a host that serves this family fetches it (`served`).
+            if !fonts.has_family(&s.font_family) {
+                crate::served::request(&s.font_family);
+            }
+            fonts.select_named_face(&mut s);
+            drawn_style(&mut s);
+            s
+        })
+        .collect()
+}
+
+/// A style naming a PostScript face the family doesn't carry takes the family the face resolves to.
+fn adopt_postscript_face(fonts: &mut FontDb, s: &mut CharStyle) {
+    let Some(ps) = s.postscript_name.clone() else {
+        return;
+    };
+    if fonts.faces(&s.font_family).iter().any(|f| f.postscript_name.as_deref() == Some(&ps)) {
+        return;
+    }
+    let f = fonts.resolve_postscript(&ps);
+    // An exact face match wins; a guessed family only fills a missing family.
+    if f.exact || (!fonts.has_family(&s.font_family) && fonts.has_family(&f.family)) {
+        s.font_family = f.family;
+        s.weight = f.weight;
+        s.italic = f.italic;
+    }
+}
+
+/// Start offset of each item, given the items' lengths.
+pub(super) fn running_starts(lens: impl Iterator<Item = usize>) -> Vec<usize> {
+    lens.scan(0, |a, len| {
+        let s = *a;
+        *a += len;
+        Some(s)
+    })
+    .collect()
+}
+
+/// How each style sets small caps. Fixed for the whole layout, and the font probe only matters for
+/// styles that use small caps. A real `smcp` substitution must receive lowercase source text; only
+/// the fallback path uppercases it and scales it down.
+pub(super) fn small_caps_modes(fonts: &mut FontDb, styles: &[CharStyle]) -> Vec<SmallCapsMode> {
+    styles
+        .iter()
+        .map(|style| match style.caps {
+            photocraft_doc::text::Caps::SmallCaps => small_caps_mode(style.caps, probe_smcp(fonts, style)),
+            _ => SmallCapsMode::None,
+        })
+        .collect()
+}
+
+/// The text handed to the shaper for one paragraph.
+struct ParaText {
+    ptext: String,
+    /// Ranges in `ptext` for lowercase characters rendered as synthetic small caps. They have the
+    /// same UTF-8 length as their uppercase form, so the layer's byte-based run and caret offsets
+    /// remain unchanged.
+    synthetic_small_caps: Vec<(Range<usize>, f32)>,
+    /// Offsets in `ptext` of the spaces standing in for tabs.
+    tabs: Vec<usize>,
+}
+
+/// The shaped text of the paragraph at `range` (`content_end` excludes its break), led by `prefix`.
+fn paragraph_text(env: &Env<'_>, prefix: &str, range: &Range<usize>, content_end: usize) -> ParaText {
+    let content = &env.text[range.start..content_end];
+    let mut ptext = String::with_capacity(prefix.len() + content.len());
+    ptext.push_str(prefix);
+    let mut synthetic_small_caps = Vec::new();
+    let mut tabs = Vec::new();
+    for (i, ch) in content.char_indices() {
+        // A forced line break ends the line but not the paragraph. The line breaker knows
+        // it as a newline, which has the same length, so text offsets don't move.
+        if ch == FORCED_LINE_BREAK {
+            ptext.push('\n');
+            continue;
+        }
+        // Imported PSD text can contain literal tab controls. Font shaping may
+        // render those as .notdef boxes; a space preserves the one-byte source
+        // and style/caret offsets while supplying a real whitespace advance. The space
+        // is widened to its tab stop after line breaking (`tab_px`).
+        if ch == '\t' {
+            tabs.push(ptext.len());
+            ptext.push(' ');
+            continue;
+        }
+        let si = env.style_at(range.start + i);
+        let synthetic = env.small_caps[si] == SmallCapsMode::Synthetic;
+        push_cased(&mut ptext, &mut synthetic_small_caps, ch, &env.styles[si], synthetic, env.k);
+    }
+    ParaText { ptext, synthetic_small_caps, tabs }
+}
+
+/// Appends `ch` as its style sets it: uppercased for all caps and synthetic small caps (when the
+/// uppercase form has the same length, so offsets don't move), recording small-cap pieces.
+fn push_cased(ptext: &mut String, small_caps: &mut Vec<(Range<usize>, f32)>, ch: char, style: &CharStyle, synthetic: bool, k: f32) {
+    let caps = style.caps;
+    if caps == photocraft_doc::text::Caps::AllCaps || synthetic {
+        let up: String = ch.to_uppercase().collect();
+        if up.len() == ch.len_utf8() {
+            ptext.push_str(&up);
+            if caps == photocraft_doc::text::Caps::SmallCaps && ch.is_lowercase() {
+                let end = ptext.len();
+                small_caps.push((end - up.len()..end, style.size_pt * k * SYNTHETIC_SMALL_CAPS_SCALE));
+            }
+            return;
+        }
+    }
+    ptext.push(ch);
+}
+
+/// One run piece of vertical type, whose upright stretches get the vertical alternates and their
+/// class in the brush.
+struct VerticalPiece<'a> {
+    style: &'a CharStyle,
+    run: usize,
+    small_caps: SmallCapsMode,
+    /// Offset of the piece in the paragraph text.
+    start: usize,
+}
+
+impl VerticalPiece<'_> {
+    fn push_upright(&self, b: &mut parley::RangedBuilder<'_, RunBrush>, from: usize, to: usize, cls: VClass) {
+        if cls == VClass::Rotate || from >= to {
+            return;
+        }
+        let mut feats = feature_list(self.style, self.small_caps);
+        feats.push("\"vert\" 1".into());
+        let r = (self.start + from)..(self.start + to);
+        b.push(StyleProperty::FontFeatures(FontFeatures::Source(Cow::Owned(feats.join(", ")))), r.clone());
+        b.push(StyleProperty::Brush(RunBrush(self.run as u32, cls as u8)), r);
+    }
+
+    /// Splits `piece` into stretches of one vertical class and styles each.
+    fn push_all(&self, b: &mut parley::RangedBuilder<'_, RunBrush>, piece: &str) {
+        let mut seg: Option<(usize, VClass)> = None;
+        for (i, ch) in piece.char_indices() {
+            let cls = vertical_class(ch);
+            match seg {
+                Some((_, c)) if c == cls => {}
+                Some((from, c)) => {
+                    self.push_upright(b, from, i, c);
+                    seg = Some((i, cls));
+                }
+                None => seg = Some((i, cls)),
+            }
+        }
+        if let Some((from, c)) = seg {
+            self.push_upright(b, from, piece.len(), c);
+        }
+    }
+}
+
+/// What line placement needs of one paragraph: its text, styles, indents and the extents its lines
+/// break at.
+pub(super) struct Para<'a> {
+    pub(super) env: &'a Env<'a>,
+    pub(super) index: usize,
+    pub(super) ps: ParagraphStyle,
+    pub(super) start: usize,
+    pub(super) content_end: usize,
+    pub(super) prefix: &'static str,
+    ptext: String,
+    synthetic_small_caps: Vec<(Range<usize>, f32)>,
+    /// Offsets in the paragraph text of the spaces standing in for tabs.
+    pub(super) tabs: Vec<usize>,
+    /// Runs intersecting the paragraph: `si0..si_end`.
+    si0: usize,
+    si_end: usize,
+    fallback: Vec<String>,
+    pub(super) indent_start: f32,
+    indent_end: f32,
+    pub(super) first_indent: f32,
+    /// Box extent along the lines: where they start.
+    pub(super) line_origin: f32,
+    /// Box extent along the lines, less the indents; `None` for point text.
+    pub(super) avail: Option<f32>,
+    pub(super) break_scale: f32,
+    pub(super) tab_px: f32,
+    /// Line-breaking passes left for this paragraph's area type (see `break_area`).
+    area_budget: Cell<usize>,
+}
+
+impl<'a> Para<'a> {
+    pub(super) fn new(env: &'a Env<'a>, fonts: &FontDb, index: usize, range: Range<usize>, ps: ParagraphStyle) -> Self {
+        let k = env.k;
+        let content_end = strip_break(env.text, &range);
+        let prefix = match ps.direction {
+            TextDirection::Auto => "",
+            TextDirection::Ltr => LRM,
+            TextDirection::Rtl => RLM,
+        };
+        let ParaText { ptext, synthetic_small_caps, tabs } = paragraph_text(env, prefix, &range, content_end);
+        // Scripts the loaded fonts may lack (Arabic, Japanese, …): a host serving a font for them
+        // fetches it (`served`); it joins the fallback stack once it arrives.
+        crate::served::request_for_text(&ptext);
+        let fallback = fonts.fallback_stack().map(str::to_string).collect();
+        let si0 = env.style_at(range.start);
+        let si_end = env.run_starts.partition_point(|&rs| rs < content_end).max(si0 + 1).min(env.styles.len());
+        let indent_start = ps.start_indent_pt * k;
+        let indent_end = ps.end_indent_pt * k;
+        let first_indent = ps.first_line_indent_pt * k;
+        // Box extent along the lines: width, or height for vertical type (columns).
+        let (box_x, box_y, box_w, box_h) = env.box_rect;
+        let (line_origin, line_len) = if env.vertical { (box_y, box_h) } else { (box_x, box_w) };
+        let avail = if env.is_box { Some((line_len - indent_start - indent_end).max(1.0)) } else { None };
+        let mut para = Self {
+            env,
+            index,
+            ps,
+            start: range.start,
+            content_end,
+            prefix,
+            ptext,
+            synthetic_small_caps,
+            tabs,
+            si0,
+            si_end,
+            fallback,
+            indent_start,
+            indent_end,
+            first_indent,
+            line_origin,
+            avail,
+            break_scale: 1.0,
+            tab_px: DEFAULT_TAB_STOP_PT * k,
+            area_budget: Cell::new(MAX_AREA_PASSES),
+        };
+        para.break_scale = para.horizontal_break_scale();
+        para
+    }
+
+    pub(super) fn first_style(&self) -> &'a CharStyle {
+        &self.env.styles[self.si0]
+    }
+
+    /// Text offset of the paragraph text's byte `o`, as the layer's text offset.
+    pub(super) fn map_offset(&self, o: usize) -> usize {
+        (self.start + o.saturating_sub(self.prefix.len())).min(self.content_end)
+    }
+
+    /// The paragraph text up to the end of the run piece at text range `range`.
+    pub(super) fn text_of(&self, range: Range<usize>) -> &str {
+        self.ptext.get(range).unwrap_or("")
+    }
+
+    /// Horizontal scale is applied after shaping, so paragraph text breaks at the box (or area span)
+    /// width divided by it (#5565). Mixed scales break at the largest, so no line overflows the box.
+    fn horizontal_break_scale(&self) -> f32 {
+        let env = self.env;
+        if !env.wraps {
+            return 1.0;
+        }
+        let scale = (self.si0..self.si_end)
+            .filter(|&ri| {
+                let rs = env.run_starts.get(ri).copied().unwrap_or(0);
+                let end = rs.saturating_add(env.runs.get(ri).map_or(0, |r| r.len));
+                ri == self.si0 || (rs.max(self.start) < end.min(self.content_end))
+            })
+            .filter_map(|ri| env.styles.get(ri))
+            .map(effective_horizontal_scale)
+            .fold(0.0f32, f32::max);
+        if scale > 0.0 { scale } else { 1.0 }
+    }
+
+    /// Shapes the paragraph, each tab widened by its letter spacing in `tab_spacing` (px).
+    fn shape(&self, lcx: &mut LayoutContext<RunBrush>, fcx: &mut parley::FontContext, tab_spacing: &[f32]) -> Layout<RunBrush> {
+        let env = self.env;
+        let mut b = lcx.ranged_builder(fcx, &self.ptext, 1.0, false);
+        // Paragraph-start style as the default (covers the direction mark and empty
+        // paragraphs), then every run piece intersecting this paragraph.
+        for p in style_props(&env.styles[self.si0], env.k, &self.fallback, self.si0 as u32, env.small_caps[self.si0]) {
+            b.push_default(p);
+        }
+        // Paragraph text breaks a word wider than the box at the box edge, as Photoshop
+        // does (#6694): parley's default only breaks at UAX #14 opportunities and lets the
+        // word run out of the box. Point text has no width to overflow.
+        if env.is_box {
+            b.push_default(StyleProperty::OverflowWrap(parley::style::OverflowWrap::BreakWord));
+        }
+        for ri in self.si0..self.si_end {
+            self.push_run_piece(&mut b, ri);
+        }
+        for (range, size) in &self.synthetic_small_caps {
+            b.push(StyleProperty::FontSize(*size), range.clone());
+        }
+        // Korean breaks lines at spaces, between words, as Photoshop sets it; Unicode's
+        // default rules break between any two Hangul syllables, mid-word (#5959).
+        for range in hangul_runs(&self.ptext) {
+            b.push(StyleProperty::WordBreak(parley::WordBreak::KeepAll), range);
+        }
+        for (&at, &spacing) in self.tabs.iter().zip(tab_spacing) {
+            b.push(StyleProperty::LetterSpacing(spacing), at..at + 1);
+        }
+        b.build(&self.ptext)
+    }
+
+    /// Styles the part of run `ri` inside this paragraph.
+    fn push_run_piece(&self, b: &mut parley::RangedBuilder<'_, RunBrush>, ri: usize) {
+        let env = self.env;
+        let rs = env.run_starts[ri];
+        let (a, z) = (rs.max(self.start), (rs + env.runs[ri].len).min(self.content_end));
+        if a >= z {
+            return;
+        }
+        let range = (a - self.start + self.prefix.len())..(z - self.start + self.prefix.len());
+        for p in style_props(&env.styles[ri], env.k, &self.fallback, ri as u32, env.small_caps[ri]) {
+            b.push(p, range.clone());
+        }
+        if env.vertical {
+            let piece = VerticalPiece { style: &env.styles[ri], run: ri, small_caps: env.small_caps[ri], start: range.start };
+            piece.push_all(b, self.text_of(range));
+        }
+    }
+
+    /// Where an area paragraph's first row goes: no higher than one leading (plus paragraph
+    /// spacing) below the previous paragraph's last line.
+    fn area_origin(&self, m: LineMetrics, flow: &Flow) -> f32 {
+        let space_before = if flow.prev_baseline.is_some() { self.ps.space_before_pt * self.env.k } else { 0.0 };
+        match (&self.env.area, flow.prev_baseline) {
+            (Some(_), Some(b)) => b + m.leading + flow.pending_space + space_before,
+            (Some(a), None) => a.bounds[1] + m.ascent,
+            (None, _) => 0.0,
+        }
+    }
+
+    /// Breaks `layout` into lines; for area type also returns each line's slot and whether the
+    /// shape ran full.
+    fn break_lines(&self, layout: &mut Layout<RunBrush>, flow: &Flow) -> (Vec<Slot>, bool) {
+        let env = self.env;
+        if self.first_indent != 0.0 {
+            layout.set_text_indent(self.first_indent / self.break_scale, parley::IndentOptions::default());
+        }
+        let Some(a) = &env.area else {
+            layout.break_all_lines(self.avail.map(|a| a / self.break_scale));
+            return (Vec::new(), false);
+        };
+        // Plan every row with the paragraph's real line metrics (its tallest font and
+        // largest leading, measured on the unwrapped paragraph), so no wrapped line comes
+        // out taller than the row it was planned in and no second plan is needed.
+        layout.break_all_lines(None);
+        let m = area_metrics(layout, env.styles, &self.ps, env.k, self.first_style(), env.vertical);
+        let from = self.area_origin(m, flow);
+        let first_px = self.first_style().size_pt * env.k;
+        break_area(layout, a, from, m, (self.indent_start, self.indent_end), first_px, self.break_scale, &self.area_budget)
+    }
+
+    /// The widths of the tabs on the broken lines of `layout`.
+    fn tab_widths(&self, layout: &Layout<RunBrush>) -> Vec<TabWidth> {
+        tab_widths(layout, &self.tabs, self.env.styles, self.indent_start, self.first_indent, self.tab_px)
+    }
+
+    /// Shapes and breaks the paragraph into lines (and area slots).
+    ///
+    /// A tab is never wider than a space plus one tab interval, so breaking lines at that width
+    /// keeps the expanded tabs inside the box, but can wrap early. Break again with the tab widths
+    /// that layout gives until they agree; if they don't settle, keep the safe layout.
+    pub(super) fn break_paragraph(&self, lcx: &mut LayoutContext<RunBrush>, fcx: &mut parley::FontContext, flow: &Flow) -> (Layout<RunBrush>, Vec<Slot>, bool) {
+        let wide = if self.env.wraps { self.tab_px } else { 0.0 };
+        let mut layout = self.shape(lcx, fcx, &vec![wide; self.tabs.len()]);
+        let (mut slots, mut full) = self.break_lines(&mut layout, flow);
+        if self.env.wraps
+            && !self.tabs.is_empty()
+            && let Some((settled, settled_slots, settled_full)) = self.settle_tabs(lcx, fcx, &layout, flow)
+        {
+            layout = settled;
+            slots = settled_slots;
+            full = settled_full;
+        }
+        (layout, slots, full)
+    }
+
+    /// Re-breaks until the tab widths the layout gives agree with the ones it was shaped for.
+    fn settle_tabs(
+        &self,
+        lcx: &mut LayoutContext<RunBrush>,
+        fcx: &mut parley::FontContext,
+        layout: &Layout<RunBrush>,
+        flow: &Flow,
+    ) -> Option<(Layout<RunBrush>, Vec<Slot>, bool)> {
+        let first = self.tab_widths(layout);
+        let mut want: Vec<f32> = first.iter().map(|t| t.width).collect();
+        for _ in 0..4 {
+            let spacing: Vec<f32> = first.iter().zip(&want).map(|(t, w)| w / t.scale - (t.advance - self.tab_px)).collect();
+            let mut next = self.shape(lcx, fcx, &spacing);
+            let (next_slots, next_full) = self.break_lines(&mut next, flow);
+            let got: Vec<f32> = self.tab_widths(&next).iter().map(|t| t.width).collect();
+            if got.iter().zip(&want).all(|(a, b)| (a - b).abs() < 0.01) {
+                return Some((next, next_slots, next_full));
+            }
+            want = got;
+        }
+        None
+    }
+
+    /// How parley aligns the paragraph's lines.
+    pub(super) fn alignment(&self) -> Alignment {
+        if !self.env.wraps {
+            return Alignment::Left;
+        }
+        match self.ps.align {
+            TextAlign::Left => Alignment::Left,
+            TextAlign::Center => Alignment::Center,
+            TextAlign::Right => Alignment::Right,
+            _ => Alignment::Justify,
+        }
+    }
+
+    pub(super) fn align_options(&self) -> AlignmentOptions {
+        AlignmentOptions { align_when_overflowing: !self.env.wraps }
+    }
+}
diff --git a/crates/text/src/layout/style.rs b/crates/text/src/layout/style.rs
index fc5b775a7d..e4edac49ae 100644
--- a/crates/text/src/layout/style.rs
+++ b/crates/text/src/layout/style.rs
@@ -1,5 +1,8 @@
 use super::paragraphs::quote;
-use super::*;
+use super::{
+    Caps, CharStyle, ClusterInfo, Cow, FontBaseline, FontDb, FontFamily, FontFeatures, FontStyle, FontVariations, FontWeight, Kerning, PlacedGlyph, RunBrush,
+    StyleProperty, Tag,
+};
 
 /// Photoshop synthesizes small caps for faces without an OpenType `smcp` table. Keep the same
 /// readable hierarchy for every font instead of silently rendering lowercase text unchanged.
diff --git a/crates/text/src/layout/vertical.rs b/crates/text/src/layout/vertical.rs
index beabcfbf05..31d21f3d32 100644
--- a/crates/text/src/layout/vertical.rs
+++ b/crates/text/src/layout/vertical.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::FontData;
 
 /// How a character is set in vertical type (a simplification of Unicode's
 /// `Vertical_Orientation`, UAX #50).
diff --git a/crates/text/src/lib.rs b/crates/text/src/lib.rs
index a19588439f..4a4219e143 100644
--- a/crates/text/src/lib.rs
+++ b/crates/text/src/lib.rs
@@ -20,7 +20,9 @@
 pub mod area;
 pub mod cjk;
 pub mod craft_fonts;
+mod embolden;
 pub mod engine_data;
+pub mod font_class;
 pub mod fonts;
 pub mod glyphs;
 pub mod layout;
@@ -39,6 +41,7 @@ use photocraft_color::PixelFormat;
 use photocraft_doc::TextLayer;
 
 pub use craft_fonts::{CRAFT_FONTS, CraftFont};
+pub use font_class::{FamilyTraits, FontClass, FontFormat};
 pub use fonts::{FaceInfo, FontDb, ResolvedFont};
 pub use layout::{
     ClusterInfo, LineInfo, PlacedGlyph, TextLayout, byte_index, char_index, hit_char, line_edge, line_index, line_step, text_point_inside, word_boundary,
diff --git a/crates/text/src/psd/build.rs b/crates/text/src/psd/build.rs
index ced4664fc3..c92a3cffea 100644
--- a/crates/text/src/psd/build.rs
+++ b/crates/text/src/psd/build.rs
@@ -1,6 +1,9 @@
 use super::edit::{TEMPLATE_NODES, edited_object, fits, is_stub, names_one_frame, new_object, pad_frames, td_edited_object, with_modes};
 use super::import::{OPENTYPE_KEYS, TXT2_FEATURES, TXT2_STYLISTIC_SETS, kern_units, manual, object_frame, pair_runs, parse_txt2, postscript_for, real};
-use super::*;
+use super::{
+    AntiAlias, Caps, CharStyle, Color, ColorMode, D, Descriptor, E, FontBaseline, Id, Kerning, Orientation, ParagraphStyle, TextAlign, TextLayer, TextShape,
+    TySh, UnicodeString, ed, engine_data, enum_value, enumv, parse_tysh, write_tysh,
+};
 
 /// A fill colour as EngineData and `Txt2` store it: the colour type (0 gray, 1 RGB, 2 CMYK) and
 /// its values, alpha first.
diff --git a/crates/text/src/psd/edit.rs b/crates/text/src/psd/edit.rs
index 8bd9129439..ba08ab1e79 100644
--- a/crates/text/src/psd/edit.rs
+++ b/crates/text/src/psd/edit.rs
@@ -1,6 +1,6 @@
 use super::build::{MAX_TEXT_INDEX, utf16_len};
 use super::import::parse_txt2;
-use super::*;
+use super::{D, E, Id, parse_tysh, write_tysh};
 
 /// The most values a `Txt2` object may hold to serve as the template for new objects. Photoshop's
 /// own objects hold a few hundred (611 at most in the file from #7698).
diff --git a/crates/text/src/psd/import.rs b/crates/text/src/psd/import.rs
index c23ea365ac..e29ec75fb6 100644
--- a/crates/text/src/psd/import.rs
+++ b/crates/text/src/psd/import.rs
@@ -1,5 +1,8 @@
 use super::build::engine_antialias;
-use super::*;
+use super::{
+    Affine, AntiAlias, Caps, CharStyle, Color, ColorMode, D, Descriptor, E, FontBaseline, Kerning, Orientation, ParagraphRun, ParagraphStyle, Point, TextAlign,
+    TextLayer, TextRun, TextShape, TextWarp, TySh, dnum, ed, engine_data, enum_value, guess_from_postscript, parse_tysh,
+};
 
 /// Parses the document's `Txt2` block (Photoshop's text engine data for all type layers).
 pub fn parse_txt2(data: &[u8]) -> Option<E> {
diff --git a/crates/text/src/render.rs b/crates/text/src/render.rs
index c7cd3960b4..dacd120dcd 100644
--- a/crates/text/src/render.rs
+++ b/crates/text/src/render.rs
@@ -17,24 +17,25 @@ use rayon::prelude::*;
 
 /// Faux-italic slant in degrees (Photoshop-like).
 pub const FAUX_ITALIC_DEG: f32 = 12.0;
-/// Faux-bold ring radius as a fraction of the font size (tuned so stem weight stays close to the old summed-coverage look).
+/// How far faux bold grows the outline on every side, as a fraction of the font size
+/// ([`crate::embolden`]): stems get twice this heavier, close to the weight of the earlier
+/// faux bold, which stamped the glyph at offsets of this radius.
 pub const FAUX_BOLD_RADIUS: f32 = 0.036;
 /// Largest raster we produce (pixels), as a guard against absurd sizes.
 const MAX_PIXELS: u64 = 256 * 1024 * 1024;
-/// Cumulative coverage-pixel work budget across all colour and faux-bold passes of one render.
+/// Cumulative coverage-pixel work budget across the colour passes of one render.
 const MAX_PASS_PIXELS: u64 = MAX_PIXELS * 4;
 /// Peak working bytes one rasterization may keep live. [`MAX_PIXELS`] does not bound them: the
-/// accumulator and the output surface are both `stride` deep, and a faux-bold pass keeps one more
-/// coverage buffer live, so a CMYK bold render reserves several times what a plain grey one does
-/// for the same pixels.
+/// accumulator and the output surface are both `stride` deep, so a CMYK render reserves several
+/// times what a plain grey one does for the same pixels.
 const MAX_RASTER_BYTES: u64 = if cfg!(target_pointer_width = "64") { 4 << 30 } else { 1 << 30 };
 
 /// Whether a `w` x `h` render's peak working bytes fit `max_bytes`: the f32 accumulator and the
-/// output surface (both `stride` deep), plus the coverage buffers live at the peak. A plain pass
-/// peaks inside `Coverage::finish`, which holds its accumulator and the vector it builds beside
-/// it; a faux-bold pass peaks one buffer higher, since the resolved plain coverage is kept while
-/// the bold pass resolves into it. `false` when the arithmetic overflows, so an absurd size is
-/// refused rather than wrapping.
+/// output surface (both `stride` deep), plus the coverage buffers live at the peak. A pass peaks
+/// inside `Coverage::finish`, which holds its accumulator and the vector it builds beside it.
+/// Faux bold draws its thickened outlines in that same pass; a `bold` render is still budgeted
+/// one buffer higher, as when it was stamped into a buffer of its own, which leaves it headroom.
+/// `false` when the arithmetic overflows, so an absurd size is refused rather than wrapping.
 fn fits_raster_budget(w: usize, h: usize, stride: usize, sample: SampleType, bold: bool, max_bytes: u64) -> bool {
     let f32s = size_of::<f32>() as u64;
     let peak = (w as u64).checked_mul(h as u64).and_then(|px| {
@@ -110,28 +111,6 @@ impl<S: LineSink> LineSink for WarpSink<'_, S> {
     }
 }
 
-/// Draws every glyph and decoration of `layout` whose style colour is `color` (or all of them
-/// when `color` is `None`) into `sink`, through `transform` (text space → sink space), bending
-/// the outlines with `warp` first (in text space).
-fn draw(layout: &TextLayout, transform: &Xform, sink: &mut impl LineSink, only_color: Option<&Color>, warp: Option<&Warp>) {
-    draw_pass(layout, transform, sink, only_color, warp, Pass::All);
-}
-
-/// Which part of the layout [`draw_pass`] emits. Faux bold draws each glyph at several offsets;
-/// summing those into one coverage buffer saturates the antialiased edge pixels (hard, pixelated
-/// stems), so the rasteriser draws every offset into its own buffer and merges them with `max`.
-#[derive(Clone, Copy, PartialEq)]
-enum Pass {
-    /// Everything, all offsets (bounds, outlines).
-    All,
-    /// Non-bold glyphs and decorations.
-    Plain,
-    /// Bold glyphs at one offset (index into [`BOLD_OFFSETS`]).
-    Bold(usize),
-}
-
-const BOLD_OFFSETS: [(f64, f64); 8] = [(-1.0, 0.0), (1.0, 0.0), (0.0, -1.0), (0.0, 1.0), (0.7, 0.7), (-0.7, -0.7), (0.7, -0.7), (-0.7, 0.7)];
-
 fn is_bold(layout: &TextLayout, g: &PlacedGlyph) -> bool {
     let face_bold = layout.faces.get(g.face as usize).is_some_and(|f| f.embolden);
     layout.styles.get(g.style as usize).is_some_and(|s| s.faux_bold) || face_bold
@@ -185,7 +164,11 @@ fn visible_color_passes(layout: &TextLayout, warp: Option<&Warp>) -> Vec<(Color,
     colors
 }
 
-fn draw_pass(layout: &TextLayout, transform: &Xform, sink: &mut impl LineSink, only_color: Option<&Color>, warp: Option<&Warp>, pass: Pass) {
+/// Draws every glyph and decoration of `layout` whose style colour is `color` (or all of them
+/// when `color` is `None`) into `sink`, through `transform` (text space → sink space), bending
+/// the outlines with `warp` first (in text space). Faux bold glyphs are drawn from their outline
+/// thickened by [`FAUX_BOLD_RADIUS`] ([`crate::embolden`]).
+fn draw(layout: &TextLayout, transform: &Xform, sink: &mut impl LineSink, only_color: Option<&Color>, warp: Option<&Warp>) {
     for g in &layout.glyphs {
         let st = &layout.styles[g.style as usize];
         if only_color.is_some_and(|c| c != &st.color) {
@@ -212,41 +195,27 @@ fn draw_pass(layout: &TextLayout, transform: &Xform, sink: &mut impl LineSink, o
                 }
             }
         }
-        let bold = st.faux_bold || face.embolden;
-        let r = (face.size_px * FAUX_BOLD_RADIUS) as f64;
-        let single = [(0.0, 0.0)];
-        let offsets: &[(f64, f64)] = match (pass, bold) {
-            (Pass::Plain, true) => continue,
-            (Pass::Bold(_), false) => continue,
-            (Pass::Bold(k), true) => match BOLD_OFFSETS.get(k..=k) {
-                Some(o) => o,
-                None => continue,
-            },
-            (Pass::All, true) => &BOLD_OFFSETS,
-            (_, false) => &single,
-        };
-        for &(ox, oy) in offsets {
-            let local = glyph.mul(&Xform([1.0, 0.0, 0.0, 1.0, ox * r, oy * r]));
-            let settings = DrawSettings::unhinted(Size::new(face.size_px), LocationRef::new(&coords));
-            match bend {
-                Some(w) => {
-                    let mut ws = WarpSink { inner: &mut *sink, warp: w, post: *transform };
-                    let mut pen = Pen::new(&mut ws, local);
-                    if outline.draw(settings, &mut pen).is_ok() {
-                        skrifa::outline::OutlinePen::close(&mut pen);
-                    }
-                }
-                None => {
-                    let mut pen = Pen::new(&mut *sink, transform.mul(&local));
-                    if outline.draw(settings, &mut pen).is_ok() {
-                        skrifa::outline::OutlinePen::close(&mut pen);
-                    }
-                }
+        let settings = || DrawSettings::unhinted(Size::new(face.size_px), LocationRef::new(&coords));
+        // Faux bold thickens the outline in font units, before faux italic and scaling, so the
+        // slant and proportions apply to the bold shape as they do to a real bold face. Other
+        // glyphs draw straight into the pen.
+        let mut bold = None;
+        if st.faux_bold || face.embolden {
+            let mut shape = crate::embolden::Outline::default();
+            if outline.draw(settings(), &mut shape).is_err() {
+                continue;
             }
+            shape.embolden(f64::from(face.size_px * FAUX_BOLD_RADIUS));
+            bold = Some(shape);
+        }
+        let settings = settings();
+        match bend {
+            Some(w) => {
+                let mut ws = WarpSink { inner: &mut *sink, warp: w, post: *transform };
+                draw_glyph(&outline, settings, bold.as_ref(), &mut Pen::new(&mut ws, glyph));
+            }
+            None => draw_glyph(&outline, settings, bold.as_ref(), &mut Pen::new(&mut *sink, transform.mul(&glyph))),
         }
-    }
-    if matches!(pass, Pass::Bold(_)) {
-        return;
     }
     for d in &layout.decorations {
         let st = &layout.styles[d.style as usize];
@@ -263,6 +232,23 @@ fn draw_pass(layout: &TextLayout, transform: &Xform, sink: &mut impl LineSink, o
     }
 }
 
+/// One glyph into `pen`: its thickened `bold` outline when there is one, else the font's own.
+fn draw_glyph(
+    outline: &skrifa::outline::OutlineGlyph,
+    settings: DrawSettings,
+    bold: Option<&crate::embolden::Outline>,
+    pen: &mut impl skrifa::outline::OutlinePen,
+) {
+    match bold {
+        Some(shape) => shape.replay(pen),
+        None => {
+            if outline.draw(settings, &mut *pen).is_ok() {
+                pen.close();
+            }
+        }
+    }
+}
+
 /// Font units (scaled to px, y up) → text space for a placed glyph: scales, faux italic,
 /// baseline shift, and the vertical-type orientation.
 fn glyph_xform(layout: &TextLayout, g: &PlacedGlyph, face_skew_deg: f32) -> Xform {
@@ -397,13 +383,13 @@ pub(crate) fn rasterize_passes(
     let xf = Xform([1.0, 0.0, 0.0, 1.0, -rect.x0 as f64, -rect.y0 as f64]).mul(&Xform(transform.m));
     let whole = Rect::new(0, 0, w as i32, h as i32);
     let mut pass_pixels = 0u64;
-    for &(c, color_bold) in &colors {
-        // Rasterise each colour only over its own glyphs (every offset of faux bold included):
+    for &(c, _) in &colors {
+        // Rasterise each colour only over its own glyphs (faux bold's thickened outlines included):
         // a full-size pass per colour made text with many coloured runs cost colours x area
         // (#8602). Outside its ink a colour's coverage is zero, so the result is the same.
         let sub = if per_colour {
             let mut b = Bounds::default();
-            draw_pass(layout, &xf, &mut b, Some(&c), warp, Pass::All);
+            draw(layout, &xf, &mut b, Some(&c), warp);
             b.rect.map(rect_from_bounds).unwrap_or(Rect::EMPTY).intersect(&whole)
         } else {
             whole
@@ -412,8 +398,8 @@ pub(crate) fn rasterize_passes(
             continue;
         }
         let (sw, sh) = (sub.width() as usize, sub.height() as usize);
-        let passes = 1 + if color_bold { BOLD_OFFSETS.len() } else { 0 };
-        let Some(cost) = (sw as u64).checked_mul(sh as u64).and_then(|px| px.checked_mul(passes as u64)) else {
+        // One pass per colour: faux bold draws thickened outlines in it (`draw`).
+        let Some(cost) = (sw as u64).checked_mul(sh as u64) else {
             return nothing(format);
         };
         let Some(total) = pass_pixels.checked_add(cost).filter(|&t| t <= MAX_PASS_PIXELS) else {
@@ -424,24 +410,10 @@ pub(crate) fn rasterize_passes(
         let Some(mut cov) = Coverage::try_new(sw, sh) else {
             return nothing(format);
         };
-        draw_pass(layout, &xf, &mut cov, Some(&c), warp, Pass::Plain);
-        let Some(mut cov) = cov.finish() else {
+        draw(layout, &xf, &mut cov, Some(&c), warp);
+        let Some(cov) = cov.finish() else {
             return nothing(format);
         };
-        if color_bold {
-            for k in 0..BOLD_OFFSETS.len() {
-                let Some(mut bc) = Coverage::try_new(sw, sh) else {
-                    return nothing(format);
-                };
-                draw_pass(layout, &xf, &mut bc, Some(&c), warp, Pass::Bold(k));
-                let Some(bold_cov) = bc.finish() else {
-                    return nothing(format);
-                };
-                for (a, b) in cov.iter_mut().zip(bold_cov) {
-                    *a = a.max(b);
-                }
-            }
-        }
         let comps = color_in(&format, &c);
         let a = c.alpha.clamp(0.0, 1.0);
         composite(&mut acc, w, sub, &cov, stride, &comps, a, antialias);
diff --git a/crates/text/src/tests.rs b/crates/text/src/tests.rs
index 0489f83c82..b63a45b4ae 100644
--- a/crates/text/src/tests.rs
+++ b/crates/text/src/tests.rs
@@ -2663,6 +2663,53 @@ fn hyphenless_postscript_names_split_trailing_styles() {
     }
 }
 
+/// Thickening moves each outline point along its bisector; this guards that curves stay as smooth
+/// as the regular glyph's at a large size (the bend of a bold "O"'s edge between rows matches the
+/// regular one's). See also `faux_bold_keeps_square_corners_square`.
+#[test]
+fn faux_bold_curves_stay_smooth_at_large_sizes() {
+    let mut e = TextEngine::new();
+    // The largest bend of the left edge between consecutive rows, in pixels (second difference
+    // of its sub-pixel position), over the middle of the glyph's height.
+    let bumpiness = |e: &mut TextEngine, bold: bool| -> f64 {
+        let style = CharStyle { size_pt: 600.0, faux_bold: bold, ..Default::default() };
+        let (_, r) = e.render(&TextLayer { transform: Affine::translate(60.0, 640.0), ..styled("O", style) }, 72.0, PixelFormat::RGBA8);
+        let alpha = |x: i32, y: i32| alpha_sum(&r.surface, photocraft_geom::Rect::new(x, y, x + 1, y + 1));
+        let h = r.rect.height() as i32;
+        let mut edges = Vec::new();
+        for y in (r.rect.y0 + h * 15 / 100)..(r.rect.y0 + h * 85 / 100) {
+            if let Some(x) = (r.rect.x0..r.rect.x1).find(|&x| alpha(x, y) > 0.01) {
+                edges.push(f64::from(x) + 1.0 - alpha(x, y));
+            }
+        }
+        edges.windows(3).map(|w| (w[2] - 2.0 * w[1] + w[0]).abs()).fold(0.0, f64::max)
+    };
+    let plain = bumpiness(&mut e, false);
+    let bold = bumpiness(&mut e, true);
+    eprintln!("bumpiness plain {plain} bold {bold}");
+    assert!(bold < plain + 0.5, "faux bold's edge is notched: bends {bold} px vs {plain} px regular");
+}
+
+/// The notches showed most at corners and stroke ends: eight stamped copies leave a stepped bite
+/// out of a square corner. Thickened outlines keep corners square, as a bold "l" shows.
+#[test]
+fn faux_bold_keeps_square_corners_square() {
+    let mut e = TextEngine::new();
+    for bold in [false, true] {
+        let style = CharStyle { size_pt: 600.0, faux_bold: bold, ..Default::default() };
+        let (_, r) = e.render(&TextLayer { transform: Affine::translate(60.0, 640.0), ..styled("l", style) }, 72.0, PixelFormat::RGBA8);
+        let alpha = |x: i32, y: i32| alpha_sum(&r.surface, photocraft_geom::Rect::new(x, y, x + 1, y + 1));
+        // The ink's own top-left and top-right corners (the raster rect pads the ink by a pixel).
+        let top = (r.rect.y0..r.rect.y1).find(|&y| (r.rect.x0..r.rect.x1).any(|x| alpha(x, y) > 0.5)).unwrap();
+        let left = (r.rect.x0..r.rect.x1).find(|&x| (r.rect.y0..r.rect.y1).any(|y| alpha(x, y) > 0.5)).unwrap();
+        let right = (r.rect.x0..r.rect.x1).rev().find(|&x| (r.rect.y0..r.rect.y1).any(|y| alpha(x, y) > 0.5)).unwrap();
+        for (x, corner) in [(left + 1, "top-left"), (right - 1, "top-right")] {
+            let a = alpha(x, top + 1);
+            assert!(a > 0.9, "bold {bold}: the {corner} corner is cut away (alpha {a})");
+        }
+    }
+}
+
 #[test]
 fn text_rebuild_preserves_imported_font_metadata() {
     use crate::engine_data::Value as E;
diff --git a/crates/ui-egui/examples/huge_doc_bench.rs b/crates/ui-egui/examples/huge_doc_bench.rs
index f1d78668d5..180cdfa8fc 100644
--- a/crates/ui-egui/examples/huge_doc_bench.rs
+++ b/crates/ui-egui/examples/huge_doc_bench.rs
@@ -175,7 +175,7 @@ fn refresh(g: &GpuCanvas, rs: &RenderState, doc: &Document, damage: Option<Rect>
     let r = g.refresh(doc.id.0, doc, damage, None);
     let _ = rs.device.poll(eframe::wgpu::PollType::Wait { submission_index: None, timeout: None });
     let kind = if r.kind.starts_with("gpu") { format!("{}, {} tiles up", r.kind, r.uploads) } else { r.kind.to_string() };
-    (kind, r.fallback)
+    (kind, r.fallback.map(|f| f.to_string()))
 }
 
 fn main() {
diff --git a/crates/ui-egui/examples/perf_scenarios.rs b/crates/ui-egui/examples/perf_scenarios.rs
index 2e4d79a56c..4ea1c1e87b 100644
--- a/crates/ui-egui/examples/perf_scenarios.rs
+++ b/crates/ui-egui/examples/perf_scenarios.rs
@@ -256,6 +256,9 @@ struct Sizes {
     a4: (u32, u32),
     /// A new 10 × 5 m document at 200 ppi (3.1 GP, #4017).
     huge_new: (u32, u32),
+    /// A huge document with one painted layer, refreshed zoomed out (#1015, #9330). The row name
+    /// leaves out the size because `--quick` uses a smaller one.
+    huge_doc: (u32, u32),
 }
 
 const FULL: Sizes = Sizes {
@@ -269,6 +272,7 @@ const FULL: Sizes = Sizes {
     big_photo: (6000, 4000),
     a4: (2480, 3508),
     huge_new: (78_740, 39_370),
+    huge_doc: (30_000, 30_000),
 };
 
 const QUICK: Sizes = Sizes {
@@ -282,6 +286,7 @@ const QUICK: Sizes = Sizes {
     big_photo: (1600, 1066),
     a4: (1240, 1754),
     huge_new: (20_000, 10_000),
+    huge_doc: (8_000, 8_000),
 };
 
 /// The layered document of #209: a background, six pixel layers with a drop shadow and a stroke,
@@ -339,6 +344,11 @@ fn many_layers_doc(w: u32, h: u32, n: usize) -> Res<(Session, u64)> {
     Ok((s, mid))
 }
 
+/// The first top-level layer of the active document, other than `except`, that `want` accepts.
+fn find_layer(s: &Session, except: u64, want: impl Fn(&photocraft_doc::Layer) -> bool) -> Option<u64> {
+    s.active()?.doc.layers.iter().find(|l| l.id.0 != except && want(l)).map(|l| l.id.0)
+}
+
 fn main() {
     let args: Vec<String> = std::env::args().collect();
     let quick = args.iter().any(|a| a == "--quick");
@@ -365,13 +375,14 @@ fn main() {
     // A panic in one group (a crash the scenario found) is reported against the row that was
     // running, and the other groups still run.
     type Group = fn(&mut Bench, &Sizes);
-    let groups: [(&str, Group); 6] = [
+    let groups: [(&str, Group); 7] = [
         ("layered", layered_scenarios),
         ("many layers", many_layer_scenarios),
         ("full-canvas layers", full_canvas_layer_scenarios),
         ("bit depths", depth_scenarios),
         ("long operations", job_scenarios),
         ("algorithms", algorithm_scenarios),
+        ("huge document", huge_document_scenarios),
     ];
     let use_gpu = b.gpu.is_some();
     if let Some(wanted) = arg(&args, "--group")
@@ -477,6 +488,37 @@ fn layered_scenarios(b: &mut Bench, sz: &Sizes) {
         Ok(ms(t) + b.refresh(s, false)?)
     });
 
+    // Advanced Blending on one layer sends the whole document to the CPU compositor (#6689):
+    // opacity edits on another layer, then the knockout is cleared again.
+    let other = find_layer(&s, target, |l| matches!(l.content, photocraft_doc::LayerContent::Raster(_)) && photocraft_compose::effects::has_effects(l));
+    let adjustment = find_layer(&s, target, |l| matches!(l.content, photocraft_doc::LayerContent::Adjustment(_)));
+    match other {
+        Some(other) if exec(&mut s, "layer.layerStyle.blendingOptions", json!({"layer": other, "knockout": "shallow"})).is_ok() => {
+            let _ = b.refresh(&s, true);
+            b.time("set opacity on a layer with Advanced Blending + refresh", &mut s, reps, true, |b, s, i| {
+                let t = Instant::now();
+                exec(s, "layer.setProps", json!({"layer": target, "opacity": if i % 2 == 0 { 0.6 } else { 0.9 }}))?;
+                Ok(ms(t) + b.refresh(s, false)?)
+            });
+            let _ = exec(&mut s, "layer.layerStyle.blendingOptions", json!({"layer": other, "knockout": "none"}));
+            let _ = b.refresh(&s, true);
+        }
+        _ => b.errors.push(("set opacity on a layer with Advanced Blending + refresh".into(), "no second styled layer to knock out".into())),
+    }
+    // Hiding the Levels adjustment changes every pixel below it (#6535).
+    match adjustment {
+        Some(adj) => {
+            b.time("toggle adjustment layer visibility + refresh", &mut s, reps, true, |b, s, i| {
+                let t = Instant::now();
+                exec(s, "layer.setProps", json!({"layer": adj, "visible": i % 2 == 1}))?;
+                Ok(ms(t) + b.refresh(s, false)?)
+            });
+            let _ = exec(&mut s, "layer.setProps", json!({"layer": adj, "visible": true}));
+            let _ = exec(&mut s, "layer.select", json!({"layer": target}));
+        }
+        None => b.errors.push(("toggle adjustment layer visibility + refresh".into(), "no adjustment layer".into())),
+    }
+
     // A layer filling the canvas, with a drop shadow (#761) and without (#128): dragged, it
     // overhangs the canvas edge.
     let full = (|| -> Res<u64> {
@@ -554,7 +596,8 @@ fn layered_scenarios(b: &mut Bench, sz: &Sizes) {
 fn full_canvas_layer_scenarios(b: &mut Bench, sz: &Sizes) {
     let opacity = "opacity of a layer among many full-canvas layers + refresh";
     let hide = "hide a layer among many full-canvas layers + refresh";
-    if !b.wanted(opacity) && !b.wanted(hide) {
+    let adjust = "hide the top adjustment layer among many full-canvas layers, over the GPU budget + refresh";
+    if !b.wanted(opacity) && !b.wanted(hide) && !b.wanted(adjust) {
         return;
     }
     b.current = Some(opacity.to_string());
@@ -582,17 +625,14 @@ fn full_canvas_layer_scenarios(b: &mut Bench, sz: &Sizes) {
             return;
         }
     };
+    let mut app_budget = None;
     if let (Some((g, _)), Some(st)) = (&b.gpu, s.active()) {
         // As the app counts it (`canvas::gpu_budget`).
         let pixels = st.memory_bytes() as u64;
         let allowance = u64::from(photocraft_engine::prefs::Performance::default().memory_usage_mb) << 20;
-        g.set_memory_budget(photocraft_ui_egui::gpu_canvas::memory_budget(
-            allowance,
-            pixels,
-            photocraft_ui_egui::gpu_canvas::physical_memory(),
-            g.video_memory(),
-            0,
-        ));
+        let budget = photocraft_ui_egui::gpu_canvas::memory_budget(allowance, pixels, photocraft_ui_egui::gpu_canvas::physical_memory(), g.video_memory(), 0);
+        g.set_memory_budget(budget);
+        app_budget = Some(budget);
     }
     let _ = b.refresh(&s, true);
     let reps = b.reps;
@@ -606,6 +646,71 @@ fn full_canvas_layer_scenarios(b: &mut Bench, sz: &Sizes) {
         exec(s, "layer.setProps", json!({"layer": mid, "visible": i % 2 == 1}))?;
         Ok(ms(t) + b.refresh(s, false)?)
     });
+    // #6533: an adjustment among them, added after the rows above so their document is unchanged.
+    // It lands on top (above the active `full n-1`), #6533's "hide the top adjustment layer" case.
+    let _ = exec(&mut s, "layer.setProps", json!({"layer": mid, "visible": true}));
+    b.current = Some(adjust.to_string());
+    let adj = exec(&mut s, "layer.newAdjustmentLayer.levels", json!({"inBlack": 8, "inWhite": 245, "gamma": 1.05})).and_then(|_| active_layer(&s));
+    match adj {
+        Ok(adj) => {
+            // As #6533's repro (`performance.gpuMemoryMb = 512`): the ~3.6 GB working set no longer
+            // fits, so a full refresh takes the from-scratch CPU path on every machine.
+            if let Some((g, _)) = &b.gpu {
+                g.set_memory_budget(photocraft_ui_egui::gpu_canvas::MIN_GPU_BUDGET);
+            }
+            let _ = b.refresh(&s, true);
+            // Each run is a from-scratch CPU composite of 150 full-canvas layers. Every timed run
+            // is a hide: the layer is shown again, untimed, before each one.
+            b.time(adjust, &mut s, reps.min(5), true, |b, s, _| {
+                exec(s, "layer.setProps", json!({"layer": adj, "visible": true}))?;
+                b.refresh(s, false)?;
+                let t = Instant::now();
+                exec(s, "layer.setProps", json!({"layer": adj, "visible": false}))?;
+                Ok(ms(t) + b.refresh(s, false)?)
+            });
+        }
+        Err(e) => b.errors.push((adjust.to_string(), e)),
+    }
+    // `b.gpu` is shared with the later groups: give them back the budget they see on main.
+    if let (Some((g, _)), Some(budget)) = (&b.gpu, app_budget) {
+        g.set_memory_budget(budget);
+    }
+}
+
+/// #1015, #9330: a huge document with one painted layer, zoomed out: times only the reduced CPU
+/// composite `canvas::ensure_texture` draws when the document is too large for GPU textures.
+fn huge_document_scenarios(b: &mut Bench, sz: &Sizes) {
+    let name = "zoomed-out reduced composite of the huge document with one painted layer";
+    if !b.wanted(name) {
+        return;
+    }
+    b.current = Some(name.to_string());
+    let (w, h) = sz.huge_doc;
+    let mut s = Session::new();
+    let built = (|| -> Res<()> {
+        exec(&mut s, "file.new", json!({"width": w, "height": h, "background": "white"}))?;
+        exec(&mut s, "layer.new.layer", json!({"name": "paint"}))?;
+        exec(&mut s, "select.rect", json!({"x": w / 4, "y": h / 4, "width": w / 2, "height": h / 2}))?;
+        exec(&mut s, "edit.fill", json!({"color": "#c03020"}))?;
+        exec(&mut s, "select.deselect", json!({}))?;
+        Ok(())
+    })();
+    if let Err(e) = built {
+        b.errors.push((name.into(), e));
+        return;
+    }
+    // One run: each is a from-scratch reduced composite of the whole document.
+    b.time(name, &mut s, 1, false, |_, s, _| {
+        let doc = &s.active().ok_or("no document")?.doc;
+        let factor = w.max(h).div_ceil(photocraft_ui_egui::canvas::MAX_TEXTURE).max(1);
+        let t = Instant::now();
+        let reduced = photocraft_compose::render_reduced(doc, w / factor, h / factor);
+        let v = ms(t);
+        if reduced.px.is_empty() {
+            return Err("the reduced canvas is empty".into());
+        }
+        Ok(v)
+    });
 }
 
 /// #209: arrow-key nudge in the 150-layer document; #1771: a new layer there.
diff --git a/crates/ui-egui/src/app.rs b/crates/ui-egui/src/app.rs
index 2ce599e30e..e5f987c71d 100644
--- a/crates/ui-egui/src/app.rs
+++ b/crates/ui-egui/src/app.rs
@@ -1,5 +1,13 @@
 use super::services::{ExportSettings, FormatChoices, SAVE_OPTIONS_OPEN, SaveKind, Services, plain_raster, saved_revision_after_write};
-use super::*;
+use super::{
+    ControlRequest, DocId, Document, HashMap, PhotocraftApp, Receiver, Session, SyntheticTarget, Tool, UiState, Value, actions, analysis_ui, brush_panel,
+    brush_picker, camera_raw_ui, canvas, dds_options_ui, delete_layer_prompt, dialogs, discard_ui, distort_ui, dock, field_wheel, file_open, gpu_canvas,
+    gpu_status, gradient_ui, histogram_panel, i18n, jobs_ui, jpeg_options_ui, json, kys_import, last_brush, layers_panel_ui, mask_thumbs_ui, mask_trash_prompt,
+    monitor_status, native_menu, notices, open_prompt, paint_mouse, palette, panel_docking, panels, prefs_ui, preset_files_ui, preset_panels, rasterize_prompt,
+    screen_picker, shape_stroke_ui, shortcuts, single_line_drag, state, stroke_trace, stylus, targa_options_ui, text_field_menu, theme, tiff_options_ui,
+    timeline_ui, titlebar, tool_cursor, tool_memory, transform_tool, type_panels_ui, type_tool, type_transform, updates_ui, vector_ui, view_cmds, wheel_nav,
+    wide_angle_ui, widgets, work_area, workspace_ui,
+};
 
 mod clipboard;
 mod commands;
@@ -165,6 +173,7 @@ impl PhotocraftApp {
             started: None,
             perf: Default::default(),
             stroke_trace: stroke_trace::StrokeTrace::from_env(),
+            render_path: Default::default(),
             prefs_rt: Default::default(),
             updates_rt: Default::default(),
             discard: None,
diff --git a/crates/ui-egui/src/app/clipboard.rs b/crates/ui-egui/src/app/clipboard.rs
index 0b268f2b9b..5a3cad5012 100644
--- a/crates/ui-egui/src/app/clipboard.rs
+++ b/crates/ui-egui/src/app/clipboard.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::PhotocraftApp;
 
 fn clip_signature(w: u32, h: u32, px: &[u8]) -> u64 {
     let mut sig = (w as u64) << 32 | h as u64;
diff --git a/crates/ui-egui/src/app/commands.rs b/crates/ui-egui/src/app/commands.rs
index 1ae200be26..9e7e986d69 100644
--- a/crates/ui-egui/src/app/commands.rs
+++ b/crates/ui-egui/src/app/commands.rs
@@ -1,4 +1,7 @@
-use super::*;
+use super::{
+    DocId, PhotocraftApp, Tool, Value, actions, canvas, delete_layer_prompt, dock, gpu_canvas, jobs_ui, json, mask_trash_prompt, notices, panel_docking, state,
+    transform_tool, type_transform, vector_ui,
+};
 
 impl PhotocraftApp {
     /// Run an engine command, reporting errors in the status bar.
@@ -115,82 +118,7 @@ impl PhotocraftApp {
             jobs_ui::run(self, id, params)
         };
         let creates_adjustment_or_fill = id.starts_with("layer.newAdjustmentLayer.") || id.starts_with("layer.newFillLayer.");
-        if r.is_ok() && ADDS_LAYER_MASK.contains(&id) {
-            // Adding an explicit mask targets it, as in Photoshop (#2166).
-            self.ui.mask_target = true;
-            self.ui.vector_mask_target = false;
-            self.ui.properties_layer = None;
-        } else if r.is_ok() && creates_adjustment_or_fill {
-            // Panel Options may suppress a fill layer's default mask. Never target a
-            // nonexistent mask; an active path creates a vector mask instead.
-            let masks = self
-                .session
-                .active()
-                .and_then(|st| st.active_layer.and_then(|id| st.doc.layer(id)))
-                .map(|layer| (layer.mask.is_some(), layer.vector_mask.is_some()))
-                .unwrap_or((false, false));
-            self.ui.mask_target = masks.0;
-            self.ui.vector_mask_target = !masks.0 && masks.1;
-            // Keep Properties on the new layer contents, as on main (#3369).
-            self.ui.properties_layer = self.session.active().and_then(|st| st.active_layer).map(|l| l.0);
-        }
-        if r.is_ok() && creates_adjustment_or_fill {
-            // Properties comes to the front, shown and expanded, so the new layer's settings can
-            // be edited at once, as in Photoshop (#4028). The layer is made whatever happens here.
-            if self.ui.docking.is_some() {
-                let _ = panel_docking::command(self, "window.panel.activate", &json!({"panel": "properties"}));
-            } else {
-                self.ui.dock_tabs.properties = 0;
-                dock::reveal(self, dock::Group::Properties);
-            }
-        }
-        // Making a new selection reveals its outline after View > Extras was hidden (#5597).
-        // These interactive selection commands complete inline; a failed command, deselection,
-        // or painting inside an existing selection must leave the user's view choice alone.
-        if r.as_ref().is_ok_and(|v| v.get("changed") != Some(&Value::Bool(false)) && v.get("pending") != Some(&Value::Bool(true)))
-            && matches!(
-                id,
-                "select.rect"
-                    | "select.lasso"
-                    | "select.magneticLasso"
-                    | "select.magicWand"
-                    | "select.quick"
-                    | "select.object"
-                    | "select.loadSelection"
-                    | "select.loadLuminosity"
-                    | "path.toSelection"
-            )
-            && self.session.active().is_some_and(|st| st.doc.selection.is_some())
-        {
-            self.ui.view.extras = true;
-        }
-        if r.is_ok() && id == "select.toWorkPath" {
-            // Make Work Path selects the new work path in the Paths panel, as in Photoshop.
-            self.ui.selected_path = Some("work".into());
-        }
-        if r.is_ok() && path_mask {
-            // The new layer's vector mask becomes the active path, as in Photoshop: the path it
-            // was made from is no longer selected, so the next fill layer isn't masked by it too.
-            self.ui.selected_path = Some("layer".into());
-        }
-        if r.is_ok() && creates_active_mask {
-            // Adding a mask selects its thumbnail: the next brush or footer Delete targets it.
-            self.ui.mask_target = true;
-            self.ui.vector_mask_target = false;
-        }
-        if r.is_ok() && creates_active_vector_mask {
-            // Likewise a new vector mask (#4728): Properties shows its Density and Feather, and a
-            // mask made from a path becomes the active path.
-            self.ui.vector_mask_target = true;
-            self.ui.mask_target = false;
-            if matches!(id, "layer.vectorMask.currentPath" | "layer.vectorMask.fromPath") {
-                self.ui.selected_path = Some("layer".into());
-            }
-        }
-        if r.is_ok() && matches!(id, "edit.copy" | "edit.cut" | "edit.copyMerged") {
-            self.clip_external = false;
-            self.export_os_clipboard();
-        }
+        self.sync_command_side_effects(id, &r, creates_active_mask, creates_active_vector_mask, creates_adjustment_or_fill, path_mask);
         self.perf.last_command = id.to_string();
         self.perf.command_ms = gpu_canvas::now_ms() - t0;
         match &r {
@@ -227,6 +155,93 @@ impl PhotocraftApp {
         self.tool_override.unwrap_or(self.ui.tool)
     }
 
+    fn sync_command_side_effects(
+        &mut self,
+        id: &str,
+        result: &Result<Value, String>,
+        creates_active_mask: bool,
+        creates_active_vector_mask: bool,
+        creates_adjustment_or_fill: bool,
+        path_mask: bool,
+    ) {
+        if result.is_ok() && ADDS_LAYER_MASK.contains(&id) {
+            // Adding an explicit mask targets it, as in Photoshop (#2166).
+            self.ui.mask_target = true;
+            self.ui.vector_mask_target = false;
+            self.ui.properties_layer = None;
+        } else if result.is_ok() && creates_adjustment_or_fill {
+            // Panel Options may suppress a fill layer's default mask. Never target a
+            // nonexistent mask; an active path creates a vector mask instead.
+            let masks = self
+                .session
+                .active()
+                .and_then(|st| st.active_layer.and_then(|id| st.doc.layer(id)))
+                .map(|layer| (layer.mask.is_some(), layer.vector_mask.is_some()))
+                .unwrap_or((false, false));
+            self.ui.mask_target = masks.0;
+            self.ui.vector_mask_target = !masks.0 && masks.1;
+            // Keep Properties on the new layer contents, as on main (#3369).
+            self.ui.properties_layer = self.session.active().and_then(|st| st.active_layer).map(|l| l.0);
+        }
+        if result.is_ok() && creates_adjustment_or_fill {
+            // Properties comes to the front, shown and expanded, so the new layer's settings can
+            // be edited at once, as in Photoshop (#4028). The layer is made whatever happens here.
+            if self.ui.docking.is_some() {
+                let _ = panel_docking::command(self, "window.panel.activate", &json!({"panel": "properties"}));
+            } else {
+                self.ui.dock_tabs.properties = 0;
+                dock::reveal(self, dock::Group::Properties);
+            }
+        }
+        // Making a new selection reveals its outline after View > Extras was hidden (#5597).
+        // These interactive selection commands complete inline; a failed command, deselection,
+        // or painting inside an existing selection must leave the user's view choice alone.
+        if result.as_ref().is_ok_and(|v| v.get("changed") != Some(&Value::Bool(false)) && v.get("pending") != Some(&Value::Bool(true)))
+            && matches!(
+                id,
+                "select.rect"
+                    | "select.lasso"
+                    | "select.magneticLasso"
+                    | "select.magicWand"
+                    | "select.quick"
+                    | "select.object"
+                    | "select.loadSelection"
+                    | "select.loadLuminosity"
+                    | "path.toSelection"
+            )
+            && self.session.active().is_some_and(|st| st.doc.selection.is_some())
+        {
+            self.ui.view.extras = true;
+        }
+        if result.is_ok() && id == "select.toWorkPath" {
+            // Make Work Path selects the new work path in the Paths panel, as in Photoshop.
+            self.ui.selected_path = Some("work".into());
+        }
+        if result.is_ok() && path_mask {
+            // The new layer's vector mask becomes the active path, as in Photoshop: the path it
+            // was made from is no longer selected, so the next fill layer isn't masked by it too.
+            self.ui.selected_path = Some("layer".into());
+        }
+        if result.is_ok() && creates_active_mask {
+            // Adding a mask selects its thumbnail: the next brush or footer Delete targets it.
+            self.ui.mask_target = true;
+            self.ui.vector_mask_target = false;
+        }
+        if result.is_ok() && creates_active_vector_mask {
+            // Likewise a new vector mask (#4728): Properties shows its Density and Feather, and a
+            // mask made from a path becomes the active path.
+            self.ui.vector_mask_target = true;
+            self.ui.mask_target = false;
+            if matches!(id, "layer.vectorMask.currentPath" | "layer.vectorMask.fromPath") {
+                self.ui.selected_path = Some("layer".into());
+            }
+        }
+        if result.is_ok() && matches!(id, "edit.copy" | "edit.cut" | "edit.copyMerged") {
+            self.clip_external = false;
+            self.export_os_clipboard();
+        }
+    }
+
     pub fn sync_views(&mut self) {
         type_transform::cancel_stale(self);
         crate::cam_transform::cancel_stale(self);
diff --git a/crates/ui-egui/src/app/control.rs b/crates/ui-egui/src/app/control.rs
index e6005b6782..425742d519 100644
--- a/crates/ui-egui/src/app/control.rs
+++ b/crates/ui-egui/src/app/control.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{ControlRequest, PhotocraftApp, Receiver};
 
 impl PhotocraftApp {
     /// Attach a control channel (requests arrive from a transport thread: TCP, stdin, tests).
diff --git a/crates/ui-egui/src/app/files.rs b/crates/ui-egui/src/app/files.rs
index ebd30492de..97b25ddb40 100644
--- a/crates/ui-egui/src/app/files.rs
+++ b/crates/ui-egui/src/app/files.rs
@@ -1,4 +1,7 @@
-use super::*;
+use super::{
+    DocId, ExportSettings, FormatChoices, PhotocraftApp, SAVE_OPTIONS_OPEN, SaveKind, Value, camera_raw_ui, dds_options_ui, file_open, jobs_ui,
+    jpeg_options_ui, json, notices, open_prompt, plain_raster, preset_files_ui, saved_revision_after_write, targa_options_ui, tiff_options_ui,
+};
 
 impl PhotocraftApp {
     /// Record `path` as the most-recently-opened file (File › Open Recent): de-duplicated, newest
diff --git a/crates/ui-egui/src/app/frame.rs b/crates/ui-egui/src/app/frame.rs
index 6969db33c1..d19eb31f7a 100644
--- a/crates/ui-egui/src/app/frame.rs
+++ b/crates/ui-egui/src/app/frame.rs
@@ -1,4 +1,10 @@
-use super::*;
+use super::{
+    PhotocraftApp, analysis_ui, brush_panel, brush_picker, camera_raw_ui, canvas, dds_options_ui, dialogs, discard_ui, distort_ui, field_wheel, file_open,
+    gpu_canvas, gpu_status, gradient_ui, i18n, jobs_ui, jpeg_options_ui, kys_import, last_brush, layers_panel_ui, monitor_status, native_menu, notices,
+    paint_mouse, palette, panels, prefs_ui, preset_panels, rasterize_prompt, screen_picker, shape_stroke_ui, shortcuts, targa_options_ui, text_field_menu,
+    theme, tiff_options_ui, timeline_ui, titlebar, tool_cursor, tool_memory, transform_tool, type_panels_ui, type_tool, updates_ui, vector_ui, view_cmds,
+    wide_angle_ui, work_area, workspace_ui,
+};
 
 impl PhotocraftApp {
     /// Wait out the rest of [`Self::min_frame_ms`] since the last frame started.
@@ -74,7 +80,7 @@ impl PhotocraftApp {
         if !screen_picker::tick(self, ctx) {
             jobs_ui::tick(self, ctx);
             #[cfg(not(target_arch = "wasm32"))]
-            filter_preview_worker::discard_closed(self);
+            crate::dialogs::filter_preview_worker::discard_closed(self);
             if type_tool::in_ui_pass(ctx) {
                 if self.fonts_ready {
                     shortcuts::handle(self, ctx);
@@ -165,6 +171,8 @@ impl PhotocraftApp {
         }
         let t0 = gpu_canvas::now_ms();
         self.perf.frame_refresh_ms = 0.0;
+        // A software adapter or CPU mode chosen at startup is every document's reason.
+        crate::render_path::frame(self);
         self.stroke_trace.cpu_prev(frame.info().cpu_usage);
         // A text field's right-click menu, before any field is drawn (text_field_menu.rs).
         text_field_menu::show(&ctx);
diff --git a/crates/ui-egui/src/app/gpu.rs b/crates/ui-egui/src/app/gpu.rs
index 73c08338ed..055a85e0fd 100644
--- a/crates/ui-egui/src/app/gpu.rs
+++ b/crates/ui-egui/src/app/gpu.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{PhotocraftApp, gpu_canvas, gpu_status};
 
 impl PhotocraftApp {
     /// Draw the document canvas on the GPU (custom WGSL shader) instead of via egui textures.
diff --git a/crates/ui-egui/src/app/ime.rs b/crates/ui-egui/src/app/ime.rs
index a0fa5b193f..3200f15869 100644
--- a/crates/ui-egui/src/app/ime.rs
+++ b/crates/ui-egui/src/app/ime.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{PhotocraftApp, type_tool};
 
 impl PhotocraftApp {
     /// Install the callback-mode markers in an app creator, before the first `run_ui` on this
diff --git a/crates/ui-egui/src/app/input.rs b/crates/ui-egui/src/app/input.rs
index 9b26957e58..7897e3a655 100644
--- a/crates/ui-egui/src/app/input.rs
+++ b/crates/ui-egui/src/app/input.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{PhotocraftApp, SyntheticTarget};
 
 /// Remove one contiguous run equal to `batch` from `events` (eframe's preserved synthetic
 /// input). A no-op when the run is not present.
diff --git a/crates/ui-egui/src/app/prefs.rs b/crates/ui-egui/src/app/prefs.rs
index 0e19c3a88e..f1a111f190 100644
--- a/crates/ui-egui/src/app/prefs.rs
+++ b/crates/ui-egui/src/app/prefs.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{PhotocraftApp, dock, panel_docking, single_line_drag, text_field_menu, theme, tool_cursor, wheel_nav};
 
 impl PhotocraftApp {
     /// Records a picked type family for the font menu's Recent group, capped by
diff --git a/crates/ui-egui/src/app/screenshot.rs b/crates/ui-egui/src/app/screenshot.rs
index 41ff5feff4..d46a1878e0 100644
--- a/crates/ui-egui/src/app/screenshot.rs
+++ b/crates/ui-egui/src/app/screenshot.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::PhotocraftApp;
 
 impl PhotocraftApp {
     /// Issue due screenshot requests. UI phase only: settling counts real layout passes, and the
diff --git a/crates/ui-egui/src/app/targets.rs b/crates/ui-egui/src/app/targets.rs
index 8a22273b69..fbdc91c8a7 100644
--- a/crates/ui-egui/src/app/targets.rs
+++ b/crates/ui-egui/src/app/targets.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{PhotocraftApp, Value, mask_thumbs_ui};
 
 /// The active layer is an adjustment layer. It has no pixels, so painting and filling it edit its
 /// mask even when its icon thumbnail, not the mask, is the Layers panel's target, as in
diff --git a/crates/ui-egui/src/app/thumbs.rs b/crates/ui-egui/src/app/thumbs.rs
index a5a52ccffc..7ba8fb1db6 100644
--- a/crates/ui-egui/src/app/thumbs.rs
+++ b/crates/ui-egui/src/app/thumbs.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{DocId, Document, PhotocraftApp, mask_thumbs_ui};
 
 impl PhotocraftApp {
     pub(super) fn prune_thumbs(&mut self) {
diff --git a/crates/ui-egui/src/app/view.rs b/crates/ui-egui/src/app/view.rs
index 1505677b94..4fb44c26c8 100644
--- a/crates/ui-egui/src/app/view.rs
+++ b/crates/ui-egui/src/app/view.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::PhotocraftApp;
 
 impl PhotocraftApp {
     /// Zoom of the active document's main view: screen (device) pixels per document pixel, the
diff --git a/crates/ui-egui/src/app/window.rs b/crates/ui-egui/src/app/window.rs
index 0379f77d20..49ecfc6b36 100644
--- a/crates/ui-egui/src/app/window.rs
+++ b/crates/ui-egui/src/app/window.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::PhotocraftApp;
 
 impl PhotocraftApp {
     /// Whether the title bar's free gap gets the drag overlay this frame: the app draws its title
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 75ecf186f2..3896b84cf6 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -201,6 +201,1547 @@ pub fn mode_label(doc: &Document) -> &'static str {
 }
 
 /// Draw one canvas view and handle its input. `primary` = main window (tools active).
+struct CanvasPaintInput<'a> {
+    ctx: &'a egui::Context,
+    rect: Rect,
+    painter: &'a egui::Painter,
+    ppp: f32,
+    border: photocraft_engine::prefs::CanvasBorder,
+    doc: &'a std::sync::Arc<Document>,
+    idx: usize,
+    output: Option<u32>,
+    size: [u32; 2],
+    primary: bool,
+    flip: bool,
+    aspect: f32,
+    render_zoom: f32,
+    target_xf: ViewXform,
+    pixel_grid: bool,
+}
+
+struct SelectionPaintInput<'a> {
+    ctx: &'a egui::Context,
+    painter: &'a egui::Painter,
+    ui: &'a egui::Ui,
+    view: &'a View,
+    xf: ViewXform,
+    rect: Rect,
+    doc: &'a Document,
+    idx: usize,
+}
+
+fn paint_selection_outline(app: &mut PhotocraftApp, input: SelectionPaintInput<'_>) {
+    // Select and Mask outlines its refined selection (on its preview proxy, reduced by `k`) in
+    // the Marching Ants view and hides the ants in the others.
+    let refined = crate::select_mask_view::ants(app, input.idx);
+    // A floating piece's ants hug the pixels being moved.
+    let floated = floating_outline(app, input.idx);
+    let (outlined, k) = match &refined {
+        None => (floated.as_ref().or(input.doc.selection.as_ref()), 1),
+        Some(None) => (None, 1),
+        Some(Some((proxy, k))) => (proxy.selection.as_ref(), (*k).max(1)),
+    };
+    // Selection outline: true boundary, animated marching ants (cached per revision).
+    if let Some(sel) = outlined.filter(|_| app.ui.view.shows(app.ui.view.show.selection_edges) && !polygon_replaces_selection(app)) {
+        // Trace at display resolution over the visible part only; key by the mask's tile identity
+        // (not the document revision) so unrelated edits don't re-trace it. The step is in
+        // device pixels per document pixel (`View::zoom`, not the point zoom), so a 1 px
+        // selection still traces at 100% on a scaled display.
+        let step = (1.0 / (input.view.zoom * k as f32).max(1e-3)).log2().floor().exp2().clamp(1.0, 64.0) as u32;
+        let corners = [input.rect.min, pos2(input.rect.max.x, input.rect.min.y), input.rect.max, pos2(input.rect.min.x, input.rect.max.y)];
+        let docs = [input.xf.to_doc(corners[0]), input.xf.to_doc(corners[1]), input.xf.to_doc(corners[2]), input.xf.to_doc(corners[3])];
+        let mut x0 = docs[0][0];
+        let mut y0 = docs[0][1];
+        let mut x1 = x0;
+        let mut y1 = y0;
+        for d in docs {
+            x0 = x0.min(d[0]);
+            y0 = y0.min(d[1]);
+            x1 = x1.max(d[0]);
+            y1 = y1.max(d[1]);
+        }
+        let (x0, y0, x1, y1) = (x0 / f64::from(k), y0 / f64::from(k), x1 / f64::from(k), y1 / f64::from(k));
+        let q = 256 * step as i32; // quantise the region so small pans reuse the cache
+        // The view centre can be any finite number (`ui.set`, #980). Past ±2³⁰ there is no document
+        // to outline, and the padding below (at most 2 · 256 · 64) can't overflow i32 from there.
+        let px = |v: f64| v.clamp(-f64::from(1 << 30), f64::from(1 << 30)) as i32;
+        // A Free Transform carries the selection to wherever its box goes (#5297), so all of
+        // it is outlined: the part now in view may have started out of it.
+        let carried = app.session.active_index() == Some(input.idx) && crate::transform_tool::carries_selection_of(app, input.doc.id);
+        let vis = if carried {
+            photocraft_geom::Rect::new(-(1 << 30), -(1 << 30), 1 << 30, 1 << 30)
+        } else {
+            photocraft_geom::Rect::new(
+                px(x0.floor()).div_euclid(q) * q - q,
+                px(y0.floor()).div_euclid(q) * q - q,
+                (px(x1.ceil()).div_euclid(q) + 2) * q,
+                (px(y1.ceil()).div_euclid(q) + 2) * q,
+            )
+        };
+        let bounds_key = if k > 1 { u64::MAX / 2 - input.doc.id.0 } else { u64::MAX - input.doc.id.0 };
+        let carried_bounds = carried.then(|| app.cached_bounds(bounds_key, sel).intersect(&vis));
+        let step = carried_bounds.map_or(step, |b| crate::outline::bounded_step(b, step));
+        let key = crate::surface_fingerprint(sel)
+            ^ u64::from(step).rotate_left(56)
+            ^ input.doc.id.0.rotate_left(17)
+            ^ (vis.x0 as u64) << 8
+            ^ (vis.y0 as u64) << 24
+            ^ (vis.x1 as u64) << 36
+            ^ (vis.y1 as u64) << 48
+            ^ u64::from(k).rotate_left(5);
+        let fresh = matches!(&app.outline_cache, Some((d, k, _)) if *d == input.doc.id && *k == key);
+        if !fresh {
+            let t0 = crate::gpu_canvas::now_ms();
+            let b = carried_bounds.unwrap_or_else(|| app.cached_bounds(bounds_key, sel).intersect(&vis));
+            // Filters can occupy every worker in Rayon's global pool. A parallel scan here would
+            // block the UI thread waiting for those workers, preventing job cancellation (#1554).
+            let mut segs =
+                if app.session.has_jobs() { crate::outline::outline_scaled_serial(sel, b, step) } else { crate::outline::outline_scaled(sel, b, step) };
+            if k > 1 {
+                let s = i32::try_from(k).unwrap_or(1);
+                let up = |p: [i32; 2]| [p[0].saturating_mul(s), p[1].saturating_mul(s)];
+                segs.iter_mut().for_each(|(a, b)| (*a, *b) = (up(*a), up(*b)));
+            }
+            app.perf.span("outline", crate::gpu_canvas::now_ms() - t0);
+            app.outline_cache = Some((input.doc.id, key, std::sync::Arc::new(segs)));
+        }
+        // Under Content-Aware Move's Transform On Drop box the ants are drawn where it puts them.
+        if let Some((_, _, segs)) = app.outline_cache.as_ref().filter(|_| !crate::cam_transform::active(app)) {
+            let time = input.ui.input(|i| i.time);
+            // A floating piece (and a selection being dragged) draws its ants where it is shown.
+            let mut shown = input.xf;
+            if let Some((dx, dy)) = selection_shown_offset(app) {
+                shown.center = [input.xf.center[0] - dx as f32, input.xf.center[1] - dy as f32];
+            }
+            // Under a Free Transform box they are where the box puts them (#5297).
+            if !(carried && crate::transform_tool::draw_selection(app, input.painter, &input.xf, input.doc.id, segs, time)) {
+                marching_ants_segments(input.painter, &shown, segs, time);
+            }
+            input.ctx.request_repaint_after(std::time::Duration::from_millis(100));
+        }
+    }
+}
+
+fn paint_canvas(app: &mut PhotocraftApp, ui: &egui::Ui, view: &View, xf: ViewXform, input: &CanvasPaintInput<'_>) -> (bool, egui::layers::ShapeIdx, Rect) {
+    let ctx = input.ctx;
+    let rect = input.rect;
+    let painter = input.painter;
+    let ppp = input.ppp;
+    let border = input.border;
+    let doc = input.doc;
+    let idx = input.idx;
+    let output = input.output;
+    let size = input.size;
+    let primary = input.primary;
+    let flip = input.flip;
+    let aspect = input.aspect;
+    let render_zoom = input.render_zoom;
+    let target_xf = input.target_xf;
+    let pixel_grid = input.pixel_grid;
+
+    let point_zoom = view.zoom / ppp;
+    let drop_shadow = border == photocraft_engine::prefs::CanvasBorder::DropShadow;
+    // Drop shadow, checkerboard, document image.
+    let img_rect = xf.doc_rect(doc.bounds());
+    // The canvas edge the Line border outlines: a size-changing preview's own (CPU canvas).
+    let mut edge_rect = img_rect;
+    // The document area the image is drawn over: a size-changing preview's own on the CPU
+    // canvas (Image › Rotation). Overlays drawn from the same preview follow it.
+    let mut shown_area = doc.bounds();
+    // Crop tool: the layers' pixels past the canvas while a frame is edited, under the canvas
+    // (whose edge blends into them) and without its shadow.
+    let beyond = draw_beyond_canvas(app, painter, &xf, idx, output);
+    // View › Pattern Preview (#1067): copies of the document around it, from the same texture.
+    let pattern = if app.ui.view.pattern_preview {
+        let v = visible_doc_rect(&xf);
+        crate::pattern_preview::copies([v.x0, v.y0, v.x1, v.y1].map(f64::from), size)
+    } else {
+        Vec::new()
+    };
+    let drop_shadow = drop_shadow && !beyond && !app.ui.view.pattern_preview;
+    // Live adjustment previews on big documents use a downsampled proxy (see proxy.rs), unless
+    // Preferences › Performance › Low Resolution Previews is off.
+    let mut on_gpu = false;
+    // A flipped or pixel-aspect-corrected view draws through the CPU path (the GPU canvas shader
+    // has no mirroring or non-square pixels). Rotation stays on the GPU: it is a view uniform.
+    let gpu_ok = crate::gpu_canvas::gpu_view_ok(flip, view.rotation, aspect);
+    if app.gpu.is_some() {
+        if gpu_ok {
+            crate::render_path::view_ok(app, doc.id.0);
+        } else {
+            crate::render_path::view_cpu(app, doc.id.0);
+        }
+    }
+    if app.gpu.is_some()
+        && gpu_ok
+        && let Some((k, key, preview_size)) =
+            ensure_adjust_proxy(app, idx, render_zoom).or_else(|| ensure_filter_preview(app, idx, ctx)).or_else(|| ensure_proxy_preview(app, idx, render_zoom))
+    {
+        on_gpu = true;
+        app.navigator_gpu.remove(&doc.id);
+        let original_size = [doc.size.width.div_ceil(k), doc.size.height.div_ceil(k)];
+        let shown = filter_preview_display_doc(app, doc, key);
+        let params = crate::gpu_canvas::ViewParams {
+            doc: key,
+            doc_size: preview_size,
+            zoom: view.zoom * k as f32 / ppp,
+            // A size-changing preview grows around the old image center; keep the view's pan.
+            center: [
+                xf.center[0] / k as f32 + (preview_size[0] as f32 - original_size[0] as f32) / 2.0,
+                xf.center[1] / k as f32 + (preview_size[1] as f32 - original_size[1] as f32) / 2.0,
+            ],
+            rotation: if view.rotation.is_finite() { view.rotation.to_radians() } else { 0.0 },
+            shadow: {
+                let t = crate::theme::Tokens::get(ctx);
+                !t.bevel && !t.pro && drop_shadow
+            },
+            pixel_grid: false,
+            view_key: egui::Id::unique(("pc-canvas-proxy", ctx.viewport_id(), idx)).value(),
+            display: sync_display_lut(app, &shown, key, output),
+            output: output.unwrap_or(0),
+            hdr: hdr_preview(app, doc),
+            offset: [0.0, 0.0],
+        };
+        paint_gpu_view(painter, rect, params, &pattern);
+    } else if gpu_ok && ensure_gpu(app, ctx, idx, redraw_focus(&target_xf, &xf)) {
+        on_gpu = true;
+        app.perf.gpu = true;
+        // Shadow, checkerboard, document and pixel grid in one custom shader (gpu_canvas.rs).
+        let params = crate::gpu_canvas::ViewParams {
+            doc: doc.id.0,
+            doc_size: [doc.size.width, doc.size.height],
+            zoom: point_zoom,
+            center: xf.center,
+            rotation: if view.rotation.is_finite() { view.rotation.to_radians() } else { 0.0 },
+            shadow: {
+                let t = crate::theme::Tokens::get(ctx);
+                !t.bevel && !t.pro && drop_shadow
+            },
+            pixel_grid,
+            view_key: egui::Id::unique(("pc-canvas", ctx.viewport_id(), idx)).value(),
+            display: sync_display_lut(app, doc, doc.id.0, output),
+            output: output.unwrap_or(0),
+            hdr: hdr_preview(app, doc),
+            offset: [0.0, 0.0],
+        };
+        if app.navigator_plain.contains(&doc.id) {
+            app.navigator_gpu.insert(doc.id, params);
+        } else {
+            app.navigator_gpu.remove(&doc.id);
+        }
+        paint_gpu_view(painter, rect, params, &pattern);
+    } else {
+        app.navigator_gpu.remove(&doc.id);
+        // A document too large for one full-resolution texture also gets the part in view at
+        // the screen's resolution, drawn over the reduced whole (#7568).
+        let in_view =
+            InView { visible: visible_doc_rect(&xf), zoom: view.zoom, key: egui::Id::unique(("pc-canvas-detail", ctx.viewport_id(), idx, primary)).value() };
+        let textures = ensure_texture_in_view(app, ctx, idx, output, Some(in_view));
+        let tex = textures.as_ref().map(|t| t.texture);
+        // The area the image covers: a size-changing preview's own (Image › Rotation).
+        let area = textures.as_ref().map_or(doc.bounds(), |t| t.bounds);
+        shown_area = area;
+        if area != doc.bounds() {
+            edge_rect = xf.doc_rect(area);
+        }
+        if !crate::theme::Tokens::get(ctx).bevel && drop_shadow {
+            let shadow_rect = edge_rect;
+            painter.add(egui::Shadow { offset: [0, 8], blur: 28, spread: 0, color: Color32::from_black_alpha(150) }.as_shape(shadow_rect, 0));
+        }
+        let rotated = view.rotation.abs() > 0.05;
+        let checkerboard = app.session.prefs().transparency_and_gamut.square().map(|square| (checker(app, ctx), square));
+        // Repeated-quad coverage is not proven identical on all Pattern Preview adapters.
+        // Retain its legacy checker submissions, including the central document's.
+        let opaque = !app.ui.view.pattern_preview && app.canvases.get(&cache_key(doc.id, output)).is_some_and(|c| c.texture_opaque) && tex.is_some();
+        paint_cpu_document(painter, &xf, area, rotated, checkerboard, tex, opaque);
+        if let Some((detail, area)) = textures.and_then(|t| t.detail) {
+            paint_cpu_detail(painter, &xf, doc.bounds(), rotated, checkerboard, detail, area);
+        }
+        // Pattern Preview tiles what is shown: a size-changing preview's area, from its origin.
+        let (tile, copies) = if area == doc.bounds() || !app.ui.view.pattern_preview {
+            (size, pattern.clone())
+        } else {
+            let tile = [area.width(), area.height()];
+            let v = visible_doc_rect(&xf).translate(-area.x0, -area.y0);
+            (tile, crate::pattern_preview::copies([v.x0, v.y0, v.x1, v.y1].map(f64::from), tile))
+        };
+        for &c in &copies {
+            paint_cpu_document(painter, &pattern_xf(&xf, c, tile), area, rotated, checkerboard, tex, opaque);
+        }
+    }
+    // Channels panel: alpha / Quick Mask overlays and single-channel views (channel_view.rs).
+    if let Some(tex) = crate::channel_view::ensure(app, ctx, idx) {
+        // Rendered from the live preview, so over the area the preview is shown in.
+        let a = shown_area;
+        if view.rotation.abs() > 0.05 {
+            paint_mapped_image_at(
+                painter,
+                &xf,
+                tex,
+                Rect::from_min_max(Pos2::ZERO, pos2(1.0, 1.0)),
+                [a.x0 as f32, a.y0 as f32],
+                [a.width() as f32, a.height() as f32],
+                Color32::WHITE,
+            );
+        } else {
+            let uv = if flip { Rect::from_min_max(pos2(1.0, 0.0), pos2(0.0, 1.0)) } else { Rect::from_min_max(Pos2::ZERO, pos2(1.0, 1.0)) };
+            painter.image(tex, xf.doc_rect(a), uv, Color32::WHITE);
+        }
+    }
+    crate::color_range_ui::paint_selection_preview(app, ctx, painter, doc.id, img_rect, flip);
+    // Artboards: pasteboard between the boards, outlines and names (artboard_ui.rs).
+    if doc.has_artboards() {
+        let t = crate::theme::Tokens::get(ctx);
+        let pasteboard = crate::prefs_ui::pasteboard_color(app);
+        let dot_tex = dots(ctx, &t);
+        // Cut around the layers as they are shown, so a loose layer dragged with the Move tool
+        // (or otherwise previewed) is not covered where it now draws.
+        let shown = display_doc(app, idx).0;
+        // Each piece is painted as its own quad (the painter clips to the canvas), so a
+        // rotated view does not paint a piece's bounding box over the boards or loose work.
+        let fill = |q: &[Pos2; 4], tex: Option<egui::TextureId>, color: Color32| {
+            let mut mesh = tex.map_or_else(egui::Mesh::default, egui::Mesh::with_texture);
+            for &p in q {
+                // Same phase as the dots around the document.
+                let uv = if tex.is_some() { ((p - rect.min) / 22.0).to_pos2() } else { egui::epaint::WHITE_UV };
+                mesh.vertices.push(egui::epaint::Vertex { pos: p, uv, color });
+            }
+            mesh.add_triangle(0, 1, 2);
+            mesh.add_triangle(0, 2, 3);
+            painter.add(mesh);
+        };
+        for q in crate::artboard_ui::pasteboard_quads(&xf, &shown) {
+            if !Rect::from_points(&q).intersects(rect) {
+                continue;
+            }
+            match pasteboard {
+                Some(c) => fill(&q, None, c),
+                None => {
+                    fill(&q, None, t.canvas);
+                    if let Some(id) = dot_tex {
+                        fill(&q, Some(id), Color32::WHITE);
+                    }
+                }
+            }
+        }
+        if primary {
+            crate::artboard_ui::draw_frames(app, painter, &xf);
+        }
+    }
+
+    // Pixel grid at high zoom, over pixels with content only (the GPU path draws its own).
+    if !on_gpu && pixel_grid && crate::pixel_grid::shows_at(view.zoom) {
+        crate::pixel_grid::paint(app, painter, &xf, idx, output, visible_doc_rect(&xf));
+    }
+
+    // Developer tile grid (`ui.set {"tileGrid": true}`): the active layer's storage tiles.
+    // Not tied to View › Extras (⌘H), which hides only the View › Show overlays.
+    if app.ui.view.tile_grid {
+        crate::tile_overlay::paint(app, ctx, painter, &xf, idx, visible_doc_rect(&xf));
+    }
+
+    // View › Show › Layer Edges: drawn at this depth, but only once this frame's tool events are
+    // in (`layer_edges_rect`), so a press that Auto-Selects a layer outlines that layer.
+    let layer_edges = painter.add(egui::Shape::Noop);
+
+    paint_selection_outline(app, SelectionPaintInput { ctx, painter, ui, view, xf, rect, doc, idx });
+
+    (beyond, layer_edges, edge_rect)
+}
+
+struct CanvasNavigationInput<'a> {
+    ctx: &'a egui::Context,
+    response: &'a egui::Response,
+    free_hover: bool,
+    wheel_owner: egui::Id,
+    xf: ViewXform,
+    ppp: f32,
+    idx: usize,
+}
+
+fn update_canvas_navigation(app: &mut PhotocraftApp, view: &mut View, input: CanvasNavigationInput<'_>) {
+    // Navigation (wheel_nav.rs): scroll pans (⇧ or ⌘/Ctrl sideways); pinch and ⌥-scroll zoom around the pointer.
+    // The wheel also scrolls over the scrollbars drawn on top of the canvas (last frame's hover).
+    let bars_id = egui::Id::unique(("pc-canvas-bars-hover", input.idx));
+    let over_bars = input.ctx.data(|d| d.get_temp::<bool>(bars_id)).unwrap_or(false);
+    let nav_hovered = input.response.hovered() || input.free_hover || over_bars;
+    // Interface › Enable Animations off: the wheel moves the canvas without a glide (#5721).
+    // General › Animated Zoom: the wheel zoom eases over the frames of a notch, or is one instant step.
+    // Enhanced Controls › Enable Gestures off: two fingers on a touch screen neither zoom nor
+    // turn the view (#204); the mouse and trackpad are unaffected.
+    let touch_gestures = app.session.prefs().enhanced_controls.touch_gestures;
+    let wheel = crate::wheel_nav::read_with(
+        input.ctx,
+        app.session.prefs().general.zoom_with_scroll_wheel,
+        app.session.prefs().enhanced_controls.zoom_with_trackpad_pinch,
+        app.session.prefs().general.animated_zoom,
+        input.wheel_owner,
+        nav_hovered,
+        app.session.prefs().interface.enable_animations,
+        touch_gestures,
+    );
+    if nav_hovered {
+        let pointer = input.ctx.input(|i| i.pointer.hover_pos());
+        match (wheel, pointer) {
+            (Some(crate::wheel_nav::Wheel::Zoom(f)), Some(p)) => {
+                // At a limit the view stays put, as in Photoshop: a notch past 12800 % neither
+                // zooms nor slides the image towards the pointer.
+                let nz = crate::zoom_levels::clamp(view.zoom * f, view.doc_size);
+                if nz != view.zoom * f {
+                    crate::wheel_nav::settle(input.ctx, input.wheel_owner);
+                }
+                if nz != view.zoom {
+                    // Over the pasteboard the anchor is the image's nearest point (#3720).
+                    let at = wheel_anchor(&input.xf, p, view.doc_size);
+                    zoom_about(view, &input.xf, at, nz, false, input.ppp);
+                }
+            }
+            (Some(crate::wheel_nav::Wheel::SnapZoom(n)), Some(p)) => {
+                let dir = if n > 0 { 1 } else { -1 };
+                let mut nz = view.zoom;
+                for _ in 0..n.unsigned_abs() {
+                    nz = crate::zoom_levels::step(nz, dir, view.doc_size);
+                }
+                if nz != view.zoom {
+                    zoom_about(view, &input.xf, p, nz, false, input.ppp);
+                }
+            }
+            (Some(crate::wheel_nav::Wheel::Pan(scroll)), _) => {
+                let d = input.xf.unmap_vec(scroll) / (view.zoom / input.ppp);
+                view.center[0] -= d.x;
+                view.center[1] -= d.y;
+            }
+            _ => {}
+        }
+        let rotate_trackpad = app.session.prefs().enhanced_controls.rotate_view_with_trackpad;
+        if let Some(delta) = crate::rotate_view::trackpad_delta(input.ctx, rotate_trackpad, touch_gestures) {
+            view.zoom_animating = false;
+            view.zoom_anchor = None;
+            let next = view.rotation + crate::rotate_view::screen_delta(delta, input.xf.flip);
+            if next.is_finite() {
+                view.rotation = crate::rotate_view::wrap_deg(next);
+            }
+        }
+    }
+}
+
+struct DialogCanvasInput<'a> {
+    ctx: &'a egui::Context,
+    view: &'a mut View,
+    xf: &'a ViewXform,
+    rect: Rect,
+    painter: &'a egui::Painter,
+    ppp: f32,
+    primary: bool,
+    middle: bool,
+    space_pan: bool,
+    temporary: Option<crate::hold_keys::Temporary>,
+    free_hover: bool,
+    img_rect: Rect,
+}
+
+fn handle_dialog_canvas_input(app: &mut PhotocraftApp, input: DialogCanvasInput<'_>) {
+    let sticky_alt = app.ui.shell.sticky_alt;
+    let zoom_out = |alt: bool| match input.temporary {
+        Some(crate::hold_keys::Temporary::ZoomOut) => true,
+        Some(crate::hold_keys::Temporary::ZoomIn) => false,
+        _ => alt || sticky_alt,
+    };
+
+    // With a colour dialog picker armed the image is its eyedropper, whatever the tool; Space
+    // and the middle button still pan. Curves and Replace Color use the same merged-composite
+    // sampler as the Color Picker, never the reduced adjustment preview.
+    let curves_picking = crate::adjust_dialog::picker_armed(app);
+    let replace_picking = crate::filter_dialog::color_eyedropper_armed(app);
+    let picking = input.primary && (crate::color_picker_ui::top(app).is_some() || curves_picking || replace_picking);
+    let range_picking =
+        input.primary && app.ui.dialogs.last().is_some_and(|d| crate::color_range_ui::owns(&d.fields) && crate::color_range_ui::controls(&d.fields).sampling);
+    // Select and Mask's Refine Edge Brush paints on the image.
+    let refine_brushing =
+        input.primary && app.ui.dialogs.last().is_some_and(|d| crate::select_mask_view::owns(&d.fields) && crate::select_mask_view::brush_on(&d.fields));
+    // Field Blur's pins are placed and dragged on the image (`blur_pins`).
+    let pinning = input.primary && app.ui.dialogs.last().is_some_and(|d| crate::blur_pins::owns(&d.fields));
+    // Layer Style on a Drop or Inner Shadow page: a drag on the image moves the shadow (#5701).
+    let shadow_drag =
+        !picking && app.ui.dialogs.last().is_some_and(|d| d.kind == crate::state::DialogKind::LayerStyle && crate::layer_style::drags_shadow(&d.fields));
+    // ⌘/Ctrl-click with Curves open: a point at the pixel's tone (#7325), whatever the tool. The
+    // press's own modifiers decide, and only the press adds: a drag would add one per frame.
+    let curve_point_press = (input.primary && !input.middle && crate::adjust_dialog::curves_on_top(app))
+        .then(|| {
+            input.ctx.input(|i| {
+                i.events.iter().rev().find_map(|e| match e {
+                    egui::Event::PointerButton { button: PointerButton::Primary, pressed: true, modifiers, .. } => Some(*modifiers),
+                    _ => None,
+                })
+            })
+        })
+        .flatten()
+        .map(|m| crate::workspace_ui::sticky_mods(app, m))
+        .filter(|m| m.command);
+    let dialog_hand = app.ui.tool == Tool::Hand && !picking && !range_picking && !refine_brushing && !pinning && !shadow_drag && curve_point_press.is_none();
+    // ⌘Space / ⌥Space zoom under the dialog as they do without one, before Space pans (#6460).
+    // With the Hand tool, ⌘ alone is Zoom In (#6434); under Curves that press is the dialog's
+    // point (#7325), not a zoom.
+    let curve_point_with_hand = curve_point_press.is_some() && app.ui.tool == Tool::Hand;
+    let held_zoom =
+        !input.middle && !curve_point_with_hand && matches!(input.temporary, Some(crate::hold_keys::Temporary::ZoomIn | crate::hold_keys::Temporary::ZoomOut));
+    if held_zoom {
+        let alt = input.ctx.input(|i| i.modifiers.alt);
+        if input.free_hover {
+            input.ctx.set_cursor_icon(crate::tool_cursor::zoom(input.ctx, zoom_out(alt)));
+        }
+        let b = crate::dialogs::free_buttons(input.ctx, input.rect);
+        let pointer = input.ctx.input(|i| i.pointer.latest_pos());
+        crate::zoom_tool::drag(app, input.ctx, input.view, input.xf, &b, pointer);
+        if b.clicked
+            && let Some(p) = pointer
+        {
+            let nz = crate::zoom_levels::step(input.view.zoom, if zoom_out(alt) { -1 } else { 1 }, input.view.doc_size);
+            zoom_about(input.view, input.xf, p, nz, app.session.prefs().tools.zoom_clicked_point_to_center, input.ppp);
+        }
+    } else if let Some(d) = crate::dialogs::pan_delta(input.ctx, input.rect, dialog_hand) {
+        let d = input.xf.unmap_vec(d) / (input.view.zoom / input.ppp);
+        input.view.center[0] -= d.x;
+        input.view.center[1] -= d.y;
+        input.ctx.set_cursor_icon(crate::tool_cursor::hand(input.ctx, true));
+    } else if input.free_hover && (input.space_pan || dialog_hand) {
+        input.ctx.set_cursor_icon(crate::tool_cursor::hand(input.ctx, false));
+    } else if shadow_drag && !input.middle && crate::dialogs::free_pointer_over(input.ctx, input.rect).is_some() {
+        input.ctx.set_cursor_icon(egui::CursorIcon::Move);
+        if let Some(p) = crate::dialogs::free_press(input.ctx, input.rect) {
+            let (start, origin) = input.ctx.input(|i| (i.pointer.primary_pressed(), i.pointer.press_origin().unwrap_or(p)));
+            let total = input.xf.unmap_vec(p - origin) / (input.view.zoom / input.ppp);
+            if let Some(d) = app.ui.dialogs.last_mut() {
+                crate::layer_style::drag_shadow(&mut d.fields, start, [f64::from(total.x), f64::from(total.y)]);
+            }
+        }
+    } else if picking && let Some(p) = crate::dialogs::free_pointer_over(input.ctx, input.rect) {
+        if app.session.prefs().cursors.other == photocraft_engine::prefs::OtherCursor::Precise {
+            input.ctx.set_cursor_icon(egui::CursorIcon::Crosshair);
+        } else {
+            input.ctx.set_cursor_icon(pipette_cursor(input.ctx, p));
+        }
+        if let Some(p) = crate::dialogs::free_press(input.ctx, input.rect) {
+            let d = input.xf.to_doc(p);
+            if curves_picking {
+                crate::adjust_dialog::sample_at(app, d[0], d[1]);
+            } else if replace_picking {
+                crate::filter_dialog::color_eyedropper_sample(app, d[0], d[1]);
+            } else {
+                crate::color_picker_ui::sample_at(app, d[0], d[1]);
+            }
+        }
+    } else if pinning
+        && !input.middle
+        && let Some(p) = crate::dialogs::free_pointer_over(input.ctx, input.rect)
+    {
+        let press = crate::dialogs::free_press(input.ctx, input.rect);
+        crate::blur_pins::canvas(app, input.ctx, input.xf, p, press);
+    } else if refine_brushing
+        && !input.middle
+        && let Some(p) = crate::dialogs::free_pointer_over(input.ctx, input.rect)
+    {
+        let press = crate::dialogs::free_press(input.ctx, input.rect).map(|q| input.xf.to_doc(q));
+        crate::select_mask_view::canvas_brush(app, input.painter, p, press, input.xf.zoom_x());
+    } else if let Some(mods) = curve_point_press
+        && let Some(p) = crate::dialogs::free_press(input.ctx, input.rect)
+    {
+        let d = input.xf.to_doc(p);
+        crate::adjust_dialog::add_point_at(app, input.ctx, d[0], d[1], mods.shift);
+    } else if input.primary
+        && !input.middle
+        && let Some(p) = crate::dialogs::free_pointer_over(input.ctx, input.rect).filter(|p| input.img_rect.contains(*p))
+    {
+        // Color Range samples colours with its eyedropper on the image itself.
+        let press = crate::dialogs::free_press(input.ctx, input.rect)
+            .filter(|p| input.img_rect.contains(*p) && input.ctx.input(|i| i.pointer.primary_pressed() || i.pointer.delta() != egui::Vec2::ZERO))
+            .map(|q| input.xf.to_doc(q));
+        crate::color_range_ui::canvas_eyedropper(app, input.ctx, p, press);
+    }
+}
+
+struct CanvasToolInput<'a> {
+    ctx: &'a egui::Context,
+    response: &'a egui::Response,
+    xf: &'a ViewXform,
+    rect: Rect,
+    full: Rect,
+    tool: Tool,
+    idx: usize,
+    primary: bool,
+    transform_owns_pointer: bool,
+    hand_pan: bool,
+    ppp: f32,
+    under_dialog: bool,
+    zoom_out: &'a dyn Fn(bool) -> bool,
+    display_zoom: f32,
+}
+
+fn handle_primary_canvas_input(app: &mut PhotocraftApp, ui: &mut egui::Ui, view: &mut View, input: &CanvasToolInput<'_>) {
+    let ctx = input.ctx;
+    let response = input.response;
+    let xf = input.xf;
+    let rect = input.rect;
+    let tool = input.tool;
+    let idx = input.idx;
+    let under_dialog = input.under_dialog;
+    let mods = ui.input(|i| i.modifiers);
+    // An ⌥-click the window manager took never arrives; say so (alt_grab.rs).
+    crate::alt_grab::watch(app, ctx, egui::Id::unique(("pc-alt-grab", idx)), rect, tool, !under_dialog);
+    // Tools follow the left button; the right one opens the Brush Preset picker or erases
+    // (Preferences › Tools, `paint_mouse`).
+    crate::paint_mouse::sync_tool_brush(app);
+    let mut buttons = crate::paint_mouse::canvas_buttons(app, response, tool);
+    // The Crop tool's frame is edited from the press (before egui's drag threshold), so the
+    // pixels past the canvas show at once, as in Photoshop.
+    if tool == Tool::Crop && response.is_pointer_button_down_on() && ui.input(|i| i.pointer.primary_down()) && crate::crop_ui::press(app) {
+        ctx.request_repaint();
+    }
+    // Capture intent at the press, before egui's drag threshold or click replay on release:
+    // Type transforms keep Command; selections keep Add/Subtract if Shift/Alt is released.
+    let capture_press =
+        tool.is_type() || matches!(tool, Tool::RectMarquee | Tool::EllipseMarquee | Tool::SingleRowMarquee | Tool::SingleColumnMarquee | Tool::ObjectSelection);
+    let tool_press = egui::Id::unique(("tool-pointer-press-modifiers", idx));
+    if capture_press
+        && let Some((p, press_mods)) = ui.input(|i| {
+            i.events.iter().find_map(|e| match e {
+                egui::Event::PointerButton { pos, button: PointerButton::Primary, pressed: true, modifiers } if rect.contains(*pos) => Some((*pos, *modifiers)),
+                _ => None,
+            })
+        })
+    {
+        let press_mods = crate::workspace_ui::sticky_mods(app, press_mods);
+        ctx.data_mut(|d| d.insert_temp(tool_press, press_mods));
+        if tool.is_type() && press_mods.command && app.ui.text_edit.is_some() {
+            let d = xf.to_doc(p);
+            tool_event(app, ToolEvent::Down { x: d[0], y: d[1], pressure: app.stylus.pressure() }, press_mods);
+        }
+    }
+
+    handle_canvas_tool_menus(app, input, mods, &mut buttons);
+    handle_canvas_tool_navigation(app, ui, view, input, &mut buttons);
+    handle_canvas_tool_stroke(app, ui, input, mods, capture_press, tool_press, &mut buttons);
+    handle_canvas_tool_clicks(app, ui, view, input, mods, tool_press, &buttons);
+}
+
+fn handle_canvas_tool_menus(app: &mut PhotocraftApp, input: &CanvasToolInput<'_>, mods: egui::Modifiers, buttons: &mut crate::paint_mouse::Buttons) {
+    let ctx = input.ctx;
+    let response = input.response;
+    let xf = input.xf;
+    let tool = input.tool;
+    let transform_owns_pointer = input.transform_owns_pointer;
+    // Right-click while transforming: switch the box's mode (Free Transform, Scale, Rotate,
+    // Skew, Distort, Perspective, Warp), or rotate or flip the box.
+    let transforming = app.ui.transform.as_ref().is_some_and(|t| t.warp.is_none());
+    if response.secondary_clicked()
+        && transforming
+        && let Some(p) = response.interact_pointer_pos()
+    {
+        crate::canvas_tool_menu::open_transform(app, ctx, [p.x, p.y]);
+    }
+    let lasso_retracted = response.secondary_clicked()
+        && match tool {
+            Tool::Lasso | Tool::FreeformPen => crate::lasso_ui::undo_last_vertex(app),
+            Tool::PolygonLasso => polygon_retract(app),
+            _ => false,
+        };
+    // The Lasso (and the Freeform Pen, which draws the same way) reads its own presses and
+    // drops the moves of a drag it didn't start, so an open Free Transform box takes the
+    // usual drag path instead (#2153).
+    if crate::lasso_ui::owns(tool) && !transform_owns_pointer {
+        crate::lasso_ui::canvas_input(app, ctx, xf, response);
+        (buttons.started, buttons.dragged, buttons.stopped, buttons.clicked) = (false, false, false, false);
+    }
+    // Right-click on a guide where it could be dragged (the Move tool, or ⌘ with a selection
+    // tool): select it and open the guide menu, as Photoshop does.
+    let guide_menu = response.secondary_clicked()
+        && !lasso_retracted
+        && !transforming
+        && response.interact_pointer_pos().is_some_and(|p| crate::canvas_tool_menu::open_guide(app, ctx, tool, mods, [p.x, p.y], xf.to_doc(p)));
+    // Right-click with the Move tool, or ⌘/Ctrl+right-click: the layers under the pointer.
+    if response.secondary_clicked()
+        && !lasso_retracted
+        && !transforming
+        && !guide_menu
+        && crate::layer_pick_ui::is_gesture(tool, mods)
+        && let Some(p) = response.interact_pointer_pos()
+    {
+        let d = xf.to_doc(p);
+        app.ui.canvas_tool_menu = None;
+        // No layers there (the pasteboard, with the Move tool): its colour menu instead.
+        if !crate::layer_pick_ui::open(app, ctx, [p.x, p.y], d[0], d[1]) && !mods.command && crate::canvas_tool_menu::pasteboard_at(app, tool, d) {
+            crate::canvas_tool_menu::open_pasteboard(app, ctx, tool, [p.x, p.y]);
+        }
+    }
+    if response.secondary_clicked()
+        && !lasso_retracted
+        && !transforming
+        && !guide_menu
+        && !crate::layer_pick_ui::is_gesture(tool, mods)
+        && let Some(p) = response.interact_pointer_pos()
+    {
+        // A pending crop: its menu, also outside the image, where the frame can reach (#6561).
+        // Outside the image: the pasteboard colour menu (#2462), else the tool's own. The view
+        // menu belongs to the selected Zoom or Hand, not to Space or a held zoom key. A crop
+        // frame or Straighten line still dragged by the left button gets no menu over it: the
+        // gesture and the held button both, as either alone can outlive a lost release. A
+        // finger held still (egui's press-and-hold right-click) is down too, but drags nothing.
+        let crop_gesture = tool == Tool::Crop
+            && !response.long_touched()
+            && (app.crop.drag.is_some() || app.crop.straighten.line.is_some())
+            && ctx.input(|i| i.pointer.primary_down());
+        if crop_gesture || crate::canvas_tool_menu::open_crop(app, ctx, tool, [p.x, p.y]) {
+        } else if crate::canvas_tool_menu::pasteboard_at(app, tool, xf.to_doc(p)) {
+            crate::canvas_tool_menu::open_pasteboard(app, ctx, tool, [p.x, p.y]);
+        } else if crate::canvas_tool_menu::is_view_tool(tool) {
+            if tool == app.ui.tool {
+                crate::canvas_tool_menu::open_view(app, ctx, tool, [p.x, p.y], xf.to_doc(p));
+            }
+        } else {
+            crate::canvas_tool_menu::open_at(app, ctx, tool, [p.x, p.y], Some(xf.to_doc(p)));
+        }
+    }
+}
+
+fn handle_canvas_tool_navigation(
+    app: &mut PhotocraftApp,
+    ui: &mut egui::Ui,
+    view: &mut View,
+    input: &CanvasToolInput<'_>,
+    buttons: &mut crate::paint_mouse::Buttons,
+) {
+    let ctx = input.ctx;
+    let response = input.response;
+    let xf = input.xf;
+    let tool = input.tool;
+    let idx = input.idx;
+    let primary = input.primary;
+    let transform_owns_pointer = input.transform_owns_pointer;
+    let hand_pan = input.hand_pan;
+    let ppp = input.ppp;
+    let zoom_out = input.zoom_out;
+    // The (temporary) Hand pans above; its gestures never reach the tool underneath. While a
+    // Free Transform box is open the Hand does not pan, so the box gets these events (#2302).
+    if hand_pan {
+        (buttons.started, buttons.dragged, buttons.stopped) = (false, false, false);
+    }
+    // Rotate View: drag around the view centre. Compass clicks are not a rotate drag.
+    let over_compass = crate::rotate_view::compass_visible(view.rotation)
+        && response.interact_pointer_pos().is_some_and(|p| crate::rotate_view::compass_rect(xf.rect).contains(p));
+    if tool == Tool::RotateView && !over_compass && crate::rotate_view::drag(ctx, view, xf, buttons, response.interact_pointer_pos()) {
+        (buttons.started, buttons.dragged, buttons.stopped, buttons.clicked) = (false, false, false, false);
+    }
+    // Animated Zoom: a Zoom press held still zooms continuously (zoom_hold.rs); while it does,
+    // it owns the press: no scrub, and its release is no click step.
+    if tool == Tool::Zoom && !transform_owns_pointer {
+        let out = zoom_out(ui.input(|i| i.modifiers.alt));
+        let on_canvas = !input.under_dialog && !over_compass && response.is_pointer_button_down_on();
+        let hold = crate::zoom_hold::hold_id(idx, primary, ctx.viewport_id());
+        if crate::zoom_hold::update(ctx, view, xf, app.session.prefs().general.animated_zoom, out, ppp, on_canvas, hold) {
+            (buttons.started, buttons.dragged, buttons.stopped, buttons.clicked) = (false, false, false, false);
+        }
+    }
+    // Zoom tool drags: scrubby zoom or a zoom rectangle (zoom_tool.rs); clicks step below.
+    // Like the Hand, the selected Zoom yields to an open Free Transform box (#4799).
+    if tool == Tool::Zoom && !transform_owns_pointer && crate::zoom_tool::drag(app, ctx, view, xf, buttons, response.interact_pointer_pos()) {
+        (buttons.started, buttons.dragged, buttons.stopped) = (false, false, false);
+    }
+}
+
+fn handle_canvas_tool_stroke(
+    app: &mut PhotocraftApp,
+    ui: &mut egui::Ui,
+    input: &CanvasToolInput<'_>,
+    mods: egui::Modifiers,
+    capture_press: bool,
+    tool_press: egui::Id,
+    buttons: &mut crate::paint_mouse::Buttons,
+) {
+    let ctx = input.ctx;
+    let response = input.response;
+    let xf = input.xf;
+    let rect = input.rect;
+    let full = input.full;
+    let tool = input.tool;
+    // A drag is only recognised once the pointer has moved past egui's click distance: the
+    // gesture starts where the button went down, not where it is now (#123).
+    let gesture_active_before = app.drag.is_some();
+    // Stroke timing: egui's events carry no timestamps, so a press takes the frame time and
+    // the moves below are spread between the previous point and this frame (`spread_ms`).
+    let now_ms = ui.input(|i| i.time) * 1000.0;
+    app.stylus.clock_ms = now_ms;
+    // Live painting tools start on the press, not once the pointer passes egui's click
+    // distance: the first dab shows at once. The drag recognised later continues that stroke,
+    // and a click (or a long press that never moved) just ends it.
+    let physical_right = app.services.right_button_down.as_ref().is_some_and(|f| f());
+    let right_down = ui.input(|i| i.pointer.secondary_down()) || physical_right;
+    if strokes_live(tool)
+        && !right_down
+        && app.drag.is_none()
+        && response.is_pointer_button_down_on()
+        && ui.input(|i| i.pointer.primary_pressed())
+        && let Some(p) = ui.input(|i| i.pointer.press_origin()).filter(|p| rect.contains(*p))
+    {
+        let d = xf.to_doc(p);
+        // The press's own modifiers: a ⇧ that arrives with the click still connects the line.
+        let press_mods = ui.input(|i| pointer_button_modifiers(&i.events, PointerButton::Primary)).unwrap_or(mods);
+        tool_event(app, ToolEvent::Down { x: d[0], y: d[1], pressure: app.stylus.pressure() }, press_mods);
+        app.press_stroke = app.drag.is_some();
+    }
+    let press_stroke = app.press_stroke;
+    // A live tool's press that went to the ⌥ eyedropper keeps sampling for the whole press: the
+    // drag recognised later must not decide again with ⌥ already let go and paint (#7802).
+    if press_stroke || (strokes_live(tool) && (app.alt_sampling || app.mixer_sampling)) {
+        buttons.started = false;
+    }
+    if buttons.started
+        && let Some(p) = ui.input(|i| i.pointer.press_origin()).filter(|p| rect.contains(*p)).or(response.interact_pointer_pos())
+    {
+        if tool == Tool::Move && app.ui.transform.is_none() {
+            begin_transform_controls_at(app, ctx, xf, p);
+        }
+        let d = xf.to_doc(p);
+        let press_mods = if capture_press { ctx.data(|d| d.get_temp(tool_press)).unwrap_or(mods) } else { mods };
+        tool_event(app, ToolEvent::Down { x: d[0], y: d[1], pressure: app.stylus.pressure() }, press_mods);
+    }
+    // A stroke started on the press takes its moves from the press on, not only once egui
+    // recognises a drag (past its click distance): otherwise the first few points are lost
+    // and the stroke starts with a straight segment and no pressure ramp.
+    let press_stroke_moving = press_stroke && app.drag.is_some();
+    if buttons.dragged || buttons.stopped || press_stroke_moving {
+        // Feed every pointer move the OS delivered this frame, not just the latest position, so
+        // a fast stroke is sampled densely and renders as a smooth curve instead of a coarse
+        // polyline. egui-winit pushes one `PointerMoved` per `CursorMoved`, and they accumulate
+        // while a frame is slow, so reading them all recovers the moves a per-frame
+        // `interact_pointer_pos()` would drop. Only freehand tools take the whole batch; the
+        // rest follow the pointer's latest position. The moves are bounded to the gesture's own
+        // press..release interval (`pointer_moves`), so the start and stop frames keep their
+        // valid samples without leaking a move from outside the gesture.
+        let events = ui.input(|i| i.events.clone());
+        let button = if response.dragged_by(PointerButton::Secondary)
+            || response.drag_started_by(PointerButton::Secondary)
+            || response.drag_stopped_by(PointerButton::Secondary)
+        {
+            PointerButton::Secondary
+        } else {
+            PointerButton::Primary
+        };
+        let press_this_frame = events.iter().any(|e| matches!(e, egui::Event::PointerButton { button: b, pressed: true, .. } if *b == button));
+        let down_at_start = !press_this_frame && (gesture_active_before || buttons.started);
+        let mut positions = if app.brush_resize.is_some() {
+            response.interact_pointer_pos().into_iter().collect()
+        } else if freehand_tool(tool) {
+            pointer_moves(&events, button, down_at_start)
+        } else if buttons.dragged {
+            response.interact_pointer_pos().into_iter().collect()
+        } else {
+            Vec::new()
+        };
+        // A frame with no raw move still tracks a held gesture (a still pointer, a modifier
+        // change): fall back to the latest position, as the old code always did.
+        if positions.is_empty()
+            && (buttons.dragged || press_stroke_moving)
+            && let Some(p) = response.interact_pointer_pos().or(ui.input(|i| i.pointer.latest_pos()))
+        {
+            positions.push(p);
+        }
+        app.defer_live_stroke = true;
+        let base = app.stylus.last_point_ms().map_or(now_ms, |t| t.min(now_ms));
+        let n = positions.len();
+        for (k, p) in positions.into_iter().enumerate() {
+            app.stylus.clock_ms = spread_ms(base, now_ms, k, n);
+            // This move's share of the pen samples the frame brought (pressure, tilt, rotation).
+            app.stylus.select(k, n);
+            let d = xf.to_doc(p);
+            tool_event(app, ToolEvent::Move { x: d[0], y: d[1], pressure: app.stylus.pressure() }, mods);
+        }
+        app.stylus.clear_selection();
+        app.stylus.clock_ms = now_ms;
+        // A held pen keeps the clock running for airbrush build-up and smoothing catch-up.
+        if app.drag.is_some() && stroke_wants_time(app) {
+            ctx.request_repaint_after(std::time::Duration::from_millis(HOLD_REPEAT_MS as u64));
+        }
+        app.defer_live_stroke = false;
+        // One live-stroke update for the whole frame, not one per recovered sample.
+        feed_live_stroke(app);
+        crate::magnetic_lasso_ui::flush(app);
+    }
+    if buttons.stopped {
+        // The live painting press already created the stroke and this release commits it.
+        // egui may also report clicked on the same release; replaying that click paints a
+        // second full-pressure dab over the real (possibly light-pressure) pen dab.
+        if press_stroke {
+            buttons.clicked = false;
+        }
+        let at = response.interact_pointer_pos();
+        // #6286: a guide let go over a ruler is removed, whichever ruler it is. Tested here in
+        // screen space, where the rulers are: on the guide's own axis the release can still be
+        // inside the document, which is what `finish_drag` sees.
+        if app.guide_drag.is_some() {
+            let on_ruler = at.is_some_and(|p| crate::rulers::dropped_on_a_ruler(app, full, p));
+            if let Some(g) = app.guide_drag.as_mut() {
+                g.over_ruler = on_ruler;
+            }
+        }
+        let p = at.map(|p| xf.to_doc(p)).or_else(|| app.drag.as_ref().and_then(|d| d.points.last().map(|q| [q[0], q[1]])));
+        if let Some(d) = p {
+            tap_at_peak_pressure(app);
+            tool_event(app, ToolEvent::Up { x: d[0], y: d[1] }, mods);
+        }
+    }
+    // A stroke started on the press ends with the release, whether egui saw a drag, a click,
+    // or neither (a long press that never moved).
+    if press_stroke && !buttons.stopped && ui.input(|i| i.pointer.primary_released()) {
+        buttons.clicked = false;
+        let p = response.interact_pointer_pos().map(|p| xf.to_doc(p)).or_else(|| app.drag.as_ref().and_then(|d| d.points.last().map(|q| [q[0], q[1]])));
+        if let Some(d) = p
+            && app.drag.is_some()
+        {
+            tap_at_peak_pressure(app);
+            tool_event(app, ToolEvent::Up { x: d[0], y: d[1] }, mods);
+        }
+    }
+    if press_stroke && (app.drag.is_none() || !ui.input(|i| i.pointer.primary_down())) {
+        app.press_stroke = false;
+    }
+}
+
+fn handle_canvas_tool_clicks(
+    app: &mut PhotocraftApp,
+    ui: &mut egui::Ui,
+    view: &mut View,
+    input: &CanvasToolInput<'_>,
+    mods: egui::Modifiers,
+    tool_press: egui::Id,
+    buttons: &crate::paint_mouse::Buttons,
+) {
+    let ctx = input.ctx;
+    let response = input.response;
+    let xf = input.xf;
+    let rect = input.rect;
+    let tool = input.tool;
+    let transform_owns_pointer = input.transform_owns_pointer;
+    let ppp = input.ppp;
+    let zoom_out = input.zoom_out;
+    let display_zoom = input.display_zoom;
+    if buttons.clicked
+        && let Some(p) = response.interact_pointer_pos()
+    {
+        let click_button = if app.secondary_erase { PointerButton::Secondary } else { PointerButton::Primary };
+        let click_mods = ui.input(|i| pointer_button_modifiers(&i.events, click_button)).unwrap_or(mods);
+        let click_mods = if tool == Tool::ObjectSelection && click_button == PointerButton::Primary {
+            ctx.data(|d| d.get_temp(tool_press)).unwrap_or(click_mods)
+        } else {
+            click_mods
+        };
+        let d = xf.to_doc(p);
+        match tool {
+            Tool::Zoom if !transform_owns_pointer => {
+                let nz = crate::zoom_levels::step(view.zoom, if zoom_out(click_mods.alt) { -1 } else { 1 }, view.doc_size);
+                let center = app.session.prefs().tools.zoom_clicked_point_to_center;
+                let doc_anchor = xf.to_doc(p);
+                let screen_anchor = p;
+                zoom_about(view, xf, p, nz, center, ppp);
+                view.request_zoom_animation(app.session.prefs().general.animated_zoom && nz != display_zoom);
+                view.zoom_anchor = (view.zoom_animating && !center).then_some((doc_anchor, [screen_anchor.x, screen_anchor.y]));
+            }
+            // A click with the (temporary) Hand does nothing, never the tool underneath.
+            Tool::Hand | Tool::RotateView => {}
+            // Double-clicking closes the polygonal lasso: the first click placed the last
+            // vertex (or already closed it), so the second never starts a new polygon. egui
+            // reports it as a triple click when a vertex went down shortly before.
+            Tool::PolygonLasso if response.double_clicked() || response.triple_clicked() => commit_polygon(app),
+            // The same for the Magnetic Lasso: along the edges, or straight with ⌥.
+            Tool::MagneticLasso if response.double_clicked() || response.triple_clicked() => crate::magnetic_lasso_ui::close(app, mods.alt),
+            // The first click placed (or grabbed) the point; the second toggles it.
+            Tool::CurvaturePen if response.double_clicked() => crate::vector_ui::curvature_toggle(app, d[0], d[1]),
+            // Double-clicking a guide opens Preferences › Guides, Grid & Slices, as in Photoshop.
+            Tool::Move if response.double_clicked() && crate::rulers::guide_at(app, d[0], d[1]).is_some() => {
+                if let Err(e) = crate::menus::invoke(app, ctx, "edit.preferences.guidesGridAndSlices", json!({})) {
+                    app.ui.status = e;
+                }
+            }
+            _ => {
+                if tool == Tool::Move && app.ui.transform.is_none() {
+                    begin_transform_controls_at(app, ctx, xf, p);
+                }
+                // If this tool was not handled on pointer-down, fall back to a
+                // click-sized gesture while preserving pen pressure (mouse stays at 1).
+                tool_event(app, ToolEvent::Down { x: d[0], y: d[1], pressure: app.stylus.pressure() }, click_mods);
+                tap_at_peak_pressure(app);
+                tool_event(app, ToolEvent::Up { x: d[0], y: d[1] }, click_mods);
+            }
+        }
+    }
+    // Magnetic Lasso: between clicks the border follows the pointer with the button up.
+    if tool == Tool::MagneticLasso && app.ui.magnetic.active() && !(buttons.started || buttons.dragged || buttons.stopped) && response.hovered() {
+        let moves: Vec<Pos2> = ui.input(|i| i.events.iter().filter_map(|e| if let egui::Event::PointerMoved(p) = e { Some(*p) } else { None }).collect());
+        app.defer_live_stroke = true;
+        for p in moves.into_iter().filter(|p| rect.contains(*p)) {
+            let d = xf.to_doc(p);
+            tool_event(app, ToolEvent::Move { x: d[0], y: d[1], pressure: app.stylus.pressure() }, mods);
+        }
+        app.defer_live_stroke = false;
+        crate::magnetic_lasso_ui::flush(app);
+    }
+    // Move tool: a double-click on type edits it, as in Photoshop (#1132). Only the selected
+    // Move tool, not ⌘ held over another tool; an open transform box keeps its double-click
+    // (commit, below).
+    if tool == Tool::Move
+        && app.ui.tool == Tool::Move
+        && app.ui.transform.is_none()
+        && response.double_clicked()
+        && let Some(p) = response.interact_pointer_pos()
+    {
+        let d = xf.to_doc(p);
+        crate::type_tool::edit_at(app, d[0], d[1]);
+    }
+    if app.ui.transform.is_some() && response.double_clicked() {
+        crate::transform_tool::commit(app);
+    }
+    if crate::cam_transform::active(app) && response.double_clicked() {
+        crate::cam_transform::commit(app);
+    }
+    // Crop: a double-click inside the frame commits it, as ↵ does (#1792).
+    if tool == Tool::Crop && response.double_clicked() && response.interact_pointer_pos().is_some_and(|p| crate::crop_ui::commits_at(app, xf.to_doc(p))) {
+        commit_crop(app);
+    }
+    // Type: 2 clicks select a word, 3 the line, 4 the paragraph, 5 all text (Photoshop).
+    if tool.is_type()
+        && response.clicked()
+        && let Some(p) = response.interact_pointer_pos()
+    {
+        if crate::type_transform::visible(app, crate::workspace_ui::sticky_mods(app, mods)) {
+            app.type_clicks = None;
+        } else {
+            let n = if response.triple_clicked() {
+                3
+            } else if response.double_clicked() {
+                2
+            } else {
+                1
+            };
+            let d = xf.to_doc(p);
+            crate::type_tool::multi_click(app, n, d[0], d[1]);
+        }
+    }
+}
+
+struct CanvasOverlayInput<'a> {
+    ctx: &'a egui::Context,
+    painter: &'a egui::Painter,
+    xf: &'a ViewXform,
+    response: &'a egui::Response,
+    doc: &'a std::sync::Arc<Document>,
+    tool: Tool,
+    idx: usize,
+    output: Option<u32>,
+    border: photocraft_engine::prefs::CanvasBorder,
+    beyond: bool,
+    edge_rect: Rect,
+    panning: bool,
+    zoom_out: &'a dyn Fn(bool) -> bool,
+}
+
+fn paint_primary_overlays(app: &mut PhotocraftApp, ui: &mut egui::Ui, view: &mut View, input: &CanvasOverlayInput<'_>) {
+    let ctx = input.ctx;
+    let painter = input.painter;
+    let xf = input.xf;
+    let response = input.response;
+    let doc = input.doc;
+    let idx = input.idx;
+    let border = input.border;
+    let beyond = input.beyond;
+    let edge_rect = input.edge_rect;
+    // The transform preview is image content: it goes under the grid and guides, which
+    // stay visible across a layer being transformed (#5086); the box is drawn later.
+    crate::transform_tool::draw_content(app, painter, xf);
+    // So are Puppet Warp's, Perspective Warp's and Vanishing Point's warped pixels (#7781).
+    crate::distort_ui::draw_content(app, painter, xf);
+    if app.ui.extras.grid && app.ui.view.extras {
+        crate::rulers::draw_grid(app, painter, xf, doc);
+    }
+    if app.ui.view.shows(app.ui.view.show.canvas_guides) || crate::guide_layout_ui::preview(app, doc).is_some() {
+        crate::rulers::draw_guides(app, painter, xf, doc);
+    }
+    // The pending crop frame shows on its own document only, not on the other tiles (#1918).
+    let foreign_crop = if app.session.active_index() == Some(idx) { None } else { app.ui.crop_rect.take() };
+    draw_drag_preview(app, painter, xf);
+    if app.session.active_index() == Some(idx) {
+        crate::move_box::draw(app, painter, xf);
+    }
+    if foreign_crop.is_some() {
+        app.ui.crop_rect = foreign_crop;
+    }
+    crate::zoom_tool::draw(ctx, painter);
+    let resizing = crate::brush_resize::draw(app, painter, xf);
+    draw_transform_controls(app, painter, xf);
+    crate::move_hover::draw(app, painter, xf, idx, response.hover_pos());
+    crate::object_finder::draw(app, painter, xf, idx, response.hover_pos());
+    crate::layer_pick_ui::show(app, ctx);
+    let shown = app.ui.views.get(idx).cloned();
+    crate::canvas_tool_menu::show(app, ctx);
+    // A view menu row (Zoom In, Fit on Screen…) changed the camera: it wins over this
+    // frame's copy, which is written back at the end.
+    if let Some(now) = app.ui.views.get(idx)
+        && Some(now) != shown.as_ref()
+    {
+        *view = now.clone();
+        ctx.request_repaint();
+    }
+    crate::snap_ui::draw(app, painter, xf);
+    crate::move_distance::draw(app, painter, xf, idx, response.hover_pos());
+    // The canvas edge isn't outlined while the pixels past it show (Photoshop's crop preview),
+    // nor while the Crop tool hides everything outside its box (Show Cropped Area off).
+    if border == photocraft_engine::prefs::CanvasBorder::Line && !beyond && !crate::crop_shield::hides_outside(app) {
+        painter.rect_stroke(edge_rect, 0.0, Stroke::new(1.0, Color32::from_gray(20)), egui::StrokeKind::Outside);
+    }
+    crate::type_tool::draw_overlay(app, painter, xf);
+    crate::transform_tool::draw_overlay(app, painter, xf);
+    crate::cam_transform::draw(app, painter, xf);
+    crate::cam_preview::wake(app, painter.ctx());
+    crate::distort_ui::draw_overlay(app, painter, xf);
+    crate::perspective_crop_ui::draw_overlay(app, painter, xf);
+    crate::retouch_ui::draw_source_marker(app, painter, xf);
+    crate::vector_ui::draw_overlay(app, painter, xf, doc);
+    crate::symmetry_ui::draw(app, painter, xf);
+    crate::analysis_ui::draw_overlay(app, painter, xf);
+    crate::gradient_ui::draw_overlay(app, painter, xf);
+    crate::slice_ui::draw_overlay(app, painter, xf);
+    crate::frame_tool::draw_overlay(app, painter, xf);
+    crate::artboard_tool::draw_overlay(app, painter, xf);
+
+    draw_canvas_tool_cursor(app, ui, input, resizing);
+}
+
+fn draw_canvas_tool_cursor(app: &mut PhotocraftApp, ui: &mut egui::Ui, input: &CanvasOverlayInput<'_>, resizing: bool) {
+    let ctx = input.ctx;
+    let xf = input.xf;
+    let response = input.response;
+    let tool = input.tool;
+    let panning = input.panning;
+    // Tool cursors (Photoshop-style).
+    let guide_hover = response.hover_pos().and_then(|p| {
+        let d = xf.to_doc(p);
+        if tool == Tool::Move {
+            return crate::rulers::guide_at(app, d[0], d[1]);
+        }
+        command_guide_at(app, tool, d, crate::workspace_ui::sticky_mods(app, ui.input(|i| i.modifiers)))
+    });
+    if panning {
+        // The fist set with the pan above stays (#2196).
+    } else if crate::tool_cursor::pointer_elsewhere(ctx, &crate::panel_docking::native_viewports(app, ctx)) {
+        // The pointer is over a floating panel's own window; this window's last position of
+        // it is stale, so no tool cursor or brush outline is painted at it.
+    } else if let Some((vertical, _)) = guide_hover {
+        ui.ctx().set_cursor_icon(crate::rulers::guide_cursor(xf, vertical));
+    } else if let Some((p, mods, c)) = response.hover_pos().and_then(|p| {
+        let mods = crate::workspace_ui::sticky_mods(app, ui.input(|i| i.modifiers));
+        let c = crate::transform_tool::cursor(app, xf, xf.to_doc(p), mods)?;
+        Some((p, mods, c))
+    }) {
+        ui.ctx().set_cursor_icon(c);
+        // CursorIcon::None hides the pointer; the curved arrow has to be drawn or the
+        // rotate zone looks like a plain cursor (#4050).
+        let d = xf.to_doc(p);
+        if let Some(k) = crate::transform_tool::rotate_cursor_dir(app, d) {
+            let toward = xf.to_screen((d[0] + k[0] * 16.0) as f32, (d[1] + k[1] * 16.0) as f32) - p;
+            crate::crop_ui::draw_turn_cursor(ctx, p, toward);
+        } else if c == egui::CursorIcon::None {
+            // Likewise the distort and skew pointers over a handle (#5405).
+            crate::transform_tool::draw_handle_cursor(app, ctx, xf, p, mods);
+        }
+    } else if let Some(c) = response.hover_pos().and_then(|p| crate::symmetry_ui::cursor(app, xf, xf.to_doc(p))) {
+        ui.ctx().set_cursor_icon(c);
+    } else if let Some(c) = response.hover_pos().and_then(|p| crate::cam_transform::cursor(app, ctx, xf, p)) {
+        ui.ctx().set_cursor_icon(c);
+    } else if let Some(p) = response.hover_pos().filter(|p| crate::corner_radius::hovers(app, xf.to_doc(*p))) {
+        // Over a live rectangle's corner widget (or dragging one): the arrow with a rounded
+        // corner badge, as Photoshop's corner radius cursor.
+        ui.ctx().set_cursor_icon(egui::CursorIcon::Default);
+        crate::icons::cursor_badge(ctx, "scan", p);
+    } else if let Some((r, p, c)) = response
+        .hover_pos()
+        .filter(|_| !transform_controls_several(app))
+        .and_then(|p| transform_controls_rect(app, xf).and_then(|r| transform_controls_cursor(r, p).map(|c| (r, p, c))))
+    {
+        // The Move tool draws handles without opening a Free Transform session.
+        // Give them their resize/rotate cursors before the first pointer press (#2871).
+        ui.ctx().set_cursor_icon(c);
+        if let Some(toward) = transform_controls_turn(r, p) {
+            crate::crop_ui::draw_turn_cursor(ctx, p, toward);
+        }
+    } else if let Some(c) = response.hover_pos().filter(|_| tool.is_type()).and_then(|p| {
+        let mods = crate::workspace_ui::sticky_mods(app, ui.input(|i| i.modifiers));
+        crate::type_transform::cursor(app, ctx, xf, p, mods)
+    }) {
+        ui.ctx().set_cursor_icon(c);
+    } else if let Some(c) = response.hover_pos().filter(|_| tool == Tool::Artboard).and_then(|p| crate::artboard_tool::cursor(app, xf, xf.to_doc(p))) {
+        ui.ctx().set_cursor_icon(c);
+    } else if let Some((p, c)) = response.hover_pos().filter(|_| tool == Tool::Crop).and_then(|p| Some((p, crate::crop_ui::cursor(app, xf.to_doc(p))?))) {
+        ui.ctx().set_cursor_icon(c);
+        let d = xf.to_doc(p);
+        if let Some(k) = crate::crop_ui::turn_cursor_dir(app, d) {
+            let toward = xf.to_screen((d[0] + k[0] * 16.0) as f32, (d[1] + k[1] * 16.0) as f32) - p;
+            crate::crop_ui::draw_turn_cursor(ctx, p, toward);
+        }
+    } else if let Some(p) = response.hover_pos()
+        && let Some(c) = selection_cursor(app, tool, xf.to_doc(p), crate::workspace_ui::sticky_mods(app, ui.input(|i| i.modifiers)))
+    {
+        // Over a selection (Photoshop's cursors): the move cursor where a press drags the
+        // outline (#1428), the arrow with a badge for what a press does to the selected
+        // pixels, a hollow arrowhead while they are dragged, a plain arrow over a floating
+        // piece.
+        let icon = match c {
+            SelCursor::Outline => egui::CursorIcon::Move,
+            SelCursor::Dragging => {
+                // The tip of the arrowhead is at (4, 4) of its 24-unit box.
+                crate::icons::cursor(ui.ctx(), "mouse-pointer-2", p, vec2(4.0, 4.0) / 24.0, 18.0);
+                egui::CursorIcon::None
+            }
+            SelCursor::Piece => egui::CursorIcon::Default,
+            SelCursor::Cut => {
+                crate::icons::cursor_badge(ui.ctx(), "scissors", p);
+                egui::CursorIcon::Default
+            }
+            SelCursor::Copy => {
+                crate::icons::cursor_copy_badge(ui.ctx(), p);
+                egui::CursorIcon::Default
+            }
+        };
+        ui.ctx().set_cursor_icon(icon);
+    } else if let Some(p) = response.hover_pos() {
+        draw_default_tool_cursor(app, ui, input, resizing, p);
+    }
+}
+
+fn draw_default_tool_cursor(app: &mut PhotocraftApp, ui: &mut egui::Ui, input: &CanvasOverlayInput<'_>, resizing: bool, p: Pos2) {
+    let painter = input.painter;
+    let xf = input.xf;
+    let response = input.response;
+    let tool = input.tool;
+    let output = input.output;
+    let zoom_out = input.zoom_out;
+
+    let alt = ui.input(|i| i.modifiers.alt);
+    if !resizing && !alt && !app.ui.shell.sticky_alt {
+        draw_clone_preview(app, painter, xf, xf.to_doc(p), output);
+    }
+    // The Type tool over a path shows Photoshop's area-type or type-on-a-path pointer (#218).
+    // Not while a type edit is open or a text box is dragged out, nor over type a click
+    // would edit (`hover_path_target`).
+    let type_path = if matches!(tool, Tool::Type | Tool::VerticalType) {
+        let [x, y] = xf.to_doc(p);
+        let shift = crate::workspace_ui::sticky_mods(app, ui.input(|i| i.modifiers)).shift;
+        crate::type_tool::hover_path_target(app, x, y, shift)
+    } else {
+        None
+    };
+    let icon = match tool {
+        // Resizing the brush: the circle stays where the drag began (`brush_resize`).
+        t if resizing && crate::brush_resize::applies(t) => egui::CursorIcon::None,
+        // ⌥ turns a painting tool into the Eyedropper (`alt_eyedropper`): its cursor too,
+        // unless Preferences › Cursors › Other Cursors asks for the precise crosshair.
+        t if app.alt_sampling
+            || (app.drag.is_none()
+                && !app.services.right_button_down.as_ref().is_some_and(|f| f())
+                && alt_samples(t, crate::workspace_ui::sticky_mods(app, ui.input(|i| i.modifiers)))) =>
+        {
+            // While it samples (button held), the comparison ring replaces the cursor (#213).
+            if let Some(icon) = eyedropper_ring(app, painter, xf, p, response.is_pointer_button_down_on()) {
+                icon
+            } else if app.session.prefs().cursors.other == photocraft_engine::prefs::OtherCursor::Precise {
+                egui::CursorIcon::Crosshair
+            } else {
+                pipette_cursor(ui.ctx(), p)
+            }
+        }
+        t if t.is_brushlike() || t == Tool::QuickSelection => {
+            // Preferences › Cursors: brush tip outline (normal = the 50% contour, or
+            // full size), precise crosshair, or the standard pointer.
+            use photocraft_engine::prefs::PaintingCursor;
+            let cur = app.session.prefs().cursors.clone();
+            // ⇪ forces the precise crosshair, whatever the cursor preference (#1758).
+            if app.caps_lock {
+                crate::tool_cursor::crosshair(painter, p, 6.0, 0.0)
+            } else {
+                let painting = app.drag.is_some();
+                let brush = &app.session.tools.brush;
+                let full = (brush.size / 2.0 * xf.zoom).max(1.0);
+                match cur.painting {
+                    PaintingCursor::Standard => egui::CursorIcon::Default,
+                    PaintingCursor::Precise => crate::tool_cursor::crosshair(painter, p, 6.0, 0.0),
+                    _ if painting && cur.show_only_crosshair_while_painting => crate::tool_cursor::crosshair(painter, p, 5.0, 0.0),
+                    // The Pencil (and the Eraser in Pencil mode): the outline of the
+                    // whole pixels its dab fills, on the pixel grid. A round tip is a
+                    // disc, a tiny one the whole square (#2662). The Block-mode Eraser:
+                    // its square, 16 screen pixels at any zoom (#2770).
+                    _ if tool == Tool::Pencil || crate::eraser_ui::pencil_mode(app, tool) || crate::eraser_ui::block_mode(app, tool) => {
+                        let block = crate::eraser_ui::block_mode(app, tool);
+                        let size = if block { crate::eraser_ui::block_size(app) } else { brush.size };
+                        let ppp = painter.ctx().pixels_per_point();
+                        let sq = pencil_cursor_rect(xf, xf.to_doc(p), size, ppp);
+                        let px = 1.0 / ppp;
+                        let (dark, light) = (Stroke::new(px, Color32::from_black_alpha(160)), Stroke::new(px, Color32::from_white_alpha(230)));
+                        if !block && pencil_tip_is_round(size) {
+                            let r = sq.width() / 2.0;
+                            painter.circle_stroke(sq.center(), r + px / 2.0, dark);
+                            painter.circle_stroke(sq.center(), (r - px / 2.0).max(0.0), light);
+                        } else {
+                            painter.rect_stroke(sq, 0.0, dark, egui::StrokeKind::Outside);
+                            painter.rect_stroke(sq, 0.0, light, egui::StrokeKind::Inside);
+                        }
+                        // Too small to see where it is: the hotspot as well.
+                        if cur.show_crosshair_in_brush_tip || sq.width() < 6.0 {
+                            crate::tool_cursor::crosshair(painter, p, 4.0, 0.0);
+                        }
+                        egui::CursorIcon::None
+                    }
+                    // A shaped tip (sampled bitmap, or a rotated/flattened round tip)
+                    // traces its outline, turned and flipped with the view; a plain round
+                    // tip keeps the circle.
+                    _ => {
+                        let centre = brush_tip_centre(tool, alt || app.ui.shell.sticky_alt, cur.show_crosshair_in_brush_tip);
+                        let axes = crate::brush_cursor::pen_axes(xf, brush, app.stylus.sample());
+                        crate::brush_cursor::cursor(painter, p, brush, full, axes, cur.painting == PaintingCursor::NormalTip, centre)
+                    }
+                }
+            }
+        }
+        // The Eyedropper: the comparison ring follows the pointer while it samples (#213);
+        // otherwise its pipette, or the crosshair for precise Other Cursors.
+        Tool::Eyedropper => {
+            if let Some(icon) = eyedropper_ring(app, painter, xf, p, response.is_pointer_button_down_on()) {
+                icon
+            } else if precise_other_cursor(app) {
+                egui::CursorIcon::Crosshair
+            } else {
+                pipette_cursor(ui.ctx(), p)
+            }
+        }
+        // The Color Sampler: a pipette, or the crosshair for precise Other Cursors.
+        Tool::ColorSampler => {
+            if precise_other_cursor(app) {
+                egui::CursorIcon::Crosshair
+            } else {
+                pipette_cursor(ui.ctx(), p)
+            }
+        }
+        // The Paint Bucket: a bucket, or the crosshair for precise Other Cursors (#3968).
+        Tool::PaintBucket => {
+            if precise_other_cursor(app) {
+                egui::CursorIcon::Crosshair
+            } else {
+                paint_bucket_cursor(ui.ctx(), p)
+            }
+        }
+        // Over the first anchor, the close-path pointer (#4596), before the pens' own cursors.
+        Tool::Pen | Tool::CurvaturePen
+            if {
+                let [x, y] = xf.to_doc(p);
+                crate::vector_ui::closes_path_at(app, tool, x, y)
+            } =>
+        {
+            crate::tool_cursor::close_path(painter, p)
+        }
+        // The pen tools: their own icon with its nib on the point, or the crosshair for
+        // precise Other Cursors (#4639).
+        Tool::Pen | Tool::FreeformPen | Tool::CurvaturePen | Tool::AddAnchorPoint | Tool::DeleteAnchorPoint | Tool::ConvertPoint => {
+            if precise_other_cursor(app) { egui::CursorIcon::Crosshair } else { pen_cursor(ui.ctx(), tool, p) }
+        }
+        // Preferences › Cursors › Other Cursors: Precise shows a crosshair for every tool.
+        Tool::Move | Tool::Type | Tool::VerticalType | Tool::HorizontalTypeMask | Tool::VerticalTypeMask
+            if app.session.prefs().cursors.other == photocraft_engine::prefs::OtherCursor::Precise =>
+        {
+            egui::CursorIcon::Crosshair
+        }
+        // Photoshop's Move tool keeps the standard arrow pointer (#5646): the movable
+        // layer under it is marked by the hover outline, not by a different cursor.
+        Tool::Move => egui::CursorIcon::Default,
+        // Dragging is handled with the pan itself, above.
+        Tool::Hand => crate::tool_cursor::hand(ui.ctx(), false),
+        Tool::RotateView => crate::rotate_view::cursor(response.dragged()),
+        Tool::Zoom => crate::tool_cursor::zoom(ui.ctx(), zoom_out(alt)),
+        Tool::Type | Tool::VerticalType if type_path.is_some() => match type_path {
+            Some(crate::type_tool::PathClick::Area { .. }) => crate::tool_cursor::area_type(painter, p),
+            _ => crate::tool_cursor::path_type(painter, p),
+        },
+        Tool::Type | Tool::VerticalType | Tool::HorizontalTypeMask | Tool::VerticalTypeMask => egui::CursorIcon::Text,
+        Tool::MagneticLasso => crate::magnetic_lasso_ui::cursor(app, painter, p, xf.zoom),
+        Tool::RedEye => {
+            let pupil = app.ui.tool_options.red_eye_pupil_size.clamp(1.0, 100.0);
+            let r_doc = photocraft_algo::redeye::search_radius(pupil);
+            let r = (r_doc * xf.zoom).max(2.0);
+            painter.circle_stroke(p, r + 0.5, Stroke::new(1.0, Color32::from_black_alpha(140)));
+            painter.circle_stroke(p, r, Stroke::new(1.0, Color32::from_white_alpha(220)));
+            for (w, c) in [(2.5, Color32::from_black_alpha(140)), (1.0, Color32::from_white_alpha(220))] {
+                painter.line_segment([p - vec2(3.0, 0.0), p + vec2(3.0, 0.0)], Stroke::new(w, c));
+                painter.line_segment([p - vec2(0.0, 3.0), p + vec2(0.0, 3.0)], Stroke::new(w, c));
+            }
+            egui::CursorIcon::None
+        }
+        _ => egui::CursorIcon::Crosshair,
+    };
+    let icon = visible_crosshair(icon, painter, p, cfg!(not(target_arch = "wasm32")));
+    ui.ctx().set_cursor_icon(icon);
+    // Selection tools: + / − / × badge for the effective mode (#170). A gesture keeps the
+    // mode it started with (⇧ then constrains the marquee instead of adding).
+    let held = crate::workspace_ui::sticky_mods(app, ui.input(|i| i.modifiers));
+    let mods = app.drag.as_ref().map_or(held, |d| d.modifiers);
+    if let Some(b) = crate::tool_feedback::badge(app, tool, mods) {
+        crate::tool_feedback::draw_badge(painter, p, b, tool == Tool::QuickSelection);
+    }
+    // ⇧ after a stroke: the straight line a click would paint (#257).
+    crate::stroke_constraint::draw_line_preview(app, painter, xf, p, tool, held.shift);
+}
+
+struct CanvasTailInput<'a> {
+    ctx: &'a egui::Context,
+    painter: &'a egui::Painter,
+    response: &'a egui::Response,
+    doc: &'a std::sync::Arc<Document>,
+    xf: ViewXform,
+    rect: Rect,
+    full: Rect,
+    idx: usize,
+    primary: bool,
+    tool: Tool,
+    middle: bool,
+    flip: bool,
+    aspect: f32,
+    bars_id: egui::Id,
+    layer_edges: egui::layers::ShapeIdx,
+    camera: Option<([f32; 2], f32)>,
+}
+
+fn finish_canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, view: &mut View, input: &CanvasTailInput<'_>) {
+    let ctx = input.ctx;
+    let painter = input.painter;
+    let response = input.response;
+    let doc = input.doc;
+    let xf = input.xf;
+    let rect = input.rect;
+    let full = input.full;
+    let idx = input.idx;
+    let primary = input.primary;
+    let tool = input.tool;
+    let middle = input.middle;
+    let flip = input.flip;
+    let aspect = input.aspect;
+    let bars_id = input.bars_id;
+    let layer_edges = input.layer_edges;
+    let camera = input.camera;
+    app.tool_override = None;
+    if let Some(b) = layer_edges_rect(app, idx) {
+        painter.set(layer_edges, egui::Shape::rect_stroke(xf.doc_rect(b), 0, Stroke::new(1.0, LAYER_EDGES), egui::StrokeKind::Outside));
+    }
+    // A tool drag held past the canvas edge scrolls the view toward the pointer (#4183); the
+    // drag's next move then extends into what scrolled in.
+    if primary
+        && app.drag.is_some()
+        && tool != Tool::Hand
+        && !middle
+        && let Some(p) = ui.input(|i| i.pointer.primary_down().then(|| i.pointer.latest_pos()).flatten())
+    {
+        let step = crate::canvas_autoscroll::edge_step(p, rect, ui.input(|i| i.stable_dt));
+        if crate::canvas_autoscroll::scroll(view, step, xf) {
+            ctx.request_repaint();
+        }
+    }
+    // Scrollbars (scrollbars.rs): drawn over the canvas edges, they take the pointer there.
+    let t0 = crate::gpu_canvas::now_ms();
+    let before = view.center;
+    let over_bars = app.ui.view.shows_scrollbars()
+        && crate::scrollbars::show(ui, rect, view, flip, aspect, app.session.prefs().tools.overscroll, egui::Id::unique(("pc-canvas", idx)));
+    ctx.data_mut(|d| d.insert_temp(bars_id, over_bars));
+    if view.center != before {
+        ctx.request_repaint();
+    }
+    if primary {
+        app.perf.span("scrollbars", crate::gpu_canvas::now_ms() - t0);
+        app.hover_doc = response.hover_pos().map(|p| xf.to_doc(p));
+    }
+    if primary && app.ui.extras.rulers {
+        let before = app.guide_drag;
+        crate::rulers::draw_rulers(app, ui, full, &xf);
+        // A guide dragged out of a ruler moved after this frame drew it: draw it again where it is.
+        if app.guide_drag != before {
+            ctx.request_repaint();
+        }
+    } else if app.ui.extras.rulers {
+        crate::rulers::paint_rulers(app, ui, full, &xf, doc);
+    }
+    // After the ruler drags above, so the readout shows where the guide is now, and not after a
+    // release ended the drag.
+    if app.session.active_index() == Some(idx) {
+        crate::rulers::draw_guide_drag_readout(app, ctx);
+    }
+    crate::rotate_view::overlay(app, ctx, painter, &xf, view, response);
+    if primary {
+        // Tool input can change the stored camera while navigation edits the local view.
+        // Merge changed camera values so write-back preserves tool-driven pan and rotation.
+        if let (Some((center, rotation)), Some(now)) = (camera, app.ui.views.get(idx)) {
+            if now.center != center {
+                view.center = now.center;
+                ctx.request_repaint();
+            }
+            if now.rotation != rotation {
+                view.rotation = now.rotation;
+                ctx.request_repaint();
+            }
+        }
+        app.ui.views[idx] = (*view).clone();
+    }
+}
+
+/// A Properties Levels/Curves eyedropper (layer_picker.rs) owns the image until Esc or another
+/// tool; Space and the middle button still pan. It samples on the press.
+fn layer_picker_eyedropper(app: &mut PhotocraftApp, ui: &egui::Ui, ctx: &egui::Context, response: &egui::Response, xf: &ViewXform) {
+    if response.hovered()
+        && let Some(p) = ui.input(|i| i.pointer.hover_pos())
+    {
+        if app.session.prefs().cursors.other == photocraft_engine::prefs::OtherCursor::Precise {
+            ctx.set_cursor_icon(egui::CursorIcon::Crosshair);
+        } else {
+            ctx.set_cursor_icon(pipette_cursor(ctx, p));
+        }
+    }
+    if response.is_pointer_button_down_on()
+        && ui.input(|i| i.pointer.primary_pressed())
+        && let Some(p) = ui.input(|i| i.pointer.interact_pos())
+    {
+        let d = xf.to_doc(p);
+        crate::layer_picker::sample_at(app, d[0], d[1]);
+    }
+}
+
+/// Per-frame reconciliation of the camera with its document: resize re-centre, pending fit/fill,
+/// and the overscroll clamp. Returns the pixel aspect the view is drawn with.
+fn sync_view_to_document(app: &PhotocraftApp, ctx: &egui::Context, view: &mut View, doc: &Document, rect: Rect, ppp: f32) -> f32 {
+    let size = [doc.size.width, doc.size.height];
+    if view.doc_size != size {
+        // Like Photoshop: keep the zoom level, re-centre the resized document.
+        if view.doc_size != [0, 0] {
+            view.center = [size[0] as f32 / 2.0, size[1] as f32 / 2.0];
+        }
+        view.doc_size = size;
+    }
+    // View › Pixel Aspect Ratio Correction: document pixels are shown this much wider.
+    let aspect = app.ui.view.display_aspect();
+    if view.fit_pending && rect.width() > 50.0 {
+        fit_view(view, doc, rect.size(), ppp, aspect);
+    }
+    if view.fill_pending && rect.width() > 50.0 {
+        fill_view(view, doc, rect.size(), ppp, aspect);
+    }
+    // Preferences › Tools › Overscroll off: clamp before anything is drawn (scrollbars.rs).
+    if !app.session.prefs().tools.overscroll && crate::scrollbars::clamp_view_with_aspect(view, rect.size(), ppp, aspect) {
+        view.zoom_anchor = None;
+        ctx.request_repaint();
+    }
+    aspect
+}
+
 pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect: Rect, mut view: View, primary: bool) -> View {
     let ctx = ui.ctx().clone();
     // The camera as the app holds it before this frame's input. The canvas works on its own copy
@@ -257,26 +1798,7 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
     }
     let doc = app.session.documents()[idx].doc.clone();
     let size = [doc.size.width, doc.size.height];
-    if view.doc_size != size {
-        // Like Photoshop: keep the zoom level, re-centre the resized document.
-        if view.doc_size != [0, 0] {
-            view.center = [size[0] as f32 / 2.0, size[1] as f32 / 2.0];
-        }
-        view.doc_size = size;
-    }
-    // View › Pixel Aspect Ratio Correction: document pixels are shown this much wider.
-    let aspect = app.ui.view.display_aspect();
-    if view.fit_pending && rect.width() > 50.0 {
-        fit_view(&mut view, &doc, rect.size(), ppp, aspect);
-    }
-    if view.fill_pending && rect.width() > 50.0 {
-        fill_view(&mut view, &doc, rect.size(), ppp, aspect);
-    }
-    // Preferences › Tools › Overscroll off: clamp before anything is drawn (scrollbars.rs).
-    if !app.session.prefs().tools.overscroll && crate::scrollbars::clamp_view_with_aspect(&mut view, rect.size(), ppp, aspect) {
-        view.zoom_anchor = None;
-        ctx.request_repaint();
-    }
+    let aspect = sync_view_to_document(app, &ctx, &mut view, &doc, rect, ppp);
     let flip = app.ui.view.flip_horizontal;
     // Document rendering follows the target; only shader uniforms and overlay geometry ease.
     let target_xf = ViewXform { rect, zoom: view.zoom / ppp, center: view.center, flip, rotation: view.rotation, aspect };
@@ -305,302 +1827,24 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
     // Default-mode Crop changes its camera during input. Defer its image until the new camera
     // is known; other tools keep their existing paint order and texture/outline snapshots.
     let crop_camera = primary && crate::crop_mode::moves_image(app);
-    let paint_canvas = |app: &mut PhotocraftApp, ui: &egui::Ui, view: &View, xf: ViewXform| {
-        let point_zoom = view.zoom / ppp;
-        let drop_shadow = border == photocraft_engine::prefs::CanvasBorder::DropShadow;
-        // Drop shadow, checkerboard, document image.
-        let img_rect = xf.doc_rect(doc.bounds());
-        // The canvas edge the Line border outlines: a size-changing preview's own (CPU canvas).
-        let mut edge_rect = img_rect;
-        // The document area the image is drawn over: a size-changing preview's own on the CPU
-        // canvas (Image › Rotation). Overlays drawn from the same preview follow it.
-        let mut shown_area = doc.bounds();
-        // Crop tool: the layers' pixels past the canvas while a frame is edited, under the canvas
-        // (whose edge blends into them) and without its shadow.
-        let beyond = draw_beyond_canvas(app, &painter, &xf, idx, output);
-        // View › Pattern Preview (#1067): copies of the document around it, from the same texture.
-        let pattern = if app.ui.view.pattern_preview {
-            let v = visible_doc_rect(&xf);
-            crate::pattern_preview::copies([v.x0, v.y0, v.x1, v.y1].map(f64::from), size)
-        } else {
-            Vec::new()
-        };
-        let drop_shadow = drop_shadow && !beyond && !app.ui.view.pattern_preview;
-        // Live adjustment previews on big documents use a downsampled proxy (see proxy.rs), unless
-        // Preferences › Performance › Low Resolution Previews is off.
-        let mut on_gpu = false;
-        // A flipped or pixel-aspect-corrected view draws through the CPU path (the GPU canvas shader
-        // has no mirroring or non-square pixels). Rotation stays on the GPU: it is a view uniform.
-        let gpu_ok = crate::gpu_canvas::gpu_view_ok(flip, view.rotation, aspect);
-        if app.gpu.is_some()
-            && gpu_ok
-            && let Some((k, key, preview_size)) = ensure_adjust_proxy(app, idx, render_zoom)
-                .or_else(|| ensure_filter_preview(app, idx, &ctx))
-                .or_else(|| ensure_proxy_preview(app, idx, render_zoom))
-        {
-            on_gpu = true;
-            app.navigator_gpu.remove(&doc.id);
-            let original_size = [doc.size.width.div_ceil(k), doc.size.height.div_ceil(k)];
-            let shown = filter_preview_display_doc(app, &doc, key);
-            let params = crate::gpu_canvas::ViewParams {
-                doc: key,
-                doc_size: preview_size,
-                zoom: view.zoom * k as f32 / ppp,
-                // A size-changing preview grows around the old image center; keep the view's pan.
-                center: [
-                    xf.center[0] / k as f32 + (preview_size[0] as f32 - original_size[0] as f32) / 2.0,
-                    xf.center[1] / k as f32 + (preview_size[1] as f32 - original_size[1] as f32) / 2.0,
-                ],
-                rotation: if view.rotation.is_finite() { view.rotation.to_radians() } else { 0.0 },
-                shadow: {
-                    let t = crate::theme::Tokens::get(&ctx);
-                    !t.bevel && !t.pro && drop_shadow
-                },
-                pixel_grid: false,
-                view_key: egui::Id::unique(("pc-canvas-proxy", ctx.viewport_id(), idx)).value(),
-                display: sync_display_lut(app, &shown, key, output),
-                output: output.unwrap_or(0),
-                hdr: hdr_preview(app, &doc),
-                offset: [0.0, 0.0],
-            };
-            paint_gpu_view(&painter, rect, params, &pattern);
-        } else if gpu_ok && ensure_gpu(app, &ctx, idx, redraw_focus(&target_xf, &xf)) {
-            on_gpu = true;
-            app.perf.gpu = true;
-            // Shadow, checkerboard, document and pixel grid in one custom shader (gpu_canvas.rs).
-            let params = crate::gpu_canvas::ViewParams {
-                doc: doc.id.0,
-                doc_size: [doc.size.width, doc.size.height],
-                zoom: point_zoom,
-                center: xf.center,
-                rotation: if view.rotation.is_finite() { view.rotation.to_radians() } else { 0.0 },
-                shadow: {
-                    let t = crate::theme::Tokens::get(&ctx);
-                    !t.bevel && !t.pro && drop_shadow
-                },
-                pixel_grid,
-                view_key: egui::Id::unique(("pc-canvas", ctx.viewport_id(), idx)).value(),
-                display: sync_display_lut(app, &doc, doc.id.0, output),
-                output: output.unwrap_or(0),
-                hdr: hdr_preview(app, &doc),
-                offset: [0.0, 0.0],
-            };
-            if app.navigator_plain.contains(&doc.id) {
-                app.navigator_gpu.insert(doc.id, params);
-            } else {
-                app.navigator_gpu.remove(&doc.id);
-            }
-            paint_gpu_view(&painter, rect, params, &pattern);
-        } else {
-            app.navigator_gpu.remove(&doc.id);
-            // A document too large for one full-resolution texture also gets the part in view at
-            // the screen's resolution, drawn over the reduced whole (#7568).
-            let in_view = InView {
-                visible: visible_doc_rect(&xf),
-                zoom: view.zoom,
-                key: egui::Id::unique(("pc-canvas-detail", ctx.viewport_id(), idx, primary)).value(),
-            };
-            let textures = ensure_texture_in_view(app, &ctx, idx, output, Some(in_view));
-            let tex = textures.as_ref().map(|t| t.texture);
-            // The area the image covers: a size-changing preview's own (Image › Rotation).
-            let area = textures.as_ref().map_or(doc.bounds(), |t| t.bounds);
-            shown_area = area;
-            if area != doc.bounds() {
-                edge_rect = xf.doc_rect(area);
-            }
-            if !crate::theme::Tokens::get(&ctx).bevel && drop_shadow {
-                let shadow_rect = edge_rect;
-                painter.add(egui::Shadow { offset: [0, 8], blur: 28, spread: 0, color: Color32::from_black_alpha(150) }.as_shape(shadow_rect, 0));
-            }
-            let rotated = view.rotation.abs() > 0.05;
-            let checkerboard = app.session.prefs().transparency_and_gamut.square().map(|square| (checker(app, &ctx), square));
-            // Repeated-quad coverage is not proven identical on all Pattern Preview adapters.
-            // Retain its legacy checker submissions, including the central document's.
-            let opaque = !app.ui.view.pattern_preview && app.canvases.get(&cache_key(doc.id, output)).is_some_and(|c| c.texture_opaque) && tex.is_some();
-            paint_cpu_document(&painter, &xf, area, rotated, checkerboard, tex, opaque);
-            if let Some((detail, area)) = textures.and_then(|t| t.detail) {
-                paint_cpu_detail(&painter, &xf, doc.bounds(), rotated, checkerboard, detail, area);
-            }
-            // Pattern Preview tiles what is shown: a size-changing preview's area, from its origin.
-            let (tile, copies) = if area == doc.bounds() || !app.ui.view.pattern_preview {
-                (size, pattern.clone())
-            } else {
-                let tile = [area.width(), area.height()];
-                let v = visible_doc_rect(&xf).translate(-area.x0, -area.y0);
-                (tile, crate::pattern_preview::copies([v.x0, v.y0, v.x1, v.y1].map(f64::from), tile))
-            };
-            for &c in &copies {
-                paint_cpu_document(&painter, &pattern_xf(&xf, c, tile), area, rotated, checkerboard, tex, opaque);
-            }
-        }
-        // Channels panel: alpha / Quick Mask overlays and single-channel views (channel_view.rs).
-        if let Some(tex) = crate::channel_view::ensure(app, &ctx, idx) {
-            // Rendered from the live preview, so over the area the preview is shown in.
-            let a = shown_area;
-            if view.rotation.abs() > 0.05 {
-                paint_mapped_image_at(
-                    &painter,
-                    &xf,
-                    tex,
-                    Rect::from_min_max(Pos2::ZERO, pos2(1.0, 1.0)),
-                    [a.x0 as f32, a.y0 as f32],
-                    [a.width() as f32, a.height() as f32],
-                    Color32::WHITE,
-                );
-            } else {
-                let uv = if flip { Rect::from_min_max(pos2(1.0, 0.0), pos2(0.0, 1.0)) } else { Rect::from_min_max(Pos2::ZERO, pos2(1.0, 1.0)) };
-                painter.image(tex, xf.doc_rect(a), uv, Color32::WHITE);
-            }
-        }
-        crate::color_range_ui::paint_selection_preview(app, &ctx, &painter, doc.id, img_rect, flip);
-        // Artboards: pasteboard between the boards, outlines and names (artboard_ui.rs).
-        if doc.has_artboards() {
-            let t = crate::theme::Tokens::get(&ctx);
-            let pasteboard = crate::prefs_ui::pasteboard_color(app);
-            let dot_tex = dots(&ctx, &t);
-            // Cut around the layers as they are shown, so a loose layer dragged with the Move tool
-            // (or otherwise previewed) is not covered where it now draws.
-            let shown = display_doc(app, idx).0;
-            // Each piece is painted as its own quad (the painter clips to the canvas), so a
-            // rotated view does not paint a piece's bounding box over the boards or loose work.
-            let fill = |q: &[Pos2; 4], tex: Option<egui::TextureId>, color: Color32| {
-                let mut mesh = tex.map_or_else(egui::Mesh::default, egui::Mesh::with_texture);
-                for &p in q {
-                    // Same phase as the dots around the document.
-                    let uv = if tex.is_some() { ((p - rect.min) / 22.0).to_pos2() } else { egui::epaint::WHITE_UV };
-                    mesh.vertices.push(egui::epaint::Vertex { pos: p, uv, color });
-                }
-                mesh.add_triangle(0, 1, 2);
-                mesh.add_triangle(0, 2, 3);
-                painter.add(mesh);
-            };
-            for q in crate::artboard_ui::pasteboard_quads(&xf, &shown) {
-                if !Rect::from_points(&q).intersects(rect) {
-                    continue;
-                }
-                match pasteboard {
-                    Some(c) => fill(&q, None, c),
-                    None => {
-                        fill(&q, None, t.canvas);
-                        if let Some(id) = dot_tex {
-                            fill(&q, Some(id), Color32::WHITE);
-                        }
-                    }
-                }
-            }
-            if primary {
-                crate::artboard_ui::draw_frames(app, &painter, &xf);
-            }
-        }
-
-        // Pixel grid at high zoom, over pixels with content only (the GPU path draws its own).
-        if !on_gpu && pixel_grid && crate::pixel_grid::shows_at(view.zoom) {
-            crate::pixel_grid::paint(app, &painter, &xf, idx, output, visible_doc_rect(&xf));
-        }
-
-        // Developer tile grid (`ui.set {"tileGrid": true}`): the active layer's storage tiles.
-        // Not tied to View › Extras (⌘H), which hides only the View › Show overlays.
-        if app.ui.view.tile_grid {
-            crate::tile_overlay::paint(app, &ctx, &painter, &xf, idx, visible_doc_rect(&xf));
-        }
-
-        // View › Show › Layer Edges: drawn at this depth, but only once this frame's tool events are
-        // in (`layer_edges_rect`), so a press that Auto-Selects a layer outlines that layer.
-        let layer_edges = painter.add(egui::Shape::Noop);
-
-        // Select and Mask outlines its refined selection (on its preview proxy, reduced by `k`) in
-        // the Marching Ants view and hides the ants in the others.
-        let refined = crate::select_mask_view::ants(app, idx);
-        // A floating piece's ants hug the pixels being moved.
-        let floated = floating_outline(app, idx);
-        let (outlined, k) = match &refined {
-            None => (floated.as_ref().or(doc.selection.as_ref()), 1),
-            Some(None) => (None, 1),
-            Some(Some((proxy, k))) => (proxy.selection.as_ref(), (*k).max(1)),
-        };
-        // Selection outline: true boundary, animated marching ants (cached per revision).
-        if let Some(sel) = outlined.filter(|_| app.ui.view.shows(app.ui.view.show.selection_edges) && !polygon_replaces_selection(app)) {
-            // Trace at display resolution over the visible part only; key by the mask's tile identity
-            // (not the document revision) so unrelated edits don't re-trace it. The step is in
-            // device pixels per document pixel (`View::zoom`, not the point zoom), so a 1 px
-            // selection still traces at 100% on a scaled display.
-            let step = (1.0 / (view.zoom * k as f32).max(1e-3)).log2().floor().exp2().clamp(1.0, 64.0) as u32;
-            let corners = [rect.min, pos2(rect.max.x, rect.min.y), rect.max, pos2(rect.min.x, rect.max.y)];
-            let docs = [xf.to_doc(corners[0]), xf.to_doc(corners[1]), xf.to_doc(corners[2]), xf.to_doc(corners[3])];
-            let mut x0 = docs[0][0];
-            let mut y0 = docs[0][1];
-            let mut x1 = x0;
-            let mut y1 = y0;
-            for d in docs {
-                x0 = x0.min(d[0]);
-                y0 = y0.min(d[1]);
-                x1 = x1.max(d[0]);
-                y1 = y1.max(d[1]);
-            }
-            let (x0, y0, x1, y1) = (x0 / f64::from(k), y0 / f64::from(k), x1 / f64::from(k), y1 / f64::from(k));
-            let q = 256 * step as i32; // quantise the region so small pans reuse the cache
-            // The view centre can be any finite number (`ui.set`, #980). Past ±2³⁰ there is no document
-            // to outline, and the padding below (at most 2 · 256 · 64) can't overflow i32 from there.
-            let px = |v: f64| v.clamp(-f64::from(1 << 30), f64::from(1 << 30)) as i32;
-            // A Free Transform carries the selection to wherever its box goes (#5297), so all of
-            // it is outlined: the part now in view may have started out of it.
-            let carried = app.session.active_index() == Some(idx) && crate::transform_tool::carries_selection_of(app, doc.id);
-            let vis = if carried {
-                photocraft_geom::Rect::new(-(1 << 30), -(1 << 30), 1 << 30, 1 << 30)
-            } else {
-                photocraft_geom::Rect::new(
-                    px(x0.floor()).div_euclid(q) * q - q,
-                    px(y0.floor()).div_euclid(q) * q - q,
-                    (px(x1.ceil()).div_euclid(q) + 2) * q,
-                    (px(y1.ceil()).div_euclid(q) + 2) * q,
-                )
-            };
-            let bounds_key = if k > 1 { u64::MAX / 2 - doc.id.0 } else { u64::MAX - doc.id.0 };
-            let carried_bounds = carried.then(|| app.cached_bounds(bounds_key, sel).intersect(&vis));
-            let step = carried_bounds.map_or(step, |b| crate::outline::bounded_step(b, step));
-            let key = crate::surface_fingerprint(sel)
-                ^ u64::from(step).rotate_left(56)
-                ^ doc.id.0.rotate_left(17)
-                ^ (vis.x0 as u64) << 8
-                ^ (vis.y0 as u64) << 24
-                ^ (vis.x1 as u64) << 36
-                ^ (vis.y1 as u64) << 48
-                ^ u64::from(k).rotate_left(5);
-            let fresh = matches!(&app.outline_cache, Some((d, k, _)) if *d == doc.id && *k == key);
-            if !fresh {
-                let t0 = crate::gpu_canvas::now_ms();
-                let b = carried_bounds.unwrap_or_else(|| app.cached_bounds(bounds_key, sel).intersect(&vis));
-                // Filters can occupy every worker in Rayon's global pool. A parallel scan here would
-                // block the UI thread waiting for those workers, preventing job cancellation (#1554).
-                let mut segs =
-                    if app.session.has_jobs() { crate::outline::outline_scaled_serial(sel, b, step) } else { crate::outline::outline_scaled(sel, b, step) };
-                if k > 1 {
-                    let s = i32::try_from(k).unwrap_or(1);
-                    let up = |p: [i32; 2]| [p[0].saturating_mul(s), p[1].saturating_mul(s)];
-                    segs.iter_mut().for_each(|(a, b)| (*a, *b) = (up(*a), up(*b)));
-                }
-                app.perf.span("outline", crate::gpu_canvas::now_ms() - t0);
-                app.outline_cache = Some((doc.id, key, std::sync::Arc::new(segs)));
-            }
-            // Under Content-Aware Move's Transform On Drop box the ants are drawn where it puts them.
-            if let Some((_, _, segs)) = app.outline_cache.as_ref().filter(|_| !crate::cam_transform::active(app)) {
-                let time = ui.input(|i| i.time);
-                // A floating piece (and a selection being dragged) draws its ants where it is shown.
-                let mut shown = xf;
-                if let Some((dx, dy)) = selection_shown_offset(app) {
-                    shown.center = [xf.center[0] - dx as f32, xf.center[1] - dy as f32];
-                }
-                // Under a Free Transform box they are where the box puts them (#5297).
-                if !(carried && crate::transform_tool::draw_selection(app, &painter, &xf, doc.id, segs, time)) {
-                    marching_ants_segments(&painter, &shown, segs, time);
-                }
-                ctx.request_repaint_after(std::time::Duration::from_millis(100));
-            }
-        }
-
-        (beyond, layer_edges, edge_rect)
+    let paint_input = CanvasPaintInput {
+        ctx: &ctx,
+        rect,
+        painter: &painter,
+        ppp,
+        border,
+        doc: &doc,
+        idx,
+        output,
+        size,
+        primary,
+        flip,
+        aspect,
+        render_zoom,
+        target_xf,
+        pixel_grid,
     };
-    let painted = if crop_camera { None } else { Some(paint_canvas(app, ui, &display_view, xf)) };
+    let painted = if crop_camera { None } else { Some(paint_canvas(app, ui, &display_view, xf, &paint_input)) };
     let img_rect = xf.doc_rect(doc.bounds());
 
     // Under an open dialog the canvas widget is inert, but the image still pans and zooms.
@@ -610,69 +1854,8 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
     if !under_dialog && ctx.input(|i| i.pointer.any_pressed() && i.pointer.interact_pos().is_some_and(|p| rect.contains(p))) {
         crate::spring_tools::note_canvas_press(app);
     }
-    // Navigation (wheel_nav.rs): scroll pans (⇧ or ⌘/Ctrl sideways); pinch and ⌥-scroll zoom around the pointer.
-    // The wheel also scrolls over the scrollbars drawn on top of the canvas (last frame's hover).
     let bars_id = egui::Id::unique(("pc-canvas-bars-hover", idx));
-    let over_bars = ctx.data(|d| d.get_temp::<bool>(bars_id)).unwrap_or(false);
-    let nav_hovered = response.hovered() || free_hover || over_bars;
-    // Interface › Enable Animations off: the wheel moves the canvas without a glide (#5721).
-    // General › Animated Zoom: the wheel zoom eases over the frames of a notch, or is one instant step.
-    // Enhanced Controls › Enable Gestures off: two fingers on a touch screen neither zoom nor
-    // turn the view (#204); the mouse and trackpad are unaffected.
-    let touch_gestures = app.session.prefs().enhanced_controls.touch_gestures;
-    let wheel = crate::wheel_nav::read_with(
-        &ctx,
-        app.session.prefs().general.zoom_with_scroll_wheel,
-        app.session.prefs().enhanced_controls.zoom_with_trackpad_pinch,
-        app.session.prefs().general.animated_zoom,
-        wheel_owner,
-        nav_hovered,
-        app.session.prefs().interface.enable_animations,
-        touch_gestures,
-    );
-    if nav_hovered {
-        let pointer = ui.input(|i| i.pointer.hover_pos());
-        match (wheel, pointer) {
-            (Some(crate::wheel_nav::Wheel::Zoom(f)), Some(p)) => {
-                // At a limit the view stays put, as in Photoshop: a notch past 12800 % neither
-                // zooms nor slides the image towards the pointer.
-                let nz = crate::zoom_levels::clamp(view.zoom * f, view.doc_size);
-                if nz != view.zoom * f {
-                    crate::wheel_nav::settle(&ctx, wheel_owner);
-                }
-                if nz != view.zoom {
-                    // Over the pasteboard the anchor is the image's nearest point (#3720).
-                    let at = wheel_anchor(&xf, p, view.doc_size);
-                    zoom_about(&mut view, &xf, at, nz, false, ppp);
-                }
-            }
-            (Some(crate::wheel_nav::Wheel::SnapZoom(n)), Some(p)) => {
-                let dir = if n > 0 { 1 } else { -1 };
-                let mut nz = view.zoom;
-                for _ in 0..n.unsigned_abs() {
-                    nz = crate::zoom_levels::step(nz, dir, view.doc_size);
-                }
-                if nz != view.zoom {
-                    zoom_about(&mut view, &xf, p, nz, false, ppp);
-                }
-            }
-            (Some(crate::wheel_nav::Wheel::Pan(scroll)), _) => {
-                let d = xf.unmap_vec(scroll) / (view.zoom / ppp);
-                view.center[0] -= d.x;
-                view.center[1] -= d.y;
-            }
-            _ => {}
-        }
-        let rotate_trackpad = app.session.prefs().enhanced_controls.rotate_view_with_trackpad;
-        if let Some(delta) = crate::rotate_view::trackpad_delta(&ctx, rotate_trackpad, touch_gestures) {
-            view.zoom_animating = false;
-            view.zoom_anchor = None;
-            let next = view.rotation + crate::rotate_view::screen_delta(delta, xf.flip);
-            if next.is_finite() {
-                view.rotation = crate::rotate_view::wrap_deg(next);
-            }
-        }
-    }
+    update_canvas_navigation(app, &mut view, CanvasNavigationInput { ctx: &ctx, response: &response, free_hover, wheel_owner, xf, ppp, idx });
 
     // Pen pressure/tilt for this frame's tool events (mouse = 1.0), unless Preferences › Tools ›
     // Use Tablet Pressure is off; the pen's eraser end selects the Eraser.
@@ -722,117 +1905,25 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
     };
 
     if under_dialog {
-        // With a colour dialog picker armed the image is its eyedropper, whatever the tool; Space
-        // and the middle button still pan. Curves and Replace Color use the same merged-composite
-        // sampler as the Color Picker, never the reduced adjustment preview.
-        let curves_picking = crate::adjust_dialog::picker_armed(app);
-        let replace_picking = crate::filter_dialog::color_eyedropper_armed(app);
-        let picking = primary && (crate::color_picker_ui::top(app).is_some() || curves_picking || replace_picking);
-        let range_picking =
-            primary && app.ui.dialogs.last().is_some_and(|d| crate::color_range_ui::owns(&d.fields) && crate::color_range_ui::controls(&d.fields).sampling);
-        // Select and Mask's Refine Edge Brush paints on the image.
-        let refine_brushing =
-            primary && app.ui.dialogs.last().is_some_and(|d| crate::select_mask_view::owns(&d.fields) && crate::select_mask_view::brush_on(&d.fields));
-        // Field Blur's pins are placed and dragged on the image (`blur_pins`).
-        let pinning = primary && app.ui.dialogs.last().is_some_and(|d| crate::blur_pins::owns(&d.fields));
-        // Layer Style on a Drop or Inner Shadow page: a drag on the image moves the shadow (#5701).
-        let shadow_drag =
-            !picking && app.ui.dialogs.last().is_some_and(|d| d.kind == crate::state::DialogKind::LayerStyle && crate::layer_style::drags_shadow(&d.fields));
-        // ⌘/Ctrl-click with Curves open: a point at the pixel's tone (#7325), whatever the tool. The
-        // press's own modifiers decide, and only the press adds: a drag would add one per frame.
-        let curve_point_press = (primary && !middle && crate::adjust_dialog::curves_on_top(app))
-            .then(|| {
-                ctx.input(|i| {
-                    i.events.iter().rev().find_map(|e| match e {
-                        egui::Event::PointerButton { button: PointerButton::Primary, pressed: true, modifiers, .. } => Some(*modifiers),
-                        _ => None,
-                    })
-                })
-            })
-            .flatten()
-            .map(|m| crate::workspace_ui::sticky_mods(app, m))
-            .filter(|m| m.command);
-        let hand = app.ui.tool == Tool::Hand && !picking && !range_picking && !refine_brushing && !pinning && !shadow_drag && curve_point_press.is_none();
-        // ⌘Space / ⌥Space zoom under the dialog as they do without one, before Space pans (#6460).
-        // With the Hand tool, ⌘ alone is Zoom In (#6434); under Curves that press is the dialog's
-        // point (#7325), not a zoom.
-        let curve_point_with_hand = curve_point_press.is_some() && app.ui.tool == Tool::Hand;
-        let held_zoom =
-            !middle && !curve_point_with_hand && matches!(temporary, Some(crate::hold_keys::Temporary::ZoomIn | crate::hold_keys::Temporary::ZoomOut));
-        if held_zoom {
-            let alt = ctx.input(|i| i.modifiers.alt);
-            if free_hover {
-                ctx.set_cursor_icon(crate::tool_cursor::zoom(&ctx, zoom_out(alt)));
-            }
-            let b = crate::dialogs::free_buttons(&ctx, rect);
-            let pointer = ctx.input(|i| i.pointer.latest_pos());
-            crate::zoom_tool::drag(app, &ctx, &mut view, &xf, &b, pointer);
-            if b.clicked
-                && let Some(p) = pointer
-            {
-                let nz = crate::zoom_levels::step(view.zoom, if zoom_out(alt) { -1 } else { 1 }, view.doc_size);
-                zoom_about(&mut view, &xf, p, nz, app.session.prefs().tools.zoom_clicked_point_to_center, ppp);
-            }
-        } else if let Some(d) = crate::dialogs::pan_delta(&ctx, rect, hand) {
-            let d = xf.unmap_vec(d) / (view.zoom / ppp);
-            view.center[0] -= d.x;
-            view.center[1] -= d.y;
-            ctx.set_cursor_icon(crate::tool_cursor::hand(&ctx, true));
-        } else if free_hover && (space_pan || hand) {
-            ctx.set_cursor_icon(crate::tool_cursor::hand(&ctx, false));
-        } else if shadow_drag && !middle && crate::dialogs::free_pointer_over(&ctx, rect).is_some() {
-            ctx.set_cursor_icon(egui::CursorIcon::Move);
-            if let Some(p) = crate::dialogs::free_press(&ctx, rect) {
-                let (start, origin) = ctx.input(|i| (i.pointer.primary_pressed(), i.pointer.press_origin().unwrap_or(p)));
-                let total = xf.unmap_vec(p - origin) / (view.zoom / ppp);
-                if let Some(d) = app.ui.dialogs.last_mut() {
-                    crate::layer_style::drag_shadow(&mut d.fields, start, [f64::from(total.x), f64::from(total.y)]);
-                }
-            }
-        } else if picking && let Some(p) = crate::dialogs::free_pointer_over(&ctx, rect) {
-            if app.session.prefs().cursors.other == photocraft_engine::prefs::OtherCursor::Precise {
-                ctx.set_cursor_icon(egui::CursorIcon::Crosshair);
-            } else {
-                ctx.set_cursor_icon(pipette_cursor(&ctx, p));
-            }
-            if let Some(p) = crate::dialogs::free_press(&ctx, rect) {
-                let d = xf.to_doc(p);
-                if curves_picking {
-                    crate::adjust_dialog::sample_at(app, d[0], d[1]);
-                } else if replace_picking {
-                    crate::filter_dialog::color_eyedropper_sample(app, d[0], d[1]);
-                } else {
-                    crate::color_picker_ui::sample_at(app, d[0], d[1]);
-                }
-            }
-        } else if pinning
-            && !middle
-            && let Some(p) = crate::dialogs::free_pointer_over(&ctx, rect)
-        {
-            let press = crate::dialogs::free_press(&ctx, rect);
-            crate::blur_pins::canvas(app, &ctx, &xf, p, press);
-        } else if refine_brushing
-            && !middle
-            && let Some(p) = crate::dialogs::free_pointer_over(&ctx, rect)
-        {
-            let press = crate::dialogs::free_press(&ctx, rect).map(|q| xf.to_doc(q));
-            crate::select_mask_view::canvas_brush(app, &painter, p, press, xf.zoom_x());
-        } else if let Some(mods) = curve_point_press
-            && let Some(p) = crate::dialogs::free_press(&ctx, rect)
-        {
-            let d = xf.to_doc(p);
-            crate::adjust_dialog::add_point_at(app, &ctx, d[0], d[1], mods.shift);
-        } else if primary
-            && !middle
-            && let Some(p) = crate::dialogs::free_pointer_over(&ctx, rect).filter(|p| img_rect.contains(*p))
-        {
-            // Color Range samples colours with its eyedropper on the image itself.
-            let press = crate::dialogs::free_press(&ctx, rect)
-                .filter(|p| img_rect.contains(*p) && ctx.input(|i| i.pointer.primary_pressed() || i.pointer.delta() != egui::Vec2::ZERO))
-                .map(|q| xf.to_doc(q));
-            crate::color_range_ui::canvas_eyedropper(app, &ctx, p, press);
-        }
+        handle_dialog_canvas_input(
+            app,
+            DialogCanvasInput {
+                ctx: &ctx,
+                view: &mut view,
+                xf: &xf,
+                rect,
+                painter: &painter,
+                ppp,
+                primary,
+                middle,
+                space_pan,
+                temporary,
+                free_hover,
+                img_rect,
+            },
+        );
     }
+
     // The selected Hand yields to an open Free Transform box in this (primary) window: the box
     // owns the pointer, so the tool behind it cannot steal the resize drag (#2302). The held Hand
     // (Space) and a middle-button drag still pan, and a secondary window's Hand never stops, as the
@@ -862,398 +1953,25 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
         // The tool cursors below are skipped while panning: the fist is set here (#2196).
         ctx.set_cursor_icon(crate::tool_cursor::hand(&ctx, true));
     } else if primary && !stroke_dismissal && temporary.is_none() && !middle && crate::layer_picker::armed(app).is_some() {
-        // A Properties Levels/Curves eyedropper (layer_picker.rs) owns the image until Esc or another
-        // tool; Space and the middle button still pan. It samples on the press.
-        if response.hovered()
-            && let Some(p) = ui.input(|i| i.pointer.hover_pos())
-        {
-            if app.session.prefs().cursors.other == photocraft_engine::prefs::OtherCursor::Precise {
-                ctx.set_cursor_icon(egui::CursorIcon::Crosshair);
-            } else {
-                ctx.set_cursor_icon(pipette_cursor(&ctx, p));
-            }
-        }
-        if response.is_pointer_button_down_on()
-            && ui.input(|i| i.pointer.primary_pressed())
-            && let Some(p) = ui.input(|i| i.pointer.interact_pos())
-        {
-            let d = xf.to_doc(p);
-            crate::layer_picker::sample_at(app, d[0], d[1]);
-        }
+        layer_picker_eyedropper(app, ui, &ctx, &response, &xf);
     } else if primary && !stroke_dismissal {
-        let mods = ui.input(|i| i.modifiers);
-        // An ⌥-click the window manager took never arrives; say so (alt_grab.rs).
-        crate::alt_grab::watch(app, &ctx, egui::Id::unique(("pc-alt-grab", idx)), rect, tool, !under_dialog);
-        // Tools follow the left button; the right one opens the Brush Preset picker or erases
-        // (Preferences › Tools, `paint_mouse`).
-        crate::paint_mouse::sync_tool_brush(app);
-        let mut buttons = crate::paint_mouse::canvas_buttons(app, &response, tool);
-        // The Crop tool's frame is edited from the press (before egui's drag threshold), so the
-        // pixels past the canvas show at once, as in Photoshop.
-        if tool == Tool::Crop && response.is_pointer_button_down_on() && ui.input(|i| i.pointer.primary_down()) && crate::crop_ui::press(app) {
-            ctx.request_repaint();
-        }
-        // Capture intent at the press, before egui's drag threshold or click replay on release:
-        // Type transforms keep Command; selections keep Add/Subtract if Shift/Alt is released.
-        let capture_press = tool.is_type()
-            || matches!(tool, Tool::RectMarquee | Tool::EllipseMarquee | Tool::SingleRowMarquee | Tool::SingleColumnMarquee | Tool::ObjectSelection);
-        let tool_press = egui::Id::unique(("tool-pointer-press-modifiers", idx));
-        if capture_press
-            && let Some((p, press_mods)) = ui.input(|i| {
-                i.events.iter().find_map(|e| match e {
-                    egui::Event::PointerButton { pos, button: PointerButton::Primary, pressed: true, modifiers } if rect.contains(*pos) => {
-                        Some((*pos, *modifiers))
-                    }
-                    _ => None,
-                })
-            })
-        {
-            let press_mods = crate::workspace_ui::sticky_mods(app, press_mods);
-            ctx.data_mut(|d| d.insert_temp(tool_press, press_mods));
-            if tool.is_type() && press_mods.command && app.ui.text_edit.is_some() {
-                let d = xf.to_doc(p);
-                tool_event(app, ToolEvent::Down { x: d[0], y: d[1], pressure: app.stylus.pressure() }, press_mods);
-            }
-        }
-        // Right-click while transforming: switch the box's mode (Free Transform, Scale, Rotate,
-        // Skew, Distort, Perspective, Warp), or rotate or flip the box.
-        let transforming = app.ui.transform.as_ref().is_some_and(|t| t.warp.is_none());
-        if response.secondary_clicked()
-            && transforming
-            && let Some(p) = response.interact_pointer_pos()
-        {
-            crate::canvas_tool_menu::open_transform(app, &ctx, [p.x, p.y]);
-        }
-        let lasso_retracted = response.secondary_clicked()
-            && match tool {
-                Tool::Lasso | Tool::FreeformPen => crate::lasso_ui::undo_last_vertex(app),
-                Tool::PolygonLasso => polygon_retract(app),
-                _ => false,
-            };
-        // The Lasso (and the Freeform Pen, which draws the same way) reads its own presses and
-        // drops the moves of a drag it didn't start, so an open Free Transform box takes the
-        // usual drag path instead (#2153).
-        if crate::lasso_ui::owns(tool) && !transform_owns_pointer {
-            crate::lasso_ui::canvas_input(app, &ctx, &xf, &response);
-            (buttons.started, buttons.dragged, buttons.stopped, buttons.clicked) = (false, false, false, false);
-        }
-        // Right-click on a guide where it could be dragged (the Move tool, or ⌘ with a selection
-        // tool): select it and open the guide menu, as Photoshop does.
-        let guide_menu = response.secondary_clicked()
-            && !lasso_retracted
-            && !transforming
-            && response.interact_pointer_pos().is_some_and(|p| crate::canvas_tool_menu::open_guide(app, &ctx, tool, mods, [p.x, p.y], xf.to_doc(p)));
-        // Right-click with the Move tool, or ⌘/Ctrl+right-click: the layers under the pointer.
-        if response.secondary_clicked()
-            && !lasso_retracted
-            && !transforming
-            && !guide_menu
-            && crate::layer_pick_ui::is_gesture(tool, mods)
-            && let Some(p) = response.interact_pointer_pos()
-        {
-            let d = xf.to_doc(p);
-            app.ui.canvas_tool_menu = None;
-            // No layers there (the pasteboard, with the Move tool): its colour menu instead.
-            if !crate::layer_pick_ui::open(app, &ctx, [p.x, p.y], d[0], d[1]) && !mods.command && crate::canvas_tool_menu::pasteboard_at(app, tool, d) {
-                crate::canvas_tool_menu::open_pasteboard(app, &ctx, tool, [p.x, p.y]);
-            }
-        }
-        if response.secondary_clicked()
-            && !lasso_retracted
-            && !transforming
-            && !guide_menu
-            && !crate::layer_pick_ui::is_gesture(tool, mods)
-            && let Some(p) = response.interact_pointer_pos()
-        {
-            // A pending crop: its menu, also outside the image, where the frame can reach (#6561).
-            // Outside the image: the pasteboard colour menu (#2462), else the tool's own. The view
-            // menu belongs to the selected Zoom or Hand, not to Space or a held zoom key. A crop
-            // frame or Straighten line still dragged by the left button gets no menu over it: the
-            // gesture and the held button both, as either alone can outlive a lost release. A
-            // finger held still (egui's press-and-hold right-click) is down too, but drags nothing.
-            let crop_gesture = tool == Tool::Crop
-                && !response.long_touched()
-                && (app.crop.drag.is_some() || app.crop.straighten.line.is_some())
-                && ctx.input(|i| i.pointer.primary_down());
-            if crop_gesture || crate::canvas_tool_menu::open_crop(app, &ctx, tool, [p.x, p.y]) {
-            } else if crate::canvas_tool_menu::pasteboard_at(app, tool, xf.to_doc(p)) {
-                crate::canvas_tool_menu::open_pasteboard(app, &ctx, tool, [p.x, p.y]);
-            } else if crate::canvas_tool_menu::is_view_tool(tool) {
-                if tool == app.ui.tool {
-                    crate::canvas_tool_menu::open_view(app, &ctx, tool, [p.x, p.y], xf.to_doc(p));
-                }
-            } else {
-                crate::canvas_tool_menu::open_at(app, &ctx, tool, [p.x, p.y], Some(xf.to_doc(p)));
-            }
-        }
-        // The (temporary) Hand pans above; its gestures never reach the tool underneath. While a
-        // Free Transform box is open the Hand does not pan, so the box gets these events (#2302).
-        if hand_pan {
-            (buttons.started, buttons.dragged, buttons.stopped) = (false, false, false);
-        }
-        // Rotate View: drag around the view centre. Compass clicks are not a rotate drag.
-        let over_compass = crate::rotate_view::compass_visible(view.rotation)
-            && response.interact_pointer_pos().is_some_and(|p| crate::rotate_view::compass_rect(xf.rect).contains(p));
-        if tool == Tool::RotateView && !over_compass && crate::rotate_view::drag(&ctx, &mut view, &xf, &buttons, response.interact_pointer_pos()) {
-            (buttons.started, buttons.dragged, buttons.stopped, buttons.clicked) = (false, false, false, false);
-        }
-        // Animated Zoom: a Zoom press held still zooms continuously (zoom_hold.rs); while it does,
-        // it owns the press: no scrub, and its release is no click step.
-        if tool == Tool::Zoom && !transform_owns_pointer {
-            let out = zoom_out(ui.input(|i| i.modifiers.alt));
-            let on_canvas = !under_dialog && !over_compass && response.is_pointer_button_down_on();
-            let hold = crate::zoom_hold::hold_id(idx, primary, ctx.viewport_id());
-            if crate::zoom_hold::update(&ctx, &mut view, &xf, app.session.prefs().general.animated_zoom, out, ppp, on_canvas, hold) {
-                (buttons.started, buttons.dragged, buttons.stopped, buttons.clicked) = (false, false, false, false);
-            }
-        }
-        // Zoom tool drags: scrubby zoom or a zoom rectangle (zoom_tool.rs); clicks step below.
-        // Like the Hand, the selected Zoom yields to an open Free Transform box (#4799).
-        if tool == Tool::Zoom && !transform_owns_pointer && crate::zoom_tool::drag(app, &ctx, &mut view, &xf, &buttons, response.interact_pointer_pos()) {
-            (buttons.started, buttons.dragged, buttons.stopped) = (false, false, false);
-        }
-        // A drag is only recognised once the pointer has moved past egui's click distance: the
-        // gesture starts where the button went down, not where it is now (#123).
-        let gesture_active_before = app.drag.is_some();
-        // Stroke timing: egui's events carry no timestamps, so a press takes the frame time and
-        // the moves below are spread between the previous point and this frame (`spread_ms`).
-        let now_ms = ui.input(|i| i.time) * 1000.0;
-        app.stylus.clock_ms = now_ms;
-        // Live painting tools start on the press, not once the pointer passes egui's click
-        // distance: the first dab shows at once. The drag recognised later continues that stroke,
-        // and a click (or a long press that never moved) just ends it.
-        let physical_right = app.services.right_button_down.as_ref().is_some_and(|f| f());
-        let right_down = ui.input(|i| i.pointer.secondary_down()) || physical_right;
-        if strokes_live(tool)
-            && !right_down
-            && app.drag.is_none()
-            && response.is_pointer_button_down_on()
-            && ui.input(|i| i.pointer.primary_pressed())
-            && let Some(p) = ui.input(|i| i.pointer.press_origin()).filter(|p| rect.contains(*p))
-        {
-            let d = xf.to_doc(p);
-            // The press's own modifiers: a ⇧ that arrives with the click still connects the line.
-            let press_mods = ui.input(|i| pointer_button_modifiers(&i.events, PointerButton::Primary)).unwrap_or(mods);
-            tool_event(app, ToolEvent::Down { x: d[0], y: d[1], pressure: app.stylus.pressure() }, press_mods);
-            app.press_stroke = app.drag.is_some();
-        }
-        let press_stroke = app.press_stroke;
-        // A live tool's press that went to the ⌥ eyedropper keeps sampling for the whole press: the
-        // drag recognised later must not decide again with ⌥ already let go and paint (#7802).
-        if press_stroke || (strokes_live(tool) && (app.alt_sampling || app.mixer_sampling)) {
-            buttons.started = false;
-        }
-        if buttons.started
-            && let Some(p) = ui.input(|i| i.pointer.press_origin()).filter(|p| rect.contains(*p)).or(response.interact_pointer_pos())
-        {
-            if tool == Tool::Move && app.ui.transform.is_none() {
-                begin_transform_controls_at(app, &ctx, &xf, p);
-            }
-            let d = xf.to_doc(p);
-            let press_mods = if capture_press { ctx.data(|d| d.get_temp(tool_press)).unwrap_or(mods) } else { mods };
-            tool_event(app, ToolEvent::Down { x: d[0], y: d[1], pressure: app.stylus.pressure() }, press_mods);
-        }
-        // A stroke started on the press takes its moves from the press on, not only once egui
-        // recognises a drag (past its click distance): otherwise the first few points are lost
-        // and the stroke starts with a straight segment and no pressure ramp.
-        let press_stroke_moving = press_stroke && app.drag.is_some();
-        if buttons.dragged || buttons.stopped || press_stroke_moving {
-            // Feed every pointer move the OS delivered this frame, not just the latest position, so
-            // a fast stroke is sampled densely and renders as a smooth curve instead of a coarse
-            // polyline. egui-winit pushes one `PointerMoved` per `CursorMoved`, and they accumulate
-            // while a frame is slow, so reading them all recovers the moves a per-frame
-            // `interact_pointer_pos()` would drop. Only freehand tools take the whole batch; the
-            // rest follow the pointer's latest position. The moves are bounded to the gesture's own
-            // press..release interval (`pointer_moves`), so the start and stop frames keep their
-            // valid samples without leaking a move from outside the gesture.
-            let events = ui.input(|i| i.events.clone());
-            let button = if response.dragged_by(PointerButton::Secondary)
-                || response.drag_started_by(PointerButton::Secondary)
-                || response.drag_stopped_by(PointerButton::Secondary)
-            {
-                PointerButton::Secondary
-            } else {
-                PointerButton::Primary
-            };
-            let press_this_frame = events.iter().any(|e| matches!(e, egui::Event::PointerButton { button: b, pressed: true, .. } if *b == button));
-            let down_at_start = !press_this_frame && (gesture_active_before || buttons.started);
-            let mut positions = if app.brush_resize.is_some() {
-                response.interact_pointer_pos().into_iter().collect()
-            } else if freehand_tool(tool) {
-                pointer_moves(&events, button, down_at_start)
-            } else if buttons.dragged {
-                response.interact_pointer_pos().into_iter().collect()
-            } else {
-                Vec::new()
-            };
-            // A frame with no raw move still tracks a held gesture (a still pointer, a modifier
-            // change): fall back to the latest position, as the old code always did.
-            if positions.is_empty()
-                && (buttons.dragged || press_stroke_moving)
-                && let Some(p) = response.interact_pointer_pos().or(ui.input(|i| i.pointer.latest_pos()))
-            {
-                positions.push(p);
-            }
-            app.defer_live_stroke = true;
-            let base = app.stylus.last_point_ms().map_or(now_ms, |t| t.min(now_ms));
-            let n = positions.len();
-            for (k, p) in positions.into_iter().enumerate() {
-                app.stylus.clock_ms = spread_ms(base, now_ms, k, n);
-                // This move's share of the pen samples the frame brought (pressure, tilt, rotation).
-                app.stylus.select(k, n);
-                let d = xf.to_doc(p);
-                tool_event(app, ToolEvent::Move { x: d[0], y: d[1], pressure: app.stylus.pressure() }, mods);
-            }
-            app.stylus.clear_selection();
-            app.stylus.clock_ms = now_ms;
-            // A held pen keeps the clock running for airbrush build-up and smoothing catch-up.
-            if app.drag.is_some() && stroke_wants_time(app) {
-                ctx.request_repaint_after(std::time::Duration::from_millis(HOLD_REPEAT_MS as u64));
-            }
-            app.defer_live_stroke = false;
-            // One live-stroke update for the whole frame, not one per recovered sample.
-            feed_live_stroke(app);
-            crate::magnetic_lasso_ui::flush(app);
-        }
-        if buttons.stopped {
-            // The live painting press already created the stroke and this release commits it.
-            // egui may also report clicked on the same release; replaying that click paints a
-            // second full-pressure dab over the real (possibly light-pressure) pen dab.
-            if press_stroke {
-                buttons.clicked = false;
-            }
-            let at = response.interact_pointer_pos();
-            // #6286: a guide let go over a ruler is removed, whichever ruler it is. Tested here in
-            // screen space, where the rulers are: on the guide's own axis the release can still be
-            // inside the document, which is what `finish_drag` sees.
-            if app.guide_drag.is_some() {
-                let on_ruler = at.is_some_and(|p| crate::rulers::dropped_on_a_ruler(app, full, p));
-                if let Some(g) = app.guide_drag.as_mut() {
-                    g.over_ruler = on_ruler;
-                }
-            }
-            let p = at.map(|p| xf.to_doc(p)).or_else(|| app.drag.as_ref().and_then(|d| d.points.last().map(|q| [q[0], q[1]])));
-            if let Some(d) = p {
-                tap_at_peak_pressure(app);
-                tool_event(app, ToolEvent::Up { x: d[0], y: d[1] }, mods);
-            }
-        }
-        // A stroke started on the press ends with the release, whether egui saw a drag, a click,
-        // or neither (a long press that never moved).
-        if press_stroke && !buttons.stopped && ui.input(|i| i.pointer.primary_released()) {
-            buttons.clicked = false;
-            let p = response.interact_pointer_pos().map(|p| xf.to_doc(p)).or_else(|| app.drag.as_ref().and_then(|d| d.points.last().map(|q| [q[0], q[1]])));
-            if let Some(d) = p
-                && app.drag.is_some()
-            {
-                tap_at_peak_pressure(app);
-                tool_event(app, ToolEvent::Up { x: d[0], y: d[1] }, mods);
-            }
-        }
-        if press_stroke && (app.drag.is_none() || !ui.input(|i| i.pointer.primary_down())) {
-            app.press_stroke = false;
-        }
-        if buttons.clicked
-            && let Some(p) = response.interact_pointer_pos()
-        {
-            let click_button = if app.secondary_erase { PointerButton::Secondary } else { PointerButton::Primary };
-            let click_mods = ui.input(|i| pointer_button_modifiers(&i.events, click_button)).unwrap_or(mods);
-            let click_mods = if tool == Tool::ObjectSelection && click_button == PointerButton::Primary {
-                ctx.data(|d| d.get_temp(tool_press)).unwrap_or(click_mods)
-            } else {
-                click_mods
-            };
-            let d = xf.to_doc(p);
-            match tool {
-                Tool::Zoom if !transform_owns_pointer => {
-                    let nz = crate::zoom_levels::step(view.zoom, if zoom_out(click_mods.alt) { -1 } else { 1 }, view.doc_size);
-                    let center = app.session.prefs().tools.zoom_clicked_point_to_center;
-                    let doc_anchor = xf.to_doc(p);
-                    let screen_anchor = p;
-                    zoom_about(&mut view, &xf, p, nz, center, ppp);
-                    view.request_zoom_animation(app.session.prefs().general.animated_zoom && nz != display_view.zoom);
-                    view.zoom_anchor = (view.zoom_animating && !center).then_some((doc_anchor, [screen_anchor.x, screen_anchor.y]));
-                }
-                // A click with the (temporary) Hand does nothing, never the tool underneath.
-                Tool::Hand | Tool::RotateView => {}
-                // Double-clicking closes the polygonal lasso: the first click placed the last
-                // vertex (or already closed it), so the second never starts a new polygon. egui
-                // reports it as a triple click when a vertex went down shortly before.
-                Tool::PolygonLasso if response.double_clicked() || response.triple_clicked() => commit_polygon(app),
-                // The same for the Magnetic Lasso: along the edges, or straight with ⌥.
-                Tool::MagneticLasso if response.double_clicked() || response.triple_clicked() => crate::magnetic_lasso_ui::close(app, mods.alt),
-                // The first click placed (or grabbed) the point; the second toggles it.
-                Tool::CurvaturePen if response.double_clicked() => crate::vector_ui::curvature_toggle(app, d[0], d[1]),
-                // Double-clicking a guide opens Preferences › Guides, Grid & Slices, as in Photoshop.
-                Tool::Move if response.double_clicked() && crate::rulers::guide_at(app, d[0], d[1]).is_some() => {
-                    if let Err(e) = crate::menus::invoke(app, &ctx, "edit.preferences.guidesGridAndSlices", json!({})) {
-                        app.ui.status = e;
-                    }
-                }
-                _ => {
-                    if tool == Tool::Move && app.ui.transform.is_none() {
-                        begin_transform_controls_at(app, &ctx, &xf, p);
-                    }
-                    // If this tool was not handled on pointer-down, fall back to a
-                    // click-sized gesture while preserving pen pressure (mouse stays at 1).
-                    tool_event(app, ToolEvent::Down { x: d[0], y: d[1], pressure: app.stylus.pressure() }, click_mods);
-                    tap_at_peak_pressure(app);
-                    tool_event(app, ToolEvent::Up { x: d[0], y: d[1] }, click_mods);
-                }
-            }
-        }
-        // Magnetic Lasso: between clicks the border follows the pointer with the button up.
-        if tool == Tool::MagneticLasso && app.ui.magnetic.active() && !(buttons.started || buttons.dragged || buttons.stopped) && response.hovered() {
-            let moves: Vec<Pos2> = ui.input(|i| i.events.iter().filter_map(|e| if let egui::Event::PointerMoved(p) = e { Some(*p) } else { None }).collect());
-            app.defer_live_stroke = true;
-            for p in moves.into_iter().filter(|p| rect.contains(*p)) {
-                let d = xf.to_doc(p);
-                tool_event(app, ToolEvent::Move { x: d[0], y: d[1], pressure: app.stylus.pressure() }, mods);
-            }
-            app.defer_live_stroke = false;
-            crate::magnetic_lasso_ui::flush(app);
-        }
-        // Move tool: a double-click on type edits it, as in Photoshop (#1132). Only the selected
-        // Move tool, not ⌘ held over another tool; an open transform box keeps its double-click
-        // (commit, below).
-        if tool == Tool::Move
-            && app.ui.tool == Tool::Move
-            && app.ui.transform.is_none()
-            && response.double_clicked()
-            && let Some(p) = response.interact_pointer_pos()
-        {
-            let d = xf.to_doc(p);
-            crate::type_tool::edit_at(app, d[0], d[1]);
-        }
-        if app.ui.transform.is_some() && response.double_clicked() {
-            crate::transform_tool::commit(app);
-        }
-        if crate::cam_transform::active(app) && response.double_clicked() {
-            crate::cam_transform::commit(app);
-        }
-        // Crop: a double-click inside the frame commits it, as ↵ does (#1792).
-        if tool == Tool::Crop && response.double_clicked() && response.interact_pointer_pos().is_some_and(|p| crate::crop_ui::commits_at(app, xf.to_doc(p))) {
-            commit_crop(app);
-        }
-        // Type: 2 clicks select a word, 3 the line, 4 the paragraph, 5 all text (Photoshop).
-        if tool.is_type()
-            && response.clicked()
-            && let Some(p) = response.interact_pointer_pos()
-        {
-            if crate::type_transform::visible(app, crate::workspace_ui::sticky_mods(app, mods)) {
-                app.type_clicks = None;
-            } else {
-                let n = if response.triple_clicked() {
-                    3
-                } else if response.double_clicked() {
-                    2
-                } else {
-                    1
-                };
-                let d = xf.to_doc(p);
-                crate::type_tool::multi_click(app, n, d[0], d[1]);
-            }
-        }
+        let input = CanvasToolInput {
+            ctx: &ctx,
+            response: &response,
+            xf: &xf,
+            rect,
+            full,
+            tool,
+            idx,
+            primary,
+            transform_owns_pointer,
+            hand_pan,
+            ppp,
+            under_dialog,
+            zoom_out: &zoom_out,
+            display_zoom: display_view.zoom,
+        };
+        handle_primary_canvas_input(app, ui, &mut view, &input);
     }
     if crop_camera && let (Some((center, rotation)), Some(now)) = (camera, app.ui.views.get(idx)) {
         if now.center != center {
@@ -1274,392 +1992,48 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
     } else {
         xf
     };
-    let (beyond, layer_edges, edge_rect) = painted.unwrap_or_else(|| paint_canvas(app, ui, &display_view, xf));
+    let (beyond, layer_edges, edge_rect) = painted.unwrap_or_else(|| paint_canvas(app, ui, &display_view, xf, &paint_input));
     // A Hand drag (the tool, Space or the middle button) keeps every overlay on screen, as in
     // Photoshop: the Pen path being drawn, paths, guides, grid, transform box (#6592). Only the
     // tool cursors below give way to the fist.
     let panning = hand_pan && response.dragged();
     if primary {
-        // The transform preview is image content: it goes under the grid and guides, which
-        // stay visible across a layer being transformed (#5086); the box is drawn later.
-        crate::transform_tool::draw_content(app, &painter, &xf);
-        // So are Puppet Warp's, Perspective Warp's and Vanishing Point's warped pixels (#7781).
-        crate::distort_ui::draw_content(app, &painter, &xf);
-        if app.ui.extras.grid && app.ui.view.extras {
-            crate::rulers::draw_grid(app, &painter, &xf, &doc);
-        }
-        if app.ui.view.shows(app.ui.view.show.canvas_guides) || crate::guide_layout_ui::preview(app, &doc).is_some() {
-            crate::rulers::draw_guides(app, &painter, &xf, &doc);
-        }
-        // The pending crop frame shows on its own document only, not on the other tiles (#1918).
-        let foreign_crop = if app.session.active_index() == Some(idx) { None } else { app.ui.crop_rect.take() };
-        draw_drag_preview(app, &painter, &xf);
-        if app.session.active_index() == Some(idx) {
-            crate::move_box::draw(app, &painter, &xf);
-        }
-        if foreign_crop.is_some() {
-            app.ui.crop_rect = foreign_crop;
-        }
-        crate::zoom_tool::draw(&ctx, &painter);
-        let resizing = crate::brush_resize::draw(app, &painter, &xf);
-        draw_transform_controls(app, &painter, &xf);
-        crate::move_hover::draw(app, &painter, &xf, idx, response.hover_pos());
-        crate::object_finder::draw(app, &painter, &xf, idx, response.hover_pos());
-        crate::layer_pick_ui::show(app, &ctx);
-        let shown = app.ui.views.get(idx).cloned();
-        crate::canvas_tool_menu::show(app, &ctx);
-        // A view menu row (Zoom In, Fit on Screen…) changed the camera: it wins over this
-        // frame's copy, which is written back at the end.
-        if let Some(now) = app.ui.views.get(idx)
-            && Some(now) != shown.as_ref()
-        {
-            view = now.clone();
-            ctx.request_repaint();
-        }
-        crate::snap_ui::draw(app, &painter, &xf);
-        crate::move_distance::draw(app, &painter, &xf, idx, response.hover_pos());
-        // The canvas edge isn't outlined while the pixels past it show (Photoshop's crop preview),
-        // nor while the Crop tool hides everything outside its box (Show Cropped Area off).
-        if border == photocraft_engine::prefs::CanvasBorder::Line && !beyond && !crate::crop_shield::hides_outside(app) {
-            painter.rect_stroke(edge_rect, 0.0, Stroke::new(1.0, Color32::from_gray(20)), egui::StrokeKind::Outside);
-        }
-        crate::type_tool::draw_overlay(app, &painter, &xf);
-        crate::transform_tool::draw_overlay(app, &painter, &xf);
-        crate::cam_transform::draw(app, &painter, &xf);
-        crate::cam_preview::wake(app, painter.ctx());
-        crate::distort_ui::draw_overlay(app, &painter, &xf);
-        crate::perspective_crop_ui::draw_overlay(app, &painter, &xf);
-        crate::retouch_ui::draw_source_marker(app, &painter, &xf);
-        crate::vector_ui::draw_overlay(app, &painter, &xf, &doc);
-        crate::symmetry_ui::draw(app, &painter, &xf);
-        crate::analysis_ui::draw_overlay(app, &painter, &xf);
-        crate::gradient_ui::draw_overlay(app, &painter, &xf);
-        crate::slice_ui::draw_overlay(app, &painter, &xf);
-        crate::frame_tool::draw_overlay(app, &painter, &xf);
-        crate::artboard_tool::draw_overlay(app, &painter, &xf);
-        // Tool cursors (Photoshop-style).
-        let guide_hover = response.hover_pos().and_then(|p| {
-            let d = xf.to_doc(p);
-            if tool == Tool::Move {
-                return crate::rulers::guide_at(app, d[0], d[1]);
-            }
-            command_guide_at(app, tool, d, crate::workspace_ui::sticky_mods(app, ui.input(|i| i.modifiers)))
-        });
-        if panning {
-            // The fist set with the pan above stays (#2196).
-        } else if crate::tool_cursor::pointer_elsewhere(&ctx, &crate::panel_docking::native_viewports(app, &ctx)) {
-            // The pointer is over a floating panel's own window; this window's last position of
-            // it is stale, so no tool cursor or brush outline is painted at it.
-        } else if let Some((vertical, _)) = guide_hover {
-            ui.ctx().set_cursor_icon(crate::rulers::guide_cursor(&xf, vertical));
-        } else if let Some(p) = response.hover_pos()
-            && let Some(c) = crate::transform_tool::cursor(app, &xf, xf.to_doc(p), ui.input(|i| i.modifiers.alt || i.modifiers.command))
-        {
-            ui.ctx().set_cursor_icon(c);
-            // CursorIcon::None hides the pointer; the curved arrow has to be drawn or the
-            // rotate zone looks like a plain cursor (#4050).
-            let d = xf.to_doc(p);
-            if let Some(k) = crate::transform_tool::rotate_cursor_dir(app, d) {
-                let toward = xf.to_screen((d[0] + k[0] * 16.0) as f32, (d[1] + k[1] * 16.0) as f32) - p;
-                crate::crop_ui::draw_turn_cursor(&ctx, p, toward);
-            }
-        } else if let Some(c) = response.hover_pos().and_then(|p| crate::symmetry_ui::cursor(app, &xf, xf.to_doc(p))) {
-            ui.ctx().set_cursor_icon(c);
-        } else if let Some(c) = response.hover_pos().and_then(|p| crate::cam_transform::cursor(app, &ctx, &xf, p)) {
-            ui.ctx().set_cursor_icon(c);
-        } else if let Some(p) = response.hover_pos().filter(|p| crate::corner_radius::hovers(app, xf.to_doc(*p))) {
-            // Over a live rectangle's corner widget (or dragging one): the arrow with a rounded
-            // corner badge, as Photoshop's corner radius cursor.
-            ui.ctx().set_cursor_icon(egui::CursorIcon::Default);
-            crate::icons::cursor_badge(&ctx, "scan", p);
-        } else if let Some((r, p, c)) = response
-            .hover_pos()
-            .filter(|_| !transform_controls_several(app))
-            .and_then(|p| transform_controls_rect(app, &xf).and_then(|r| transform_controls_cursor(r, p).map(|c| (r, p, c))))
-        {
-            // The Move tool draws handles without opening a Free Transform session.
-            // Give them their resize/rotate cursors before the first pointer press (#2871).
-            ui.ctx().set_cursor_icon(c);
-            if let Some(toward) = transform_controls_turn(r, p) {
-                crate::crop_ui::draw_turn_cursor(&ctx, p, toward);
-            }
-        } else if let Some(c) = response.hover_pos().filter(|_| tool.is_type()).and_then(|p| {
-            let mods = crate::workspace_ui::sticky_mods(app, ui.input(|i| i.modifiers));
-            crate::type_transform::cursor(app, &ctx, &xf, p, mods)
-        }) {
-            ui.ctx().set_cursor_icon(c);
-        } else if let Some(c) = response.hover_pos().filter(|_| tool == Tool::Artboard).and_then(|p| crate::artboard_tool::cursor(app, &xf, xf.to_doc(p))) {
-            ui.ctx().set_cursor_icon(c);
-        } else if let Some((p, c)) = response.hover_pos().filter(|_| tool == Tool::Crop).and_then(|p| Some((p, crate::crop_ui::cursor(app, xf.to_doc(p))?))) {
-            ui.ctx().set_cursor_icon(c);
-            let d = xf.to_doc(p);
-            if let Some(k) = crate::crop_ui::turn_cursor_dir(app, d) {
-                let toward = xf.to_screen((d[0] + k[0] * 16.0) as f32, (d[1] + k[1] * 16.0) as f32) - p;
-                crate::crop_ui::draw_turn_cursor(&ctx, p, toward);
-            }
-        } else if let Some(p) = response.hover_pos()
-            && let Some(c) = selection_cursor(app, tool, xf.to_doc(p), crate::workspace_ui::sticky_mods(app, ui.input(|i| i.modifiers)))
-        {
-            // Over a selection (Photoshop's cursors): the move cursor where a press drags the
-            // outline (#1428), the arrow with a badge for what a press does to the selected
-            // pixels, a hollow arrowhead while they are dragged, a plain arrow over a floating
-            // piece.
-            let icon = match c {
-                SelCursor::Outline => egui::CursorIcon::Move,
-                SelCursor::Dragging => {
-                    // The tip of the arrowhead is at (4, 4) of its 24-unit box.
-                    crate::icons::cursor(ui.ctx(), "mouse-pointer-2", p, vec2(4.0, 4.0) / 24.0, 18.0);
-                    egui::CursorIcon::None
-                }
-                SelCursor::Piece => egui::CursorIcon::Default,
-                SelCursor::Cut => {
-                    crate::icons::cursor_badge(ui.ctx(), "scissors", p);
-                    egui::CursorIcon::Default
-                }
-                SelCursor::Copy => {
-                    crate::icons::cursor_copy_badge(ui.ctx(), p);
-                    egui::CursorIcon::Default
-                }
-            };
-            ui.ctx().set_cursor_icon(icon);
-        } else if let Some(p) = response.hover_pos() {
-            let alt = ui.input(|i| i.modifiers.alt);
-            if !resizing && !alt && !app.ui.shell.sticky_alt {
-                draw_clone_preview(app, &painter, &xf, xf.to_doc(p), output);
-            }
-            // The Type tool over a path shows Photoshop's area-type or type-on-a-path pointer (#218).
-            // Not while a type edit is open or a text box is dragged out, nor over type a click
-            // would edit (`hover_path_target`).
-            let type_path = if matches!(tool, Tool::Type | Tool::VerticalType) {
-                let [x, y] = xf.to_doc(p);
-                let shift = crate::workspace_ui::sticky_mods(app, ui.input(|i| i.modifiers)).shift;
-                crate::type_tool::hover_path_target(app, x, y, shift)
-            } else {
-                None
-            };
-            let icon = match tool {
-                // Resizing the brush: the circle stays where the drag began (`brush_resize`).
-                t if resizing && crate::brush_resize::applies(t) => egui::CursorIcon::None,
-                // ⌥ turns a painting tool into the Eyedropper (`alt_eyedropper`): its cursor too,
-                // unless Preferences › Cursors › Other Cursors asks for the precise crosshair.
-                t if app.alt_sampling
-                    || (app.drag.is_none()
-                        && !app.services.right_button_down.as_ref().is_some_and(|f| f())
-                        && alt_samples(t, crate::workspace_ui::sticky_mods(app, ui.input(|i| i.modifiers)))) =>
-                {
-                    // While it samples (button held), the comparison ring replaces the cursor (#213).
-                    if let Some(icon) = eyedropper_ring(app, &painter, &xf, p, response.is_pointer_button_down_on()) {
-                        icon
-                    } else if app.session.prefs().cursors.other == photocraft_engine::prefs::OtherCursor::Precise {
-                        egui::CursorIcon::Crosshair
-                    } else {
-                        pipette_cursor(ui.ctx(), p)
-                    }
-                }
-                t if t.is_brushlike() || t == Tool::QuickSelection => {
-                    // Preferences › Cursors: brush tip outline (normal = the 50% contour, or
-                    // full size), precise crosshair, or the standard pointer.
-                    use photocraft_engine::prefs::PaintingCursor;
-                    let cur = app.session.prefs().cursors.clone();
-                    // ⇪ forces the precise crosshair, whatever the cursor preference (#1758).
-                    if app.caps_lock {
-                        crate::tool_cursor::crosshair(&painter, p, 6.0, 0.0)
-                    } else {
-                        let painting = app.drag.is_some();
-                        let brush = &app.session.tools.brush;
-                        let full = (brush.size / 2.0 * xf.zoom).max(1.0);
-                        match cur.painting {
-                            PaintingCursor::Standard => egui::CursorIcon::Default,
-                            PaintingCursor::Precise => crate::tool_cursor::crosshair(&painter, p, 6.0, 0.0),
-                            _ if painting && cur.show_only_crosshair_while_painting => crate::tool_cursor::crosshair(&painter, p, 5.0, 0.0),
-                            // The Pencil (and the Eraser in Pencil mode): the outline of the
-                            // whole pixels its dab fills, on the pixel grid. A round tip is a
-                            // disc, a tiny one the whole square (#2662). The Block-mode Eraser:
-                            // its square, 16 screen pixels at any zoom (#2770).
-                            _ if tool == Tool::Pencil || crate::eraser_ui::pencil_mode(app, tool) || crate::eraser_ui::block_mode(app, tool) => {
-                                let block = crate::eraser_ui::block_mode(app, tool);
-                                let size = if block { crate::eraser_ui::block_size(app) } else { brush.size };
-                                let ppp = painter.ctx().pixels_per_point();
-                                let sq = pencil_cursor_rect(&xf, xf.to_doc(p), size, ppp);
-                                let px = 1.0 / ppp;
-                                let (dark, light) = (Stroke::new(px, Color32::from_black_alpha(160)), Stroke::new(px, Color32::from_white_alpha(230)));
-                                if !block && pencil_tip_is_round(size) {
-                                    let r = sq.width() / 2.0;
-                                    painter.circle_stroke(sq.center(), r + px / 2.0, dark);
-                                    painter.circle_stroke(sq.center(), (r - px / 2.0).max(0.0), light);
-                                } else {
-                                    painter.rect_stroke(sq, 0.0, dark, egui::StrokeKind::Outside);
-                                    painter.rect_stroke(sq, 0.0, light, egui::StrokeKind::Inside);
-                                }
-                                // Too small to see where it is: the hotspot as well.
-                                if cur.show_crosshair_in_brush_tip || sq.width() < 6.0 {
-                                    crate::tool_cursor::crosshair(&painter, p, 4.0, 0.0);
-                                }
-                                egui::CursorIcon::None
-                            }
-                            // A shaped tip (sampled bitmap, or a rotated/flattened round tip)
-                            // traces its outline, turned and flipped with the view; a plain round
-                            // tip keeps the circle.
-                            _ => {
-                                let centre = brush_tip_centre(tool, alt || app.ui.shell.sticky_alt, cur.show_crosshair_in_brush_tip);
-                                let axes = crate::brush_cursor::pen_axes(&xf, brush, app.stylus.sample());
-                                crate::brush_cursor::cursor(&painter, p, brush, full, axes, cur.painting == PaintingCursor::NormalTip, centre)
-                            }
-                        }
-                    }
-                }
-                // The Eyedropper: the comparison ring follows the pointer while it samples (#213);
-                // otherwise its pipette, or the crosshair for precise Other Cursors.
-                Tool::Eyedropper => {
-                    if let Some(icon) = eyedropper_ring(app, &painter, &xf, p, response.is_pointer_button_down_on()) {
-                        icon
-                    } else if precise_other_cursor(app) {
-                        egui::CursorIcon::Crosshair
-                    } else {
-                        pipette_cursor(ui.ctx(), p)
-                    }
-                }
-                // The Color Sampler: a pipette, or the crosshair for precise Other Cursors.
-                Tool::ColorSampler => {
-                    if precise_other_cursor(app) {
-                        egui::CursorIcon::Crosshair
-                    } else {
-                        pipette_cursor(ui.ctx(), p)
-                    }
-                }
-                // The Paint Bucket: a bucket, or the crosshair for precise Other Cursors (#3968).
-                Tool::PaintBucket => {
-                    if precise_other_cursor(app) {
-                        egui::CursorIcon::Crosshair
-                    } else {
-                        paint_bucket_cursor(ui.ctx(), p)
-                    }
-                }
-                // Over the first anchor, the close-path pointer (#4596), before the pens' own cursors.
-                Tool::Pen | Tool::CurvaturePen
-                    if {
-                        let [x, y] = xf.to_doc(p);
-                        crate::vector_ui::closes_path_at(app, tool, x, y)
-                    } =>
-                {
-                    crate::tool_cursor::close_path(&painter, p)
-                }
-                // The pen tools: their own icon with its nib on the point, or the crosshair for
-                // precise Other Cursors (#4639).
-                Tool::Pen | Tool::FreeformPen | Tool::CurvaturePen | Tool::AddAnchorPoint | Tool::DeleteAnchorPoint | Tool::ConvertPoint => {
-                    if precise_other_cursor(app) {
-                        egui::CursorIcon::Crosshair
-                    } else {
-                        pen_cursor(ui.ctx(), tool, p)
-                    }
-                }
-                // Preferences › Cursors › Other Cursors: Precise shows a crosshair for every tool.
-                Tool::Move | Tool::Type | Tool::VerticalType | Tool::HorizontalTypeMask | Tool::VerticalTypeMask
-                    if app.session.prefs().cursors.other == photocraft_engine::prefs::OtherCursor::Precise =>
-                {
-                    egui::CursorIcon::Crosshair
-                }
-                // Photoshop's Move tool keeps the standard arrow pointer (#5646): the movable
-                // layer under it is marked by the hover outline, not by a different cursor.
-                Tool::Move => egui::CursorIcon::Default,
-                // Dragging is handled with the pan itself, above.
-                Tool::Hand => crate::tool_cursor::hand(ui.ctx(), false),
-                Tool::RotateView => crate::rotate_view::cursor(response.dragged()),
-                Tool::Zoom => crate::tool_cursor::zoom(ui.ctx(), zoom_out(alt)),
-                Tool::Type | Tool::VerticalType if type_path.is_some() => match type_path {
-                    Some(crate::type_tool::PathClick::Area { .. }) => crate::tool_cursor::area_type(&painter, p),
-                    _ => crate::tool_cursor::path_type(&painter, p),
-                },
-                Tool::Type | Tool::VerticalType | Tool::HorizontalTypeMask | Tool::VerticalTypeMask => egui::CursorIcon::Text,
-                Tool::MagneticLasso => crate::magnetic_lasso_ui::cursor(app, &painter, p, xf.zoom),
-                Tool::RedEye => {
-                    let pupil = app.ui.tool_options.red_eye_pupil_size.clamp(1.0, 100.0);
-                    let r_doc = photocraft_algo::redeye::search_radius(pupil);
-                    let r = (r_doc * xf.zoom).max(2.0);
-                    painter.circle_stroke(p, r + 0.5, Stroke::new(1.0, Color32::from_black_alpha(140)));
-                    painter.circle_stroke(p, r, Stroke::new(1.0, Color32::from_white_alpha(220)));
-                    for (w, c) in [(2.5, Color32::from_black_alpha(140)), (1.0, Color32::from_white_alpha(220))] {
-                        painter.line_segment([p - vec2(3.0, 0.0), p + vec2(3.0, 0.0)], Stroke::new(w, c));
-                        painter.line_segment([p - vec2(0.0, 3.0), p + vec2(0.0, 3.0)], Stroke::new(w, c));
-                    }
-                    egui::CursorIcon::None
-                }
-                _ => egui::CursorIcon::Crosshair,
-            };
-            let icon = visible_crosshair(icon, &painter, p, cfg!(not(target_arch = "wasm32")));
-            ui.ctx().set_cursor_icon(icon);
-            // Selection tools: + / − / × badge for the effective mode (#170). A gesture keeps the
-            // mode it started with (⇧ then constrains the marquee instead of adding).
-            let held = crate::workspace_ui::sticky_mods(app, ui.input(|i| i.modifiers));
-            let mods = app.drag.as_ref().map_or(held, |d| d.modifiers);
-            if let Some(b) = crate::tool_feedback::badge(app, tool, mods) {
-                crate::tool_feedback::draw_badge(&painter, p, b, tool == Tool::QuickSelection);
-            }
-            // ⇧ after a stroke: the straight line a click would paint (#257).
-            crate::stroke_constraint::draw_line_preview(app, &painter, &xf, p, tool, held.shift);
-        }
-    }
-    app.tool_override = None;
-    if let Some(b) = layer_edges_rect(app, idx) {
-        painter.set(layer_edges, egui::Shape::rect_stroke(xf.doc_rect(b), 0, Stroke::new(1.0, LAYER_EDGES), egui::StrokeKind::Outside));
-    }
-    // A tool drag held past the canvas edge scrolls the view toward the pointer (#4183); the
-    // drag's next move then extends into what scrolled in.
-    if primary
-        && app.drag.is_some()
-        && tool != Tool::Hand
-        && !middle
-        && let Some(p) = ui.input(|i| i.pointer.primary_down().then(|| i.pointer.latest_pos()).flatten())
-    {
-        let step = crate::canvas_autoscroll::edge_step(p, rect, ui.input(|i| i.stable_dt));
-        if crate::canvas_autoscroll::scroll(&mut view, step, xf) {
-            ctx.request_repaint();
-        }
-    }
-    // Scrollbars (scrollbars.rs): drawn over the canvas edges, they take the pointer there.
-    let t0 = crate::gpu_canvas::now_ms();
-    let before = view.center;
-    let over_bars = app.ui.view.shows_scrollbars()
-        && crate::scrollbars::show(ui, rect, &mut view, flip, aspect, app.session.prefs().tools.overscroll, egui::Id::unique(("pc-canvas", idx)));
-    ctx.data_mut(|d| d.insert_temp(bars_id, over_bars));
-    if view.center != before {
-        ctx.request_repaint();
-    }
-    if primary {
-        app.perf.span("scrollbars", crate::gpu_canvas::now_ms() - t0);
-        app.hover_doc = response.hover_pos().map(|p| xf.to_doc(p));
-    }
-    if primary && app.ui.extras.rulers {
-        let before = app.guide_drag;
-        crate::rulers::draw_rulers(app, ui, full, &xf);
-        // A guide dragged out of a ruler moved after this frame drew it: draw it again where it is.
-        if app.guide_drag != before {
-            ctx.request_repaint();
-        }
-    } else if app.ui.extras.rulers {
-        crate::rulers::paint_rulers(app, ui, full, &xf, &doc);
-    }
-    // After the ruler drags above, so the readout shows where the guide is now, and not after a
-    // release ended the drag.
-    if app.session.active_index() == Some(idx) {
-        crate::rulers::draw_guide_drag_readout(app, &ctx);
-    }
-    crate::rotate_view::overlay(app, &ctx, &painter, &xf, &mut view, &response);
-    if primary {
-        // Tool input can change the stored camera while navigation edits the local view.
-        // Merge changed camera values so write-back preserves tool-driven pan and rotation.
-        if let (Some((center, rotation)), Some(now)) = (camera, app.ui.views.get(idx)) {
-            if now.center != center {
-                view.center = now.center;
-                ctx.request_repaint();
-            }
-            if now.rotation != rotation {
-                view.rotation = now.rotation;
-                ctx.request_repaint();
-            }
-        }
-        app.ui.views[idx] = view.clone();
+        let input = CanvasOverlayInput {
+            ctx: &ctx,
+            painter: &painter,
+            xf: &xf,
+            response: &response,
+            doc: &doc,
+            tool,
+            idx,
+            output,
+            border,
+            beyond,
+            edge_rect,
+            panning,
+            zoom_out: &zoom_out,
+        };
+        paint_primary_overlays(app, ui, &mut view, &input);
     }
+    let tail = CanvasTailInput {
+        ctx: &ctx,
+        painter: &painter,
+        response: &response,
+        doc: &doc,
+        xf,
+        rect,
+        full,
+        idx,
+        primary,
+        tool,
+        middle,
+        flip,
+        aspect,
+        bars_id,
+        layer_edges,
+        camera,
+    };
+    finish_canvas_view(app, ui, &mut view, &tail);
     view
 }
 
diff --git a/crates/ui-egui/src/canvas/background_redraw.rs b/crates/ui-egui/src/canvas/background_redraw.rs
index 0d2f747877..003d250ab3 100644
--- a/crates/ui-egui/src/canvas/background_redraw.rs
+++ b/crates/ui-egui/src/canvas/background_redraw.rs
@@ -110,7 +110,7 @@ pub(crate) struct Redraw {
     rx: Receiver<Piece>,
     stop: Arc<AtomicBool>,
     started_ms: f64,
-    fallback: Option<String>,
+    fallback: Option<crate::render_path::CpuReason>,
     /// The state the blocks are drawn from, and what the texels depend on besides it.
     doc: Arc<Document>,
     display: u64,
@@ -285,7 +285,7 @@ pub(crate) fn start(
     display: Option<Arc<CanvasDisplay>>,
     visible: Rect,
     region: Rect,
-    fallback: Option<String>,
+    fallback: Option<crate::render_path::CpuReason>,
 ) {
     let all = blocks(doc.bounds());
     let display_key = display.as_deref().map_or(0, |d| d.texture_key);
@@ -384,7 +384,7 @@ pub(crate) fn poll(app: &mut PhotocraftApp, gpu: &GpuCanvas, doc: DocId) {
     }
     let ms = crate::gpu_canvas::now_ms() - r.started_ms;
     app.perf.record("background", r.drawn, ms, 0.0);
-    crate::notices::slow_cpu_refresh(app, doc.0, ms, r.fallback.as_deref());
+    crate::notices::slow_cpu_refresh(app, doc.0, ms, r.fallback.as_ref());
 }
 
 /// Keep uploaded block `p` for [`Kept`], unless the composite would pass the cap.
@@ -454,7 +454,7 @@ struct Spawn {
     pending: Vec<bool>,
     /// When it started and the pixels uploaded so far.
     since: (f64, u64),
-    fallback: Option<String>,
+    fallback: Option<crate::render_path::CpuReason>,
     /// Blocks collected for [`Kept`], their bytes, and the cap.
     keep: (Vec<Option<Vec<u8>>>, u64, u64),
 }
diff --git a/crates/ui-egui/src/canvas/background_redraw/tests.rs b/crates/ui-egui/src/canvas/background_redraw/tests.rs
index 114a150eb1..55afe9ac6b 100644
--- a/crates/ui-egui/src/canvas/background_redraw/tests.rs
+++ b/crates/ui-egui/src/canvas/background_redraw/tests.rs
@@ -523,6 +523,105 @@ fn hiding_a_large_layer_over_the_gpu_budget_redraws_in_the_background() {
     assert!(g.harness.state().redraws.contains_key(&doc), "not composited inline: {}", g.harness.state().perf.last_refresh);
     settle(&mut g);
     assert_eq!(g.harness.state().perf.last_refresh, "background");
-    assert_eq!(g.harness.state().perf.gpu_fallback.as_deref(), Some(crate::gpu_canvas::OVER_BUDGET));
+    let app = g.harness.state();
+    assert!(matches!(app.render_path.current(doc.0), Some(crate::render_path::CpuReason::OverBudget { .. })), "{:?}", app.perf.gpu_fallback);
     assert_matches_synchronous(&mut g, doc);
 }
+
+/// The active document's render path: its reason's kind and the status bar's label.
+fn render_path_of(g: &Gpu) -> (Option<&'static str>, Option<&'static str>) {
+    let app = g.harness.state();
+    let doc = app.session.active().expect("document").doc.id.0;
+    (app.render_path.current(doc).map(crate::render_path::CpuReason::kind), crate::chrome_ui::render_path_label(app).map(|l| l.0))
+}
+
+/// On the GPU canvas: no reason, or only a software adapter's (CI's runners have one).
+fn on_gpu_canvas(g: &Gpu) -> bool {
+    matches!(render_path_of(g).0, None | Some("softwareAdapter"))
+}
+
+#[test]
+fn advanced_blending_fallback_is_shown_in_the_status_bar() {
+    use egui_kittest::kittest::Queryable;
+    let _gpu = photocraft_testkit::gpu_lock();
+    let Some(mut g) = gpu_app() else { return };
+    cpu_only_document(g.harness.state_mut(), 800, 600);
+    g.harness.step();
+    settle(&mut g);
+    g.harness.run_steps(2);
+    assert_eq!(render_path_of(&g), (Some("unsupported"), Some("CPU Rendering")));
+    assert!(g.harness.query_by_label("CPU Rendering").is_some(), "the status bar says so");
+    let tip = crate::chrome_ui::render_path_label(g.harness.state()).map(|l| l.1).unwrap_or_default();
+    assert!(tip.contains("Advanced Blending"), "{tip}");
+}
+
+#[test]
+fn over_budget_fallback_shows_working_set_and_budget() {
+    use egui_kittest::kittest::Queryable;
+    let _gpu = photocraft_testkit::gpu_lock();
+    let Some(mut g) = gpu_app() else { return };
+    // As in `hiding_a_large_layer_over_the_gpu_budget_redraws_in_the_background`: a large damage
+    // rect over a budget the whole width's pages don't fit.
+    let app = g.harness.state_mut();
+    app.run("file.new", json!({"width": 5000, "height": 2000, "background": "#336699"})).expect("new");
+    app.run("layer.new.layer", json!({})).expect("layer");
+    app.run("select.rect", json!({"x": 0, "y": 0, "width": 4800, "height": 1800})).expect("select");
+    app.run("edit.fill", json!({"color": "#cc8844"})).expect("fill");
+    app.run("select.deselect", json!({})).expect("deselect");
+    let layer = app.session.active().expect("document").active_layer.expect("layer");
+    settle(&mut g);
+    assert!(on_gpu_canvas(&g), "the document fits the GPU");
+    g.observer.set_memory_budget(48 << 20);
+    g.harness.state_mut().run("layer.setProps", json!({"layer": layer.0, "visible": false})).expect("hide");
+    g.harness.step();
+    settle(&mut g);
+    g.harness.run_steps(2);
+    assert_eq!(render_path_of(&g), (Some("overBudget"), Some("GPU Memory Full")));
+    assert!(g.harness.query_by_label("GPU Memory Full").is_some());
+    let text = g.harness.state().perf.gpu_fallback.clone().unwrap_or_default();
+    assert!(text.contains("of GPU memory, budget") && text.contains('M'), "{text}");
+}
+
+#[test]
+fn a_compositor_build_failure_shows_its_reason() {
+    use egui_kittest::kittest::Queryable;
+    let _gpu = photocraft_testkit::gpu_lock();
+    let Some(mut g) = gpu_app() else { return };
+    // The DX12 FXC failure of #8733, which no Mac reproduces.
+    g.observer.fail_compositor("Shader compilation failed: error X3507: not all control paths return a value");
+    g.harness.state_mut().run("file.new", json!({"width": 400, "height": 300, "background": "#336699"})).expect("new");
+    g.harness.step();
+    settle(&mut g);
+    g.harness.run_steps(2);
+    assert_eq!(render_path_of(&g), (Some("compositorBuild"), Some("CPU Rendering")));
+    assert!(g.harness.query_by_label("CPU Rendering").is_some());
+    assert!(g.harness.state().perf.gpu_fallback.as_deref().is_some_and(|f| f.contains("X3507")));
+}
+
+#[test]
+fn a_canvas_over_the_texture_budget_records_its_reason() {
+    let _gpu = photocraft_testkit::gpu_lock();
+    let Some(mut g) = gpu_app() else { return };
+    // The app's canvas, not the observer: each `GpuCanvas::new` shares a new budget.
+    g.harness.state().gpu.as_ref().expect("gpu canvas").set_canvas_budget(1);
+    g.harness.state_mut().run("file.new", json!({"width": 400, "height": 300, "background": "#336699"})).expect("new");
+    g.harness.run_steps(3);
+    assert_eq!(render_path_of(&g), (Some("canvasTooLarge"), Some("CPU Rendering")));
+    let doc = g.harness.state().session.active().expect("document").doc.id.0;
+    assert_eq!(g.harness.state().render_path.history().filter(|c| c.doc == doc).count(), 1, "once, not every frame");
+}
+
+#[test]
+fn a_flipped_view_records_why_it_draws_on_the_cpu() {
+    let _gpu = photocraft_testkit::gpu_lock();
+    let Some(mut g) = gpu_app() else { return };
+    g.harness.state_mut().run("file.new", json!({"width": 400, "height": 300, "background": "#336699"})).expect("new");
+    g.harness.run_steps(3);
+    assert!(on_gpu_canvas(&g));
+    g.harness.state_mut().ui.view.flip_horizontal = true;
+    g.harness.run_steps(3);
+    assert_eq!(render_path_of(&g), (Some("viewTransform"), Some("CPU Rendering")));
+    g.harness.state_mut().ui.view.flip_horizontal = false;
+    g.harness.run_steps(3);
+    assert!(on_gpu_canvas(&g), "back on the GPU");
+}
diff --git a/crates/ui-egui/src/canvas/canvas_tool_menu.rs b/crates/ui-egui/src/canvas/canvas_tool_menu.rs
index dd9b635e64..d2a49241d5 100644
--- a/crates/ui-egui/src/canvas/canvas_tool_menu.rs
+++ b/crates/ui-egui/src/canvas/canvas_tool_menu.rs
@@ -1041,6 +1041,10 @@ fn pen_dialog(app: &mut PhotocraftApp, command: &str, label: &str, name: &str) {
     } else {
         fields.insert("name".into(), json!(name));
     }
+    if command == "path.toSelection" {
+        // OK deselects and hides the path, as ⌘↩ does (#6079).
+        fields.insert("__deselectPath".into(), json!(true));
+    }
     if command == "path.fill" {
         let fg = app.session.tools.foreground;
         let byte = |v: f32| (v.clamp(0.0, 1.0) * 255.0).round() as u8;
diff --git a/crates/ui-egui/src/canvas/canvas_tool_menu/tests.rs b/crates/ui-egui/src/canvas/canvas_tool_menu/tests.rs
index eb9147a7a5..6f8d0a3aa8 100644
--- a/crates/ui-egui/src/canvas/canvas_tool_menu/tests.rs
+++ b/crates/ui-egui/src/canvas/canvas_tool_menu/tests.rs
@@ -712,6 +712,16 @@ fn completed_pen_path_right_click_makes_selection() {
     crate::dialogs::confirm(h.state_mut(), dialog).unwrap();
     assert!(h.state().session.active().unwrap().doc.selection.is_some());
     assert_eq!(h.state().session.journal.last().map(|(id, _)| id.as_str()), Some("path.toSelection"));
+    // Like ⌘↩, it deselects and hides the work path, which stays in the document (#6079).
+    assert_eq!(h.state().ui.selected_path, None);
+    assert!(h.state().session.active().unwrap().doc.work_path.is_some());
+    assert!(!crate::vector_ui::work_path_shown(h.state()));
+    // The hidden work path is no longer the active path: a second right-click offers no path
+    // commands, so Delete Path can't remove it unseen.
+    right_click(&mut h, center, Modifiers::NONE);
+    assert!(h.state().ui.canvas_tool_menu.as_ref().is_some_and(|m| m.tool == Tool::Pen && !m.has_path && m.path_name.is_none()));
+    choose(h.state_mut(), &ctx, "path.delete");
+    assert!(h.state().session.active().unwrap().doc.work_path.is_some(), "the hidden work path survives Delete Path");
 }
 
 #[test]
@@ -751,8 +761,12 @@ fn pen_options_bar_makes_a_selection_from_the_path() {
     crate::dialogs::confirm(&mut app, dialog).unwrap();
     let st = app.session.active().unwrap();
     assert!(st.doc.work_path.is_some() && st.doc.selection.is_some());
-    // The active (Work) path again, with no pen path in progress.
+    // That hid the Work Path (#6079): it is not the active path until it is selected in the
+    // Paths panel again, and then it is, with no pen path in progress.
     app.run("select.deselect", json!({})).unwrap();
+    assert!(make_selection(&mut app).is_err(), "the hidden Work Path is not the active path");
+    assert!(app.ui.dialogs.is_empty());
+    app.ui.selected_path = Some("work".into());
     make_selection(&mut app).unwrap();
     let dialog = app.ui.dialogs.last().map(|d| d.id).unwrap();
     crate::dialogs::confirm(&mut app, dialog).unwrap();
diff --git a/crates/ui-egui/src/canvas/cursors.rs b/crates/ui-egui/src/canvas/cursors.rs
index a7048ea3c5..06819c5ea1 100644
--- a/crates/ui-egui/src/canvas/cursors.rs
+++ b/crates/ui-egui/src/canvas/cursors.rs
@@ -1,6 +1,6 @@
 use super::tool_input::ToolEvent;
 use super::view_xform::ViewXform;
-use super::*;
+use super::{Color32, PhotocraftApp, Pos2, Rect, Stroke, Tool, json, pos2, vec2};
 
 /// Windows' crosshair cursor inverts the pixels under it, so over mid-grey (the pasteboard, many
 /// photos) it vanishes (#737), and the Linux themes' and macOS's differ. Use the same black-and-white
diff --git a/crates/ui-egui/src/canvas/display.rs b/crates/ui-egui/src/canvas/display.rs
index 1cfae7a46d..3b111232bd 100644
--- a/crates/ui-egui/src/canvas/display.rs
+++ b/crates/ui-egui/src/canvas/display.rs
@@ -1,5 +1,5 @@
 use super::strokes::live_stroke;
-use super::*;
+use super::{Color32, Document, LayerContent, PhotocraftApp, TextureOptions};
 
 pub(super) fn checker(app: &mut PhotocraftApp, ctx: &egui::Context) -> egui::TextureId {
     // Preferences › Transparency & Gamut colours (the texture is rebuilt when they change).
diff --git a/crates/ui-egui/src/canvas/drag.rs b/crates/ui-egui/src/canvas/drag.rs
index a58e8db11b..6083756416 100644
--- a/crates/ui-egui/src/canvas/drag.rs
+++ b/crates/ui-egui/src/canvas/drag.rs
@@ -1,5 +1,5 @@
 use super::view_xform::ViewXform;
-use super::*;
+use super::{PhotocraftApp, Pos2, Rect, Stroke, Tool, vec2};
 
 /// An in-progress pointer gesture on the canvas.
 #[derive(Clone, Debug)]
diff --git a/crates/ui-egui/src/canvas/filter_preview.rs b/crates/ui-egui/src/canvas/filter_preview.rs
index 6940b7b720..a7d3f8dc94 100644
--- a/crates/ui-egui/src/canvas/filter_preview.rs
+++ b/crates/ui-egui/src/canvas/filter_preview.rs
@@ -1,6 +1,6 @@
 use super::display::canvas_display;
 use super::textures::texture_buffer;
-use super::*;
+use super::{Document, LayerContent, PhotocraftApp};
 
 /// The proxy factor of a live preview of filter `cmd` with `params` on `doc`, the active document:
 /// reduced on a large document (Preferences › Performance › Low Resolution Previews), except for
@@ -125,7 +125,7 @@ pub(crate) fn ensure_filter_preview(app: &mut PhotocraftApp, idx: usize, ctx: &e
                     let buffer = photocraft_compose::flatten(&doc);
                     (std::sync::Arc::new(doc), buffer)
                 });
-                crate::filter_preview_worker::Computed { result, ms: crate::gpu_canvas::now_ms() - t0 }
+                crate::dialogs::filter_preview_worker::Computed { result, ms: crate::gpu_canvas::now_ms() - t0 }
             }) {
                 app.filter_preview = Some(crate::filter_dialog::FilterPreview { key: request.clone(), result: None, committing: false });
                 crate::notices::error(app, error);
diff --git a/crates/ui-egui/src/canvas/gesture.rs b/crates/ui-egui/src/canvas/gesture.rs
index 81c0b231a4..251b6c9205 100644
--- a/crates/ui-egui/src/canvas/gesture.rs
+++ b/crates/ui-egui/src/canvas/gesture.rs
@@ -4,7 +4,7 @@ use super::strokes::{
     EngineStroke, commit_brush_stroke, feed_live_stroke, live_retouch_command, offer_live_retouch, paint_target, snap_aliased_tip, stroke_params,
 };
 use super::textures::shown_as_document;
-use super::*;
+use super::{PhotocraftApp, Tool, json};
 
 pub(crate) fn finish_gesture(app: &mut PhotocraftApp, d: Drag) {
     // Control can select a different tool and release before the next frame cancels the drag.
diff --git a/crates/ui-egui/src/canvas/gpu_canvas.rs b/crates/ui-egui/src/canvas/gpu_canvas.rs
index 7f16afd5ce..48aeb07e0f 100644
--- a/crates/ui-egui/src/canvas/gpu_canvas.rs
+++ b/crates/ui-egui/src/canvas/gpu_canvas.rs
@@ -32,6 +32,8 @@ use std::sync::atomic::Ordering;
 use eframe::egui_wgpu::{self, CallbackResources, CallbackTrait, RenderState, ScreenDescriptor};
 use eframe::wgpu;
 
+use crate::render_path::CpuReason;
+
 pub use photocraft_gpu::{DeviceHealth, Fault};
 
 mod budget;
@@ -43,12 +45,14 @@ mod setup;
 mod shaders;
 mod texels;
 
-#[cfg(test)]
-use budget::drm_video_memory;
+#[cfg(all(test, target_os = "linux"))]
+use budget::nvidia_video_memory;
 pub use budget::{
     DEFER_PX, MIN_GPU_BUDGET, OVER_BUDGET, OVER_CANVAS_BUDGET, REFRESH_DEFERRED, REFRESH_OVER_BUDGET, canvas_budget, canvas_texture_bytes, memory_budget,
     physical_memory, video_memory, vram_share,
 };
+#[cfg(test)]
+use budget::{NVIDIA_VENDOR, bounded_output, drm_video_memory, parse_nvidia_smi};
 #[cfg(all(test, windows))]
 use budget::{detect_physical_memory, detect_video_memory};
 use callback::CanvasCallback;
@@ -351,10 +355,53 @@ impl GpuCanvas {
     /// Whether `doc`'s display textures fit [`canvas_budget`]; when they don't, nothing is
     /// created for it and it is drawn on the CPU canvas.
     pub fn fits_canvas(&self, doc: &photocraft_doc::Document) -> bool {
+        self.canvas_fit(doc).is_some_and(|(bytes, budget)| bytes <= budget)
+    }
+
+    /// The bytes `doc`'s display textures would take and [`canvas_budget`] (`None` without a GPU
+    /// canvas): the numbers of a [`CpuReason::CanvasTooLarge`].
+    pub fn canvas_fit(&self, doc: &photocraft_doc::Document) -> Option<(u64, u64)> {
         let size = [doc.size.width, doc.size.height];
         let bytes = canvas_texture_bytes(size, self.tile, texel_bytes(self.format_for(doc.depth, size)));
         let r = self.rs.renderer.read();
-        r.callback_resources.get::<Resources>().is_some_and(|res| bytes <= res.canvas_budget.load(Ordering::Relaxed))
+        r.callback_resources.get::<Resources>().map(|res| (bytes, res.canvas_budget.load(Ordering::Relaxed)))
+    }
+
+    /// Act as if the driver couldn't build the compositor's pipelines (the DX12 FXC X3507 case,
+    /// #8733): every later refresh goes to the CPU compositor with `msg` as the reason.
+    #[cfg(test)]
+    pub(crate) fn fail_compositor(&self, msg: &str) {
+        let mut r = self.rs.renderer.write();
+        if let Some(res) = r.callback_resources.get_mut::<Resources>() {
+            res.compositor = None;
+            res.compositor_failed = Some(photocraft_gpu::Unsupported(msg.into()));
+        }
+    }
+
+    /// Why the compositor couldn't be built, once it couldn't (see [`GpuCanvas::composite`]).
+    fn compositor_failed(&self) -> Option<String> {
+        let r = self.rs.renderer.read();
+        r.callback_resources.get::<Resources>()?.compositor_failed.as_ref().map(|e| e.0.clone())
+    }
+
+    /// A [`photocraft_gpu::Unsupported`] from [`GpuCanvas::composite`] as a typed reason, with
+    /// the numbers of the budget it names.
+    fn reason(&self, doc: &photocraft_doc::Document, e: photocraft_gpu::Unsupported) -> CpuReason {
+        if let Some(f) = self.fault() {
+            return CpuReason::from_fault(&f);
+        }
+        if e.0 == OVER_BUDGET {
+            let fit = self.layer_fit();
+            return CpuReason::OverBudget { needed: fit.map_or(0, |f| f.needed), budget: fit.map_or(0, |f| f.budget) };
+        }
+        if e.0 == OVER_CANVAS_BUDGET {
+            let (bytes, budget) = self.canvas_fit(doc).unwrap_or_default();
+            return CpuReason::CanvasTooLarge { bytes, budget };
+        }
+        if self.compositor_failed().is_some_and(|f| f == e.0) {
+            return CpuReason::CompositorBuild(e.0);
+        }
+        CpuReason::Unsupported(e.0)
     }
 
     /// Cap lower-stack composite reuse; zero disables it for profiling the uncached path.
@@ -557,7 +604,7 @@ impl GpuCanvas {
             None => match photocraft_gpu::Compositor::try_new_with_format(device, photocraft_gpu::Compositor::preferred_acc_format(&self.rs.adapter)) {
                 Ok(c) => c,
                 Err(e) => {
-                    log::warn!("{e}; using the CPU compositor");
+                    // `render_path::note` logs it, once, as this document's reason.
                     res.compositor_failed = Some(e.clone());
                     return Err(e);
                 }
@@ -703,7 +750,7 @@ impl GpuCanvas {
     ) -> Refresh {
         if let Some(f) = self.fault() {
             // Nothing reaches the GPU any more; the app switches to the CPU canvas.
-            return Refresh { kind: "lost", fallback: Some(f.to_string()), ..Default::default() };
+            return Refresh { kind: "lost", fallback: Some(CpuReason::from_fault(&f)), ..Default::default() };
         }
         if !self.fits_canvas(doc) {
             // Neither compositor can fill textures that are never created: the CPU canvas draws
@@ -711,7 +758,8 @@ impl GpuCanvas {
             if let Some(res) = self.rs.renderer.write().callback_resources.get_mut::<Resources>() {
                 res.docs.remove(&key);
             }
-            return Refresh { kind: REFRESH_OVER_BUDGET, fallback: Some(OVER_CANVAS_BUDGET.into()), ..Default::default() };
+            let (bytes, budget) = self.canvas_fit(doc).unwrap_or_default();
+            return Refresh { kind: REFRESH_OVER_BUDGET, fallback: Some(CpuReason::CanvasTooLarge { bytes, budget }), ..Default::default() };
         }
         let bounds = doc.bounds();
         let size = [doc.size.width, doc.size.height];
@@ -737,7 +785,7 @@ impl GpuCanvas {
                 out.gpu = stats.gpu_time;
                 return out;
             }
-            Err(e) => out.fallback = Some(e.0),
+            Err(e) => out.fallback = Some(self.reason(doc, e)),
         }
         let px = region.width() as u64 * region.height() as u64;
         if defer && px >= DEFER_PX && self.prepare_texture(key, doc).is_some() {
diff --git a/crates/ui-egui/src/canvas/gpu_canvas/budget.rs b/crates/ui-egui/src/canvas/gpu_canvas/budget.rs
index c98870130f..9f5df3ebd6 100644
--- a/crates/ui-egui/src/canvas/gpu_canvas/budget.rs
+++ b/crates/ui-egui/src/canvas/gpu_canvas/budget.rs
@@ -1,5 +1,5 @@
 use super::doc_textures::mip_count;
-use super::*;
+use super::wgpu;
 
 /// Floor of the compositor's memory budget: enough for a viewport's pages of a dozen layers.
 pub const MIN_GPU_BUDGET: u64 = 512 << 20;
@@ -120,11 +120,11 @@ fn detect_physical_memory() -> Option<u64> {
 }
 
 /// The memory of `adapter` itself, in bytes, when it is a discrete GPU and the platform reports
-/// it: DXGI's dedicated video memory on Windows, amdgpu's VRAM size on Linux. `None` for
-/// integrated and software adapters, whose textures live in system memory (the RAM-based
-/// budgets already cover them), and where nothing reports it. `PHOTOCRAFT_VRAM_MB` overrides it
-/// for any adapter, simulating a discrete card of that size: on an integrated GPU the budget then
-/// stops charging the document's pixels too, as for a real card (a development switch).
+/// it: DXGI's dedicated video memory on Windows, amdgpu's VRAM size or `nvidia-smi`'s report on
+/// Linux. `None` for integrated and software adapters, whose textures live in system memory (the
+/// RAM-based budgets already cover them), and where nothing reports it. `PHOTOCRAFT_VRAM_MB`
+/// overrides it for any adapter, simulating a discrete card of that size: on an integrated GPU the
+/// budget then stops charging the document's pixels too, as for a real card (a development switch).
 pub fn video_memory(adapter: &wgpu::AdapterInfo) -> Option<u64> {
     if let Some(mb) = std::env::var("PHOTOCRAFT_VRAM_MB").ok().and_then(|v| v.trim().parse::<u64>().ok()) {
         return mb.checked_mul(1 << 20).filter(|b| *b > 0);
@@ -161,7 +161,103 @@ pub(super) fn detect_video_memory(vendor: u32, device: u32) -> Option<u64> {
 
 #[cfg(target_os = "linux")]
 fn detect_video_memory(vendor: u32, device: u32) -> Option<u64> {
-    drm_video_memory(std::path::Path::new("/sys/class/drm"), vendor, device)
+    drm_video_memory(std::path::Path::new("/sys/class/drm"), vendor, device).or_else(|| nvidia_video_memory(vendor, device))
+}
+
+/// PCI vendor id of NVIDIA, whose proprietary Linux driver writes none of amdgpu's
+/// `mem_info_vram_total` sysfs files (a card of its own still reads as [`None`] above): without
+/// this, a discrete NVIDIA card was charged for the document's pixels like an integrated one,
+/// `memory_budget` shrank to Memory Usage minus them, and a many-layer document whose pages then
+/// missed that budget redrew whole-document edits on the CPU every time (P60/P61 on an NVIDIA
+/// Linux box: 1.5 s where the fix's own benchmark measures tens of milliseconds elsewhere).
+#[cfg(any(target_os = "linux", test))]
+pub(super) const NVIDIA_VENDOR: u32 = 0x10de;
+
+/// How long `nvidia-smi` gets to answer: it runs on the UI thread while the window opens, and a
+/// driver that hangs the query must not keep PhotoCraft from starting.
+#[cfg(target_os = "linux")]
+const NVIDIA_SMI_DEADLINE: std::time::Duration = std::time::Duration::from_secs(2);
+
+/// NVIDIA's own memory size on Linux, from `nvidia-smi` (installed with the driver that put this
+/// adapter there in the first place): absent, slower than [`NVIDIA_SMI_DEADLINE`] or odd output
+/// all read as `None`, never a hang or a panic.
+#[cfg(target_os = "linux")]
+pub(super) fn nvidia_video_memory(vendor: u32, device: u32) -> Option<u64> {
+    if vendor != NVIDIA_VENDOR {
+        return None;
+    }
+    let mut cmd = std::process::Command::new("nvidia-smi");
+    cmd.args(["--query-gpu=pci.device_id,memory.total", "--format=csv,noheader,nounits"]);
+    let out = bounded_output(cmd, NVIDIA_SMI_DEADLINE)?;
+    parse_nvidia_smi(&String::from_utf8_lossy(&out), vendor, device)
+}
+
+/// The first 64 KiB of `cmd`'s stdout when it exits successfully within `deadline`; `None` when
+/// it can't start, fails or is still running by then. A late one is killed and reaped on a thread
+/// of its own (a process stuck in the driver may not die at once), so the caller waits about
+/// `deadline` at most.
+#[cfg(any(target_os = "linux", test))]
+pub(super) fn bounded_output(mut cmd: std::process::Command, deadline: std::time::Duration) -> Option<Vec<u8>> {
+    use std::io::Read;
+    use std::process::{Child, Stdio};
+    use std::time::{Duration, Instant};
+    fn abandon(mut child: Child) {
+        let _ = child.kill();
+        let _ = std::thread::Builder::new().name("reap".into()).spawn(move || child.wait());
+    }
+    let end = Instant::now().checked_add(deadline)?;
+    let mut child = cmd.stdin(Stdio::null()).stdout(Stdio::piped()).stderr(Stdio::null()).spawn().ok()?;
+    let Some(stdout) = child.stdout.take() else {
+        abandon(child);
+        return None;
+    };
+    let (tx, rx) = std::sync::mpsc::channel();
+    let reader = std::thread::Builder::new().name("child-stdout".into()).spawn(move || {
+        let mut buf = Vec::new();
+        let _ = stdout.take(64 << 10).read_to_end(&mut buf);
+        let _ = tx.send(buf);
+    });
+    if reader.is_err() {
+        abandon(child);
+        return None;
+    }
+    let status = loop {
+        match child.try_wait() {
+            Ok(Some(status)) => break status,
+            Ok(None) if Instant::now() < end => std::thread::sleep(Duration::from_millis(10)),
+            _ => {
+                abandon(child);
+                return None;
+            }
+        }
+    };
+    if !status.success() {
+        return None;
+    }
+    // The child has exited, so its stdout is at EOF unless it handed the pipe on to a process of
+    // its own: bounded too, rather than joining the reader.
+    rx.recv_timeout(end.saturating_duration_since(Instant::now()).max(Duration::from_millis(50))).ok()
+}
+
+/// `nvidia-smi --query-gpu=pci.device_id,memory.total --format=csv,noheader,nounits`'s own
+/// format: one `0xDDDDVVVV, size-in-MiB` line per card (device id the high half, vendor id the
+/// low, as `lspci -n` and wgpu's own ids read them). The matching line's size, in bytes, and the
+/// smallest when several cards share those ids (the ids can't tell which one wgpu picked, so the
+/// budget assumes the smaller); `None` when no line names this `vendor`/`device`, or the output
+/// isn't shaped like that at all.
+#[cfg(any(target_os = "linux", test))]
+pub(super) fn parse_nvidia_smi(output: &str, vendor: u32, device: u32) -> Option<u64> {
+    output
+        .lines()
+        .filter_map(|line| {
+            let (id, mb) = line.split_once(',')?;
+            let id = u32::from_str_radix(id.trim().trim_start_matches("0x").trim_start_matches("0X"), 16).ok()?;
+            if id & 0xffff != vendor || id >> 16 != device {
+                return None;
+            }
+            mb.trim().parse::<u64>().ok()?.checked_mul(1 << 20).filter(|b| *b > 0)
+        })
+        .min()
 }
 
 /// amdgpu's VRAM size (`<card>/device/mem_info_vram_total`, bytes) of the card under `drm` (the
diff --git a/crates/ui-egui/src/canvas/gpu_canvas/callback.rs b/crates/ui-egui/src/canvas/gpu_canvas/callback.rs
index c128a8f297..23e11399b0 100644
--- a/crates/ui-egui/src/canvas/gpu_canvas/callback.rs
+++ b/crates/ui-egui/src/canvas/gpu_canvas/callback.rs
@@ -1,5 +1,5 @@
 use super::resources::{CanvasStyle, Resources, ViewGpu, f32_bytes};
-use super::*;
+use super::{CallbackResources, CallbackTrait, ScreenDescriptor, VIEW_FLOATS, VIEW_UNIFORM_SIZE, ViewParams, wgpu};
 
 // ---------------------------------------------------------------------------------------------
 // Per-frame callback
diff --git a/crates/ui-egui/src/canvas/gpu_canvas/doc_textures.rs b/crates/ui-egui/src/canvas/gpu_canvas/doc_textures.rs
index 05a40faa1a..fb09f08e14 100644
--- a/crates/ui-egui/src/canvas/gpu_canvas/doc_textures.rs
+++ b/crates/ui-egui/src/canvas/gpu_canvas/doc_textures.rs
@@ -1,7 +1,7 @@
 use super::budget::canvas_texture_bytes;
 use super::resources::{DocTextures, Resources, Tile, f32_bytes};
 use super::texels::texel_bytes;
-use super::*;
+use super::{Ordering, WHOLE_MIP_SIDE, wgpu};
 
 pub(super) fn mip_count(w: u32, h: u32) -> u32 {
     32 - w.max(h).max(1).leading_zeros()
diff --git a/crates/ui-egui/src/canvas/gpu_canvas/perf.rs b/crates/ui-egui/src/canvas/gpu_canvas/perf.rs
index 8c22dfbf89..b1fedc6a62 100644
--- a/crates/ui-egui/src/canvas/gpu_canvas/perf.rs
+++ b/crates/ui-egui/src/canvas/gpu_canvas/perf.rs
@@ -1,7 +1,7 @@
 use super::budget::video_memory;
 use super::setup::Refresh;
 use super::texels::LayerFit;
-use super::*;
+use super::wgpu;
 
 /// Milliseconds since the process (or page) started, from a monotonic clock.
 ///
@@ -46,7 +46,8 @@ pub struct Perf {
     /// Pixels of the refresh `gpu_ms` measured, which is a frame or two behind
     /// `last_refresh_px` and may be a different size.
     pub gpu_ms_px: u64,
-    /// Why the last refresh fell back to the CPU compositor (None = GPU composited).
+    /// Why the active view is drawn on the CPU (None = GPU composited): the current
+    /// [`crate::render_path`] reason as text, written only by `render_path`.
     pub gpu_fallback: Option<String>,
     /// Adapter, backend, driver and fallback state (Help › System Info).
     pub gpu_info: GpuInfo,
@@ -224,8 +225,6 @@ impl Perf {
             // refresh's would be read as this refresh's.
             self.gpu_ms = None;
             self.gpu_ms_px = 0;
-        } else {
-            self.gpu_fallback = None;
         }
     }
 
diff --git a/crates/ui-egui/src/canvas/gpu_canvas/resources.rs b/crates/ui-egui/src/canvas/gpu_canvas/resources.rs
index 27606b7c05..721377e928 100644
--- a/crates/ui-egui/src/canvas/gpu_canvas/resources.rs
+++ b/crates/ui-egui/src/canvas/gpu_canvas/resources.rs
@@ -2,7 +2,7 @@ use super::budget::{canvas_budget, physical_memory};
 use super::doc_textures::init_buffer;
 use super::shaders::{CANVAS_WGSL, ENCODE_WGSL, MIP_WGSL};
 use super::texels::LayerFit;
-use super::*;
+use super::{FORMAT, FORMAT_HIGH, HashMap, NonZeroU64, TILE_UNIFORM_SIZE, VIEW_FLOATS, VIEW_UNIFORM_SIZE, wgpu};
 
 pub(super) struct Resources {
     pub(super) view_bgl: wgpu::BindGroupLayout,
diff --git a/crates/ui-egui/src/canvas/gpu_canvas/setup.rs b/crates/ui-egui/src/canvas/gpu_canvas/setup.rs
index 8195148a45..b9d3f98bbe 100644
--- a/crates/ui-egui/src/canvas/gpu_canvas/setup.rs
+++ b/crates/ui-egui/src/canvas/gpu_canvas/setup.rs
@@ -1,5 +1,6 @@
 use super::texels::texels;
-use super::*;
+use super::{egui_wgpu, wgpu};
+use crate::render_path::CpuReason;
 
 /// A CPU composite as the canvas texture stores it (`display`'s encoding; as is without one).
 pub(super) fn texture_buffer<'a>(
@@ -43,7 +44,7 @@ pub struct Refresh {
     /// document under-reports by more than the few per cent of a warm one.
     pub gpu: Option<photocraft_gpu::GpuTiming>,
     /// Why the wgpu compositor wasn't used.
-    pub fallback: Option<String>,
+    pub fallback: Option<CpuReason>,
 }
 
 /// How the app creates its wgpu device: egui's defaults clamped to the adapter's supported limits,
diff --git a/crates/ui-egui/src/canvas/gpu_canvas/tests.rs b/crates/ui-egui/src/canvas/gpu_canvas/tests.rs
index 7402f5026f..74305c024b 100644
--- a/crates/ui-egui/src/canvas/gpu_canvas/tests.rs
+++ b/crates/ui-egui/src/canvas/gpu_canvas/tests.rs
@@ -210,6 +210,86 @@ fn drm_video_memory_reads_the_matching_cards_vram() {
     std::fs::remove_dir_all(&drm).unwrap();
 }
 
+/// #P60/P61: amdgpu's sysfs files have no NVIDIA equivalent, so a discrete NVIDIA card's own
+/// memory comes from `nvidia-smi`'s CSV instead (real output: `0x2C0510DE, 16303`, device id
+/// the high half of the hex, vendor the low). A second card, an upper-case `0X` prefix, extra
+/// spaces, a non-matching id, a missing comma, a non-numeric size, empty output and a size
+/// that would overflow all give nothing rather than the wrong (or a panicking) answer.
+#[test]
+fn parses_nvidia_smis_own_report_of_the_cards_memory() {
+    let two = "0x2C0510DE, 16303\n0x061C10DE, 24576\n";
+    assert_eq!(parse_nvidia_smi(two, NVIDIA_VENDOR, 0x2c05), Some(16303 << 20));
+    assert_eq!(parse_nvidia_smi(two, NVIDIA_VENDOR, 0x061c), Some(24576 << 20));
+    assert_eq!(parse_nvidia_smi("0X2C0510DE,   16303  \n", NVIDIA_VENDOR, 0x2c05), Some(16303 << 20), "upper-case prefix, loose spacing");
+    assert_eq!(parse_nvidia_smi(two, NVIDIA_VENDOR, 0xdead), None, "no such device id");
+    assert_eq!(parse_nvidia_smi(two, 0x1002, 0x2c05), None, "no such vendor id");
+    assert_eq!(parse_nvidia_smi("not csv at all", NVIDIA_VENDOR, 0x2c05), None);
+    assert_eq!(parse_nvidia_smi("0x2C0510DE 16303\n", NVIDIA_VENDOR, 0x2c05), None, "no comma");
+    assert_eq!(parse_nvidia_smi("0x2C0510DE, lots\n", NVIDIA_VENDOR, 0x2c05), None, "not a number");
+    assert_eq!(parse_nvidia_smi("", NVIDIA_VENDOR, 0x2c05), None, "empty output");
+    assert_eq!(parse_nvidia_smi(&format!("0x2C0510DE, {}\n", u64::MAX), NVIDIA_VENDOR, 0x2c05), None, "would overflow");
+}
+
+/// Two cards of one model (same vendor and device id) with different memory: wgpu's ids can't
+/// tell which one it picked, so the budget assumes the smaller rather than whichever came first.
+#[test]
+fn nvidia_smi_cards_sharing_an_id_report_the_smaller_memory() {
+    assert_eq!(parse_nvidia_smi("0x2C0510DE, 16303\n0x2C0510DE, 8192\n", NVIDIA_VENDOR, 0x2c05), Some(8192 << 20));
+    assert_eq!(parse_nvidia_smi("0x2C0510DE, 8192\n0x2C0510DE, 16303\n", NVIDIA_VENDOR, 0x2c05), Some(8192 << 20));
+    assert_eq!(parse_nvidia_smi("0x2C0510DE, lots\n0x2C0510DE, 16303\n", NVIDIA_VENDOR, 0x2c05), Some(16303 << 20), "a bad line is skipped");
+    assert_eq!(parse_nvidia_smi("0x2C0510DE, 0\n0x2C0510DE, 16303\n", NVIDIA_VENDOR, 0x2c05), Some(16303 << 20), "a zero size is no answer");
+}
+
+/// `nvidia-smi` runs on the UI thread at startup, so a query the driver never answers must
+/// give up at the deadline instead of keeping the window from opening.
+#[cfg(any(unix, windows))]
+#[test]
+fn a_child_that_never_answers_gives_up_at_the_deadline() {
+    let slow = if cfg!(windows) {
+        let mut c = std::process::Command::new("ping");
+        c.args(["-n", "11", "127.0.0.1"]);
+        c
+    } else {
+        let mut c = std::process::Command::new("sleep");
+        c.arg("10");
+        c
+    };
+    let start = std::time::Instant::now();
+    assert_eq!(bounded_output(slow, std::time::Duration::from_millis(200)), None);
+    assert!(start.elapsed() < std::time::Duration::from_secs(2), "took {:?}", start.elapsed());
+
+    let quick = if cfg!(windows) {
+        let mut c = std::process::Command::new("cmd");
+        c.args(["/C", "echo 0x2C0510DE, 16303"]);
+        c
+    } else {
+        let mut c = std::process::Command::new("printf");
+        c.arg("0x2C0510DE, 16303\n");
+        c
+    };
+    let out = bounded_output(quick, std::time::Duration::from_secs(10)).expect("a quick command answers");
+    assert_eq!(parse_nvidia_smi(&String::from_utf8_lossy(&out), NVIDIA_VENDOR, 0x2c05), Some(16303 << 20));
+
+    let failing = if cfg!(windows) {
+        let mut c = std::process::Command::new("cmd");
+        c.args(["/C", "exit 3"]);
+        c
+    } else {
+        std::process::Command::new("false")
+    };
+    assert_eq!(bounded_output(failing, std::time::Duration::from_secs(10)), None, "a failed run");
+    assert_eq!(bounded_output(std::process::Command::new("photocraft-no-such-tool"), std::time::Duration::from_secs(1)), None, "not installed");
+}
+
+/// Only a discrete NVIDIA adapter asks `nvidia-smi`: nothing else spawns a process whose
+/// answer it would then ignore anyway (`nvidia_video_memory` gates on the vendor id first).
+#[cfg(target_os = "linux")]
+#[test]
+fn nvidia_video_memory_only_asks_for_an_nvidia_vendor_id() {
+    assert_eq!(nvidia_video_memory(0x1002, 0x73bf), None, "an AMD id never runs nvidia-smi");
+    assert_eq!(nvidia_video_memory(0x8086, 0x9a49), None, "an Intel id never runs nvidia-smi");
+}
+
 /// Windows used to report no RAM at all, so the budget assumed 16 GB on every machine.
 #[cfg(windows)]
 #[test]
diff --git a/crates/ui-egui/src/canvas/gpu_canvas/texels.rs b/crates/ui-egui/src/canvas/gpu_canvas/texels.rs
index 966b23c40c..5350ea5fae 100644
--- a/crates/ui-egui/src/canvas/gpu_canvas/texels.rs
+++ b/crates/ui-egui/src/canvas/gpu_canvas/texels.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{FORMAT, FORMAT_HIGH, wgpu};
 
 /// Straight-alpha f32 RGBA (sRGB-encoded) → premultiplied RGBA8, split across threads on native.
 pub fn premultiply_rgba8(px: &[[f32; 4]]) -> Vec<u8> {
diff --git a/crates/ui-egui/src/canvas/navigator.rs b/crates/ui-egui/src/canvas/navigator.rs
index d95c9a20ec..413bf82686 100644
--- a/crates/ui-egui/src/canvas/navigator.rs
+++ b/crates/ui-egui/src/canvas/navigator.rs
@@ -1,7 +1,7 @@
 use super::display::{canvas_display, display_doc, display_image};
 use super::strokes::live_stroke;
 use super::textures::{effect_reach, ensure_texture};
-use super::*;
+use super::{Document, PhotocraftApp, Rect, TextureOptions};
 
 /// Longest side of the Navigator panel's image (about twice the panel's width, for HiDPI).
 pub const NAVIGATOR_SIDE: u32 = 512;
diff --git a/crates/ui-egui/src/canvas/paint.rs b/crates/ui-egui/src/canvas/paint.rs
index b9a040257e..415bb071a7 100644
--- a/crates/ui-egui/src/canvas/paint.rs
+++ b/crates/ui-egui/src/canvas/paint.rs
@@ -6,7 +6,7 @@ use super::gesture::constrained_polygon_point;
 use super::strokes::{EngineStroke, SPOT_HEALING_TRAIL, draw_smoothing_string, strokes_live};
 use super::textures::texture_side;
 use super::view_xform::ViewXform;
-use super::*;
+use super::{Color32, DRect, Document, Mesh, PhotocraftApp, Pos2, Rect, Stroke, TextureOptions, Tool, json, pos2, vec2};
 
 /// A texture mapped over the `size` document area starting at `origin` (follows a rotated view).
 pub(super) fn paint_mapped_image_at(painter: &egui::Painter, xf: &ViewXform, tex: egui::TextureId, uv: Rect, origin: [f32; 2], size: [f32; 2], tint: Color32) {
diff --git a/crates/ui-egui/src/canvas/select_mask_view.rs b/crates/ui-egui/src/canvas/select_mask_view.rs
index a06c78e468..e60da1054d 100644
--- a/crates/ui-egui/src/canvas/select_mask_view.rs
+++ b/crates/ui-egui/src/canvas/select_mask_view.rs
@@ -197,12 +197,25 @@ pub fn controls(ui: &mut egui::Ui, fields: &mut Map<String, Value>) {
         fields.insert(field.into(), json!(on));
     }
     ui.label(egui::RichText::new(tl!("F cycles the views; hold X to see the image")).color(t.text_dim).small());
+    // Photoshop's Remember Settings, off by default: the next Select and Mask starts from these
+    // settings instead of the defaults (#9423).
+    let mut remember = remembers(fields);
+    crate::widgets::checkbox(ui, &mut remember, tl!("Remember Settings"));
+    fields.insert(REMEMBER.into(), json!(remember));
     ui.add_space(4.0);
     crate::widgets::hairline(ui);
     ui.add_space(6.0);
     brush_controls(ui, fields);
 }
 
+/// The dialog field behind Remember Settings.
+pub const REMEMBER: &str = "__remember";
+
+/// Whether Remember Settings is on in `fields` (a dialog's, or the remembered ones).
+pub fn remembers(fields: &Map<String, Value>) -> bool {
+    flag(fields, REMEMBER)
+}
+
 /// The Refine Edge Brush (R): painting on the canvas sets where edge refinement happens.
 fn brush_controls(ui: &mut egui::Ui, fields: &mut Map<String, Value>) {
     let t = Tokens::get(ui.ctx());
diff --git a/crates/ui-egui/src/canvas/selection.rs b/crates/ui-egui/src/canvas/selection.rs
index fe096f1159..67577e2a27 100644
--- a/crates/ui-egui/src/canvas/selection.rs
+++ b/crates/ui-egui/src/canvas/selection.rs
@@ -1,5 +1,5 @@
 use super::tool_input::selection_drag_kind;
-use super::*;
+use super::{PhotocraftApp, Tool, json};
 
 /// Photoshop's cursor over a selection: what a press (or the drag under way) would do.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
diff --git a/crates/ui-egui/src/canvas/start_screen.rs b/crates/ui-egui/src/canvas/start_screen.rs
index d22295886c..e8b6633e5a 100644
--- a/crates/ui-egui/src/canvas/start_screen.rs
+++ b/crates/ui-egui/src/canvas/start_screen.rs
@@ -1,5 +1,5 @@
 use super::tabs::{open_on_double_click, paint_dots};
-use super::*;
+use super::{PhotocraftApp, Rect, Sense};
 
 /// The Home screen's card is this wide when the canvas has room, and as wide as the canvas when it doesn't.
 const HOME_CARD_WIDTH: f32 = 460.0;
diff --git a/crates/ui-egui/src/canvas/strokes.rs b/crates/ui-egui/src/canvas/strokes.rs
index 173e9968c0..560c4e5aef 100644
--- a/crates/ui-egui/src/canvas/strokes.rs
+++ b/crates/ui-egui/src/canvas/strokes.rs
@@ -2,7 +2,7 @@ use super::display::{canvas_display, display_image};
 use super::drag::Drag;
 use super::textures::{canvas_texture_options, shown_as_document};
 use super::view_xform::ViewXform;
-use super::*;
+use super::{Color32, DRect, PhotocraftApp, Pos2, Stroke, Tool, json, pos2};
 
 pub(crate) struct ClonePreviewCache {
     pub(super) key: String,
diff --git a/crates/ui-egui/src/canvas/tabs.rs b/crates/ui-egui/src/canvas/tabs.rs
index 5f59f3c028..82a1e2089f 100644
--- a/crates/ui-egui/src/canvas/tabs.rs
+++ b/crates/ui-egui/src/canvas/tabs.rs
@@ -1,6 +1,6 @@
 use super::start_screen::start_screen;
 use super::textures::retain_gpu_documents;
-use super::*;
+use super::{Color32, PhotocraftApp, Pos2, Rect, Sense, Stroke, TextureOptions, canvas_view, fmt_zoom, json, mode_label, pos2};
 
 /// Tabs + canvas for the active document, or the start screen; then drops layers dragged onto
 /// another document (`layer_transfer`).
diff --git a/crates/ui-egui/src/canvas/tests.rs b/crates/ui-egui/src/canvas/tests.rs
index e5fb1559cc..f8e7a74660 100644
--- a/crates/ui-egui/src/canvas/tests.rs
+++ b/crates/ui-egui/src/canvas/tests.rs
@@ -285,7 +285,7 @@ fn every_filter_previews_off_the_ui_thread_and_a_newer_value_cancels_the_old() {
                 std::thread::sleep(std::time::Duration::from_millis(1));
             }
             let _ = told.send(job.cancelled());
-            crate::filter_preview_worker::Computed { result: None, ms: 0.0 }
+            crate::dialogs::filter_preview_worker::Computed { result: None, ms: 0.0 }
         })
         .unwrap();
     // The slider moves on and stops: once the value settles, the stale preview is cancelled
@@ -352,7 +352,7 @@ fn gated_blur_preview(app: &mut PhotocraftApp, ctx: &egui::Context) -> (std::syn
                 let buffer = photocraft_compose::flatten(&d);
                 (std::sync::Arc::new(d), buffer)
             });
-            crate::filter_preview_worker::Computed { result, ms: 0.0 }
+            crate::dialogs::filter_preview_worker::Computed { result, ms: 0.0 }
         })
         .expect("the worker starts");
     (release, radius)
@@ -482,7 +482,7 @@ fn a_mid_drag_empty_result_leaves_the_preview_alone() {
     app.filter_preview_worker
         .start(key, ctx.clone(), move |_| {
             wait.recv_timeout(std::time::Duration::from_secs(60)).expect("released");
-            crate::filter_preview_worker::Computed { result: None, ms: 0.0 }
+            crate::dialogs::filter_preview_worker::Computed { result: None, ms: 0.0 }
         })
         .expect("the worker starts");
     app.ui.dialogs[0].fields.insert("radius".into(), json!(moved + 4.0));
diff --git a/crates/ui-egui/src/canvas/textures.rs b/crates/ui-egui/src/canvas/textures.rs
index 17b6f1bf26..99f9e77096 100644
--- a/crates/ui-egui/src/canvas/textures.rs
+++ b/crates/ui-egui/src/canvas/textures.rs
@@ -3,7 +3,7 @@ use super::filter_preview::filter_channel_preview;
 use super::navigator::navigator_waits_for_drag;
 use super::strokes::live_stroke;
 use super::view_xform::ViewXform;
-use super::*;
+use super::{CanvasCache, CpuTextures, DRect, DetailTexture, Document, InView, LayerContent, PhotocraftApp, TextureOptions, pos2};
 
 /// Largest texture side we upload; bigger documents are uploaded downsampled, with the part in
 /// view added at the screen's resolution when zoomed in (`detail_plan`).
@@ -519,7 +519,7 @@ pub(super) fn ensure_gpu(app: &mut PhotocraftApp, ctx: &egui::Context, idx: usiz
     if present && app.perf.gpu_layer_fit.is_none_or(|f| f.doc != id.0) {
         gpu_budget(app, &gpu, idx, false, visible);
         let fit = gpu.measure_fit(&doc).unwrap_or(crate::gpu_canvas::LayerFit { doc: id.0, needed: 0, budget: 0 });
-        app.perf.gpu_layer_fit = Some(fit);
+        crate::render_path::layer_fit(app, fit);
     }
     if present && current {
         // An adjustment preview composited where the view was: catch up where it moved to.
@@ -546,6 +546,8 @@ pub(super) fn ensure_gpu(app: &mut PhotocraftApp, ctx: &egui::Context, idx: usiz
         if app.perf.gpu_layer_fit.is_some_and(|f| f.doc == id.0) {
             app.perf.gpu_layer_fit = None;
         }
+        let (bytes, budget) = gpu.canvas_fit(&doc).unwrap_or_default();
+        crate::render_path::note(app, id.0, crate::render_path::Path::Cpu(crate::render_path::CpuReason::CanvasTooLarge { bytes, budget }));
         return false;
     }
     let partial = present && damage.is_some();
@@ -557,6 +559,9 @@ pub(super) fn ensure_gpu(app: &mut PhotocraftApp, ctx: &egui::Context, idx: usiz
         // The device is gone (`gpu_status` then drops the GPU canvas) or the canvas is over the
         // texture budget: draw this frame on the CPU path.
         crate::background_redraw::cancel(app, id);
+        if let Some(reason) = r.fallback {
+            crate::render_path::note(app, id.0, crate::render_path::Path::Cpu(reason));
+        }
         return false;
     }
     if r.kind == crate::gpu_canvas::REFRESH_DEFERRED {
@@ -569,21 +574,19 @@ pub(super) fn ensure_gpu(app: &mut PhotocraftApp, ctx: &egui::Context, idx: usiz
     } else {
         crate::background_redraw::cancel(app, id);
     }
-    if let Some(e) = &r.fallback
-        && app.perf.gpu_fallback.as_deref() != Some(e.as_str())
-    {
-        log::info!("{e}; using the CPU compositor");
+    match &r.fallback {
+        Some(reason) => crate::render_path::note(app, id.0, crate::render_path::Path::Cpu(reason.clone())),
+        None if r.kind.starts_with("gpu") => crate::render_path::note(app, id.0, crate::render_path::Path::Gpu { full: r.kind == "gpu-full" }),
+        None => {}
     }
     if r.kind != crate::gpu_canvas::REFRESH_DEFERRED {
         app.perf.record_refresh(&r);
     }
     if r.kind == "full" {
-        crate::notices::slow_cpu_refresh(app, id.0, r.composite_ms + r.upload_ms, r.fallback.as_deref());
+        crate::notices::slow_cpu_refresh(app, id.0, r.composite_ms + r.upload_ms, r.fallback.as_ref());
     }
     if r.kind.starts_with("gpu") {
         app.perf.gpu_uploads = r.uploads;
-    } else {
-        app.perf.gpu_fallback = r.fallback;
     }
     let Some(cache) = app.canvases.get_mut(&(id, GPU_OUTPUT)) else { return true };
     cache.revision = revision;
@@ -611,7 +614,7 @@ fn gpu_budget(app: &mut PhotocraftApp, gpu: &crate::gpu_canvas::GpuCanvas, idx:
     app.perf.gpu_budget_mb = budget >> 20;
     app.perf.gpu_budget_allowance = allowance;
     if changed && let Some(fit) = gpu.measure_fit(&st.doc) {
-        app.perf.gpu_layer_fit = Some(fit);
+        crate::render_path::layer_fit(app, fit);
     }
 }
 
diff --git a/crates/ui-egui/src/canvas/tool_input.rs b/crates/ui-egui/src/canvas/tool_input.rs
index a58555037a..d193bf6e00 100644
--- a/crates/ui-egui/src/canvas/tool_input.rs
+++ b/crates/ui-egui/src/canvas/tool_input.rs
@@ -3,7 +3,7 @@ use super::drag::Drag;
 use super::gesture::{finish_gesture, polygon_click, selection_mode};
 use super::selection::finish_selection_drag;
 use super::strokes::{HOLD_REPEAT_MS, begin_live_stroke, feed_live_stroke, paint_target, snap_aliased_tip, stroke_params, strokes_live};
-use super::*;
+use super::{PhotocraftApp, Tool, json};
 
 /// Abstract tool event, produced by the mouse or by automation (`ui.pointer`).
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -52,8 +52,7 @@ fn tool_move(app: &mut PhotocraftApp, x: f64, y: f64, pressure: f32, mods: egui:
     }
 }
 
-/// Tool state machine. Shared by mouse input and automation.
-pub fn tool_event(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers) {
+fn preflight_tool_event(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers) -> Option<(bool, egui::Modifiers)> {
     // A press anywhere but on a guide deselects the selected guide (`guide_select`).
     if let ToolEvent::Down { x, y, .. } = ev
         && app.ui.selected_guide.is_some()
@@ -62,7 +61,7 @@ pub fn tool_event(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers)
         crate::guide_select::clear(app);
     }
     if crate::symmetry_ui::pointer(app, ev, crate::workspace_ui::sticky_mods(app, mods)) {
-        return;
+        return None;
     }
     // An Alt+right-drag armed for this press (`paint_mouse`): taken before anything else can
     // consume the event, so it never outlives the press it was armed for (#297).
@@ -70,11 +69,11 @@ pub fn tool_event(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers)
     crate::transform_tool::end_if_left(app);
     let mods = crate::workspace_ui::sticky_mods(app, mods);
     if app.ui.transform.is_none() && crate::type_transform::pointer(app, ev, mods) {
-        return;
+        return None;
     }
     // Content-Aware Move's Transform On Drop box takes every press until ↩ or Esc.
     if crate::cam_transform::pointer(app, ev, mods) {
-        return;
+        return None;
     }
     // A Mixer Brush press that loaded paint stays a sample press until it is released, with ⌥
     // let go or not (`mixer_sampling`; `canvas_view` holds back egui's later drag start too).
@@ -82,9 +81,9 @@ pub fn tool_event(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers)
         ToolEvent::Down { .. } => app.mixer_sampling = false,
         ToolEvent::Up { .. } if app.mixer_sampling => {
             app.mixer_sampling = false;
-            return;
+            return None;
         }
-        _ if app.mixer_sampling => return,
+        _ if app.mixer_sampling => return None,
         _ => {}
     }
     // The tool in use, so a held temporary tool (⌘ = Move) with ⌥ doesn't load paint.
@@ -98,13 +97,17 @@ pub fn tool_event(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers)
                 app.ui.status_error = true;
             }
         }
-        return;
+        return None;
     }
+    Some((armed, mods))
+}
+
+fn filter_event_before_tool(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers, armed: bool) -> Option<(ToolEvent, ToolEvent, egui::Modifiers)> {
     // View › Snap / Snap To and smart guides (snap_ui.rs).
     let raw = ev;
     // The Move tool's marquee selecting layers takes its moves and release unsnapped (move_box.rs).
     if crate::move_box::pointer(app, raw) {
-        return;
+        return None;
     }
     // A press anywhere but on the floating piece (or with ⇧ / ⌥, to draw) drops it first; the
     // Move tool (⌘ with a painting tool too, `event_tool`) drags it from anywhere.
@@ -120,29 +123,29 @@ pub fn tool_event(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers)
     // can land outside the corner's grab area and turn a corner drag into a move of the whole box.
     let transform_ev = if matches!(raw, ToolEvent::Down { .. }) { raw } else { ev };
     if crate::transform_tool::pointer(app, transform_ev, mods) {
-        return;
+        return None;
     }
     if crate::distort_ui::pointer(app, ev, mods) {
-        return;
+        return None;
     }
     if crate::perspective_crop_ui::pointer(app, ev) {
-        return;
+        return None;
     }
     // Window › Modifier Keys: sticky Shift/⌘/⌥ act as held keys.
     let mods = crate::workspace_ui::sticky_mods(app, mods);
     // ⌘⌥⌃-click with any tool selects the topmost layer with pixels there (quick_pick.rs); it
     // must run before the ⌃⌥ brush resize below, which the same keys would trigger.
     if crate::quick_pick::pointer(app, ev, mods) {
-        return;
+        return None;
     }
     // Control+Alt-drag or Alt+right-drag with a painting tool resizes the brush instead of
     // painting (#231, #297).
     if crate::brush_resize::pointer(app, ev, mods, armed) {
-        return;
+        return None;
     }
     // ⌥ (Alt) with a painting tool is the Eyedropper for that press.
     if alt_eyedropper(app, ev, mods) {
-        return;
+        return None;
     }
     // Move tool: ⇧ locks the axis, ⌥ duplicates (move_mods.rs).
     let ev = crate::move_mods::filter_event(app, ev, mods);
@@ -150,39 +153,39 @@ pub fn tool_event(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers)
     // transform controls). Unsnapped, as Free Transform's handles: snapping would pull the press
     // off a widget onto a nearby vertex or guide, and the shape tool would draw a new shape.
     if crate::corner_radius::pointer(app, raw, mods) {
-        return;
+        return None;
     }
     // Direct Selection, and the Pen's ⌘ (Direct Selection) and ⌥ (Convert Point) modes (#790).
     if crate::direct_select::pointer(app, ev, mods) {
-        return;
+        return None;
     }
     // Add / Delete Anchor Point tools (#1044).
     if crate::anchor_tools::pointer(app, ev, mods) {
-        return;
+        return None;
     }
     // Ruler, Count and Note tools.
     if crate::analysis_ui::pointer(app, ev, mods) {
-        return;
+        return None;
     }
     // Slice and Slice Select tools.
     if crate::slice_ui::pointer(app, ev, mods) {
-        return;
+        return None;
     }
     // Frame tool: draw rectangular and elliptical frames.
     if crate::frame_tool::pointer(app, ev, mods) {
-        return;
+        return None;
     }
     // Artboard tool: draw, select, move and resize boards.
     if crate::artboard_tool::pointer(app, ev, mods) {
-        return;
+        return None;
     }
     // Crop tool: draw, move and resize the frame.
     if crate::crop_ui::pointer(app, ev, mods) {
-        return;
+        return None;
     }
     // Gradient tool, live mode: draw and edit Gradient Fill layers.
     if crate::gradient_ui::pointer(app, ev, mods) {
-        return;
+        return None;
     }
     // ⌘ over a guide takes the guide (#2690, #6288); the guide drag below moves it.
     if let ToolEvent::Down { x, y, .. } = raw
@@ -190,15 +193,107 @@ pub fn tool_event(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers)
     {
         app.guide_drag = Some(crate::rulers::GuideDrag::existing(vertical, i, [x, y]));
         crate::snap_ui::begin_guide(app, [x, y]);
-        return;
+        return None;
     }
     if crate::lasso_ui::pointer(app, ev, mods) {
-        return;
+        return None;
     }
     // Magnetic Lasso: fastening points and the border following the pointer.
     if crate::magnetic_lasso_ui::pointer(app, ev, mods) {
-        return;
+        return None;
     }
+    Some((raw, ev, mods))
+}
+
+fn handle_move_pointer(app: &mut PhotocraftApp, ev: ToolEvent, tool: Tool, mods: egui::Modifiers) -> bool {
+    match ev {
+        ToolEvent::Down { x, y, pressure } if tool == Tool::Move => {
+            if let Some((vertical, i)) = crate::rulers::guide_at(app, x, y) {
+                // ⌥-click turns the guide, through the point clicked, as in Photoshop.
+                if mods.alt && !mods.shift && !mods.command {
+                    crate::guide_select::flip(app, vertical, i, [x, y]);
+                    return true;
+                }
+                app.guide_drag = Some(crate::rulers::GuideDrag::existing(vertical, i, [x, y]));
+                return true;
+            }
+            // Auto-Select (or ⌘-click while it is off) picks the layer under the pointer first
+            // (not when the selected pixels move: those are the active layer's).
+            if !crate::move_ui::moves_selected_pixels_with(app, tool) && app.ui.tool_options.move_auto_select != mods.command {
+                let target = app.ui.tool_options.move_target.clone();
+                let mode = if mods.shift { "add" } else { "replace" };
+                let before = app.session.active().map(|st| st.selected_layers());
+                // A locked layer under the pointer (the Background) can't move. Photoshop draws
+                // the layer marquee instead of reporting the lock (#4058). Probe without
+                // selecting so a locked hit doesn't become the selection first.
+                let probe = app.run("layer.pickAt", json!({"x": x, "y": y, "target": target, "select": false}));
+                let locked_hit = probe.as_ref().ok().and_then(|v| v["layer"].as_u64()).is_some_and(|id| {
+                    app.session.active().is_some_and(|st| {
+                        let id = photocraft_doc::LayerId(id);
+                        let locks = st.doc.effective_locks(id);
+                        locks.position || locks.all || st.doc.is_background(id)
+                    })
+                });
+                if locked_hit || (probe.as_ref().is_ok_and(|v| v["layer"].is_null()) && crate::move_box::empty_at(app, [x, y])) {
+                    if locked_hit {
+                        // A click still selects the locked layer, as in Photoshop; a drag's
+                        // marquee then replaces that selection on release.
+                        let _ = app.run("layer.pickAt", json!({"x": x, "y": y, "target": target, "mode": mode}));
+                    }
+                    crate::move_box::begin(app, [x, y], mods.shift);
+                    return true;
+                }
+                let picked = app.run("layer.pickAt", json!({"x": x, "y": y, "target": target, "mode": mode}));
+                // No pixels there at all (an empty spot, or off the canvas): drag a marquee that
+                // selects the layers it touches instead (move_box.rs).
+                if picked.is_ok_and(|v| v["layer"].is_null()) && crate::move_box::empty_at(app, [x, y]) {
+                    crate::move_box::begin(app, [x, y], mods.shift);
+                    return true;
+                }
+                // Snapping (and the drag's box) started before the pick: point it at what moves.
+                if app.session.active().map(|st| st.selected_layers()) != before {
+                    crate::snap_ui::retarget_move(app, [x, y], mods);
+                }
+            }
+            // A locked layer: no drag, and Photoshop's message once the pointer moves (`move_lock`).
+            if crate::move_lock::blocked(app, tool, [x, y], mods) {
+                app.move_blocked = true;
+                return true;
+            }
+            // With a selection: cut the selected pixels (⌥ copies them) and drag them as a floating
+            // piece, from anywhere, as a marquee ⌘-drag does.
+            if crate::move_ui::moves_selected_pixels_with(app, tool) {
+                if crate::move_ui::float_selected(app, mods.alt, 0.0, 0.0) {
+                    let mut d = Drag::new(tool, [x, y], vec![[x, y, pressure as f64]], mods, false);
+                    d.sel_move = Some(true);
+                    app.drag = Some(d);
+                }
+                return true;
+            }
+        }
+        ToolEvent::Move { x, y, .. } => {
+            if let Some(d) = app.guide_drag.as_mut().filter(|d| d.index.is_some()) {
+                d.pos = if d.vertical { x } else { y };
+                return true;
+            }
+        }
+        ToolEvent::Up { x, y } => {
+            if let Some(mut d) = app.guide_drag.filter(|d| d.index.is_some()) {
+                app.guide_drag = None;
+                d.pos = if d.vertical { x } else { y };
+                crate::rulers::finish_drag(app, d);
+                return true;
+            }
+        }
+        _ => {}
+    }
+    false
+}
+
+/// Tool state machine. Shared by mouse input and automation.
+pub fn tool_event(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers) {
+    let Some((armed, mods)) = preflight_tool_event(app, ev, mods) else { return };
+    let Some((raw, ev, mods)) = filter_event_before_tool(app, ev, mods, armed) else { return };
     let tool = event_tool(app, mods);
     if tool == Tool::Eyedropper {
         match ev {
@@ -228,88 +323,10 @@ pub fn tool_event(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers)
         }
         _ => {}
     }
-    // Move tool over a guide drags the guide (off the canvas deletes it).
-    match ev {
-        ToolEvent::Down { x, y, pressure } if tool == Tool::Move => {
-            if let Some((vertical, i)) = crate::rulers::guide_at(app, x, y) {
-                // ⌥-click turns the guide, through the point clicked, as in Photoshop.
-                if mods.alt && !mods.shift && !mods.command {
-                    crate::guide_select::flip(app, vertical, i, [x, y]);
-                    return;
-                }
-                app.guide_drag = Some(crate::rulers::GuideDrag::existing(vertical, i, [x, y]));
-                return;
-            }
-            // Auto-Select (or ⌘-click while it is off) picks the layer under the pointer first
-            // (not when the selected pixels move: those are the active layer's).
-            if !crate::move_ui::moves_selected_pixels_with(app, tool) && app.ui.tool_options.move_auto_select != mods.command {
-                let target = app.ui.tool_options.move_target.clone();
-                let mode = if mods.shift { "add" } else { "replace" };
-                let before = app.session.active().map(|st| st.selected_layers());
-                // A locked layer under the pointer (the Background) can't move. Photoshop draws
-                // the layer marquee instead of reporting the lock (#4058). Probe without
-                // selecting so a locked hit doesn't become the selection first.
-                let probe = app.run("layer.pickAt", json!({"x": x, "y": y, "target": target, "select": false}));
-                let locked_hit = probe.as_ref().ok().and_then(|v| v["layer"].as_u64()).is_some_and(|id| {
-                    app.session.active().is_some_and(|st| {
-                        let id = photocraft_doc::LayerId(id);
-                        let locks = st.doc.effective_locks(id);
-                        locks.position || locks.all || st.doc.is_background(id)
-                    })
-                });
-                if locked_hit || (probe.as_ref().is_ok_and(|v| v["layer"].is_null()) && crate::move_box::empty_at(app, [x, y])) {
-                    if locked_hit {
-                        // A click still selects the locked layer, as in Photoshop; a drag's
-                        // marquee then replaces that selection on release.
-                        let _ = app.run("layer.pickAt", json!({"x": x, "y": y, "target": target, "mode": mode}));
-                    }
-                    crate::move_box::begin(app, [x, y], mods.shift);
-                    return;
-                }
-                let picked = app.run("layer.pickAt", json!({"x": x, "y": y, "target": target, "mode": mode}));
-                // No pixels there at all (an empty spot, or off the canvas): drag a marquee that
-                // selects the layers it touches instead (move_box.rs).
-                if picked.is_ok_and(|v| v["layer"].is_null()) && crate::move_box::empty_at(app, [x, y]) {
-                    crate::move_box::begin(app, [x, y], mods.shift);
-                    return;
-                }
-                // Snapping (and the drag's box) started before the pick: point it at what moves.
-                if app.session.active().map(|st| st.selected_layers()) != before {
-                    crate::snap_ui::retarget_move(app, [x, y], mods);
-                }
-            }
-            // A locked layer: no drag, and Photoshop's message once the pointer moves (`move_lock`).
-            if crate::move_lock::blocked(app, tool, [x, y], mods) {
-                app.move_blocked = true;
-                return;
-            }
-            // With a selection: cut the selected pixels (⌥ copies them) and drag them as a floating
-            // piece, from anywhere, as a marquee ⌘-drag does.
-            if crate::move_ui::moves_selected_pixels_with(app, tool) {
-                if crate::move_ui::float_selected(app, mods.alt, 0.0, 0.0) {
-                    let mut d = Drag::new(tool, [x, y], vec![[x, y, pressure as f64]], mods, false);
-                    d.sel_move = Some(true);
-                    app.drag = Some(d);
-                }
-                return;
-            }
-        }
-        ToolEvent::Move { x, y, .. } => {
-            if let Some(d) = app.guide_drag.as_mut().filter(|d| d.index.is_some()) {
-                d.pos = if d.vertical { x } else { y };
-                return;
-            }
-        }
-        ToolEvent::Up { x, y } => {
-            if let Some(mut d) = app.guide_drag.filter(|d| d.index.is_some()) {
-                app.guide_drag = None;
-                d.pos = if d.vertical { x } else { y };
-                crate::rulers::finish_drag(app, d);
-                return;
-            }
-        }
-        _ => {}
+    if handle_move_pointer(app, ev, tool, mods) {
+        return;
     }
+
     match ev {
         ToolEvent::Down { x, y, pressure } => {
             // Painting a type, shape, Smart Object or fill layer asks to rasterize it first
diff --git a/crates/ui-egui/src/canvas/transform_controls.rs b/crates/ui-egui/src/canvas/transform_controls.rs
index 9d583cd604..fccc2c9751 100644
--- a/crates/ui-egui/src/canvas/transform_controls.rs
+++ b/crates/ui-egui/src/canvas/transform_controls.rs
@@ -1,6 +1,6 @@
 use super::selection::floating_outline;
 use super::view_xform::ViewXform;
-use super::*;
+use super::{Color32, LayerContent, PhotocraftApp, Pos2, Rect, Stroke, Tool, Vec2, pos2, vec2};
 
 /// View › Show › Layer Edges: the colour of the active layer's outline.
 pub(crate) const LAYER_EDGES: Color32 = Color32::from_rgb(0x2d, 0x8c, 0xeb);
diff --git a/crates/ui-egui/src/canvas/view_xform.rs b/crates/ui-egui/src/canvas/view_xform.rs
index ec3df91d13..3a0b42ca4e 100644
--- a/crates/ui-egui/src/canvas/view_xform.rs
+++ b/crates/ui-egui/src/canvas/view_xform.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{DRect, Document, PhotocraftApp, Pos2, Rect, Vec2, View, pos2, vec2};
 
 /// Document ↔ screen mapping for a canvas rect and a view.
 #[derive(Clone, Copy, Debug)]
diff --git a/crates/ui-egui/src/color_panel_tests.rs b/crates/ui-egui/src/color_panel_tests.rs
index 6f7cc49729..a3c1f4b9b0 100644
--- a/crates/ui-egui/src/color_panel_tests.rs
+++ b/crates/ui-egui/src/color_panel_tests.rs
@@ -226,6 +226,38 @@ fn web_sliders_snap_and_take_hex() {
     assert_eq!(bytes(h.state().session.tools.foreground), [0x66, 0xCC, 0]);
 }
 
+#[test]
+fn cube_modes_warn_when_the_colour_cannot_print() {
+    // #8672: Photoshop's Hue and Brightness Cube show the ⚠ and the nearest printable colour under
+    // the chips, as the slider modes do; a click takes that colour.
+    const GAMUT: &str = "Out of gamut for printing: click for the nearest printable colour";
+    for mode in [ColorPanelMode::HueCube, ColorPanelMode::BrightnessCube] {
+        let mut h = color_tab(ThemeKind::Classic, mode, [0.0, 1.0, 0.0, 1.0]);
+        let near = crate::color_picker_ui::out_of_gamut([0.0, 1.0, 0.0]).expect("pure green can't print");
+        let alert = h.get_by_label(GAMUT).rect().center();
+        press(&mut h, alert, Modifiers::NONE);
+        let fg = h.state().session.tools.foreground;
+        assert_eq!(bytes(fg), bytes([near[0], near[1], near[2], 1.0]), "{mode:?}");
+        h.run_steps(2);
+        assert!(h.query_by_label(GAMUT).is_none(), "{mode:?}: the printable colour still warns");
+        // A printable colour shows no alert.
+        let h = color_tab(ThemeKind::Classic, mode, [0.5, 0.5, 0.5, 1.0]);
+        assert!(h.query_by_label(GAMUT).is_none(), "{mode:?}");
+        // CodeRabbit on #9154: with the background chip active, the click sets the background.
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        app.session.tools.foreground = [0.5, 0.5, 0.5, 1.0];
+        app.session.tools.background = [0.0, 1.0, 0.0, 1.0];
+        app.ui.color_panel.mode = mode;
+        app.ui.color_panel.background = true;
+        let mut h = color_tab_of(ThemeKind::Classic, app);
+        let alert = h.get_by_label(GAMUT).rect().center();
+        press(&mut h, alert, Modifiers::NONE);
+        let tools = &h.state().session.tools;
+        assert_eq!(bytes(tools.background), bytes([near[0], near[1], near[2], 1.0]), "{mode:?}: background");
+        assert_eq!(bytes(tools.foreground), bytes([0.5, 0.5, 0.5, 1.0]), "{mode:?}: the foreground is left alone");
+    }
+}
+
 #[test]
 fn ramp_picks_and_shift_click_cycles_and_alt_picks_the_other_colour() {
     let mut h = color_tab(ThemeKind::BreezeDark, ColorPanelMode::RgbSliders, [0.0, 0.0, 0.0, 1.0]);
@@ -412,6 +444,34 @@ fn color_wheel_ignores_clicks_beside_it() {
     assert_eq!(bytes(h.state().session.tools.foreground), [0, 0, 255]);
 }
 
+/// The Color Wheel shrinks to the Color group at its default height in every theme, as the
+/// slider modes' ramp does, instead of running past the group's bottom into its scroll area.
+#[test]
+fn color_wheel_fits_the_default_color_group() {
+    for kind in ThemeKind::ALL {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        app.ui.color_panel.mode = ColorPanelMode::ColorWheel;
+        app.ui.theme = kind;
+        app.ui.dock_tabs.color = Group::Color.tabs(Tokens::for_kind(kind).pro).iter().position(|name| *name == "Color").unwrap();
+        let mut h = Harness::builder().with_size(vec2(1440.0, 1200.0)).build_ui_state(
+            |ui, app: &mut PhotocraftApp| {
+                if ui.ctx().fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
+                    crate::panels::dock_area(app, ui);
+                    egui::CentralPanel::default().show(ui, |_| {});
+                }
+            },
+            app,
+        );
+        PhotocraftApp::setup_context(&h.ctx, kind);
+        h.run_steps(4);
+        let group = crate::panel_docking::probe::native_group_rect(h.state(), &h.ctx, Group::Color).unwrap();
+        assert!((group.height() - Group::Color.default_height()).abs() < 0.5, "{kind:?}: Color group {group:?}");
+        let wheel = h.query_by_label("Color Wheel").unwrap_or_else(|| panic!("{kind:?}: no Color Wheel")).rect();
+        // The group's scroll area ends at least 8 pt above its bottom edge (the card's bottom margin).
+        assert!(wheel.bottom() <= group.bottom() - 8.0, "{kind:?}: wheel {wheel:?} runs past the Color group {group:?}");
+    }
+}
+
 /// The Color tab in `mode` with a document holding one selected black rectangle, the Rectangle tool
 /// in hand, foreground blue and background red, editing the background chip if `background`.
 fn color_tab_with_a_shape(mode: ColorPanelMode, background: bool) -> Harness<'static, PhotocraftApp> {
diff --git a/crates/ui-egui/src/control/dispatch.rs b/crates/ui-egui/src/control/dispatch.rs
index 7057d35f55..f3e2756071 100644
--- a/crates/ui-egui/src/control/dispatch.rs
+++ b/crates/ui-egui/src/control/dispatch.rs
@@ -3,78 +3,38 @@ use super::params::{
     BUTTONS, KEY_MODIFIERS, MAX_CLICKS, POINTER_MODIFIERS, UI_SET_FIELDS, bool_field, err, f32_field, f32_range, input_choice, input_modifiers, input_number,
     input_object, merged_object, modifiers_from, num_field, ok, screen_point, uint_field, whole_object,
 };
-use super::*;
+use super::{ControlRequest, DialogKind, Outcome, PhotocraftApp, SHELL_DIALOG, Tool, ToolEvent, Value, json, run_waiting, tool_event, wrap};
+
+/// A domain handler: `Some` when it owns the request's method, `None` to let the next one try.
+type Handler = fn(&mut PhotocraftApp, &egui::Context, &ControlRequest) -> Option<Outcome>;
 
 pub(super) fn dispatch(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest) -> Outcome {
-    let p = &req.params;
-    let s = |k: &str| p.get(k).and_then(Value::as_str);
-    let u = |k: &str| p.get(k).and_then(Value::as_u64);
-    let wait = p.get("wait").and_then(Value::as_bool).unwrap_or(true);
-    match req.method.as_str() {
-        "ui.context.choose" => {
-            let Some(id) = s("id") else { return err("missing `id`") };
-            let Some(menu) = app.ui.canvas_tool_menu.as_ref() else { return err("no canvas context menu is open") };
-            if !crate::canvas_tool_menu::available(app, menu, id) {
-                return err("context action is unavailable");
-            }
-            // A pasteboard row changes a preference: the policy sees the `prefs.set` it runs.
-            let (command, params) = crate::canvas_tool_menu::engine_call(app, menu, id);
-            if let Some(authorize) = app.services.automation_command.as_ref()
-                && let Err(error) = authorize(&command, &params)
-            {
-                return err(error);
-            }
-            crate::canvas_tool_menu::choose(app, ctx, id);
-            ok(json!({"command": id, "dialog": app.ui.dialogs.last().map(|d| d.id)}))
-        }
-        "engine.execute" | "ui.menu.invoke" => {
-            let Some(id) = s("command").or(s("id")) else { return err("missing `command`") };
-            let params = p.get("params").cloned().unwrap_or(json!({}));
-            // A control-channel menu click must respect the same modal gate as the native menu.
-            // The documented `ui` requests of Camera Raw and the full-window workspaces operate
-            // the already-open one rather than click a menu. Only that continuation may pass its
-            // own modal gate. engine.execute is deliberately not subject to the UI's menu-click semantics.
-            let open_modal = if app.camera_raw.is_some() { Some("filter.cameraRaw") } else { crate::distort_ui::modal_workspace(app) };
-            let continuation = open_modal == Some(id)
-                && params.as_object().is_some_and(|fields| fields.len() == 1 && fields.get("ui").is_some_and(Value::is_object))
-                && app.ui.dialogs.is_empty()
-                && app.discard.is_none()
-                && !crate::crop_ui::blocks(app, id);
-            if req.method == "ui.menu.invoke" && !continuation && !crate::menus::modal_allows(app, id) {
-                return err("menu command is unavailable while a modal dialog is open");
-            }
-            if let Some(authorize) = app.services.automation_command.as_ref()
-                && let Err(error) = authorize(id, &params)
-            {
-                return err(error);
-            }
-            // `engine.execute` is programmatic: engine commands run directly with their default
-            // params and never open a dialog (an agent would otherwise get a modal instead of a
-            // result). `ui.menu.invoke` behaves like a menu click, so it may open the dialog.
-            if req.method == "engine.execute" && photocraft_engine::commands::find(id).is_some() {
-                return run_waiting(app, wait, |app| app.run(id, params));
-            }
-            run_waiting(app, wait, |app| crate::menus::invoke(app, ctx, id, params))
-        }
+    const HANDLERS: [Handler; 5] = [engine_methods, shell_methods, dialog_methods, input_methods, app_methods];
+    HANDLERS.iter().find_map(|handler| handler(app, ctx, req)).unwrap_or_else(|| err(format!("unknown method `{}`", req.method)))
+}
+
+fn str_param<'a>(p: &'a Value, key: &str) -> Option<&'a str> {
+    p.get(key).and_then(Value::as_str)
+}
+
+fn u64_param(p: &Value, key: &str) -> Option<u64> {
+    p.get(key).and_then(Value::as_u64)
+}
+
+fn wait_param(p: &Value) -> bool {
+    p.get("wait").and_then(Value::as_bool).unwrap_or(true)
+}
+
+// ---- engine commands, menus and jobs ----
+
+fn engine_methods(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest) -> Option<Outcome> {
+    Some(match req.method.as_str() {
+        "ui.context.choose" => context_choose(app, ctx, &req.params),
+        "engine.execute" | "ui.menu.invoke" => execute_command(app, ctx, req),
         "engine.commands" => wrap(app.run("command.list", json!({}))),
         // Background jobs (#210): running ones with progress, then the last few that ended.
         "jobs.list" => wrap(app.session.execute("jobs.list", json!({})).map_err(|e| e.to_string())),
-        "jobs.cancel" => {
-            let all = p.get("job").is_none_or(Value::is_null);
-            match p.get("job").and_then(Value::as_u64) {
-                Some(j) if app.session.job(photocraft_engine::jobs::JobId(j)).is_some() => {
-                    let cancelled = crate::jobs_ui::cancel(app, photocraft_engine::jobs::JobId(j));
-                    ok(json!({"cancelled": usize::from(cancelled)}))
-                }
-                Some(j) => err(format!("no running job {j}")),
-                None if all => {
-                    let ids: Vec<_> = app.session.jobs().into_iter().map(|j| j.id).collect();
-                    let cancelled = ids.into_iter().filter(|j| crate::jobs_ui::cancel(app, *j)).count();
-                    ok(json!({"cancelled": cancelled}))
-                }
-                None => err("`job` must be a job id"),
-            }
-        }
+        "jobs.cancel" => jobs_cancel(app, &req.params),
         "ui.menu.list" => {
             // Report the same enablement the native menu shows, so a listed item is invokable.
             let mut items = crate::menus::menu_items(app);
@@ -84,526 +44,786 @@ pub(super) fn dispatch(app: &mut PhotocraftApp, ctx: &egui::Context, req: &Contr
             ok(serde_json::to_value(items).unwrap_or_default())
         }
         "ui.inspect" => ok(inspect(app, ctx)),
-        "ui.set" => {
-            if let Some(field) = p.as_object().and_then(|o| o.keys().find(|k| !UI_SET_FIELDS.contains(&k.as_str()))) {
-                return err(format!("unknown field `{field}` (fields: {})", UI_SET_FIELDS.join(", ")));
+        _ => return None,
+    })
+}
+
+fn context_choose(app: &mut PhotocraftApp, ctx: &egui::Context, p: &Value) -> Outcome {
+    let Some(id) = str_param(p, "id") else { return err("missing `id`") };
+    let Some(menu) = app.ui.canvas_tool_menu.as_ref() else { return err("no canvas context menu is open") };
+    if !crate::canvas_tool_menu::available(app, menu, id) {
+        return err("context action is unavailable");
+    }
+    // A pasteboard row changes a preference: the policy sees the `prefs.set` it runs.
+    let (command, params) = crate::canvas_tool_menu::engine_call(app, menu, id);
+    if let Some(authorize) = app.services.automation_command.as_ref()
+        && let Err(error) = authorize(&command, &params)
+    {
+        return err(error);
+    }
+    crate::canvas_tool_menu::choose(app, ctx, id);
+    ok(json!({"command": id, "dialog": app.ui.dialogs.last().map(|d| d.id)}))
+}
+
+fn execute_command(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest) -> Outcome {
+    let p = &req.params;
+    let Some(id) = str_param(p, "command").or(str_param(p, "id")) else { return err("missing `command`") };
+    let params = p.get("params").cloned().unwrap_or(json!({}));
+    let wait = wait_param(p);
+    // A control-channel menu click must respect the same modal gate as the native menu.
+    // The documented `ui` requests of Camera Raw and the full-window workspaces operate
+    // the already-open one rather than click a menu. Only that continuation may pass its
+    // own modal gate. engine.execute is deliberately not subject to the UI's menu-click semantics.
+    let open_modal = if app.camera_raw.is_some() { Some("filter.cameraRaw") } else { crate::distort_ui::modal_workspace(app) };
+    let continuation = open_modal == Some(id)
+        && params.as_object().is_some_and(|fields| fields.len() == 1 && fields.get("ui").is_some_and(Value::is_object))
+        && app.ui.dialogs.is_empty()
+        && app.discard.is_none()
+        && !crate::crop_ui::blocks(app, id);
+    if req.method == "ui.menu.invoke" && !continuation && !crate::menus::modal_allows(app, id) {
+        return err("menu command is unavailable while a modal dialog is open");
+    }
+    if let Some(authorize) = app.services.automation_command.as_ref()
+        && let Err(error) = authorize(id, &params)
+    {
+        return err(error);
+    }
+    // `engine.execute` is programmatic: engine commands run directly with their default
+    // params and never open a dialog (an agent would otherwise get a modal instead of a
+    // result). `ui.menu.invoke` behaves like a menu click, so it may open the dialog.
+    if req.method == "engine.execute" && photocraft_engine::commands::find(id).is_some() {
+        return run_waiting(app, wait, |app| app.run(id, params));
+    }
+    run_waiting(app, wait, |app| crate::menus::invoke(app, ctx, id, params))
+}
+
+fn jobs_cancel(app: &mut PhotocraftApp, p: &Value) -> Outcome {
+    let all = p.get("job").is_none_or(Value::is_null);
+    match p.get("job").and_then(Value::as_u64) {
+        Some(j) if app.session.job(photocraft_engine::jobs::JobId(j)).is_some() => {
+            let cancelled = crate::jobs_ui::cancel(app, photocraft_engine::jobs::JobId(j));
+            ok(json!({"cancelled": usize::from(cancelled)}))
+        }
+        Some(j) => err(format!("no running job {j}")),
+        None if all => {
+            let ids: Vec<_> = app.session.jobs().into_iter().map(|j| j.id).collect();
+            let cancelled = ids.into_iter().filter(|j| crate::jobs_ui::cancel(app, *j)).count();
+            ok(json!({"cancelled": cancelled}))
+        }
+        None => err("`job` must be a job id"),
+    }
+}
+
+// ---- the shell: view state, windows, GPU, focus, screenshots ----
+
+fn shell_methods(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest) -> Option<Outcome> {
+    let p = &req.params;
+    Some(match req.method.as_str() {
+        "ui.set" => ui_set(app, ctx, p),
+        "ui.window.open" => {
+            if let Some(d) = u64_param(p, "document")
+                && !app.session.set_active(d as usize)
+            {
+                return Some(err(format!("no document {d}")));
             }
-            let gradient_blend = if let Some(value) = p.get("gradientBlendMode") {
-                let Some(name) = value.as_str() else { return err("gradientBlendMode must be a blend mode name") };
-                let Some(mode) = photocraft_engine::commands::blend_from_str(name).filter(|m| photocraft_color::BlendMode::LAYER_MODES.contains(m)) else {
-                    return err(format!("unknown gradient blend mode `{name}`"));
-                };
-                Some(mode)
+            wrap(crate::menus::invoke(app, ctx, "window.newWindowForDocument", json!({})))
+        }
+        "ui.window.close" => {
+            let Some(id) = u64_param(p, "window") else { return Some(err("missing `window`")) };
+            let before = app.ui.windows.len();
+            app.ui.windows.retain(|w| w.id != id);
+            if app.ui.windows.len() < before { ok(Value::Null) } else { err(format!("no window {id}")) }
+        }
+        "ui.resize" => {
+            let (w, h) = (p.get("width").and_then(Value::as_f64).unwrap_or(1280.0), p.get("height").and_then(Value::as_f64).unwrap_or(800.0));
+            ctx.send_viewport_cmd(egui::ViewportCommand::InnerSize(egui::vec2(w as f32, h as f32)));
+            ok(Value::Null)
+        }
+        "ui.gpu.simulateLoss" => simulate_gpu_loss(app, ctx, p),
+        "ui.focus" => {
+            ctx.send_viewport_cmd(egui::ViewportCommand::Visible(true));
+            ctx.send_viewport_cmd(egui::ViewportCommand::Minimized(false));
+            ctx.send_viewport_cmd(egui::ViewportCommand::Focus);
+            ctx.request_repaint();
+            ok(Value::Null)
+        }
+        "ui.screenshot" => screenshot(app, ctx, p),
+        _ => return None,
+    })
+}
+
+fn simulate_gpu_loss(app: &mut PhotocraftApp, ctx: &egui::Context, p: &Value) -> Outcome {
+    if p.get("destroy").and_then(Value::as_bool).unwrap_or(false) {
+        let destroyed = app.destroy_window_device();
+        ctx.request_repaint();
+        return ok(json!({"destroyed": destroyed}));
+    }
+    let error = p.get("error").and_then(Value::as_bool).unwrap_or(false);
+    let fault = if error {
+        photocraft_gpu::Fault::Error("simulated error (ui.gpu.simulateLoss)".into())
+    } else {
+        photocraft_gpu::Fault::Lost("simulated (ui.gpu.simulateLoss)".into())
+    };
+    let active = match app.gpu_health() {
+        Some(h) => {
+            h.mark(fault);
+            true
+        }
+        None => false,
+    };
+    app.check_gpu(ctx);
+    ctx.request_repaint();
+    ok(json!({"wasActive": active, "gpuInfo": app.perf.gpu_info}))
+}
+
+fn screenshot(app: &mut PhotocraftApp, ctx: &egui::Context, p: &Value) -> Outcome {
+    let parsed =
+        input_object(p, None, &["path", "focus"]).and_then(|p| Ok((input_choice(&p, "path", "path", &[])?.map(str::to_string), bool_field(&p, "focus")?)));
+    let (path, focus) = match parsed {
+        Ok(parsed) => parsed,
+        Err(e) => return err(e),
+    };
+    // Occluded windows don't render on macOS, so the screenshot would never arrive: raise first.
+    if focus.unwrap_or(true) {
+        ctx.send_viewport_cmd(egui::ViewportCommand::Focus);
+    }
+    // The capture itself is admitted by `PhotocraftApp::drain_control` (budget and
+    // geometry) and issued from a later `App::ui` pass once open/close animations
+    // (modals, popups) have settled (see `screenshot.rs`).
+    let token = app.ui.alloc_id();
+    ctx.request_repaint();
+    Outcome::Screenshot { token, path }
+}
+
+// ---- ui.set: every field is validated and materialized into a `UiSet` before the first one is applied ----
+
+fn ui_set(app: &mut PhotocraftApp, ctx: &egui::Context, p: &Value) -> Outcome {
+    if let Some(field) = p.as_object().and_then(|o| o.keys().find(|k| !UI_SET_FIELDS.contains(&k.as_str()))) {
+        return err(format!("unknown field `{field}` (fields: {})", UI_SET_FIELDS.join(", ")));
+    }
+    // Everything is validated and materialized before the first field is applied, so a
+    // rejected call applies none of its fields (#412's guarantee, down to the values
+    // and nested keys).
+    wrap(UiSet::parse(app, p).and_then(|set| set.apply(app, ctx, p)))
+}
+
+struct UiSet {
+    tools: ToolSet,
+    crop: CropSet,
+    panels: PanelSet,
+    view: ViewSet,
+    theme: Option<crate::theme::ThemeKind>,
+    brush: BrushSet,
+    legacy_update: Option<crate::panel_docking::LegacyUpdate>,
+}
+
+impl UiSet {
+    fn parse(app: &PhotocraftApp, p: &Value) -> std::result::Result<Self, String> {
+        let tools = ToolSet::parse(app, p)?;
+        let crop = CropSet::parse(app, p)?;
+        let panels = PanelSet::parse(app, p)?;
+        let view = ViewSet::parse(app, p)?;
+        let theme = theme_param(p)?;
+        let brush = BrushSet::parse(app, p)?;
+        let bridge_pro = matches!(theme.unwrap_or(app.ui.theme), crate::theme::ThemeKind::Pro | crate::theme::ThemeKind::ProMedium);
+        let legacy_update =
+            crate::panel_docking::prepare_legacy_update(app, p, panels.panels.as_ref(), panels.dock_tabs.as_ref(), panels.dock.as_ref(), bridge_pro)?;
+        Ok(Self { tools, crop, panels, view, theme, brush, legacy_update })
+    }
+
+    /// Apply (nothing but the final `brushSize` command can fail).
+    fn apply(mut self, app: &mut PhotocraftApp, ctx: &egui::Context, p: &Value) -> std::result::Result<Value, String> {
+        self.tools.apply(app);
+        self.crop.apply(app);
+        self.panels.apply_options(app);
+        if let Some(k) = self.theme {
+            app.set_theme(ctx, k);
+        }
+        self.panels.apply_dock(app);
+        if let Some(update) = self.legacy_update {
+            crate::panel_docking::commit_legacy_update(app, update, p);
+        }
+        self.panels.apply_color_and_width(app, ctx);
+        self.view.apply(app);
+        self.brush.apply(app)?;
+        Ok(Value::Null)
+    }
+}
+
+fn theme_param(p: &Value) -> std::result::Result<Option<crate::theme::ThemeKind>, String> {
+    let Some(name) = str_param(p, "theme") else { return Ok(None) };
+    crate::theme::ThemeKind::from_name(name).map(Some).ok_or_else(|| {
+        let names: Vec<_> = crate::theme::ThemeKind::ALL.iter().map(|k| k.id()).collect();
+        format!("unknown theme `{name}` ({})", names.join(", "))
+    })
+}
+
+// -- tools: stroke, tool, gradient, eyedropper, Content-Aware Move, tile grid, layer filter --
+
+struct ToolSet {
+    gradient_blend: Option<photocraft_color::BlendMode>,
+    shape_stroke: Option<Option<photocraft_doc::ShapeStroke>>,
+    tool: Option<Tool>,
+    gradient_classic: Option<bool>,
+    stroke_trace: Option<&'static str>,
+    eyedropper_size: Option<u32>,
+    eyedropper_sample: Option<String>,
+    eyedropper_ring: Option<bool>,
+    cam_transform_on_drop: Option<bool>,
+    tile_grid: Option<bool>,
+    layer_filter: Option<crate::layer_filter_ui::Filter>,
+}
+
+impl ToolSet {
+    fn parse(app: &PhotocraftApp, p: &Value) -> std::result::Result<Self, String> {
+        Ok(Self {
+            gradient_blend: gradient_blend_param(p)?,
+            shape_stroke: shape_stroke_param(app, p)?,
+            tool: tool_param(p)?,
+            gradient_classic: bool_field(p, "gradientClassic")?,
+            stroke_trace: stroke_trace_param(p)?,
+            // The Eyedropper's options bar (#1649): Sample Size, Sample, Show Sampling Ring.
+            eyedropper_size: eyedropper_size_param(p)?,
+            eyedropper_sample: eyedropper_sample_param(p)?,
+            eyedropper_ring: bool_field(p, "eyedropperRing")?,
+            // Content-Aware Move's Transform On Drop checkbox.
+            cam_transform_on_drop: bool_field(p, "camTransformOnDrop")?,
+            // Developer overlay of the active layer's storage tiles (tile_overlay.rs).
+            tile_grid: bool_field(p, "tileGrid")?,
+            layer_filter: p.get("layerFilter").map(|v| crate::layer_filter_ui::patched(&app.ui, v)).transpose()?,
+        })
+    }
+
+    fn apply(self, app: &mut PhotocraftApp) {
+        if let Some(stroke) = &self.shape_stroke {
+            if let Some(stroke) = stroke {
+                app.ui.tool_options.stroke_width = stroke.width;
+                app.ui.tool_options.shape_stroke = crate::shape_stroke_ui::StrokeOptions::from(stroke);
             } else {
-                None
-            };
-            // Everything is validated and materialized before the first field is applied, so a
-            // rejected call applies none of its fields (#412's guarantee, down to the values
-            // and nested keys).
-            let applied = (|| -> std::result::Result<Value, String> {
-                let shape_stroke = match p.get("shapeStroke") {
-                    Some(v) => {
-                        if let Some(object) = v.as_object() {
-                            let keys = ["width", "opacity", "align", "cap", "join", "miterLimit", "dashes", "dashOffset"];
-                            if let Some(key) = object.keys().find(|key| !keys.contains(&key.as_str())) {
-                                return Err(format!("unknown shapeStroke field `{key}`"));
-                            }
-                        }
-                        let o = &app.ui.tool_options;
-                        let base = o.shape_stroke.stroke(o.stroke_width, photocraft_doc::Fill::Solid(photocraft_doc::Color::BLACK));
-                        Some(photocraft_engine::vector_cmds::parse_stroke(v, Some(base), photocraft_doc::Color::BLACK)?)
-                    }
-                    None => None,
-                };
-                let tool = match s("tool") {
-                    Some(t) => Tool::from_name(t).map(Some).ok_or_else(|| format!("unknown tool `{t}`"))?,
-                    None => None,
-                };
-                let gradient_classic = bool_field(p, "gradientClassic")?;
-                // The stroke latency trace (`stroke_trace`), at runtime: on (stderr) or off. A CSV
-                // file is only for the user's own launch (`--stroke-trace <path>`): a path over the
-                // control channel would write outside the automation write root.
-                let stroke_trace = match p.get("strokeTrace") {
-                    None | Some(Value::Null) => None,
-                    Some(Value::Bool(b)) => Some(if *b { "stderr" } else { "off" }),
-                    Some(Value::String(v)) => match v.trim() {
-                        "stderr" | "on" | "true" => Some("stderr"),
-                        "off" | "false" => Some("off"),
-                        _ => return Err("strokeTrace must be true, false, \"stderr\" or \"off\"; a CSV file is set at launch (--stroke-trace <path>)".into()),
-                    },
-                    Some(_) => return Err("strokeTrace must be true, false, \"stderr\" or \"off\"".into()),
-                };
-                // The Eyedropper's options bar (#1649): Sample Size, Sample, Show Sampling Ring.
-                let eyedropper_size = match p.get("eyedropperSampleSize") {
-                    Some(v) => Some(
-                        photocraft_engine::sample_cmds::size_param("ui.set", &json!({"size": v}))
-                            .map_err(|_| format!("eyedropperSampleSize must be \"point\" or one of {:?}", photocraft_engine::sample_cmds::SAMPLE_SIZES))?,
-                    ),
-                    None => None,
-                };
-                let eyedropper_sample = match p.get("eyedropperSample") {
-                    Some(v) => {
-                        let ids: Vec<&str> = photocraft_engine::sample_cmds::SampleLayers::ALL.iter().map(|(_, n)| *n).collect();
-                        let id = v.as_str().filter(|id| ids.contains(id)).ok_or_else(|| format!("eyedropperSample must be one of {}", ids.join(", ")))?;
-                        Some(id.to_string())
-                    }
-                    None => None,
-                };
-                let eyedropper_ring = bool_field(p, "eyedropperRing")?;
-                // Content-Aware Move's Transform On Drop checkbox.
-                let cam_transform_on_drop = bool_field(p, "camTransformOnDrop")?;
-                // Developer overlay of the active layer's storage tiles (tile_overlay.rs).
-                let tile_grid = bool_field(p, "tileGrid")?;
-                let layer_filter = p.get("layerFilter").map(|v| crate::layer_filter_ui::patched(&app.ui, v)).transpose()?;
-                // The Crop tool's overlay menu (#1919).
-                let crop_overlay = match p.get("cropOverlay") {
-                    Some(v) => Some(v.as_str().and_then(crate::crop_overlay::CropOverlay::from_id).ok_or_else(|| {
-                        let ids: Vec<&str> = crate::crop_overlay::CropOverlay::ALL.iter().map(|k| k.id()).collect();
-                        format!("cropOverlay must be one of {}", ids.join(", "))
-                    })?),
-                    None => None,
-                };
-                let crop_overlay_show = match p.get("cropOverlayShow") {
-                    Some(v) => Some(
-                        v.as_str()
-                            .and_then(crate::crop_overlay::OverlayShow::from_id)
-                            .ok_or_else(|| "cropOverlayShow must be one of auto, always, never".to_string())?,
-                    ),
-                    None => None,
-                };
-                let crop_overlay_orientation = match uint_field(p, "cropOverlayOrientation")? {
-                    Some(o) if o < 4 => Some(o as u8),
-                    Some(_) => return Err("cropOverlayOrientation must be 0, 1, 2 or 3".into()),
-                    None => None,
-                };
-                // The Crop tool's Fill (#3823): "background" (Background (Default)) or "contentAware".
-                let crop_content_aware = match p.get("cropFill") {
-                    Some(v) => Some(match v.as_str() {
-                        Some("background") => false,
-                        Some("contentAware") => true,
-                        _ => return Err("cropFill must be \"background\" or \"contentAware\"".into()),
-                    }),
-                    None => None,
-                };
-                // The Crop tool's gear menu: Show Cropped Area and the shield (#1919).
-                let crop_shield = merged_object(&app.ui.tool_options.crop_shield, p.get("cropShield"), "cropShield")?;
-                if crop_shield.as_ref().is_some_and(|s| !(0.0..=100.0).contains(&s.opacity)) {
-                    return Err("cropShield.opacity must be 0..100".into());
-                }
-                // The Histogram panel: its options, the dragged tonal range ([from, to] levels or
-                // null) and Uncached Refresh.
-                let histogram_panel = merged_object(&app.ui.histogram_panel, p.get("histogramPanel"), "histogramPanel")?;
-                let histogram_range = match p.get("histogramRange") {
-                    Some(v) => Some(
-                        serde_json::from_value::<Option<[u8; 2]>>(v.clone())
-                            .map_err(|_| "histogramRange must be [from, to] levels 0..255, or null".to_string())?,
-                    ),
-                    None => None,
-                };
-                let histogram_refresh = bool_field(p, "histogramRefresh")?;
-                let panels = merged_object(&app.ui.panels, p.get("panels"), "panels")?;
-                let mask_target = bool_field(p, "maskTarget")?;
-                let updates_open = bool_field(p, "updatesOpen")?;
-                let vector_mask_target = bool_field(p, "vectorMaskTarget")?;
-                // Target the active smart object's filter mask (FILE-215-3): it needs smart filters.
-                let filter_mask_target = bool_field(p, "filterMaskTarget")?;
-                if filter_mask_target == Some(true) {
-                    let st = app.session.active().ok_or("filterMaskTarget needs an open document")?;
-                    let l = st.active_layer.and_then(|id| st.doc.layer(id)).ok_or("filterMaskTarget needs an active layer")?;
-                    if !matches!(&l.content, photocraft_doc::LayerContent::Smart(sm) if !sm.smart_filters.is_empty()) {
-                        return Err("filterMaskTarget needs an active smart object with smart filters".into());
-                    }
-                    use photocraft_engine::channel_cmds::ChannelTarget;
-                    let composite = matches!(st.channel_view.target, ChannelTarget::Composite | ChannelTarget::LayerMask | ChannelTarget::VectorMask);
-                    if !composite || st.doc.quick_mask.is_some() {
-                        return Err("filterMaskTarget can't be set while a single channel or Quick Mask is targeted".into());
-                    }
-                }
-                let selection_mode = uint_field(p, "selectionMode")?;
-                let dock_tabs = merged_object(&app.ui.dock_tabs, p.get("dockTabs"), "dockTabs")?;
-                let dock = whole_object(&app.ui.dock, p.get("dock"), "dock")?;
-                // Which chip the Color panel edits.
-                let color_panel = merged_object(&app.ui.color_panel, p.get("colorPanel"), "colorPanel")?;
-                let dock_width = f32_field(p, "dockWidth")?;
-                let zoom = f32_field(p, "zoom")?;
-                let rotation = f32_field(p, "rotation")?;
-                if rotation.is_some() && app.session.active_index().is_none() {
-                    return Err("no document open".into());
-                }
-                let center = match p.get("center") {
-                    Some(v) => {
-                        let a = v.as_array().ok_or_else(|| "center must be [x, y]".to_string())?;
-                        if a.len() != 2 {
-                            return Err("center must be exactly [x, y]".into());
-                        }
-                        let (Some(x), Some(y)) = (a.first().and_then(Value::as_f64), a.get(1).and_then(Value::as_f64)) else {
-                            return Err("center must be [x, y] of two numbers".into());
-                        };
-                        if !f32_range(&x) || !f32_range(&y) {
-                            return Err("center must be finite numbers within f32 range".into());
-                        }
-                        Some([x as f32, y as f32])
-                    }
-                    None => None,
-                };
-                let fit = bool_field(p, "fit")? == Some(true);
-                let theme = match s("theme") {
-                    Some(name) => {
-                        let kind = crate::theme::ThemeKind::from_name(name).ok_or_else(|| {
-                            let names: Vec<_> = crate::theme::ThemeKind::ALL.iter().map(|k| k.id()).collect();
-                            format!("unknown theme `{name}` ({})", names.join(", "))
-                        })?;
-                        Some(kind)
-                    }
-                    None => None,
-                };
-                let brush_section = uint_field(p, "brushSection")?;
-                let brush_tab = uint_field(p, "brushTab")?;
-                let brushes_view = match p.get("brushesView") {
-                    Some(v) => serde_json::from_value(v.clone()).map(Some).map_err(|e| format!("brushesView: {e} (list, grid)"))?,
-                    None => None,
-                };
-                // The three parts of the picker's cards. At least one stays on (a rejected call
-                // leaves them all alone).
-                let brush_picker_name = bool_field(p, "brushPickerName")?;
-                let brush_picker_stroke = bool_field(p, "brushPickerStroke")?;
-                let brush_picker_tip = bool_field(p, "brushPickerTip")?;
-                if [brush_picker_name, brush_picker_stroke, brush_picker_tip].iter().any(Option::is_some) {
-                    let on = [
-                        brush_picker_name.unwrap_or(app.ui.brush_picker_list.show_name),
-                        brush_picker_stroke.unwrap_or(app.ui.brush_picker_list.show_stroke),
-                        brush_picker_tip.unwrap_or(app.ui.brush_picker_list.show_tip),
-                    ];
-                    if !on.iter().any(|b| *b) {
-                        return Err("brushPickerName, brushPickerStroke and brushPickerTip: at least one must stay on".into());
-                    }
-                }
-                // The picker footer slider: the preset cards' size scale (1 standard; 0.30 and
-                // below the tips drop their size numbers).
-                let brush_picker_scale = match num_field(p, "brushPickerScale")? {
-                    Some(s) if !(0.15..=2.0).contains(&s) => return Err("brushPickerScale must be between 0.15 and 2".into()),
-                    Some(s) => Some(s as f32),
-                    None => None,
-                };
-                // `Some(None)` is an explicit null, which closes the picker (a missing field
-                // leaves it alone).
-                let brush_picker = match p.get("brushPicker") {
-                    Some(v) => {
-                        let at = serde_json::from_value::<Option<[f32; 2]>>(v.clone())
-                            .map_err(|_| "brushPicker must be [x, y] in screen points, or null to close it".to_string())?;
-                        if at.is_some_and(|[x, y]| !x.is_finite() || !y.is_finite()) {
-                            return Err("brushPicker must be [x, y] in screen points, or null to close it".into());
-                        }
-                        Some(at)
-                    }
-                    None => None,
-                };
-                // brushSize rides the journaled `tools.setBrush` command (#744). Numeric values
-                // are validated here so the command cannot fail after other fields were
-                // applied; non-numeric values keep the API's historical silent no-op.
-                let brush_size: Option<f64> = match p.get("brushSize").and_then(Value::as_f64) {
-                    Some(size) => {
-                        if !size.is_finite() || size > f64::from(photocraft_paint::MAX_BRUSH_SIZE) {
-                            return Err(format!("brushSize must be finite and at most {} px", photocraft_paint::MAX_BRUSH_SIZE));
-                        }
-                        Some(size)
-                    }
-                    None => None,
-                };
-
-                let bridge_pro = matches!(theme.unwrap_or(app.ui.theme), crate::theme::ThemeKind::Pro | crate::theme::ThemeKind::ProMedium);
-                let legacy_update = crate::panel_docking::prepare_legacy_update(app, p, panels.as_ref(), dock_tabs.as_ref(), dock.as_ref(), bridge_pro)?;
-
-                // Apply (nothing below can fail).
-                if let Some(stroke) = shape_stroke {
-                    if let Some(stroke) = stroke {
-                        app.ui.tool_options.stroke_width = stroke.width;
-                        app.ui.tool_options.shape_stroke = crate::shape_stroke_ui::StrokeOptions::from(&stroke);
-                    } else {
-                        app.ui.tool_options.stroke_width = 0.0;
-                    }
-                }
-                if let Some(t) = tool {
-                    crate::tool_memory::select(app, t);
-                    // Each tool keeps its own brush (#218), so switch it in before `brushSize`
-                    // below sets the new tool's size.
-                    crate::paint_mouse::sync_tool_brush(app);
-                }
-                let gradient_before = app.ui.tool_options.clone();
-                if let Some(mode) = gradient_blend {
-                    app.ui.tool_options.gradient_blend_mode = mode;
-                }
-                if let Some(v) = &stroke_trace {
-                    app.stroke_trace.set(v);
-                }
-                if let Some(classic) = gradient_classic {
-                    app.ui.tool_options.gradient_classic = classic;
-                }
-                if gradient_blend.is_some() {
-                    crate::gradient_ui::options_changed(app, &gradient_before);
-                }
-                if let Some(size) = eyedropper_size {
-                    app.ui.tool_options.eyedropper_size = size;
-                }
-                if let Some(id) = eyedropper_sample {
-                    app.ui.tool_options.eyedropper_sample = id;
-                }
-                if let Some(ring) = eyedropper_ring {
-                    app.ui.tool_options.eyedropper_ring = ring;
-                }
-                if let Some(on) = cam_transform_on_drop {
-                    app.ui.tool_options.cam_transform_on_drop = on;
-                }
-                if let Some(on) = tile_grid {
-                    app.ui.view.tile_grid = on;
-                }
-                if let Some(f) = layer_filter {
-                    crate::layer_filter_ui::apply(&mut app.ui, f);
-                }
-                if let Some(h) = histogram_panel {
-                    app.ui.histogram_panel = h;
-                    crate::histogram_panel::persist_options(app);
-                }
-                if let Some(r) = histogram_range {
-                    app.ui.histogram_range = r;
-                }
-                if histogram_refresh == Some(true) {
-                    crate::histogram_panel::uncached_refresh(app);
-                }
-                if let Some(k) = crop_overlay {
-                    app.ui.tool_options.crop_overlay = k;
-                }
-                if let Some(on) = crop_content_aware {
-                    app.ui.tool_options.crop_content_aware = on;
-                }
-                if let Some(v) = crop_overlay_show {
-                    app.ui.tool_options.crop_overlay_show = v;
-                }
-                if let Some(o) = crop_overlay_orientation {
-                    app.ui.tool_options.crop_overlay_orientation = o;
-                }
-                if let Some(s) = crop_shield {
-                    app.ui.tool_options.crop_shield = s;
-                }
-                if let Some(v) = panels {
-                    app.ui.panels = v;
-                }
-                if let Some(m) = mask_target {
-                    app.end_filter_mask_view();
-                    app.ui.filter_mask_target = None;
-                    app.ui.mask_target = m;
-                    app.ui.properties_layer = None;
-                    app.ui.vector_mask_target &= !m;
-                    app.sync_mask_targets();
-                }
-                if let Some(open) = updates_open {
-                    app.ui.updates_open = open;
-                }
-                if let Some(m) = vector_mask_target {
-                    app.end_filter_mask_view();
-                    app.ui.filter_mask_target = None;
-                    app.ui.vector_mask_target = m;
-                    app.ui.mask_target &= !m;
-                    app.sync_mask_targets();
-                }
-                if let Some(m) = filter_mask_target {
-                    let layer = if m { app.session.active().and_then(|st| st.active_layer).map(|id| id.0) } else { None };
-                    app.select_filter_mask_target(layer);
-                }
-                // Selection tools' options-bar mode: 0 New, 1 Add, 2 Subtract, 3 Intersect.
-                if let Some(m) = selection_mode {
-                    app.ui.selection_mode = m.min(3) as u8;
-                }
-                if let Some(k) = theme {
-                    app.set_theme(ctx, k);
-                }
-                if let Some(v) = dock_tabs {
-                    app.ui.dock_tabs = v;
-                }
-                // Dock group order, heights and collapsed groups (see `dock::DockLayout`).
-                if let Some(v) = dock {
-                    app.ui.dock = v;
-                }
-                if let Some(update) = legacy_update {
-                    crate::panel_docking::commit_legacy_update(app, update, p);
-                }
-                if let Some(v) = color_panel {
-                    app.ui.color_panel = v;
-                }
-                // Right dock width in points (clamped to the dock's 250..=520 range), applied next frame.
-                if let Some(w) = dock_width {
-                    crate::panels::request_dock_width(ctx, w as f32);
-                }
-                if let Some(i) = app.session.active_index() {
-                    if zoom.is_some() || center.is_some() || rotation.is_some() || fit {
-                        app.ui.views[i].zoom_animating = false;
-                        app.ui.views[i].zoom_anchor = None;
-                    }
-                    if let Some(z) = zoom {
-                        let size = app.session.documents().get(i).map_or([0, 0], |st| [st.doc.size.width, st.doc.size.height]);
-                        app.ui.views[i].zoom = crate::zoom_levels::clamp(z as f32, size);
-                        app.ui.views[i].fit_pending = false;
-                        app.ui.views[i].fill_pending = false;
-                    }
-                    if let Some(c) = center {
-                        app.ui.views[i].center = c;
-                        app.ui.views[i].fit_pending = false;
-                        app.ui.views[i].fill_pending = false;
-                    }
-                    if fit {
-                        app.ui.views[i].fit_pending = true;
-                        app.ui.views[i].fill_pending = false;
-                    }
-                    if let Some(r) = rotation {
-                        app.ui.views[i].rotation = crate::rotate_view::wrap_deg(r as f32);
-                    }
-                }
-                if let Some(i) = brush_section {
-                    app.ui.brush_section = (i as usize).min(crate::brush_panel::SECTIONS.len() - 1);
-                }
-                if let Some(i) = brush_tab {
-                    app.ui.brush_tab = (i as usize).min(1);
-                }
-                if let Some(v) = brushes_view {
-                    app.ui.brushes_panel.view = v;
-                }
-                if let Some(v) = brush_picker_name {
-                    app.ui.brush_picker_list.show_name = v;
-                }
-                if let Some(v) = brush_picker_stroke {
-                    app.ui.brush_picker_list.show_stroke = v;
-                }
-                if let Some(v) = brush_picker_tip {
-                    app.ui.brush_picker_list.show_tip = v;
-                }
-                if let Some(v) = brush_picker_scale {
-                    app.ui.brush_picker_list.scale = v;
-                }
-                if let Some(at) = brush_picker {
-                    app.ui.brush_picker = at;
-                }
-                // Which chip the Color panel edits.
-                if let Some(c) = color_panel {
-                    app.ui.color_panel = c;
-                }
-                if let Some(size) = brush_size {
-                    app.run("tools.setBrush", json!({"brush": {"size": size}})).map_err(|e| e.to_string())?;
-                }
-                Ok(Value::Null)
-            })();
-            wrap(applied)
-        }
-        "ui.dialog.open" => {
-            let kind = match s("kind").unwrap_or("") {
-                "newDocument" | "NewDocument" => DialogKind::NewDocument,
-                "about" | "About" => DialogKind::About,
-                "layerStyle" | "LayerStyle" => {
-                    return match crate::layer_style::open(app, s("effect")) {
-                        Some(id) => ok(json!({"dialog": id})),
-                        None => err("no active layer"),
-                    };
-                }
-                "colorPicker" | "ColorPicker" => {
-                    if let Some(style) = p.get("textStyle") {
-                        if ["parent", "effect", "field", "target"].iter().any(|key| p.get(*key).is_some()) {
-                            return err("textStyle cannot be combined with another picker target");
-                        }
-                        let Some(style) = style.as_object().filter(|s| s.keys().all(|k| k == "kind" || k == "id")) else {
-                            return err("textStyle needs kind and id only");
-                        };
-                        let Some(kind) = style.get("kind").cloned().and_then(|v| serde_json::from_value::<crate::type_panels_ui::color_picker::Kind>(v).ok())
-                        else {
-                            return err("textStyle kind must be character or paragraph");
-                        };
-                        let Some(id) = style.get("id").and_then(Value::as_u64).and_then(|id| u32::try_from(id).ok()) else {
-                            return err("textStyle id must be a u32 integer");
-                        };
-                        return match crate::type_panels_ui::color_picker::open(app, kind, id) {
-                            Ok(id) => ok(json!({"dialog": id})),
-                            Err(error) => err(error),
-                        };
-                    }
-                    if p.get("parent").is_some() {
-                        let (Some(parent), Some(effect), Some(field)) = (u("parent"), s("effect"), s("field")) else {
-                            return err("need integer `parent` and string `effect` and `field`");
-                        };
-                        return match crate::layer_style::color_picker::open(app, parent, effect, field) {
-                            Ok(id) => ok(json!({"dialog": id})),
-                            Err(error) => err(error),
-                        };
-                    }
-                    if p.get("effect").is_some() || p.get("field").is_some() {
-                        return err("Layer Style color pickers need `parent`");
-                    }
-                    let target = if s("target") == Some("background") { "background" } else { "foreground" };
-                    return ok(json!({"dialog": crate::color_picker_ui::open(app, target)}));
-                }
-                // The Crop tool's New / Delete Crop Preset… (#1919).
-                "newCropPreset" => {
-                    return match crate::crop_presets::open_new(app) {
-                        Some(id) => ok(json!({"dialog": id})),
-                        None => err("nothing to save: set W and H (W x H x Resolution) or a ratio first"),
-                    };
-                }
-                "deleteCropPreset" => {
-                    return match crate::crop_presets::open_delete(app) {
-                        Some(id) => ok(json!({"dialog": id})),
-                        None => err("no crop presets are saved"),
-                    };
-                }
-                "command" | "Command" => {
-                    let Some(cmd) = s("command") else { return err("command dialogs need `command`") };
-                    let label = photocraft_engine::commands::find(cmd).map(|c| c.label).unwrap_or(cmd);
-                    return ok(json!({"dialog": crate::dialogs::open_command_dialog(app, cmd, label)}));
-                }
-                other => return err(format!("unknown dialog kind `{other}`")),
-            };
-            let mut fields = if kind == DialogKind::NewDocument { app.new_document_fields() } else { Default::default() };
-            if let Some(f) = p.get("fields").and_then(Value::as_object) {
-                if let Some(marker) = f.keys().find(|k| crate::dialogs::is_route_marker(k)) {
-                    return err(format!("`{marker}` is set only by the dialog it belongs to"));
-                }
-                fields.extend(f.clone());
+                app.ui.tool_options.stroke_width = 0.0;
             }
-            ok(json!({"dialog": app.ui.open_dialog(kind, fields)}))
         }
+        if let Some(t) = self.tool {
+            crate::tool_memory::select(app, t);
+            // Each tool keeps its own brush (#218), so switch it in before `brushSize`
+            // sets the new tool's size.
+            crate::paint_mouse::sync_tool_brush(app);
+        }
+        self.apply_gradient_and_trace(app);
+        if let Some(size) = self.eyedropper_size {
+            app.ui.tool_options.eyedropper_size = size;
+        }
+        if let Some(id) = self.eyedropper_sample {
+            app.ui.tool_options.eyedropper_sample = id;
+        }
+        if let Some(ring) = self.eyedropper_ring {
+            app.ui.tool_options.eyedropper_ring = ring;
+        }
+        if let Some(on) = self.cam_transform_on_drop {
+            app.ui.tool_options.cam_transform_on_drop = on;
+        }
+        if let Some(on) = self.tile_grid {
+            app.ui.view.tile_grid = on;
+        }
+        if let Some(f) = self.layer_filter {
+            crate::layer_filter_ui::apply(&mut app.ui, f);
+        }
+    }
+
+    fn apply_gradient_and_trace(&self, app: &mut PhotocraftApp) {
+        let gradient_before = app.ui.tool_options.clone();
+        if let Some(mode) = self.gradient_blend {
+            app.ui.tool_options.gradient_blend_mode = mode;
+        }
+        if let Some(v) = &self.stroke_trace {
+            app.stroke_trace.set(v);
+        }
+        if let Some(classic) = self.gradient_classic {
+            app.ui.tool_options.gradient_classic = classic;
+        }
+        if self.gradient_blend.is_some() {
+            crate::gradient_ui::options_changed(app, &gradient_before);
+        }
+    }
+}
+
+fn gradient_blend_param(p: &Value) -> std::result::Result<Option<photocraft_color::BlendMode>, String> {
+    let Some(value) = p.get("gradientBlendMode") else { return Ok(None) };
+    let Some(name) = value.as_str() else { return Err("gradientBlendMode must be a blend mode name".into()) };
+    photocraft_engine::commands::blend_from_str(name)
+        .filter(|m| photocraft_color::BlendMode::LAYER_MODES.contains(m))
+        .map(Some)
+        .ok_or_else(|| format!("unknown gradient blend mode `{name}`"))
+}
+
+fn shape_stroke_param(app: &PhotocraftApp, p: &Value) -> std::result::Result<Option<Option<photocraft_doc::ShapeStroke>>, String> {
+    let Some(v) = p.get("shapeStroke") else { return Ok(None) };
+    if let Some(object) = v.as_object() {
+        let keys = ["width", "opacity", "align", "cap", "join", "miterLimit", "dashes", "dashOffset"];
+        if let Some(key) = object.keys().find(|key| !keys.contains(&key.as_str())) {
+            return Err(format!("unknown shapeStroke field `{key}`"));
+        }
+    }
+    let o = &app.ui.tool_options;
+    let base = o.shape_stroke.stroke(o.stroke_width, photocraft_doc::Fill::Solid(photocraft_doc::Color::BLACK));
+    Ok(Some(photocraft_engine::vector_cmds::parse_stroke(v, Some(base), photocraft_doc::Color::BLACK)?))
+}
+
+fn tool_param(p: &Value) -> std::result::Result<Option<Tool>, String> {
+    match str_param(p, "tool") {
+        Some(t) => Tool::from_name(t).map(Some).ok_or_else(|| format!("unknown tool `{t}`")),
+        None => Ok(None),
+    }
+}
+
+/// The stroke latency trace (`stroke_trace`), at runtime: on (stderr) or off. A CSV
+/// file is only for the user's own launch (`--stroke-trace <path>`): a path over the
+/// control channel would write outside the automation write root.
+fn stroke_trace_param(p: &Value) -> std::result::Result<Option<&'static str>, String> {
+    match p.get("strokeTrace") {
+        None | Some(Value::Null) => Ok(None),
+        Some(Value::Bool(b)) => Ok(Some(if *b { "stderr" } else { "off" })),
+        Some(Value::String(v)) => match v.trim() {
+            "stderr" | "on" | "true" => Ok(Some("stderr")),
+            "off" | "false" => Ok(Some("off")),
+            _ => Err("strokeTrace must be true, false, \"stderr\" or \"off\"; a CSV file is set at launch (--stroke-trace <path>)".into()),
+        },
+        Some(_) => Err("strokeTrace must be true, false, \"stderr\" or \"off\"".into()),
+    }
+}
+
+fn eyedropper_size_param(p: &Value) -> std::result::Result<Option<u32>, String> {
+    let Some(v) = p.get("eyedropperSampleSize") else { return Ok(None) };
+    photocraft_engine::sample_cmds::size_param("ui.set", &json!({"size": v}))
+        .map(Some)
+        .map_err(|_| format!("eyedropperSampleSize must be \"point\" or one of {:?}", photocraft_engine::sample_cmds::SAMPLE_SIZES))
+}
+
+fn eyedropper_sample_param(p: &Value) -> std::result::Result<Option<String>, String> {
+    let Some(v) = p.get("eyedropperSample") else { return Ok(None) };
+    let ids: Vec<&str> = photocraft_engine::sample_cmds::SampleLayers::ALL.iter().map(|(_, n)| *n).collect();
+    let id = v.as_str().filter(|id| ids.contains(id)).ok_or_else(|| format!("eyedropperSample must be one of {}", ids.join(", ")))?;
+    Ok(Some(id.to_string()))
+}
+
+// -- the Crop tool's overlay, Fill and gear menu --
+
+struct CropSet {
+    overlay: Option<crate::crop_overlay::CropOverlay>,
+    overlay_show: Option<crate::crop_overlay::OverlayShow>,
+    orientation: Option<u8>,
+    content_aware: Option<bool>,
+    shield: Option<crate::crop_shield::CropShield>,
+}
+
+impl CropSet {
+    fn parse(app: &PhotocraftApp, p: &Value) -> std::result::Result<Self, String> {
+        // The Crop tool's overlay menu (#1919).
+        let overlay = crop_overlay_param(p)?;
+        let overlay_show = crop_overlay_show_param(p)?;
+        let orientation = crop_orientation_param(p)?;
+        // The Crop tool's Fill (#3823): "background" (Background (Default)) or "contentAware".
+        let content_aware = crop_fill_param(p)?;
+        // The Crop tool's gear menu: Show Cropped Area and the shield (#1919).
+        let shield = merged_object(&app.ui.tool_options.crop_shield, p.get("cropShield"), "cropShield")?;
+        if shield.as_ref().is_some_and(|s| !(0.0..=100.0).contains(&s.opacity)) {
+            return Err("cropShield.opacity must be 0..100".into());
+        }
+        Ok(Self { overlay, overlay_show, orientation, content_aware, shield })
+    }
+
+    fn apply(self, app: &mut PhotocraftApp) {
+        let o = &mut app.ui.tool_options;
+        if let Some(k) = self.overlay {
+            o.crop_overlay = k;
+        }
+        if let Some(on) = self.content_aware {
+            o.crop_content_aware = on;
+        }
+        if let Some(v) = self.overlay_show {
+            o.crop_overlay_show = v;
+        }
+        if let Some(v) = self.orientation {
+            o.crop_overlay_orientation = v;
+        }
+        if let Some(s) = self.shield {
+            o.crop_shield = s;
+        }
+    }
+}
+
+fn crop_overlay_param(p: &Value) -> std::result::Result<Option<crate::crop_overlay::CropOverlay>, String> {
+    let Some(v) = p.get("cropOverlay") else { return Ok(None) };
+    v.as_str().and_then(crate::crop_overlay::CropOverlay::from_id).map(Some).ok_or_else(|| {
+        let ids: Vec<&str> = crate::crop_overlay::CropOverlay::ALL.iter().map(|k| k.id()).collect();
+        format!("cropOverlay must be one of {}", ids.join(", "))
+    })
+}
+
+fn crop_overlay_show_param(p: &Value) -> std::result::Result<Option<crate::crop_overlay::OverlayShow>, String> {
+    let Some(v) = p.get("cropOverlayShow") else { return Ok(None) };
+    v.as_str().and_then(crate::crop_overlay::OverlayShow::from_id).map(Some).ok_or_else(|| "cropOverlayShow must be one of auto, always, never".to_string())
+}
+
+fn crop_orientation_param(p: &Value) -> std::result::Result<Option<u8>, String> {
+    match uint_field(p, "cropOverlayOrientation")? {
+        Some(o) if o < 4 => Ok(Some(o as u8)),
+        Some(_) => Err("cropOverlayOrientation must be 0, 1, 2 or 3".into()),
+        None => Ok(None),
+    }
+}
+
+fn crop_fill_param(p: &Value) -> std::result::Result<Option<bool>, String> {
+    match p.get("cropFill") {
+        Some(v) => match v.as_str() {
+            Some("background") => Ok(Some(false)),
+            Some("contentAware") => Ok(Some(true)),
+            _ => Err("cropFill must be \"background\" or \"contentAware\"".into()),
+        },
+        None => Ok(None),
+    }
+}
+
+// -- panels: Histogram, masks targets, docking, Color panel --
+
+struct PanelSet {
+    histogram_panel: Option<crate::histogram_panel::HistogramPanelState>,
+    histogram_range: Option<Option<[u8; 2]>>,
+    histogram_refresh: Option<bool>,
+    panels: Option<crate::state::Panels>,
+    mask_target: Option<bool>,
+    updates_open: Option<bool>,
+    vector_mask_target: Option<bool>,
+    filter_mask_target: Option<bool>,
+    selection_mode: Option<u64>,
+    dock_tabs: Option<crate::state::DockTabs>,
+    dock: Option<crate::dock::DockLayout>,
+    color_panel: Option<crate::state::ColorPanelState>,
+    dock_width: Option<f64>,
+}
+
+impl PanelSet {
+    fn parse(app: &PhotocraftApp, p: &Value) -> std::result::Result<Self, String> {
+        Ok(Self {
+            // The Histogram panel: its options, the dragged tonal range ([from, to] levels or
+            // null) and Uncached Refresh.
+            histogram_panel: merged_object(&app.ui.histogram_panel, p.get("histogramPanel"), "histogramPanel")?,
+            histogram_range: histogram_range_param(p)?,
+            histogram_refresh: bool_field(p, "histogramRefresh")?,
+            panels: merged_object(&app.ui.panels, p.get("panels"), "panels")?,
+            mask_target: bool_field(p, "maskTarget")?,
+            updates_open: bool_field(p, "updatesOpen")?,
+            vector_mask_target: bool_field(p, "vectorMaskTarget")?,
+            filter_mask_target: filter_mask_target_param(app, p)?,
+            selection_mode: uint_field(p, "selectionMode")?,
+            dock_tabs: merged_object(&app.ui.dock_tabs, p.get("dockTabs"), "dockTabs")?,
+            dock: whole_object(&app.ui.dock, p.get("dock"), "dock")?,
+            // Which chip the Color panel edits.
+            color_panel: merged_object(&app.ui.color_panel, p.get("colorPanel"), "colorPanel")?,
+            dock_width: f32_field(p, "dockWidth")?,
+        })
+    }
+
+    /// Everything that precedes the theme.
+    fn apply_options(&mut self, app: &mut PhotocraftApp) {
+        self.apply_histogram(app);
+        if let Some(v) = self.panels.take() {
+            app.ui.panels = v;
+        }
+        self.apply_mask_targets(app);
+        // Selection tools' options-bar mode: 0 New, 1 Add, 2 Subtract, 3 Intersect.
+        if let Some(m) = self.selection_mode {
+            app.ui.selection_mode = m.min(3) as u8;
+        }
+    }
+
+    fn apply_histogram(&mut self, app: &mut PhotocraftApp) {
+        if let Some(h) = self.histogram_panel.take() {
+            app.ui.histogram_panel = h;
+            crate::histogram_panel::persist_options(app);
+        }
+        if let Some(r) = self.histogram_range {
+            app.ui.histogram_range = r;
+        }
+        if self.histogram_refresh == Some(true) {
+            crate::histogram_panel::uncached_refresh(app);
+        }
+    }
+
+    fn apply_mask_targets(&self, app: &mut PhotocraftApp) {
+        if let Some(m) = self.mask_target {
+            app.end_filter_mask_view();
+            app.ui.filter_mask_target = None;
+            app.ui.mask_target = m;
+            app.ui.properties_layer = None;
+            app.ui.vector_mask_target &= !m;
+            app.sync_mask_targets();
+        }
+        if let Some(open) = self.updates_open {
+            app.ui.updates_open = open;
+        }
+        if let Some(m) = self.vector_mask_target {
+            app.end_filter_mask_view();
+            app.ui.filter_mask_target = None;
+            app.ui.vector_mask_target = m;
+            app.ui.mask_target &= !m;
+            app.sync_mask_targets();
+        }
+        if let Some(m) = self.filter_mask_target {
+            let layer = if m { app.session.active().and_then(|st| st.active_layer).map(|id| id.0) } else { None };
+            app.select_filter_mask_target(layer);
+        }
+    }
+
+    fn apply_dock(&mut self, app: &mut PhotocraftApp) {
+        if let Some(v) = self.dock_tabs.take() {
+            app.ui.dock_tabs = v;
+        }
+        // Dock group order, heights and collapsed groups (see `dock::DockLayout`).
+        if let Some(v) = self.dock.take() {
+            app.ui.dock = v;
+        }
+    }
+
+    fn apply_color_and_width(&mut self, app: &mut PhotocraftApp, ctx: &egui::Context) {
+        if let Some(v) = self.color_panel.take() {
+            app.ui.color_panel = v;
+        }
+        // Right dock width in points (clamped to the dock's 250..=520 range), applied next frame.
+        if let Some(w) = self.dock_width {
+            crate::panels::request_dock_width(ctx, w as f32);
+        }
+    }
+}
+
+fn histogram_range_param(p: &Value) -> std::result::Result<Option<Option<[u8; 2]>>, String> {
+    let Some(v) = p.get("histogramRange") else { return Ok(None) };
+    serde_json::from_value::<Option<[u8; 2]>>(v.clone()).map(Some).map_err(|_| "histogramRange must be [from, to] levels 0..255, or null".to_string())
+}
+
+/// Target the active smart object's filter mask (FILE-215-3): it needs smart filters.
+fn filter_mask_target_param(app: &PhotocraftApp, p: &Value) -> std::result::Result<Option<bool>, String> {
+    let target = bool_field(p, "filterMaskTarget")?;
+    if target == Some(true) {
+        check_filter_mask_target(app)?;
+    }
+    Ok(target)
+}
+
+fn check_filter_mask_target(app: &PhotocraftApp) -> std::result::Result<(), String> {
+    use photocraft_engine::channel_cmds::ChannelTarget;
+    let st = app.session.active().ok_or("filterMaskTarget needs an open document")?;
+    let l = st.active_layer.and_then(|id| st.doc.layer(id)).ok_or("filterMaskTarget needs an active layer")?;
+    if !matches!(&l.content, photocraft_doc::LayerContent::Smart(sm) if !sm.smart_filters.is_empty()) {
+        return Err("filterMaskTarget needs an active smart object with smart filters".into());
+    }
+    let composite = matches!(st.channel_view.target, ChannelTarget::Composite | ChannelTarget::LayerMask | ChannelTarget::VectorMask);
+    if !composite || st.doc.quick_mask.is_some() {
+        return Err("filterMaskTarget can't be set while a single channel or Quick Mask is targeted".into());
+    }
+    Ok(())
+}
+
+// -- the document view: zoom, centre, rotation, fit --
+
+struct ViewSet {
+    zoom: Option<f64>,
+    rotation: Option<f64>,
+    center: Option<[f32; 2]>,
+    fit: bool,
+}
+
+impl ViewSet {
+    fn parse(app: &PhotocraftApp, p: &Value) -> std::result::Result<Self, String> {
+        let zoom = f32_field(p, "zoom")?;
+        let rotation = f32_field(p, "rotation")?;
+        if rotation.is_some() && app.session.active_index().is_none() {
+            return Err("no document open".into());
+        }
+        let center = center_param(p)?;
+        let fit = bool_field(p, "fit")? == Some(true);
+        Ok(Self { zoom, rotation, center, fit })
+    }
+
+    fn apply(&self, app: &mut PhotocraftApp) {
+        let Some(i) = app.session.active_index() else { return };
+        if self.zoom.is_some() || self.center.is_some() || self.rotation.is_some() || self.fit {
+            app.ui.views[i].zoom_animating = false;
+            app.ui.views[i].zoom_anchor = None;
+        }
+        if let Some(z) = self.zoom {
+            let size = app.session.documents().get(i).map_or([0, 0], |st| [st.doc.size.width, st.doc.size.height]);
+            app.ui.views[i].zoom = crate::zoom_levels::clamp(z as f32, size);
+            app.ui.views[i].fit_pending = false;
+            app.ui.views[i].fill_pending = false;
+        }
+        if let Some(c) = self.center {
+            app.ui.views[i].center = c;
+            app.ui.views[i].fit_pending = false;
+            app.ui.views[i].fill_pending = false;
+        }
+        if self.fit {
+            app.ui.views[i].fit_pending = true;
+            app.ui.views[i].fill_pending = false;
+        }
+        if let Some(r) = self.rotation {
+            app.ui.views[i].rotation = crate::rotate_view::wrap_deg(r as f32);
+        }
+    }
+}
+
+fn center_param(p: &Value) -> std::result::Result<Option<[f32; 2]>, String> {
+    let Some(v) = p.get("center") else { return Ok(None) };
+    let a = v.as_array().ok_or_else(|| "center must be [x, y]".to_string())?;
+    if a.len() != 2 {
+        return Err("center must be exactly [x, y]".into());
+    }
+    let (Some(x), Some(y)) = (a.first().and_then(Value::as_f64), a.get(1).and_then(Value::as_f64)) else {
+        return Err("center must be [x, y] of two numbers".into());
+    };
+    if !f32_range(&x) || !f32_range(&y) {
+        return Err("center must be finite numbers within f32 range".into());
+    }
+    Ok(Some([x as f32, y as f32]))
+}
+
+// -- brushes: sections, picker, size --
+
+struct BrushSet {
+    section: Option<u64>,
+    tab: Option<u64>,
+    brushes_view: Option<crate::brush_panel::BrushesView>,
+    picker_name: Option<bool>,
+    picker_stroke: Option<bool>,
+    picker_tip: Option<bool>,
+    picker_scale: Option<f32>,
+    picker: Option<Option<[f32; 2]>>,
+    size: Option<f64>,
+}
+
+impl BrushSet {
+    fn parse(app: &PhotocraftApp, p: &Value) -> std::result::Result<Self, String> {
+        let section = uint_field(p, "brushSection")?;
+        let tab = uint_field(p, "brushTab")?;
+        let brushes_view = brushes_view_param(p)?;
+        // The three parts of the picker's cards. At least one stays on (a rejected call
+        // leaves them all alone).
+        let picker_name = bool_field(p, "brushPickerName")?;
+        let picker_stroke = bool_field(p, "brushPickerStroke")?;
+        let picker_tip = bool_field(p, "brushPickerTip")?;
+        check_picker_parts(app, [picker_name, picker_stroke, picker_tip])?;
+        Ok(Self {
+            section,
+            tab,
+            brushes_view,
+            picker_name,
+            picker_stroke,
+            picker_tip,
+            picker_scale: picker_scale_param(p)?,
+            picker: picker_param(p)?,
+            size: brush_size_param(p)?,
+        })
+    }
+
+    fn apply(&self, app: &mut PhotocraftApp) -> std::result::Result<(), String> {
+        if let Some(i) = self.section {
+            app.ui.brush_section = (i as usize).min(crate::brush_panel::SECTIONS.len() - 1);
+        }
+        if let Some(i) = self.tab {
+            app.ui.brush_tab = (i as usize).min(1);
+        }
+        if let Some(v) = self.brushes_view {
+            app.ui.brushes_panel.view = v;
+        }
+        self.apply_picker(app);
+        if let Some(size) = self.size {
+            app.run("tools.setBrush", json!({"brush": {"size": size}})).map_err(|e| e.to_string())?;
+        }
+        Ok(())
+    }
+
+    fn apply_picker(&self, app: &mut PhotocraftApp) {
+        let list = &mut app.ui.brush_picker_list;
+        if let Some(v) = self.picker_name {
+            list.show_name = v;
+        }
+        if let Some(v) = self.picker_stroke {
+            list.show_stroke = v;
+        }
+        if let Some(v) = self.picker_tip {
+            list.show_tip = v;
+        }
+        if let Some(v) = self.picker_scale {
+            list.scale = v;
+        }
+        if let Some(at) = self.picker {
+            app.ui.brush_picker = at;
+        }
+    }
+}
+
+fn brushes_view_param(p: &Value) -> std::result::Result<Option<crate::brush_panel::BrushesView>, String> {
+    let Some(v) = p.get("brushesView") else { return Ok(None) };
+    serde_json::from_value(v.clone()).map(Some).map_err(|e| format!("brushesView: {e} (list, grid)"))
+}
+
+fn check_picker_parts(app: &PhotocraftApp, parts: [Option<bool>; 3]) -> std::result::Result<(), String> {
+    if parts.iter().all(Option::is_none) {
+        return Ok(());
+    }
+    let list = &app.ui.brush_picker_list;
+    let on = [parts[0].unwrap_or(list.show_name), parts[1].unwrap_or(list.show_stroke), parts[2].unwrap_or(list.show_tip)];
+    if on.iter().any(|b| *b) { Ok(()) } else { Err("brushPickerName, brushPickerStroke and brushPickerTip: at least one must stay on".into()) }
+}
+
+/// The picker footer slider: the preset cards' size scale (1 standard; 0.30 and
+/// below the tips drop their size numbers).
+fn picker_scale_param(p: &Value) -> std::result::Result<Option<f32>, String> {
+    match num_field(p, "brushPickerScale")? {
+        Some(s) if !(0.15..=2.0).contains(&s) => Err("brushPickerScale must be between 0.15 and 2".into()),
+        Some(s) => Ok(Some(s as f32)),
+        None => Ok(None),
+    }
+}
+
+/// `Some(None)` is an explicit null, which closes the picker (a missing field leaves it alone).
+fn picker_param(p: &Value) -> std::result::Result<Option<Option<[f32; 2]>>, String> {
+    let Some(v) = p.get("brushPicker") else { return Ok(None) };
+    let at =
+        serde_json::from_value::<Option<[f32; 2]>>(v.clone()).map_err(|_| "brushPicker must be [x, y] in screen points, or null to close it".to_string())?;
+    if at.is_some_and(|[x, y]| !x.is_finite() || !y.is_finite()) {
+        return Err("brushPicker must be [x, y] in screen points, or null to close it".into());
+    }
+    Ok(Some(at))
+}
+
+/// brushSize rides the journaled `tools.setBrush` command (#744). Numeric values
+/// are validated here so the command cannot fail after other fields were
+/// applied; non-numeric values keep the API's historical silent no-op.
+fn brush_size_param(p: &Value) -> std::result::Result<Option<f64>, String> {
+    let Some(size) = p.get("brushSize").and_then(Value::as_f64) else { return Ok(None) };
+    if !size.is_finite() || size > f64::from(photocraft_paint::MAX_BRUSH_SIZE) {
+        return Err(format!("brushSize must be finite and at most {} px", photocraft_paint::MAX_BRUSH_SIZE));
+    }
+    Ok(Some(size))
+}
+
+// ---- dialogs ----
+
+fn dialog_methods(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest) -> Option<Outcome> {
+    let p = &req.params;
+    let s = |k: &str| str_param(p, k);
+    let u = |k: &str| u64_param(p, k);
+    Some(match req.method.as_str() {
+        "ui.dialog.open" => dialog_open(app, p),
         // The shell's own dialog (Window › Workspace, View › Pixel Aspect Ratio › Custom, Show
         // Extras Options, 32-bit Preview Options), listed by ui.inspect with the id "shell".
-        "ui.dialog.set" if s("dialog") == Some(SHELL_DIALOG) => {
-            let Some(field) = s("field") else { return err("need `dialog` and `field`") };
-            let value = p.get("value").cloned().unwrap_or(Value::Null);
-            match app.ui.shell.dialog.as_mut() {
-                Some((_, fields)) => {
-                    fields.insert(field.to_string(), value);
-                    ok(Value::Null)
-                }
-                None => err("no shell dialog is open"),
-            }
-        }
-        "ui.dialog.confirm" if s("dialog") == Some(SHELL_DIALOG) => {
-            let Some((kind, fields)) = app.ui.shell.dialog.clone() else { return err("no shell dialog is open") };
-            if let Some((command, params)) = crate::workspace_ui::dialog_command(&kind, &fields)
-                && let Some(authorize) = app.services.automation_command.as_ref()
-                && let Err(error) = authorize(command, &params)
-            {
-                return err(error);
-            }
-            wrap(crate::workspace_ui::confirm(app, ctx))
-        }
+        "ui.dialog.set" if s("dialog") == Some(SHELL_DIALOG) => shell_dialog_set(app, p),
+        "ui.dialog.confirm" if s("dialog") == Some(SHELL_DIALOG) => shell_dialog_confirm(app, ctx),
         "ui.dialog.apply" if s("dialog") == Some(SHELL_DIALOG) => err("`ui.dialog.apply` is for Preferences; use `ui.dialog.confirm`"),
         // The unsaved-changes prompt (closing, Revert, quitting), listed by ui.inspect with the
         // id "discard" (#4920): confirm takes a `choice` (save, dontSave, cancel; default save).
-        "ui.dialog.confirm" if s("dialog") == Some(crate::discard_ui::CONTROL_ID) => {
-            let choice = s("choice").unwrap_or("save");
-            if choice != "cancel"
-                && let Some((command, params)) = crate::discard_ui::pending_command(app)
-                && let Some(authorize) = app.services.automation_command.as_ref()
-                && let Err(error) = authorize(&command, &params)
-            {
-                return err(error);
-            }
-            wrap(crate::discard_ui::answer_control(app, ctx, choice))
-        }
+        "ui.dialog.confirm" if s("dialog") == Some(crate::discard_ui::CONTROL_ID) => discard_dialog_confirm(app, ctx, s("choice").unwrap_or("save")),
         "ui.dialog.cancel" if s("dialog") == Some(crate::discard_ui::CONTROL_ID) => wrap(crate::discard_ui::answer_control(app, ctx, "cancel")),
         "ui.dialog.set" | "ui.dialog.apply" if s("dialog") == Some(crate::discard_ui::CONTROL_ID) => {
             err("the unsaved-changes prompt has no fields; use `ui.dialog.confirm` with a `choice`")
@@ -612,42 +832,9 @@ pub(super) fn dispatch(app: &mut PhotocraftApp, ctx: &egui::Context, req: &Contr
             Some(_) => ok(Value::Null),
             None => err("no such dialog"),
         },
-        "ui.dialog.set" => {
-            let (Some(id), Some(field)) = (u("dialog"), s("field")) else { return err("need `dialog` and `field`") };
-            let value = p.get("value").cloned().unwrap_or(Value::Null);
-            match app.ui.dialog_mut(id) {
-                // A continuation belongs to the dialog that paused it, even when another
-                // action has a valid token. Replacing it would resume or cancel that action.
-                Some(_) if field == crate::actions::RESUME => err("the paused action token is read-only"),
-                // A marker picks the handler OK runs: a dialog keeps the ones it was opened with.
-                Some(d) if !d.fields.contains_key(field) && crate::dialogs::is_route_marker(field) => {
-                    err(format!("`{field}` is set only by the dialog it belongs to"))
-                }
-                Some(d) => {
-                    d.fields.insert(field.to_string(), value);
-                    ok(Value::Null)
-                }
-                None => err(format!("no dialog {id}")),
-            }
-        }
+        "ui.dialog.set" => dialog_set(app, p),
         "ui.dialog.confirm" | "ui.dialog.apply" => match u("dialog") {
-            Some(id) => {
-                let command = app.ui.dialogs.iter().find(|dialog| dialog.id == id).and_then(|dialog| {
-                    if req.method == "ui.dialog.apply" {
-                        dialog.fields.get("values").map(|values| ("prefs.set".to_string(), json!({"path": "", "value": values})))
-                    } else {
-                        dialog.fields.get("__command").and_then(Value::as_str).map(|command| (command.to_string(), Value::Object(dialog.fields.clone())))
-                    }
-                });
-                if let Some((command, params)) = command
-                    && let Some(authorize) = app.services.automation_command.as_ref()
-                    && let Err(error) = authorize(&command, &params)
-                {
-                    return err(error);
-                }
-                let apply = req.method == "ui.dialog.apply";
-                run_waiting(app, wait, |app| if apply { crate::prefs_ui::apply(app, id) } else { crate::dialogs::confirm(app, id) })
-            }
+            Some(id) => dialog_confirm_or_apply(app, req, id),
             None => err("missing `dialog`"),
         },
         "ui.dialog.cancel" => match u("dialog") {
@@ -657,341 +844,477 @@ pub(super) fn dispatch(app: &mut PhotocraftApp, ctx: &egui::Context, req: &Contr
             },
             None => err("missing `dialog`"),
         },
-        "ui.window.open" => {
-            if let Some(d) = u("document")
-                && !app.session.set_active(d as usize)
-            {
-                return err(format!("no document {d}"));
-            }
-            wrap(crate::menus::invoke(app, ctx, "window.newWindowForDocument", json!({})))
+        _ => return None,
+    })
+}
+
+fn dialog_open(app: &mut PhotocraftApp, p: &Value) -> Outcome {
+    let kind = match str_param(p, "kind").unwrap_or("") {
+        "newDocument" | "NewDocument" => DialogKind::NewDocument,
+        "about" | "About" => DialogKind::About,
+        "colorPicker" | "ColorPicker" => return color_picker_dialog(app, p),
+        other => return open_named_dialog(app, p, other),
+    };
+    let mut fields = if kind == DialogKind::NewDocument { app.new_document_fields() } else { Default::default() };
+    if let Some(f) = p.get("fields").and_then(Value::as_object) {
+        if let Some(marker) = f.keys().find(|k| crate::dialogs::is_route_marker(k)) {
+            return err(format!("`{marker}` is set only by the dialog it belongs to"));
         }
-        "ui.window.close" => {
-            let Some(id) = u("window") else { return err("missing `window`") };
-            let before = app.ui.windows.len();
-            app.ui.windows.retain(|w| w.id != id);
-            if app.ui.windows.len() < before { ok(Value::Null) } else { err(format!("no window {id}")) }
+        fields.extend(f.clone());
+    }
+    ok(json!({"dialog": app.ui.open_dialog(kind, fields)}))
+}
+
+/// The dialog kinds that open through their own module rather than `open_dialog`.
+fn open_named_dialog(app: &mut PhotocraftApp, p: &Value, kind: &str) -> Outcome {
+    let opened = |id: Option<u64>, missing: &str| match id {
+        Some(id) => ok(json!({"dialog": id})),
+        None => err(missing),
+    };
+    match kind {
+        "layerStyle" | "LayerStyle" => opened(crate::layer_style::open(app, str_param(p, "effect")), "no active layer"),
+        // The Crop tool's New / Delete Crop Preset… (#1919).
+        "newCropPreset" => opened(crate::crop_presets::open_new(app), "nothing to save: set W and H (W x H x Resolution) or a ratio first"),
+        "deleteCropPreset" => opened(crate::crop_presets::open_delete(app), "no crop presets are saved"),
+        "command" | "Command" => {
+            let Some(cmd) = str_param(p, "command") else { return err("command dialogs need `command`") };
+            let label = photocraft_engine::commands::find(cmd).map(|c| c.label).unwrap_or(cmd);
+            ok(json!({"dialog": crate::dialogs::open_command_dialog(app, cmd, label)}))
         }
-        "ui.pointer" => {
-            // Every field and event is validated before the first event runs, so a rejected call
-            // changes nothing (#2449).
-            let parsed = (|| -> std::result::Result<_, String> {
-                let fields = ["events", "tool", "modifiers", "button", "shift", "alt", "command", "ctrl", "space"];
-                let p = input_object(p, None, &fields)?;
-                let tool = match input_choice(&p, "tool", "tool", &[])? {
-                    Some(t) => Some(Tool::from_name(t).ok_or_else(|| format!("unknown tool `{t}`"))?),
-                    None => None,
-                };
-                let button = input_choice(&p, "button", "button", &BUTTONS)?.unwrap_or("left").to_string();
-                // Modifier flags may be top-level or grouped under "modifiers".
-                let m = input_modifiers(&p, &POINTER_MODIFIERS)?;
-                let Some(events) = p.get("events") else { return Err("missing `events`".into()) };
-                let Some(events) = events.as_array() else { return Err("events must be an array".into()) };
-                let mut parsed = Vec::with_capacity(events.len());
-                for (i, e) in events.iter().enumerate() {
-                    let name = format!("events[{i}]");
-                    let e = input_object(e, Some(&name), &["kind", "x", "y", "pressure", "tiltX", "tiltY", "rotation"])?;
-                    let num = |k: &str, range| input_number(&e, k, &format!("{name}.{k}"), range);
-                    let (x, y) = (num("x", None)?.unwrap_or(0.0), num("y", None)?.unwrap_or(0.0));
-                    let pr = num("pressure", Some((0.0, 1.0)))?.unwrap_or(1.0) as f32;
-                    let ev = match input_choice(&e, "kind", &format!("{name}.kind"), &["down", "move", "up"])?.unwrap_or("move") {
-                        "down" => ToolEvent::Down { x, y, pressure: pr },
-                        "up" => ToolEvent::Up { x, y },
-                        _ => ToolEvent::Move { x, y, pressure: pr },
-                    };
-                    let tilt = |k: &str, range| num(k, Some(range)).map(|v| v.map(|v| v as f32));
-                    let pen = (tilt("tiltX", (-90.0, 90.0))?, tilt("tiltY", (-90.0, 90.0))?, tilt("rotation", (0.0, 360.0))?);
-                    parsed.push((ev, x, y, pr, pen));
-                }
-                Ok((tool, button, m, parsed))
-            })();
-            let (tool, button, m, events) = match parsed {
-                Ok(parsed) => parsed,
-                Err(e) => return err(e),
-            };
-            let secondary = matches!(button.as_str(), "secondary" | "right");
-            let mods = modifiers_from(&m);
-            if let Some(t) = tool {
-                crate::tool_memory::select(app, t);
-            }
-            // Space held: the Crop tool moves the frame being drawn, a marquee, lasso or shape
-            // being drawn moves instead of growing (hold_keys.rs). Like a modifier flag, it may be
-            // top-level or grouped under "modifiers".
-            let space = p.get("modifiers").unwrap_or(p).get("space").and_then(Value::as_bool).unwrap_or(false);
-            crate::crop_ui::set_space(app, space);
-            for (ev, x, y, pr, pen) in events {
-                // With the Color Picker on top the image is its eyedropper, as for the mouse.
-                if crate::color_picker_ui::top(app).is_some() {
-                    if !matches!(ev, ToolEvent::Up { .. }) {
-                        crate::color_picker_ui::sample_at(app, x, y);
-                    }
-                    continue;
-                }
-                // Curves' modal eyedroppers use document coordinates here, matching the native
-                // canvas path after its ViewXform conversion. Sample on press only.
-                if !secondary && crate::adjust_dialog::picker_armed(app) {
-                    if matches!(ev, ToolEvent::Down { .. }) {
-                        crate::adjust_dialog::sample_at(app, x, y);
-                    }
-                    continue;
-                }
-                // ⌘/Ctrl-click with Curves open adds a point at the pixel's tone, on press only (#7325).
-                if !secondary && !space && button != "middle" && mods.command && crate::adjust_dialog::curves_on_top(app) {
-                    if matches!(ev, ToolEvent::Down { .. }) {
-                        crate::adjust_dialog::add_point_at(app, ctx, x, y, mods.shift);
-                    }
-                    continue;
-                }
-                // A Properties Levels/Curves eyedropper owns the primary button the same way.
-                if app.ui.dialogs.is_empty() && !matches!(s("button"), Some("secondary" | "right")) && crate::layer_picker::armed(app).is_some() {
-                    if matches!(ev, ToolEvent::Down { .. }) {
-                        crate::layer_picker::sample_at(app, x, y);
-                    }
-                    continue;
-                }
-                // The dialog owns all pointer events, including Up: no underlying brush stroke
-                // or context menu may leak through while inspecting a Color Range preview.
-                if app.ui.dialogs.last().is_some_and(|d| crate::color_range_ui::owns(&d.fields)) {
-                    let down = matches!(ev, ToolEvent::Down { .. });
-                    let up = matches!(ev, ToolEvent::Up { .. });
-                    let held = app.ui.dialogs.last().and_then(|d| d.fields.get("__pointerDown")).and_then(Value::as_bool).unwrap_or(false);
-                    if let Some(d) = app.ui.dialogs.last_mut() {
-                        d.fields.insert("__pointerDown".into(), json!(!up && (down || held)));
-                    }
-                    if !up && (down || held) && !space && !secondary && button != "middle" {
-                        crate::color_range_ui::pick_top(app, [x, y], mods);
-                    }
-                    continue;
-                }
-                if secondary {
-                    let down = matches!(ev, ToolEvent::Down { .. });
-                    // Right-click while transforming: the box's menu, as on the canvas.
-                    if app.ui.transform.as_ref().is_some_and(|t| t.warp.is_none()) {
-                        if down {
-                            crate::canvas_tool_menu::open_transform(app, ctx, screen_point(app, x, y));
-                        }
-                        continue;
-                    }
-                    // Right-click with the Move tool, or ⌘/Ctrl+right-click: list the layers there.
-                    if crate::layer_pick_ui::is_gesture(app.ui.tool, mods) {
-                        if down {
-                            app.ui.canvas_tool_menu = None;
-                            crate::layer_pick_ui::open(app, ctx, screen_point(app, x, y), x, y);
-                        }
-                        continue;
-                    }
-                    // No menu over the agent's own crop frame or Straighten line still being
-                    // dragged, also the first one on the default frame (nothing pending yet).
-                    if app.ui.tool == crate::state::Tool::Crop && (app.crop.drag.is_some() || app.crop.straighten.line.is_some()) {
-                        continue;
-                    }
-                    if app.ui.tool == crate::state::Tool::Crop && crate::crop_ui::pending(app) {
-                        if down {
-                            crate::canvas_tool_menu::open_crop(app, ctx, app.ui.tool, screen_point(app, x, y));
-                        }
-                        continue;
-                    }
-                    if crate::canvas_tool_menu::pasteboard_at(app, app.ui.tool, [x, y]) {
-                        if down {
-                            crate::canvas_tool_menu::open_pasteboard(app, ctx, app.ui.tool, screen_point(app, x, y));
-                        }
-                        continue;
-                    }
-                    if crate::canvas_tool_menu::is_view_tool(app.ui.tool) {
-                        if down {
-                            crate::canvas_tool_menu::open_view(app, ctx, app.ui.tool, screen_point(app, x, y), [x, y]);
-                        }
-                        continue;
-                    }
-                    if crate::canvas_tool_menu::applies(app.ui.tool)
-                        || crate::canvas_tool_menu::editing_text(app, app.ui.tool)
-                        || crate::canvas_tool_menu::type_layer_at(app, app.ui.tool, [x, y]).is_some()
-                    {
-                        if down {
-                            crate::canvas_tool_menu::open_at(app, ctx, app.ui.tool, screen_point(app, x, y), Some([x, y]));
-                        }
-                        continue;
-                    }
-                    if !crate::paint_mouse::pointer_secondary(app, ctx, down, mods, screen_point(app, x, y)) {
-                        continue;
-                    }
-                }
-                // A simulated pen: tilt/rotation reach the stroke like a real stylus's (see `stylus`).
-                if pen != (None, None, None) {
-                    let (tilt_x, tilt_y, rotation) = (pen.0.unwrap_or(0.0), pen.1.unwrap_or(0.0), pen.2.unwrap_or(0.0));
-                    app.stylus.feed.set(Some(crate::stylus::PenSample { pressure: pr, tilt_x, tilt_y, rotation, eraser: false }));
-                }
-                if let Some(d) = app.drag.as_mut().filter(|d| crate::hold_keys::repositions(d.tool)) {
-                    d.reposition = space;
-                }
-                // A Crop drag in the default mode turns and pans the view with the image: its
-                // points are read as the view showed them at the press (`crop_mode`).
-                let ev = match ev {
-                    ToolEvent::Move { x, y, pressure } => {
-                        let [x, y] = crate::crop_mode::control_point(app, [x, y]);
-                        ToolEvent::Move { x, y, pressure }
-                    }
-                    ToolEvent::Up { x, y } => {
-                        let [x, y] = crate::crop_mode::control_point(app, [x, y]);
-                        ToolEvent::Up { x, y }
-                    }
-                    down => down,
-                };
-                tool_event(app, ev, mods);
-            }
-            app.stylus.feed.set(None);
-            ok(json!({"status": app.ui.status}))
+        other => err(format!("unknown dialog kind `{other}`")),
+    }
+}
+
+fn color_picker_dialog(app: &mut PhotocraftApp, p: &Value) -> Outcome {
+    if let Some(style) = p.get("textStyle") {
+        return text_style_color_picker(app, p, style);
+    }
+    if p.get("parent").is_some() {
+        let (Some(parent), Some(effect), Some(field)) = (u64_param(p, "parent"), str_param(p, "effect"), str_param(p, "field")) else {
+            return err("need integer `parent` and string `effect` and `field`");
+        };
+        return match crate::layer_style::color_picker::open(app, parent, effect, field) {
+            Ok(id) => ok(json!({"dialog": id})),
+            Err(error) => err(error),
+        };
+    }
+    if p.get("effect").is_some() || p.get("field").is_some() {
+        return err("Layer Style color pickers need `parent`");
+    }
+    let target = if str_param(p, "target") == Some("background") { "background" } else { "foreground" };
+    ok(json!({"dialog": crate::color_picker_ui::open(app, target)}))
+}
+
+fn text_style_color_picker(app: &mut PhotocraftApp, p: &Value, style: &Value) -> Outcome {
+    if ["parent", "effect", "field", "target"].iter().any(|key| p.get(*key).is_some()) {
+        return err("textStyle cannot be combined with another picker target");
+    }
+    let Some(style) = style.as_object().filter(|s| s.keys().all(|k| k == "kind" || k == "id")) else {
+        return err("textStyle needs kind and id only");
+    };
+    let Some(kind) = style.get("kind").cloned().and_then(|v| serde_json::from_value::<crate::type_panels_ui::color_picker::Kind>(v).ok()) else {
+        return err("textStyle kind must be character or paragraph");
+    };
+    let Some(id) = style.get("id").and_then(Value::as_u64).and_then(|id| u32::try_from(id).ok()) else {
+        return err("textStyle id must be a u32 integer");
+    };
+    match crate::type_panels_ui::color_picker::open(app, kind, id) {
+        Ok(id) => ok(json!({"dialog": id})),
+        Err(error) => err(error),
+    }
+}
+
+fn shell_dialog_set(app: &mut PhotocraftApp, p: &Value) -> Outcome {
+    let Some(field) = str_param(p, "field") else { return err("need `dialog` and `field`") };
+    let value = p.get("value").cloned().unwrap_or(Value::Null);
+    match app.ui.shell.dialog.as_mut() {
+        Some((_, fields)) => {
+            fields.insert(field.to_string(), value);
+            ok(Value::Null)
         }
-        "ui.click" | "ui.move" => {
-            let click = req.method == "ui.click";
-            let fields: &[&str] = if click { &["x", "y", "button", "count"] } else { &["x", "y"] };
-            let parsed = (|| -> std::result::Result<_, String> {
-                let p = input_object(p, None, fields)?;
-                // Screen coordinates in points (as reported by ui.inspect window size).
-                let x = input_number(&p, "x", "x", None)?.unwrap_or(0.0) as f32;
-                let y = input_number(&p, "y", "y", None)?.unwrap_or(0.0) as f32;
-                let button = match input_choice(&p, "button", "button", &BUTTONS)?.unwrap_or("left") {
-                    "right" | "secondary" => egui::PointerButton::Secondary,
-                    "middle" => egui::PointerButton::Middle,
-                    _ => egui::PointerButton::Primary,
-                };
-                let clicks = if click { uint_field(&p, "count")?.unwrap_or(1) } else { 0 };
-                if clicks > MAX_CLICKS {
-                    return Err(format!("`count` must be at most {MAX_CLICKS} (got {clicks})"));
-                }
-                Ok((egui::pos2(x, y), button, clicks))
-            })();
-            let (pos, button, clicks) = match parsed {
-                Ok(parsed) => parsed,
-                Err(e) => return err(e),
-            };
-            app.synthetic.push(egui::Event::PointerMoved(pos));
-            for _ in 0..clicks {
-                app.synthetic.push(egui::Event::PointerButton { pos, button, pressed: true, modifiers: Default::default() });
-                app.synthetic.push(egui::Event::PointerButton { pos, button, pressed: false, modifiers: Default::default() });
-            }
-            ctx.request_repaint();
-            Outcome::AfterInput
+        None => err("no shell dialog is open"),
+    }
+}
+
+fn shell_dialog_confirm(app: &mut PhotocraftApp, ctx: &egui::Context) -> Outcome {
+    let Some((kind, fields)) = app.ui.shell.dialog.clone() else { return err("no shell dialog is open") };
+    if let Some((command, params)) = crate::workspace_ui::dialog_command(&kind, &fields)
+        && let Some(authorize) = app.services.automation_command.as_ref()
+        && let Err(error) = authorize(command, &params)
+    {
+        return err(error);
+    }
+    wrap(crate::workspace_ui::confirm(app, ctx))
+}
+
+fn discard_dialog_confirm(app: &mut PhotocraftApp, ctx: &egui::Context, choice: &str) -> Outcome {
+    if choice != "cancel"
+        && let Some((command, params)) = crate::discard_ui::pending_command(app)
+        && let Some(authorize) = app.services.automation_command.as_ref()
+        && let Err(error) = authorize(&command, &params)
+    {
+        return err(error);
+    }
+    wrap(crate::discard_ui::answer_control(app, ctx, choice))
+}
+
+fn dialog_set(app: &mut PhotocraftApp, p: &Value) -> Outcome {
+    let (Some(id), Some(field)) = (u64_param(p, "dialog"), str_param(p, "field")) else { return err("need `dialog` and `field`") };
+    let value = p.get("value").cloned().unwrap_or(Value::Null);
+    match app.ui.dialog_mut(id) {
+        // A continuation belongs to the dialog that paused it, even when another
+        // action has a valid token. Replacing it would resume or cancel that action.
+        Some(_) if field == crate::actions::RESUME => err("the paused action token is read-only"),
+        // A marker picks the handler OK runs: a dialog keeps the ones it was opened with.
+        Some(d) if !d.fields.contains_key(field) && crate::dialogs::is_route_marker(field) => err(format!("`{field}` is set only by the dialog it belongs to")),
+        Some(d) => {
+            d.fields.insert(field.to_string(), value);
+            ok(Value::Null)
         }
-        "ui.key" => {
-            let parsed = (|| -> std::result::Result<_, String> {
-                let p = input_object(p, None, &["key", "modifiers", "shift", "alt", "command", "ctrl"])?;
-                let Some(name) = input_choice(&p, "key", "key", &[])? else { return Err("missing `key`".into()) };
-                let key = egui::Key::from_name(name).ok_or_else(|| format!("unknown key `{name}`"))?;
-                // Modifier flags may be top-level or grouped under "modifiers".
-                Ok((key, input_modifiers(&p, &KEY_MODIFIERS)?))
-            })();
-            let (key, m) = match parsed {
-                Ok(parsed) => parsed,
-                Err(e) => return err(e),
-            };
-            let modifiers = modifiers_from(&m);
-            app.synthetic.push(egui::Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers });
-            app.synthetic.push(egui::Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers });
-            ctx.request_repaint();
-            Outcome::AfterInput
+        None => err(format!("no dialog {id}")),
+    }
+}
+
+fn dialog_confirm_or_apply(app: &mut PhotocraftApp, req: &ControlRequest, id: u64) -> Outcome {
+    let apply = req.method == "ui.dialog.apply";
+    let command = app.ui.dialogs.iter().find(|dialog| dialog.id == id).and_then(|dialog| {
+        if apply {
+            dialog.fields.get("values").map(|values| ("prefs.set".to_string(), json!({"path": "", "value": values})))
+        } else {
+            dialog.fields.get("__command").and_then(Value::as_str).map(|command| (command.to_string(), Value::Object(dialog.fields.clone())))
         }
+    });
+    if let Some((command, params)) = command
+        && let Some(authorize) = app.services.automation_command.as_ref()
+        && let Err(error) = authorize(&command, &params)
+    {
+        return err(error);
+    }
+    run_waiting(app, wait_param(&req.params), |app| if apply { crate::prefs_ui::apply(app, id) } else { crate::dialogs::confirm(app, id) })
+}
+
+// ---- synthetic input: pointer events, clicks, keys, text ----
+
+fn input_methods(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest) -> Option<Outcome> {
+    let p = &req.params;
+    Some(match req.method.as_str() {
+        "ui.pointer" => pointer(app, ctx, p),
+        "ui.click" | "ui.move" => click(app, ctx, p, req.method == "ui.click"),
+        "ui.key" => key(app, ctx, p),
         "ui.type" => {
-            let Some(text) = s("text") else { return err("missing `text`") };
+            let Some(text) = str_param(p, "text") else { return Some(err("missing `text`")) };
             app.synthetic.push(egui::Event::Text(text.to_string()));
             ctx.request_repaint();
             Outcome::AfterInput
         }
-        "ui.resize" => {
-            let (w, h) = (p.get("width").and_then(Value::as_f64).unwrap_or(1280.0), p.get("height").and_then(Value::as_f64).unwrap_or(800.0));
-            ctx.send_viewport_cmd(egui::ViewportCommand::InnerSize(egui::vec2(w as f32, h as f32)));
-            ok(Value::Null)
+        _ => return None,
+    })
+}
+
+fn click(app: &mut PhotocraftApp, ctx: &egui::Context, p: &Value, click: bool) -> Outcome {
+    let fields: &[&str] = if click { &["x", "y", "button", "count"] } else { &["x", "y"] };
+    let parsed = (|| -> std::result::Result<_, String> {
+        let p = input_object(p, None, fields)?;
+        // Screen coordinates in points (as reported by ui.inspect window size).
+        let x = input_number(&p, "x", "x", None)?.unwrap_or(0.0) as f32;
+        let y = input_number(&p, "y", "y", None)?.unwrap_or(0.0) as f32;
+        let button = match input_choice(&p, "button", "button", &BUTTONS)?.unwrap_or("left") {
+            "right" | "secondary" => egui::PointerButton::Secondary,
+            "middle" => egui::PointerButton::Middle,
+            _ => egui::PointerButton::Primary,
+        };
+        let clicks = if click { uint_field(&p, "count")?.unwrap_or(1) } else { 0 };
+        if clicks > MAX_CLICKS {
+            return Err(format!("`count` must be at most {MAX_CLICKS} (got {clicks})"));
         }
-        "ui.gpu.simulateLoss" => {
-            if p.get("destroy").and_then(Value::as_bool).unwrap_or(false) {
-                let destroyed = app.destroy_window_device();
-                ctx.request_repaint();
-                return ok(json!({"destroyed": destroyed}));
-            }
-            let error = p.get("error").and_then(Value::as_bool).unwrap_or(false);
-            let fault = if error {
-                photocraft_gpu::Fault::Error("simulated error (ui.gpu.simulateLoss)".into())
-            } else {
-                photocraft_gpu::Fault::Lost("simulated (ui.gpu.simulateLoss)".into())
-            };
-            let active = match app.gpu_health() {
-                Some(h) => {
-                    h.mark(fault);
-                    true
-                }
-                None => false,
-            };
-            app.check_gpu(ctx);
-            ctx.request_repaint();
-            ok(json!({"wasActive": active, "gpuInfo": app.perf.gpu_info}))
+        Ok((egui::pos2(x, y), button, clicks))
+    })();
+    let (pos, button, clicks) = match parsed {
+        Ok(parsed) => parsed,
+        Err(e) => return err(e),
+    };
+    app.synthetic.push(egui::Event::PointerMoved(pos));
+    for _ in 0..clicks {
+        app.synthetic.push(egui::Event::PointerButton { pos, button, pressed: true, modifiers: Default::default() });
+        app.synthetic.push(egui::Event::PointerButton { pos, button, pressed: false, modifiers: Default::default() });
+    }
+    ctx.request_repaint();
+    Outcome::AfterInput
+}
+
+fn key(app: &mut PhotocraftApp, ctx: &egui::Context, p: &Value) -> Outcome {
+    let parsed = (|| -> std::result::Result<_, String> {
+        let p = input_object(p, None, &["key", "modifiers", "shift", "alt", "command", "ctrl"])?;
+        let Some(name) = input_choice(&p, "key", "key", &[])? else { return Err("missing `key`".into()) };
+        let key = egui::Key::from_name(name).ok_or_else(|| format!("unknown key `{name}`"))?;
+        // Modifier flags may be top-level or grouped under "modifiers".
+        Ok((key, input_modifiers(&p, &KEY_MODIFIERS)?))
+    })();
+    let (key, m) = match parsed {
+        Ok(parsed) => parsed,
+        Err(e) => return err(e),
+    };
+    let modifiers = modifiers_from(&m);
+    app.synthetic.push(egui::Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers });
+    app.synthetic.push(egui::Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers });
+    ctx.request_repaint();
+    Outcome::AfterInput
+}
+
+/// Simulated pen tilt/rotation of one `ui.pointer` event.
+type Pen = (Option<f32>, Option<f32>, Option<f32>);
+
+/// One validated `ui.pointer` event.
+struct PointerSample {
+    ev: ToolEvent,
+    x: f64,
+    y: f64,
+    pressure: f32,
+    pen: Pen,
+}
+
+struct ParsedPointer {
+    tool: Option<Tool>,
+    button: String,
+    modifiers: Value,
+    events: Vec<PointerSample>,
+}
+
+/// The gesture shared by every event of one `ui.pointer` call.
+struct PointerGesture {
+    secondary: bool,
+    middle: bool,
+    space: bool,
+    mods: egui::Modifiers,
+}
+
+fn pointer(app: &mut PhotocraftApp, ctx: &egui::Context, p: &Value) -> Outcome {
+    // Every field and event is validated before the first event runs, so a rejected call
+    // changes nothing (#2449).
+    let parsed = match parse_pointer(p) {
+        Ok(parsed) => parsed,
+        Err(e) => return err(e),
+    };
+    if let Some(t) = parsed.tool {
+        crate::tool_memory::select(app, t);
+    }
+    // Space held: the Crop tool moves the frame being drawn, a marquee, lasso or shape
+    // being drawn moves instead of growing (hold_keys.rs). Like a modifier flag, it may be
+    // top-level or grouped under "modifiers".
+    let space = p.get("modifiers").unwrap_or(p).get("space").and_then(Value::as_bool).unwrap_or(false);
+    crate::crop_ui::set_space(app, space);
+    let gesture = PointerGesture {
+        secondary: matches!(parsed.button.as_str(), "secondary" | "right"),
+        middle: parsed.button == "middle",
+        space,
+        mods: modifiers_from(&parsed.modifiers),
+    };
+    for sample in parsed.events {
+        if !pointer_event_intercepted(app, ctx, &gesture, &sample) {
+            forward_pointer_event(app, &gesture, sample);
         }
-        "ui.focus" => {
-            ctx.send_viewport_cmd(egui::ViewportCommand::Visible(true));
-            ctx.send_viewport_cmd(egui::ViewportCommand::Minimized(false));
-            ctx.send_viewport_cmd(egui::ViewportCommand::Focus);
-            ctx.request_repaint();
-            ok(Value::Null)
+    }
+    app.stylus.feed.set(None);
+    ok(json!({"status": app.ui.status}))
+}
+
+fn parse_pointer(p: &Value) -> std::result::Result<ParsedPointer, String> {
+    let fields = ["events", "tool", "modifiers", "button", "shift", "alt", "command", "ctrl", "space"];
+    let p = input_object(p, None, &fields)?;
+    let tool = match input_choice(&p, "tool", "tool", &[])? {
+        Some(t) => Some(Tool::from_name(t).ok_or_else(|| format!("unknown tool `{t}`"))?),
+        None => None,
+    };
+    let button = input_choice(&p, "button", "button", &BUTTONS)?.unwrap_or("left").to_string();
+    // Modifier flags may be top-level or grouped under "modifiers".
+    let modifiers = input_modifiers(&p, &POINTER_MODIFIERS)?;
+    let Some(events) = p.get("events") else { return Err("missing `events`".into()) };
+    let Some(events) = events.as_array() else { return Err("events must be an array".into()) };
+    let events = events.iter().enumerate().map(|(i, e)| parse_pointer_event(i, e)).collect::<std::result::Result<Vec<_>, _>>()?;
+    Ok(ParsedPointer { tool, button, modifiers, events })
+}
+
+fn parse_pointer_event(i: usize, e: &Value) -> std::result::Result<PointerSample, String> {
+    let name = format!("events[{i}]");
+    let e = input_object(e, Some(&name), &["kind", "x", "y", "pressure", "tiltX", "tiltY", "rotation"])?;
+    let num = |k: &str, range| input_number(&e, k, &format!("{name}.{k}"), range);
+    let (x, y) = (num("x", None)?.unwrap_or(0.0), num("y", None)?.unwrap_or(0.0));
+    let pressure = num("pressure", Some((0.0, 1.0)))?.unwrap_or(1.0) as f32;
+    let ev = match input_choice(&e, "kind", &format!("{name}.kind"), &["down", "move", "up"])?.unwrap_or("move") {
+        "down" => ToolEvent::Down { x, y, pressure },
+        "up" => ToolEvent::Up { x, y },
+        _ => ToolEvent::Move { x, y, pressure },
+    };
+    let tilt = |k: &str, range| num(k, Some(range)).map(|v| v.map(|v| v as f32));
+    let pen = (tilt("tiltX", (-90.0, 90.0))?, tilt("tiltY", (-90.0, 90.0))?, tilt("rotation", (0.0, 360.0))?);
+    Ok(PointerSample { ev, x, y, pressure, pen })
+}
+
+/// Whether a modal tool, picker or context menu took the event instead of the canvas.
+fn pointer_event_intercepted(app: &mut PhotocraftApp, ctx: &egui::Context, g: &PointerGesture, s: &PointerSample) -> bool {
+    pointer_eyedropper_took(app, ctx, g, s) || color_range_took(app, g, s) || (g.secondary && secondary_menu_took(app, ctx, g, s))
+}
+
+fn pointer_eyedropper_took(app: &mut PhotocraftApp, ctx: &egui::Context, g: &PointerGesture, s: &PointerSample) -> bool {
+    let (x, y) = (s.x, s.y);
+    let down = matches!(s.ev, ToolEvent::Down { .. });
+    // With the Color Picker on top the image is its eyedropper, as for the mouse.
+    if crate::color_picker_ui::top(app).is_some() {
+        if !matches!(s.ev, ToolEvent::Up { .. }) {
+            crate::color_picker_ui::sample_at(app, x, y);
         }
-        "ui.screenshot" => {
-            let parsed = input_object(p, None, &["path", "focus"])
-                .and_then(|p| Ok((input_choice(&p, "path", "path", &[])?.map(str::to_string), bool_field(&p, "focus")?)));
-            let (path, focus) = match parsed {
-                Ok(parsed) => parsed,
-                Err(e) => return err(e),
-            };
-            // Occluded windows don't render on macOS, so the screenshot would never arrive: raise first.
-            if focus.unwrap_or(true) {
-                ctx.send_viewport_cmd(egui::ViewportCommand::Focus);
-            }
-            // The capture itself is admitted by `PhotocraftApp::drain_control` (budget and
-            // geometry) and issued from a later `App::ui` pass once open/close animations
-            // (modals, popups) have settled (see `screenshot.rs`).
-            let token = app.ui.alloc_id();
-            ctx.request_repaint();
-            Outcome::Screenshot { token, path }
+        return true;
+    }
+    // Curves' modal eyedroppers use document coordinates here, matching the native
+    // canvas path after its ViewXform conversion. Sample on press only.
+    if !g.secondary && crate::adjust_dialog::picker_armed(app) {
+        if down {
+            crate::adjust_dialog::sample_at(app, x, y);
         }
-        "app.open" => match s("path") {
-            Some(path) => {
-                // Directory .pcraft (the native on-disk form) loads through a capability-scoped
-                // source; the single-file (zip) form falls back to the bytes path, as do all
-                // other formats.
-                if path.rsplit_once('.').is_some_and(|(_, ext)| ext.eq_ignore_ascii_case(photocraft_format::EXTENSION))
-                    && let Some(open) = app.services.automation_open_pcraft.as_mut()
-                {
-                    match open(path) {
-                        Ok(Some((name, doc))) => {
-                            app.session.add_document(doc, None);
-                            // Recent files, but no save-back target: the capability writer
-                            // replaces files, never directories.
-                            app.push_recent(path);
-                            app.sync_views();
-                            app.ui.status = crate::i18n::fmt(tl!("Opened {name}"), &[("name", &name)]);
-                            app.ui.status_error = false;
-                            return ok(json!({"path": path, "name": name, "warnings": []}));
-                        }
-                        Ok(None) => {} // a regular file: the bytes path reads the zip form
-                        Err(e) => return err(e),
-                    }
-                }
-                let opened = match app.services.automation_read.as_mut() {
-                    Some(read) => read(path),
-                    None => Err("automation read authority is not configured".into()),
-                };
-                wrap(opened.and_then(|(name, bytes)| {
-                    let name = app.open_name(&name);
-                    let warnings = app.open_automation_bytes(&name, &bytes)?;
-                    // Brushes/gradients go to the preset libraries: no document, no Open Recent entry.
-                    if !crate::preset_files_ui::is_preset_file(&name) {
-                        app.opened_from(path);
-                    }
-                    Ok(json!({"path": path, "name": name, "warnings": warnings}))
-                }))
-            }
+        return true;
+    }
+    // ⌘/Ctrl-click with Curves open adds a point at the pixel's tone, on press only (#7325).
+    if !g.secondary && !g.space && !g.middle && g.mods.command && crate::adjust_dialog::curves_on_top(app) {
+        if down {
+            crate::adjust_dialog::add_point_at(app, ctx, x, y, g.mods.shift);
+        }
+        return true;
+    }
+    // A Properties Levels/Curves eyedropper owns the primary button the same way.
+    if app.ui.dialogs.is_empty() && !g.secondary && crate::layer_picker::armed(app).is_some() {
+        if down {
+            crate::layer_picker::sample_at(app, x, y);
+        }
+        return true;
+    }
+    false
+}
+
+/// The dialog owns all pointer events, including Up: no underlying brush stroke
+/// or context menu may leak through while inspecting a Color Range preview.
+fn color_range_took(app: &mut PhotocraftApp, g: &PointerGesture, s: &PointerSample) -> bool {
+    if !app.ui.dialogs.last().is_some_and(|d| crate::color_range_ui::owns(&d.fields)) {
+        return false;
+    }
+    let down = matches!(s.ev, ToolEvent::Down { .. });
+    let up = matches!(s.ev, ToolEvent::Up { .. });
+    let held = app.ui.dialogs.last().and_then(|d| d.fields.get("__pointerDown")).and_then(Value::as_bool).unwrap_or(false);
+    if let Some(d) = app.ui.dialogs.last_mut() {
+        d.fields.insert("__pointerDown".into(), json!(!up && (down || held)));
+    }
+    if !up && (down || held) && !g.space && !g.secondary && !g.middle {
+        crate::color_range_ui::pick_top(app, [s.x, s.y], g.mods);
+    }
+    true
+}
+
+/// Right-click: the transform box's menu, the layer list, or a canvas menu. Whether it opens
+/// only on the press, the event is consumed either way.
+fn secondary_menu_took(app: &mut PhotocraftApp, ctx: &egui::Context, g: &PointerGesture, s: &PointerSample) -> bool {
+    secondary_transform_or_crop_took(app, ctx, g, s) || secondary_canvas_menu_took(app, ctx, g, s)
+}
+
+fn secondary_transform_or_crop_took(app: &mut PhotocraftApp, ctx: &egui::Context, g: &PointerGesture, s: &PointerSample) -> bool {
+    let (x, y) = (s.x, s.y);
+    let down = matches!(s.ev, ToolEvent::Down { .. });
+    // Right-click while transforming: the box's menu, as on the canvas.
+    if app.ui.transform.as_ref().is_some_and(|t| t.warp.is_none()) {
+        if down {
+            crate::canvas_tool_menu::open_transform(app, ctx, screen_point(app, x, y));
+        }
+        return true;
+    }
+    // Right-click with the Move tool, or ⌘/Ctrl+right-click: list the layers there.
+    if crate::layer_pick_ui::is_gesture(app.ui.tool, g.mods) {
+        if down {
+            app.ui.canvas_tool_menu = None;
+            crate::layer_pick_ui::open(app, ctx, screen_point(app, x, y), x, y);
+        }
+        return true;
+    }
+    if app.ui.tool != crate::state::Tool::Crop {
+        return false;
+    }
+    // No menu over the agent's own crop frame or Straighten line still being
+    // dragged, also the first one on the default frame (nothing pending yet).
+    if app.crop.drag.is_some() || app.crop.straighten.line.is_some() {
+        return true;
+    }
+    if crate::crop_ui::pending(app) {
+        if down {
+            crate::canvas_tool_menu::open_crop(app, ctx, app.ui.tool, screen_point(app, x, y));
+        }
+        return true;
+    }
+    false
+}
+
+fn secondary_canvas_menu_took(app: &mut PhotocraftApp, ctx: &egui::Context, g: &PointerGesture, s: &PointerSample) -> bool {
+    let (x, y) = (s.x, s.y);
+    let down = matches!(s.ev, ToolEvent::Down { .. });
+    if crate::canvas_tool_menu::pasteboard_at(app, app.ui.tool, [x, y]) {
+        if down {
+            crate::canvas_tool_menu::open_pasteboard(app, ctx, app.ui.tool, screen_point(app, x, y));
+        }
+        return true;
+    }
+    if crate::canvas_tool_menu::is_view_tool(app.ui.tool) {
+        if down {
+            crate::canvas_tool_menu::open_view(app, ctx, app.ui.tool, screen_point(app, x, y), [x, y]);
+        }
+        return true;
+    }
+    if crate::canvas_tool_menu::applies(app.ui.tool)
+        || crate::canvas_tool_menu::editing_text(app, app.ui.tool)
+        || crate::canvas_tool_menu::type_layer_at(app, app.ui.tool, [x, y]).is_some()
+    {
+        if down {
+            crate::canvas_tool_menu::open_at(app, ctx, app.ui.tool, screen_point(app, x, y), Some([x, y]));
+        }
+        return true;
+    }
+    !crate::paint_mouse::pointer_secondary(app, ctx, down, g.mods, screen_point(app, x, y))
+}
+
+/// Hand an event nothing intercepted to the active tool.
+fn forward_pointer_event(app: &mut PhotocraftApp, g: &PointerGesture, s: PointerSample) {
+    // A simulated pen: tilt/rotation reach the stroke like a real stylus's (see `stylus`).
+    if s.pen != (None, None, None) {
+        let (tilt_x, tilt_y, rotation) = (s.pen.0.unwrap_or(0.0), s.pen.1.unwrap_or(0.0), s.pen.2.unwrap_or(0.0));
+        app.stylus.feed.set(Some(crate::stylus::PenSample { pressure: s.pressure, tilt_x, tilt_y, rotation, eraser: false }));
+    }
+    if let Some(d) = app.drag.as_mut().filter(|d| crate::hold_keys::repositions(d.tool)) {
+        d.reposition = g.space;
+    }
+    // A Crop drag in the default mode turns and pans the view with the image: its
+    // points are read as the view showed them at the press (`crop_mode`).
+    let ev = match s.ev {
+        ToolEvent::Move { x, y, pressure } => {
+            let [x, y] = crate::crop_mode::control_point(app, [x, y]);
+            ToolEvent::Move { x, y, pressure }
+        }
+        ToolEvent::Up { x, y } => {
+            let [x, y] = crate::crop_mode::control_point(app, [x, y]);
+            ToolEvent::Up { x, y }
+        }
+        down => down,
+    };
+    tool_event(app, ev, g.mods);
+}
+
+// ---- the application: open, save, quit ----
+
+fn app_methods(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest) -> Option<Outcome> {
+    let p = &req.params;
+    Some(match req.method.as_str() {
+        "app.open" => match str_param(p, "path") {
+            Some(path) => app_open(app, path),
             None => err("missing `path`"),
         },
         "app.save" => match crate::FormatChoices::from_params(p, "app.save") {
             Ok(choices) => {
-                let path = s("path").map(str::to_string);
-                run_waiting(app, p.get("wait").and_then(Value::as_bool).unwrap_or(true), move |app| app.save_automation_with(path, choices))
+                let path = str_param(p, "path").map(str::to_string);
+                run_waiting(app, wait_param(p), move |app| app.save_automation_with(path, choices))
             }
             Err(e) => err(e),
         },
@@ -1000,6 +1323,49 @@ pub(super) fn dispatch(app: &mut PhotocraftApp, ctx: &egui::Context, req: &Contr
             ctx.send_viewport_cmd(egui::ViewportCommand::Close);
             ok(Value::Null)
         }
-        other => err(format!("unknown method `{other}`")),
+        _ => return None,
+    })
+}
+
+fn app_open(app: &mut PhotocraftApp, path: &str) -> Outcome {
+    if let Some(outcome) = open_pcraft_directory(app, path) {
+        return outcome;
+    }
+    let opened = match app.services.automation_read.as_mut() {
+        Some(read) => read(path),
+        None => Err("automation read authority is not configured".into()),
+    };
+    wrap(opened.and_then(|(name, bytes)| {
+        let name = app.open_name(&name);
+        let warnings = app.open_automation_bytes(&name, &bytes)?;
+        // Brushes/gradients go to the preset libraries: no document, no Open Recent entry.
+        if !crate::preset_files_ui::is_preset_file(&name) {
+            app.opened_from(path);
+        }
+        Ok(json!({"path": path, "name": name, "warnings": warnings}))
+    }))
+}
+
+/// Directory .pcraft (the native on-disk form) loads through a capability-scoped
+/// source; the single-file (zip) form falls back to the bytes path, as do all
+/// other formats. `None` means "not a directory .pcraft".
+fn open_pcraft_directory(app: &mut PhotocraftApp, path: &str) -> Option<Outcome> {
+    if !path.rsplit_once('.').is_some_and(|(_, ext)| ext.eq_ignore_ascii_case(photocraft_format::EXTENSION)) {
+        return None;
+    }
+    let open = app.services.automation_open_pcraft.as_mut()?;
+    match open(path) {
+        Ok(Some((name, doc))) => {
+            app.session.add_document(doc, None);
+            // Recent files, but no save-back target: the capability writer
+            // replaces files, never directories.
+            app.push_recent(path);
+            app.sync_views();
+            app.ui.status = crate::i18n::fmt(tl!("Opened {name}"), &[("name", &name)]);
+            app.ui.status_error = false;
+            Some(ok(json!({"path": path, "name": name, "warnings": []})))
+        }
+        Ok(None) => None, // a regular file: the bytes path reads the zip form
+        Err(e) => Some(err(e)),
     }
 }
diff --git a/crates/ui-egui/src/control/inspect.rs b/crates/ui-egui/src/control/inspect.rs
index cae7b358cb..86b7d0d734 100644
--- a/crates/ui-egui/src/control/inspect.rs
+++ b/crates/ui-egui/src/control/inspect.rs
@@ -88,7 +88,7 @@ pub fn inspect(app: &PhotocraftApp, ctx: &egui::Context) -> Value {
         "frame": app.frame,
         "session": photocraft_engine::inspect::session(&app.session),
         "document": app.session.active().map(photocraft_engine::inspect::document),
-        "perf": {"fps": app.fps, "timings": app.perf, "strokeTrace": app.stroke_trace.last},
+        "perf": {"fps": app.fps, "timings": app.perf, "strokeTrace": app.stroke_trace.last, "renderPath": crate::render_path::inspect(app)},
         "brush": {"size": app.session.tools.brush.size, "hardness": app.session.tools.brush.hardness, "opacity": app.session.tools.brush.opacity},
         "distort": app.distort.describe(),
         "jobs": crate::jobs_ui::inspect(app),
diff --git a/crates/ui-egui/src/control/params.rs b/crates/ui-egui/src/control/params.rs
index 0d9fbd6a49..b2d8668ecb 100644
--- a/crates/ui-egui/src/control/params.rs
+++ b/crates/ui-egui/src/control/params.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Outcome, PhotocraftApp, Value, json};
 
 /// The fields `ui.set` reads. Anything else is rejected before a field is applied, and every
 /// field's value is validated before the first one is applied, so a typo, an unknown field, a
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index c9d6f46d68..a14b42c37f 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -267,6 +267,263 @@ pub(crate) fn close_box(ui: &mut egui::Ui, rect: egui::Rect) -> bool {
     crate::icons::button(&mut child, "x", CLOSE_BOX_SIZE, false, tl!("Close")).clicked()
 }
 
+/// The dialog's contents under the title rule, picked by its kind and the marker field that routes
+/// it. Returns `Some(true)` / `Some(false)` when the body itself answered OK / Cancel.
+/// The body of a command dialog: the first handler whose marker the fields carry. The prompts and
+/// small editors come first; the rest are in `command_body_more`.
+fn command_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, d: &Dialog, fields: &mut Fields, id: egui::Id, interactive: bool) -> Option<bool> {
+    let mut outcome: Option<bool> = None;
+    match d.kind {
+        _ if crate::open_prompt::owns_damage(fields) => crate::open_prompt::damage_body(ui, fields),
+        _ if crate::guide_layout_ui::owns(fields) => outcome = crate::guide_layout_ui::body(app, ui, fields, interactive),
+        _ if crate::brush_preset_dialog::owns(fields) => outcome = crate::brush_preset_dialog::body(app, ui, fields, interactive),
+        _ if crate::fill_ui::owns(fields) => crate::fill_ui::body(app, ui, fields),
+        _ if crate::pattern_fill_ui::owns(fields) => crate::pattern_fill_ui::body(app, ui, fields),
+        _ if crate::stroke_ui::owns(fields) => crate::stroke_ui::body(ui, fields),
+        _ if crate::new_group_ui::owns(fields) => crate::new_group_ui::body(ui, fields),
+        _ if crate::snapshot_dialog::owns(fields) => crate::snapshot_dialog::body(ui, fields),
+        _ if crate::channel_options_ui::owns(fields) => crate::channel_options_ui::body(ui, fields),
+        _ if crate::channel_options_ui::owns_new_spot(fields) => crate::channel_options_ui::new_spot_body(ui, fields),
+        _ if crate::shape_dialog::owns(fields) => crate::shape_dialog::body(app, ui, fields),
+        _ if crate::delete_layer_prompt::owns(fields) => crate::delete_layer_prompt::body(ui, fields),
+        _ if crate::disk_change_prompt::owns(fields) => crate::disk_change_prompt::body(ui, fields),
+        _ if crate::replace_prompt::owns(fields) => crate::replace_prompt::body(ui, fields),
+        _ if crate::actions::owns_insert_stop(fields) => crate::actions::insert_stop_body(ui, fields),
+        _ if crate::new_layer_ui::owns(fields) => crate::new_layer_ui::body(ui, fields),
+        _ if crate::mask_trash_prompt::owns(fields) => crate::mask_trash_prompt::body(ui, fields),
+        _ if crate::rasterize_prompt::owns(fields) => crate::rasterize_prompt::body(ui, fields),
+        _ if crate::duplicate_layer_ui::owns(fields) => crate::duplicate_layer_ui::body(app, ui, fields),
+        _ if crate::stack_dialog::owns(fields) => crate::stack_dialog::body(app, ui, fields, d.id),
+        _ if crate::tool_reset::owns(fields) => crate::tool_reset::body(ui),
+        _ if crate::crop_presets::owns(fields) => crate::crop_presets::body(app, ui, fields),
+        _ if crate::variables_ui::owns(fields) => crate::variables_ui::body(app, ui, fields),
+        _ => return command_body_more(app, ui, d, fields, id),
+    }
+    outcome
+}
+
+/// The rest of the command dialogs: files, colour, export, sizing, filters and forms.
+fn command_body_more(app: &mut PhotocraftApp, ui: &mut egui::Ui, d: &Dialog, fields: &mut Fields, id: egui::Id) -> Option<bool> {
+    let mut outcome: Option<bool> = None;
+    match d.kind {
+        _ if crate::file_ui::owns(fields) => crate::file_ui::body(app, ui, fields, d.id),
+        _ if crate::color_picker_ui::owns(fields) => {
+            outcome = crate::color_picker_ui::body(ui, fields);
+            crate::color_picker_ui::take_add_swatch(app, fields);
+            if let Some(web) = fields.get("__webOnly").and_then(Value::as_bool) {
+                app.ui.color_panel.web_only = web;
+            }
+        }
+        _ if crate::color_range_ui::owns(fields) => crate::color_range_ui::body(app, ui, fields),
+        _ if crate::prefs_ui::owns(fields) => crate::prefs_ui::body(app, ui, fields),
+        _ if fields.contains_key("__export") => crate::export_dialog::body(app, ui, fields),
+        // Image Size and Canvas Size open on Width, selected (#2329).
+        _ if fields.contains_key("__sizing") => first_field_focused(ui, id, |ui| crate::sizing::body(ui, fields)),
+        _ if crate::smart_filter_dialog::owns(fields) => crate::smart_filter_dialog::body(app, ui, fields),
+        _ if crate::adjust_dialog::owns(fields) => crate::adjust_dialog::body(app, ui, fields),
+        _ if crate::blur_pins::owns(fields) => crate::blur_pins::body(ui, fields),
+        _ if fields.contains_key("__filter") => filter_body(app, ui, d, fields, id),
+        _ if crate::new_guide_ui::owns(fields) => crate::new_guide_ui::body(ui, fields),
+        _ if fields.contains_key("__form") => crate::view_cmds::form_body(ui, fields),
+        _ => {}
+    }
+    outcome
+}
+
+fn dialog_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, d: &Dialog, fields: &mut Fields, id: egui::Id, interactive: bool) -> Option<bool> {
+    let mut outcome: Option<bool> = None;
+    match d.kind {
+        DialogKind::NewDocument => {
+            if crate::new_doc_ui::body(app, ui, fields) {
+                outcome = Some(true);
+            }
+        }
+        DialogKind::About if fields.get("systemInfo").and_then(Value::as_bool) == Some(true) => {
+            let lines = crate::gpu_status::system_info_ui(app);
+            for l in &lines {
+                ui.add(egui::Label::new(egui::RichText::new(l).font(crate::theme::mono(12.0))).selectable(true));
+            }
+            ui.add_space(8.0);
+            if crate::widgets::secondary_button(ui, tl!("Copy"), 84.0).clicked() {
+                ui.ctx().copy_text(crate::gpu_status::system_info(app).join("\n"));
+            }
+        }
+        DialogKind::About => {
+            // Tabs About · Contributors · Models (craftrules standards/contributors.md). The
+            // tab is a dialog field, so automation can switch it with `ui.dialog.set`.
+            let tab = about_tab(fields);
+            let mut chosen = tab;
+            ui.horizontal(|ui| {
+                for (key, label) in [("about", tl!("About")), ("contributors", tl!("Contributors")), ("models", tl!("Models"))] {
+                    if crate::widgets::pill_tab(ui, label, tab == key).clicked() {
+                        chosen = key;
+                    }
+                }
+            });
+            if chosen != tab {
+                fields.insert("tab".into(), json!(chosen));
+            }
+            ui.add_space(8.0);
+            about_tab_body(app, ui, chosen);
+        }
+        DialogKind::Command => outcome = command_body(app, ui, d, fields, id, interactive),
+        DialogKind::LayerStyle => crate::layer_style::body(app, ui, fields),
+        DialogKind::Error => {
+            ui.label(fields.get("message").and_then(Value::as_str).unwrap_or("Error"));
+        }
+    }
+    outcome
+}
+
+/// A filter-style dialog: scrolling parameters with the in-dialog preview window under them.
+fn filter_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, d: &Dialog, fields: &mut Fields, id: egui::Id) {
+    // Color Settings: the monitor profile in use can change while it is open.
+    if fields.get("__command").and_then(Value::as_str) == Some("edit.colorSettings") {
+        fields.insert("__note".into(), Value::String(crate::monitor_status::note(app)));
+    }
+    // Long parameter lists (Flame, Lighting Effects) scroll, so the title and the
+    // OK / Cancel buttons stay inside a small window. The preview window below the
+    // parameters reserves its own space (#3769).
+    let room = (ui.ctx().content_rect().height() - DIALOG_CHROME - crate::filter_preview_ui::reserved_height(fields)).max(120.0);
+    let body = |ui: &mut egui::Ui, fields: &mut serde_json::Map<String, Value>| {
+        egui::ScrollArea::vertical().id_salt(id.with("body")).max_height(room).show(ui, |ui| {
+            if crate::bitmap_dialog::owns(fields) {
+                crate::bitmap_dialog::body(app, ui, fields);
+            } else {
+                crate::filter_dialog::body(ui, fields);
+            }
+        });
+        // The in-dialog preview window sits under the scrolling parameters (#3769),
+        // so it never shifts them.
+        crate::filter_preview_ui::window(app, d.id, ui, fields);
+    };
+    // Select and Mask leaves the keyboard to its view keys (F, X, O, V…).
+    if crate::select_mask_view::owns(fields) {
+        body(ui, fields);
+    } else {
+        first_field_focused(ui, id, |ui| body(ui, fields));
+    }
+}
+
+/// The OK / Cancel row (with Apply, Alternate or Reset where the dialog has them), drawn in the
+/// right-to-left layout. Returns what the buttons (or Enter) answered and whether Apply was hit.
+/// `popup_blocks_enter` is true when a web dialog has a popup open, which keeps Enter for the popup.
+fn button_row(
+    app: &mut PhotocraftApp,
+    ui: &mut egui::Ui,
+    d: &Dialog,
+    fields: &mut Fields,
+    id: egui::Id,
+    interactive: bool,
+    popup_blocks_enter: bool,
+) -> (Option<bool>, bool) {
+    let mut outcome: Option<bool> = None;
+    let mut apply_requested = false;
+    if matches!(d.kind, DialogKind::About | DialogKind::Error) {
+        // ↩ is OK too, as on every other dialog (#4872), from the frame after the
+        // alert appeared: the ↩ that raised it (committing a locked layer's Free
+        // Transform, say) must not close it again at once.
+        let seen = id.with("alert-seen");
+        let shown_before = ui.ctx().data(|m| m.get_temp::<bool>(seen).unwrap_or(false));
+        ui.ctx().data_mut(|m| m.insert_temp(seen, true));
+        let enter = interactive && shown_before && ui.input(|i| i.key_pressed(egui::Key::Enter));
+        if dialog_buttons(ui, &[DialogButton::new(ButtonRole::Default, tl!("OK"), 84.0)]).is_some() || enter {
+            outcome = Some(false);
+        }
+    } else {
+        let ok_label = ok_label(d);
+        // Dialogs that need an input first (a preset name, a selection) grey OK out.
+        let can_ok = crate::crop_presets::can_confirm(app, fields) && crate::stack_dialog::can_confirm(fields);
+        let ok = DialogButton::new(ButtonRole::Default, ok_label, 84.0).enabled(can_ok);
+        // Photoshop: holding Alt turns Cancel into Reset (the dialog stays open).
+        // Dialogs opt in via `dialog_alt_reset::supported` (per marker).
+        let reset = ui.input(|i| i.modifiers.alt) && crate::dialog_alt_reset::supported(fields);
+        let cancel_label = if reset {
+            tl!("Reset")
+        } else if d.kind == DialogKind::NewDocument {
+            tl!("Close")
+        } else {
+            tl!("Cancel")
+        };
+        let cancel = DialogButton::new(ButtonRole::Cancel, cancel_label, 84.0);
+        let clicked = if d.kind == DialogKind::Command && crate::prefs_ui::is_preferences(fields) {
+            let changed = crate::prefs_ui::preferences_changed(app, fields);
+            dialog_buttons(ui, &[ok, cancel, DialogButton::new(ButtonRole::Apply, tl!("Apply"), 84.0).enabled(changed)])
+        } else if crate::mask_trash_prompt::owns(fields) && !crate::mask_trash_prompt::is_vector(fields) {
+            // Photoshop: Apply / Cancel / Delete. Delete answers with the choice set.
+            let apply = DialogButton::new(ButtonRole::Default, tl!("Apply"), 84.0).enabled(crate::mask_trash_prompt::can_apply(fields));
+            let delete = DialogButton::new(ButtonRole::Alternate, tl!("Delete"), 84.0);
+            let hit = dialog_buttons(ui, &[apply, cancel, delete]);
+            if hit == Some(ButtonRole::Alternate) {
+                fields.insert("choice".into(), json!("delete"));
+            } else if hit == Some(ButtonRole::Default) {
+                fields.insert("choice".into(), json!("apply"));
+            }
+            hit
+        } else if crate::rasterize_prompt::is_filter(fields) {
+            // Photoshop: Convert to Smart Object / Rasterize / Cancel (#4303).
+            let rasterize = DialogButton::new(ButtonRole::Default, tl!("Rasterize"), 84.0);
+            let hit = if crate::rasterize_prompt::offers_smart_object(fields) {
+                let convert = DialogButton::new(ButtonRole::Alternate, tl!("Convert to Smart Object"), 160.0);
+                dialog_buttons(ui, &[rasterize, cancel, convert])
+            } else {
+                dialog_buttons(ui, &[rasterize, cancel])
+            };
+            if hit == Some(ButtonRole::Alternate) {
+                fields.insert("choice".into(), json!("smartObject"));
+            } else if hit == Some(ButtonRole::Default) {
+                fields.insert("choice".into(), json!("rasterize"));
+            }
+            hit
+        } else {
+            dialog_buttons(ui, &[ok, cancel])
+        };
+        match clicked {
+            Some(ButtonRole::Cancel) if reset => crate::dialog_alt_reset::apply(app, ui.ctx(), fields),
+            Some(ButtonRole::Cancel) => outcome = Some(false),
+            Some(ButtonRole::Apply) => apply_requested = true,
+            Some(_) => outcome = Some(true),
+            None if interactive && can_ok && !popup_blocks_enter && ui.input(|i| i.key_pressed(egui::Key::Enter)) => outcome = Some(true),
+            None => {}
+        }
+    }
+    (outcome, apply_requested)
+}
+
+/// The default button's label: what OK means for this dialog.
+fn ok_label(d: &Dialog) -> &'static str {
+    if d.kind == DialogKind::NewDocument {
+        tl!("Create")
+    } else if crate::open_prompt::owns_damage(&d.fields) {
+        tl!("Continue")
+    } else if crate::delete_layer_prompt::owns(&d.fields) {
+        tl!("Delete")
+    } else if crate::disk_change_prompt::owns(&d.fields) || crate::replace_prompt::owns(&d.fields) {
+        tl!("Replace")
+    } else if d.fields.contains_key("__export") {
+        tl!("Export")
+    } else {
+        crate::file_ui::ok_label(&d.fields).unwrap_or(tl!("OK"))
+    }
+}
+
+/// The widest a dialog grows when its body names no width of its own.
+fn default_max_width(d: &Dialog, compact: bool, curves: bool, about_tabs: bool, available: f32) -> f32 {
+    if d.kind == DialogKind::NewDocument {
+        800.0
+    } else if about_tabs {
+        700.0
+    } else if d.kind == DialogKind::LayerStyle || d.fields.contains_key("__export") || crate::color_picker_ui::owns(&d.fields) {
+        600.0
+    } else if compact {
+        260.0
+    } else if curves {
+        available.max(300.0)
+    } else {
+        440.0
+    }
+}
+
 pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     crate::layer_style::color_picker::prune(app);
     crate::type_panels_ui::color_picker::prune(app);
@@ -353,19 +610,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
             if about_tabs {
                 ui.set_min_width(700.0);
             }
-            ui.set_max_width(wide.unwrap_or(if d.kind == DialogKind::NewDocument {
-                800.0
-            } else if about_tabs {
-                700.0
-            } else if d.kind == DialogKind::LayerStyle || d.fields.contains_key("__export") || crate::color_picker_ui::owns(&d.fields) {
-                600.0
-            } else if compact {
-                260.0
-            } else if curves {
-                available.x.max(300.0)
-            } else {
-                440.0
-            }));
+            ui.set_max_width(wide.unwrap_or_else(|| default_max_width(&d, compact, curves, about_tabs, available.x)));
             if web {
                 ui.set_max_width(available.x);
                 ui.set_min_size(available);
@@ -399,115 +644,8 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
             crate::widgets::hairline(ui);
             ui.add_space(8.0);
             crate::field_tab::begin(ui.ctx());
-            match d.kind {
-                DialogKind::NewDocument => {
-                    if crate::new_doc_ui::body(app, ui, &mut fields) {
-                        outcome = Some(true);
-                    }
-                }
-                DialogKind::About if fields.get("systemInfo").and_then(Value::as_bool) == Some(true) => {
-                    let lines = crate::gpu_status::system_info_ui(app);
-                    for l in &lines {
-                        ui.add(egui::Label::new(egui::RichText::new(l).font(crate::theme::mono(12.0))).selectable(true));
-                    }
-                    ui.add_space(8.0);
-                    if crate::widgets::secondary_button(ui, tl!("Copy"), 84.0).clicked() {
-                        ui.ctx().copy_text(crate::gpu_status::system_info(app).join("\n"));
-                    }
-                }
-                DialogKind::About => {
-                    // Tabs About · Contributors · Models (craftrules standards/contributors.md). The
-                    // tab is a dialog field, so automation can switch it with `ui.dialog.set`.
-                    let tab = about_tab(&fields);
-                    let mut chosen = tab;
-                    ui.horizontal(|ui| {
-                        for (key, label) in [("about", tl!("About")), ("contributors", tl!("Contributors")), ("models", tl!("Models"))] {
-                            if crate::widgets::pill_tab(ui, label, tab == key).clicked() {
-                                chosen = key;
-                            }
-                        }
-                    });
-                    if chosen != tab {
-                        fields.insert("tab".into(), json!(chosen));
-                    }
-                    ui.add_space(8.0);
-                    about_tab_body(app, ui, chosen);
-                }
-                DialogKind::Command if crate::open_prompt::owns_damage(&fields) => crate::open_prompt::damage_body(ui, &fields),
-                DialogKind::Command if crate::guide_layout_ui::owns(&fields) => outcome = crate::guide_layout_ui::body(app, ui, &mut fields, interactive),
-                DialogKind::Command if crate::brush_preset_dialog::owns(&fields) => {
-                    outcome = crate::brush_preset_dialog::body(app, ui, &mut fields, interactive)
-                }
-                DialogKind::Command if crate::fill_ui::owns(&fields) => crate::fill_ui::body(app, ui, &mut fields),
-                DialogKind::Command if crate::pattern_fill_ui::owns(&fields) => crate::pattern_fill_ui::body(app, ui, &mut fields),
-                DialogKind::Command if crate::stroke_ui::owns(&fields) => crate::stroke_ui::body(ui, &mut fields),
-                DialogKind::Command if crate::snapshot_dialog::owns(&fields) => crate::snapshot_dialog::body(ui, &mut fields),
-                DialogKind::Command if crate::channel_options_ui::owns(&fields) => crate::channel_options_ui::body(ui, &mut fields),
-                DialogKind::Command if crate::channel_options_ui::owns_new_spot(&fields) => crate::channel_options_ui::new_spot_body(ui, &mut fields),
-                DialogKind::Command if crate::shape_dialog::owns(&fields) => crate::shape_dialog::body(app, ui, &mut fields),
-                DialogKind::Command if crate::delete_layer_prompt::owns(&fields) => crate::delete_layer_prompt::body(ui, &mut fields),
-                DialogKind::Command if crate::disk_change_prompt::owns(&fields) => crate::disk_change_prompt::body(ui, &fields),
-                DialogKind::Command if crate::replace_prompt::owns(&fields) => crate::replace_prompt::body(ui, &fields),
-                DialogKind::Command if crate::actions::owns_insert_stop(&fields) => crate::actions::insert_stop_body(ui, &mut fields),
-                DialogKind::Command if crate::new_layer_ui::owns(&fields) => crate::new_layer_ui::body(ui, &mut fields),
-                DialogKind::Command if crate::mask_trash_prompt::owns(&fields) => crate::mask_trash_prompt::body(ui, &fields),
-                DialogKind::Command if crate::rasterize_prompt::owns(&fields) => crate::rasterize_prompt::body(ui, &fields),
-                DialogKind::Command if crate::duplicate_layer_ui::owns(&fields) => crate::duplicate_layer_ui::body(app, ui, &mut fields),
-                DialogKind::Command if crate::stack_dialog::owns(&fields) => crate::stack_dialog::body(app, ui, &mut fields, d.id),
-                DialogKind::Command if crate::tool_reset::owns(&fields) => crate::tool_reset::body(ui),
-                DialogKind::Command if crate::crop_presets::owns(&fields) => crate::crop_presets::body(app, ui, &mut fields),
-                DialogKind::Command if crate::variables_ui::owns(&fields) => crate::variables_ui::body(app, ui, &mut fields),
-                DialogKind::Command if crate::file_ui::owns(&fields) => crate::file_ui::body(app, ui, &mut fields, d.id),
-                DialogKind::Command if crate::color_picker_ui::owns(&fields) => {
-                    outcome = crate::color_picker_ui::body(ui, &mut fields);
-                    crate::color_picker_ui::take_add_swatch(app, &mut fields);
-                    if let Some(web) = fields.get("__webOnly").and_then(Value::as_bool) {
-                        app.ui.color_panel.web_only = web;
-                    }
-                }
-                DialogKind::Command if crate::color_range_ui::owns(&fields) => crate::color_range_ui::body(app, ui, &mut fields),
-                DialogKind::Command if crate::prefs_ui::owns(&fields) => crate::prefs_ui::body(app, ui, &mut fields),
-                DialogKind::Command if fields.contains_key("__export") => crate::export_dialog::body(app, ui, &mut fields),
-                // Image Size and Canvas Size open on Width, selected (#2329).
-                DialogKind::Command if fields.contains_key("__sizing") => first_field_focused(ui, id, |ui| crate::sizing::body(ui, &mut fields)),
-                DialogKind::Command if crate::smart_filter_dialog::owns(&fields) => crate::smart_filter_dialog::body(app, ui, &mut fields),
-                DialogKind::Command if crate::adjust_dialog::owns(&fields) => crate::adjust_dialog::body(app, ui, &mut fields),
-                DialogKind::Command if crate::blur_pins::owns(&fields) => crate::blur_pins::body(ui, &mut fields),
-                DialogKind::Command if fields.contains_key("__filter") => {
-                    // Color Settings: the monitor profile in use can change while it is open.
-                    if fields.get("__command").and_then(Value::as_str) == Some("edit.colorSettings") {
-                        fields.insert("__note".into(), Value::String(crate::monitor_status::note(app)));
-                    }
-                    // Long parameter lists (Flame, Lighting Effects) scroll, so the title and the
-                    // OK / Cancel buttons stay inside a small window. The preview window below the
-                    // parameters reserves its own space (#3769).
-                    let room = (ctx.content_rect().height() - DIALOG_CHROME - crate::filter_preview_ui::reserved_height(&fields)).max(120.0);
-                    let body = |ui: &mut egui::Ui, fields: &mut serde_json::Map<String, Value>| {
-                        egui::ScrollArea::vertical().id_salt(id.with("body")).max_height(room).show(ui, |ui| {
-                            if crate::bitmap_dialog::owns(fields) {
-                                crate::bitmap_dialog::body(app, ui, fields);
-                            } else {
-                                crate::filter_dialog::body(ui, fields);
-                            }
-                        });
-                        // The in-dialog preview window sits under the scrolling parameters (#3769),
-                        // so it never shifts them.
-                        crate::filter_preview_ui::window(app, d.id, ui, fields);
-                    };
-                    // Select and Mask leaves the keyboard to its view keys (F, X, O, V…).
-                    if crate::select_mask_view::owns(&fields) {
-                        body(ui, &mut fields);
-                    } else {
-                        first_field_focused(ui, id, |ui| body(ui, &mut fields));
-                    }
-                }
-                DialogKind::Command if crate::new_guide_ui::owns(&fields) => crate::new_guide_ui::body(ui, &mut fields),
-                DialogKind::Command if fields.contains_key("__form") => crate::view_cmds::form_body(ui, &mut fields),
-                DialogKind::Command => {}
-                DialogKind::LayerStyle => crate::layer_style::body(app, ui, &mut fields),
-                DialogKind::Error => {
-                    ui.label(fields.get("message").and_then(Value::as_str).unwrap_or("Error"));
-                }
+            if let Some(done) = dialog_body(app, ui, &d, &mut fields, id, interactive) {
+                outcome = Some(done);
             }
             crate::field_tab::end(ui.ctx(), tab);
             if let Some(Value::String(key)) = fields.remove(BROWSE_FIELD) {
@@ -529,92 +667,9 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 // (larger) size, so a dialog whose body gets shorter would never shrink back.
                 ui.with_layout(egui::Layout::right_to_left(egui::Align::Min), |ui| {
                     ui.spacing_mut().item_spacing.x = 10.0;
-                    if matches!(d.kind, DialogKind::About | DialogKind::Error) {
-                        // ↩ is OK too, as on every other dialog (#4872), from the frame after the
-                        // alert appeared: the ↩ that raised it (committing a locked layer's Free
-                        // Transform, say) must not close it again at once.
-                        let seen = id.with("alert-seen");
-                        let shown_before = ui.ctx().data(|m| m.get_temp::<bool>(seen).unwrap_or(false));
-                        ui.ctx().data_mut(|m| m.insert_temp(seen, true));
-                        let enter = interactive && shown_before && ui.input(|i| i.key_pressed(egui::Key::Enter));
-                        if dialog_buttons(ui, &[DialogButton::new(ButtonRole::Default, tl!("OK"), 84.0)]).is_some() || enter {
-                            outcome = Some(false);
-                        }
-                    } else {
-                        let ok_label = if d.kind == DialogKind::NewDocument {
-                            tl!("Create")
-                        } else if crate::open_prompt::owns_damage(&d.fields) {
-                            tl!("Continue")
-                        } else if crate::delete_layer_prompt::owns(&d.fields) {
-                            tl!("Delete")
-                        } else if crate::disk_change_prompt::owns(&d.fields) || crate::replace_prompt::owns(&d.fields) {
-                            tl!("Replace")
-                        } else if d.fields.contains_key("__export") {
-                            tl!("Export")
-                        } else {
-                            crate::file_ui::ok_label(&d.fields).unwrap_or(tl!("OK"))
-                        };
-                        // Dialogs that need an input first (a preset name, a selection) grey OK out.
-                        let can_ok = crate::crop_presets::can_confirm(app, &fields) && crate::stack_dialog::can_confirm(&fields);
-                        let ok = DialogButton::new(ButtonRole::Default, ok_label, 84.0).enabled(can_ok);
-                        // Photoshop: holding Alt turns Cancel into Reset (the dialog stays open).
-                        // Dialogs opt in via `dialog_alt_reset::supported` (per marker).
-                        let reset = ui.input(|i| i.modifiers.alt) && crate::dialog_alt_reset::supported(&fields);
-                        let cancel_label = if reset {
-                            tl!("Reset")
-                        } else if d.kind == DialogKind::NewDocument {
-                            tl!("Close")
-                        } else {
-                            tl!("Cancel")
-                        };
-                        let cancel = DialogButton::new(ButtonRole::Cancel, cancel_label, 84.0);
-                        let clicked = if d.kind == DialogKind::Command && crate::prefs_ui::is_preferences(&fields) {
-                            let changed = crate::prefs_ui::preferences_changed(app, &fields);
-                            dialog_buttons(ui, &[ok, cancel, DialogButton::new(ButtonRole::Apply, tl!("Apply"), 84.0).enabled(changed)])
-                        } else if crate::mask_trash_prompt::owns(&fields) && !crate::mask_trash_prompt::is_vector(&fields) {
-                            // Photoshop: Apply / Cancel / Delete. Delete answers with the choice set.
-                            let apply = DialogButton::new(ButtonRole::Default, tl!("Apply"), 84.0).enabled(crate::mask_trash_prompt::can_apply(&fields));
-                            let delete = DialogButton::new(ButtonRole::Alternate, tl!("Delete"), 84.0);
-                            let hit = dialog_buttons(ui, &[apply, cancel, delete]);
-                            if hit == Some(ButtonRole::Alternate) {
-                                fields.insert("choice".into(), json!("delete"));
-                            } else if hit == Some(ButtonRole::Default) {
-                                fields.insert("choice".into(), json!("apply"));
-                            }
-                            hit
-                        } else if crate::rasterize_prompt::is_filter(&fields) {
-                            // Photoshop: Convert to Smart Object / Rasterize / Cancel (#4303).
-                            let rasterize = DialogButton::new(ButtonRole::Default, tl!("Rasterize"), 84.0);
-                            let hit = if crate::rasterize_prompt::offers_smart_object(&fields) {
-                                let convert = DialogButton::new(ButtonRole::Alternate, tl!("Convert to Smart Object"), 160.0);
-                                dialog_buttons(ui, &[rasterize, cancel, convert])
-                            } else {
-                                dialog_buttons(ui, &[rasterize, cancel])
-                            };
-                            if hit == Some(ButtonRole::Alternate) {
-                                fields.insert("choice".into(), json!("smartObject"));
-                            } else if hit == Some(ButtonRole::Default) {
-                                fields.insert("choice".into(), json!("rasterize"));
-                            }
-                            hit
-                        } else {
-                            dialog_buttons(ui, &[ok, cancel])
-                        };
-                        match clicked {
-                            Some(ButtonRole::Cancel) if reset => crate::dialog_alt_reset::apply(app, ui.ctx(), &mut fields),
-                            Some(ButtonRole::Cancel) => outcome = Some(false),
-                            Some(ButtonRole::Apply) => apply_requested = true,
-                            Some(_) => outcome = Some(true),
-                            None if interactive
-                                && can_ok
-                                && (!web || (!web_popup_open && !egui::Popup::is_any_open(ui.ctx())))
-                                && ui.input(|i| i.key_pressed(egui::Key::Enter)) =>
-                            {
-                                outcome = Some(true)
-                            }
-                            None => {}
-                        }
-                    }
+                    let (done, apply) = button_row(app, ui, &d, &mut fields, id, interactive, web && (web_popup_open || egui::Popup::is_any_open(ui.ctx())));
+                    outcome = done.or(outcome);
+                    apply_requested |= apply;
                 });
             }
             // The frame around the content (Frame::popup's margin and stroke).
@@ -759,6 +814,7 @@ const ROUTES: &[fn(&Fields) -> bool] = &[
     crate::disk_change_prompt::owns,
     crate::actions::owns_insert_stop,
     crate::new_layer_ui::owns,
+    crate::new_group_ui::owns,
     crate::mask_trash_prompt::owns,
     crate::rasterize_prompt::owns,
     crate::duplicate_layer_ui::owns,
@@ -804,8 +860,74 @@ fn file_command(fields: &Fields) -> Option<&'static str> {
     }
 }
 
-/// Confirm a dialog: run its action and close it. Used by the OK button and by automation.
-pub fn confirm(app: &mut PhotocraftApp, id: u64) -> Result<Value, String> {
+/// Confirm a command dialog no specific handler owns: run its `__command` with the dialog's
+/// parameters, then settle the filter preview and the playing action.
+fn confirm_generic_command(app: &mut PhotocraftApp, d: Dialog) -> Result<Value, String> {
+    let Some(cmd) = d.fields.get("__command").and_then(Value::as_str).map(str::to_string) else {
+        app.filter_preview = None;
+        crate::actions::abandoned(app, &d.fields);
+        return Err("dialog has no command".into());
+    };
+    if crate::filter_dialog::needs_displace_map(&cmd, &crate::filter_dialog::params_of(&d.fields)) {
+        app.filter_preview = None;
+        let result = crate::filter_dialog::ask_displace_map(app, cmd, d.fields.clone());
+        if result.is_err() {
+            crate::actions::abandoned(app, &d.fields);
+        } else {
+            // Cancel and an unavailable picker finish before the Displace callback
+            // runs. Observe the whole file-dialog result, including those exits.
+            app.after_file_dialog(move |app, result| {
+                if result.is_err() {
+                    crate::actions::abandoned(app, &d.fields);
+                }
+                result
+            });
+        }
+        return result;
+    }
+    let (cmd, params) = match crate::smart_ui::confirm_command(app, &d.fields, cmd, crate::filter_dialog::params_of(&d.fields)) {
+        Ok(edit) => edit,
+        Err(e) => {
+            app.filter_preview = None;
+            return Err(e);
+        }
+    };
+    let result = app.run(&cmd, params.clone());
+    // A filter that runs as a background job keeps its preview on screen until the job
+    // lands (`canvas::committed_filter_preview`) instead of flashing the unfiltered image.
+    let running =
+        app.session.active().is_some_and(|st| app.filter_preview.as_ref().is_some_and(|p| p.key.doc == st.doc.id) && app.session.job_on(st.doc.id).is_some());
+    match app.filter_preview.as_mut() {
+        Some(p) if result.is_ok() && running => p.committing = true,
+        _ => app.filter_preview = None,
+    }
+    if result.is_ok()
+        && cmd == "path.toSelection"
+        && d.fields.contains_key("__deselectPath")
+        && let Some(name) = params.get("name").and_then(Value::as_str)
+    {
+        crate::vector_ui::deselect_loaded_path(app, name);
+    }
+    if result.is_ok() && cmd == "view.newGuideLayout" {
+        app.ui.view.guide_layout = params;
+    }
+    if result.is_ok() {
+        if crate::adjust_dialog::owns(&d.fields) {
+            crate::adjust_dialog::remember(app, &d.fields);
+        } else {
+            crate::filter_dialog::remember(app, &cmd, &d.fields);
+        }
+        // A step dialog of a playing action: the action continues after it.
+        crate::actions::resume(app, &d.fields)?;
+    } else {
+        crate::actions::abandoned(app, &d.fields);
+    }
+    result
+}
+
+/// The checks before a dialog is confirmed: no open child picker, the automation gate for a handler
+/// that touches files itself, and a valid guide layout.
+fn confirm_preflight(app: &mut PhotocraftApp, id: u64) -> Result<(), String> {
     if crate::layer_style::color_picker::has_child(app, id) {
         return Err("confirm or cancel the Layer Style color picker first".into());
     }
@@ -824,6 +946,56 @@ pub fn confirm(app: &mut PhotocraftApp, id: u64) -> Result<Value, String> {
         }
         crate::guide_layout_ui::validate(app, &d.fields)?;
     }
+    Ok(())
+}
+
+/// Confirm a dialog: run its action and close it. Used by the OK button and by automation.
+/// Confirm a command dialog through the first handler whose marker its fields carry; the prompts
+/// and small editors are here, the rest in `confirm_command_more`.
+fn confirm_command(app: &mut PhotocraftApp, d: Dialog) -> Result<Value, String> {
+    match d.kind {
+        _ if crate::open_prompt::owns_damage(&d.fields) => crate::open_prompt::answer_damage(app, true),
+        _ if crate::guide_layout_ui::owns(&d.fields) => crate::guide_layout_ui::confirm(app, &d.fields),
+        _ if crate::brush_preset_dialog::owns(&d.fields) => crate::brush_preset_dialog::confirm(app, &d.fields),
+        _ if crate::fill_ui::owns(&d.fields) => crate::fill_ui::confirm(app, &d.fields),
+        _ if crate::pattern_fill_ui::owns(&d.fields) => crate::pattern_fill_ui::confirm(app, &d.fields),
+        _ if crate::stroke_ui::owns(&d.fields) => crate::stroke_ui::confirm(app, &d.fields),
+        _ if crate::new_group_ui::owns(&d.fields) => crate::new_group_ui::confirm(app, &d.fields),
+        _ if crate::snapshot_dialog::owns(&d.fields) => crate::snapshot_dialog::confirm(app, &d.fields),
+        _ if crate::channel_options_ui::owns(&d.fields) => crate::channel_options_ui::confirm(app, &d.fields),
+        _ if crate::channel_options_ui::owns_new_spot(&d.fields) => crate::channel_options_ui::confirm_new_spot(app, &d.fields),
+        _ if crate::shape_dialog::owns(&d.fields) => crate::shape_dialog::confirm(app, &d.fields),
+        _ if crate::delete_layer_prompt::owns(&d.fields) => crate::delete_layer_prompt::confirm(app, &d.fields),
+        _ if crate::disk_change_prompt::owns(&d.fields) => crate::disk_change_prompt::confirm(app, &d.fields),
+        _ if crate::replace_prompt::owns(&d.fields) => crate::replace_prompt::confirm(app),
+        _ if crate::actions::owns_insert_stop(&d.fields) => crate::actions::insert_stop_confirm(app, &d.fields),
+        _ if crate::new_layer_ui::owns(&d.fields) => crate::new_layer_ui::confirm(app, &d.fields),
+        _ if crate::mask_trash_prompt::owns(&d.fields) => crate::mask_trash_prompt::confirm(app, &d.fields),
+        _ if crate::rasterize_prompt::owns(&d.fields) => crate::rasterize_prompt::confirm(app, &d.fields),
+        _ if crate::duplicate_layer_ui::owns(&d.fields) => crate::duplicate_layer_ui::confirm(app, &d.fields),
+        _ if crate::stack_dialog::owns(&d.fields) => crate::stack_dialog::confirm(app, &d.fields),
+        _ if crate::tool_reset::owns(&d.fields) => crate::tool_reset::confirm(app),
+        _ if crate::crop_presets::owns(&d.fields) => crate::crop_presets::confirm(app, &d.fields),
+        _ if crate::variables_ui::owns(&d.fields) => crate::variables_ui::confirm(app, &d.fields),
+        _ => confirm_command_more(app, d),
+    }
+}
+
+/// The rest of the command dialogs: files, colour, preferences and export, then any other command.
+fn confirm_command_more(app: &mut PhotocraftApp, d: Dialog) -> Result<Value, String> {
+    match d.kind {
+        _ if crate::file_ui::owns(&d.fields) => crate::file_ui::confirm(app, &d.fields),
+        _ if crate::new_guide_ui::owns(&d.fields) => crate::new_guide_ui::confirm(app, &d.fields),
+        _ if crate::color_picker_ui::owns(&d.fields) => crate::color_picker_ui::confirm(app, &d.fields),
+        _ if crate::color_range_ui::owns(&d.fields) => crate::color_range_ui::confirm(app, &d.fields),
+        _ if crate::prefs_ui::owns(&d.fields) => crate::prefs_ui::confirm(app, &d.fields),
+        _ if d.fields.contains_key("__export") => crate::export_dialog::confirm(app, &d.fields),
+        _ => confirm_generic_command(app, d),
+    }
+}
+
+pub fn confirm(app: &mut PhotocraftApp, id: u64) -> Result<Value, String> {
+    confirm_preflight(app, id)?;
     let d = app.ui.close_dialog(id).ok_or_else(|| format!("no dialog {id}"))?;
     match d.kind {
         DialogKind::NewDocument => {
@@ -838,91 +1010,7 @@ pub fn confirm(app: &mut PhotocraftApp, id: u64) -> Result<Value, String> {
             }
             r
         }
-        DialogKind::Command if crate::open_prompt::owns_damage(&d.fields) => crate::open_prompt::answer_damage(app, true),
-        DialogKind::Command if crate::guide_layout_ui::owns(&d.fields) => crate::guide_layout_ui::confirm(app, &d.fields),
-        DialogKind::Command if crate::brush_preset_dialog::owns(&d.fields) => crate::brush_preset_dialog::confirm(app, &d.fields),
-        DialogKind::Command if crate::fill_ui::owns(&d.fields) => crate::fill_ui::confirm(app, &d.fields),
-        DialogKind::Command if crate::pattern_fill_ui::owns(&d.fields) => crate::pattern_fill_ui::confirm(app, &d.fields),
-        DialogKind::Command if crate::stroke_ui::owns(&d.fields) => crate::stroke_ui::confirm(app, &d.fields),
-        DialogKind::Command if crate::snapshot_dialog::owns(&d.fields) => crate::snapshot_dialog::confirm(app, &d.fields),
-        DialogKind::Command if crate::channel_options_ui::owns(&d.fields) => crate::channel_options_ui::confirm(app, &d.fields),
-        DialogKind::Command if crate::channel_options_ui::owns_new_spot(&d.fields) => crate::channel_options_ui::confirm_new_spot(app, &d.fields),
-        DialogKind::Command if crate::shape_dialog::owns(&d.fields) => crate::shape_dialog::confirm(app, &d.fields),
-        DialogKind::Command if crate::delete_layer_prompt::owns(&d.fields) => crate::delete_layer_prompt::confirm(app, &d.fields),
-        DialogKind::Command if crate::disk_change_prompt::owns(&d.fields) => crate::disk_change_prompt::confirm(app, &d.fields),
-        DialogKind::Command if crate::replace_prompt::owns(&d.fields) => crate::replace_prompt::confirm(app),
-        DialogKind::Command if crate::actions::owns_insert_stop(&d.fields) => crate::actions::insert_stop_confirm(app, &d.fields),
-        DialogKind::Command if crate::new_layer_ui::owns(&d.fields) => crate::new_layer_ui::confirm(app, &d.fields),
-        DialogKind::Command if crate::mask_trash_prompt::owns(&d.fields) => crate::mask_trash_prompt::confirm(app, &d.fields),
-        DialogKind::Command if crate::rasterize_prompt::owns(&d.fields) => crate::rasterize_prompt::confirm(app, &d.fields),
-        DialogKind::Command if crate::duplicate_layer_ui::owns(&d.fields) => crate::duplicate_layer_ui::confirm(app, &d.fields),
-        DialogKind::Command if crate::stack_dialog::owns(&d.fields) => crate::stack_dialog::confirm(app, &d.fields),
-        DialogKind::Command if crate::tool_reset::owns(&d.fields) => crate::tool_reset::confirm(app),
-        DialogKind::Command if crate::crop_presets::owns(&d.fields) => crate::crop_presets::confirm(app, &d.fields),
-        DialogKind::Command if crate::variables_ui::owns(&d.fields) => crate::variables_ui::confirm(app, &d.fields),
-        DialogKind::Command if crate::file_ui::owns(&d.fields) => crate::file_ui::confirm(app, &d.fields),
-        DialogKind::Command if crate::new_guide_ui::owns(&d.fields) => crate::new_guide_ui::confirm(app, &d.fields),
-        DialogKind::Command if crate::color_picker_ui::owns(&d.fields) => crate::color_picker_ui::confirm(app, &d.fields),
-        DialogKind::Command if crate::color_range_ui::owns(&d.fields) => crate::color_range_ui::confirm(app, &d.fields),
-        DialogKind::Command if crate::prefs_ui::owns(&d.fields) => crate::prefs_ui::confirm(app, &d.fields),
-        DialogKind::Command if d.fields.contains_key("__export") => crate::export_dialog::confirm(app, &d.fields),
-        DialogKind::Command => {
-            let Some(cmd) = d.fields.get("__command").and_then(Value::as_str).map(str::to_string) else {
-                app.filter_preview = None;
-                crate::actions::abandoned(app, &d.fields);
-                return Err("dialog has no command".into());
-            };
-            if crate::filter_dialog::needs_displace_map(&cmd, &crate::filter_dialog::params_of(&d.fields)) {
-                app.filter_preview = None;
-                let result = crate::filter_dialog::ask_displace_map(app, cmd, d.fields.clone());
-                if result.is_err() {
-                    crate::actions::abandoned(app, &d.fields);
-                } else {
-                    // Cancel and an unavailable picker finish before the Displace callback
-                    // runs. Observe the whole file-dialog result, including those exits.
-                    app.after_file_dialog(move |app, result| {
-                        if result.is_err() {
-                            crate::actions::abandoned(app, &d.fields);
-                        }
-                        result
-                    });
-                }
-                return result;
-            }
-            let (cmd, params) = match crate::smart_ui::confirm_command(app, &d.fields, cmd, crate::filter_dialog::params_of(&d.fields)) {
-                Ok(edit) => edit,
-                Err(e) => {
-                    app.filter_preview = None;
-                    return Err(e);
-                }
-            };
-            let result = app.run(&cmd, params.clone());
-            // A filter that runs as a background job keeps its preview on screen until the job
-            // lands (`canvas::committed_filter_preview`) instead of flashing the unfiltered image.
-            let running = app
-                .session
-                .active()
-                .is_some_and(|st| app.filter_preview.as_ref().is_some_and(|p| p.key.doc == st.doc.id) && app.session.job_on(st.doc.id).is_some());
-            match app.filter_preview.as_mut() {
-                Some(p) if result.is_ok() && running => p.committing = true,
-                _ => app.filter_preview = None,
-            }
-            if result.is_ok() && cmd == "view.newGuideLayout" {
-                app.ui.view.guide_layout = params;
-            }
-            if result.is_ok() {
-                if crate::adjust_dialog::owns(&d.fields) {
-                    crate::adjust_dialog::remember(app, &d.fields);
-                } else {
-                    crate::filter_dialog::remember(app, &cmd, &d.fields);
-                }
-                // A step dialog of a playing action: the action continues after it.
-                crate::actions::resume(app, &d.fields)?;
-            } else {
-                crate::actions::abandoned(app, &d.fields);
-            }
-            result
-        }
+        DialogKind::Command => confirm_command(app, d),
         DialogKind::LayerStyle => crate::layer_style::confirm(app, &d.fields),
         DialogKind::About | DialogKind::Error => Ok(Value::Null),
     }
@@ -962,6 +1050,9 @@ pub fn open_command_dialog(app: &mut PhotocraftApp, command: &str, label: &str)
     if command == crate::stroke_ui::COMMAND {
         return crate::stroke_ui::open(app);
     }
+    if crate::new_group_ui::fronts(command) {
+        return crate::new_group_ui::open(app, command);
+    }
     if command == crate::color_range_ui::COMMAND {
         return crate::color_range_ui::open(app);
     }
@@ -1014,12 +1105,14 @@ pub(super) mod filter_preview_ui;
 pub(super) mod filter_preview_worker;
 pub mod gallery_ui;
 pub mod guide_layout_ui;
+pub mod history_options_ui;
 pub mod jpeg_options_ui;
 pub mod layer_picker;
 pub mod layer_style;
 pub mod liquify_ui;
 pub mod mask_trash_prompt;
 pub mod new_doc_ui;
+pub mod new_group_ui;
 pub mod new_guide_ui;
 pub mod new_layer_ui;
 pub mod open_prompt;
diff --git a/crates/ui-egui/src/dialogs/adjust_editors/basic.rs b/crates/ui-egui/src/dialogs/adjust_editors/basic.rs
index 00b940cdbd..18c740ab80 100644
--- a/crates/ui-egui/src/dialogs/adjust_editors/basic.rs
+++ b/crates/ui-egui/src/dialogs/adjust_editors/basic.rs
@@ -1,5 +1,8 @@
 use super::hue_saturation::RANGE_LABELS;
-use super::*;
+use super::{
+    Color32, Edit, EditorCx, HUE_RANGES, PHOTO_FILTERS, RichText, Sense, Stroke, StrokeKind, Tokens, Value, adjust_params, color_button, flag, json, label,
+    num, nums, pos2, rgb_of, round, tone, vec2, widgets,
+};
 
 /// Labelled slider rows over top-level keys: (key, label, min, max, default, unit).
 /// A row of [`sliders`]: params key, label, range, default, unit, and its decimal places (None:
diff --git a/crates/ui-egui/src/dialogs/adjust_editors/curves.rs b/crates/ui-egui/src/dialogs/adjust_editors/curves.rs
index 7a3f4ea510..4b1867e83b 100644
--- a/crates/ui-egui/src/dialogs/adjust_editors/curves.rs
+++ b/crates/ui-egui/src/dialogs/adjust_editors/curves.rs
@@ -1,4 +1,7 @@
-use super::*;
+use super::{
+    Color32, CurveUi, Edit, EditorCx, Pos2, Rect, RichText, Sense, Stroke, StrokeKind, Tokens, ToneSpace, Value, adjust_params, curve_edit, json, label, pos2,
+    space_of, tone, vec2, widgets,
+};
 
 // ---------------------------------------------------------------------------------------------
 // Channels of Levels / Curves
diff --git a/crates/ui-egui/src/dialogs/adjust_editors/gradient_map.rs b/crates/ui-egui/src/dialogs/adjust_editors/gradient_map.rs
index 1684d9bb47..74dc454bb7 100644
--- a/crates/ui-egui/src/dialogs/adjust_editors/gradient_map.rs
+++ b/crates/ui-egui/src/dialogs/adjust_editors/gradient_map.rs
@@ -1,5 +1,8 @@
 use super::hue_saturation::spectrum_bar;
-use super::*;
+use super::{
+    Color32, Edit, EditorCx, GradientPreset, Group, PhotocraftApp, Pos2, Rect, RichText, Sense, Stroke, StrokeKind, Tokens, Value, adjust_params, color_button,
+    color32, flag, json, label, pos2, rgb_of, round, vec2, widgets,
+};
 
 // ---------------------------------------------------------------------------------------------
 // Gradient Map
@@ -158,7 +161,7 @@ pub(super) fn gradient_map(ui: &mut egui::Ui, v: &mut Value, cx: &EditorCx) -> E
         label(ui, tl!("Preset:"));
         let mut picked = None;
         let (press, close) = crate::press_menu::PressCombo::before(ui, cx.mem.with("gm-preset"));
-        let combo = egui::ComboBox::from_id_salt(cx.mem.with("gm-preset"))
+        let combo = craft_ui::ComboBox::from_id_salt(cx.mem.with("gm-preset"))
             .selected_text(tl!("Custom"))
             .width(ui.available_width().min(190.0))
             .height(420.0)
diff --git a/crates/ui-egui/src/dialogs/adjust_editors/hue_saturation.rs b/crates/ui-egui/src/dialogs/adjust_editors/hue_saturation.rs
index 042f398619..b1c61947fa 100644
--- a/crates/ui-egui/src/dialogs/adjust_editors/hue_saturation.rs
+++ b/crates/ui-egui/src/dialogs/adjust_editors/hue_saturation.rs
@@ -1,7 +1,10 @@
 use super::basic::{sliders, track_stops};
 use super::curves::gradient_bar;
 use super::levels::nearest;
-use super::*;
+use super::{
+    Color32, Edit, EditorCx, HUE_RANGES, HueRange, Rect, RichText, Sense, Stroke, StrokeKind, Tokens, Value, color32, flag, hue_color, json, num, nums, pos2,
+    vec2, widgets,
+};
 
 // ---------------------------------------------------------------------------------------------
 // Hue/Saturation
diff --git a/crates/ui-egui/src/dialogs/adjust_editors/levels.rs b/crates/ui-egui/src/dialogs/adjust_editors/levels.rs
index 8963e438e2..f1eac2a075 100644
--- a/crates/ui-egui/src/dialogs/adjust_editors/levels.rs
+++ b/crates/ui-egui/src/dialogs/adjust_editors/levels.rs
@@ -1,5 +1,5 @@
 use super::curves::{ToneChannel, bar_color, channel_picker, gradient_bar, hist_color, tone_channels};
-use super::*;
+use super::{Color32, Edit, EditorCx, Sense, Stroke, StrokeKind, Tokens, Value, json, label, pos2, round, space_of, tone, vec2, widgets};
 
 // ---------------------------------------------------------------------------------------------
 // Levels
diff --git a/crates/ui-egui/src/dialogs/adjust_editors/session.rs b/crates/ui-egui/src/dialogs/adjust_editors/session.rs
index bb3eeeebbc..12eb73b470 100644
--- a/crates/ui-egui/src/dialogs/adjust_editors/session.rs
+++ b/crates/ui-egui/src/dialogs/adjust_editors/session.rs
@@ -1,6 +1,6 @@
 use super::basic::reset_color_balance;
 use super::gradient_map::{gradient_presets, is_gray, swatches};
-use super::*;
+use super::{Adjustment, EditorCx, HistSource, LayerId, PhotocraftApp, RichText, Tokens, Value, adjust_params, editor, json, needs_histogram, space_of, tone};
 
 /// Root of an adjustment layer's Properties editor view state in egui memory.
 pub fn layer_mem(id: LayerId) -> egui::Id {
diff --git a/crates/ui-egui/src/dialogs/adjust_preview.rs b/crates/ui-egui/src/dialogs/adjust_preview.rs
index d82eac9014..69b8ea3568 100644
--- a/crates/ui-egui/src/dialogs/adjust_preview.rs
+++ b/crates/ui-egui/src/dialogs/adjust_preview.rs
@@ -218,6 +218,7 @@ fn update(app: &mut PhotocraftApp, idx: usize) -> Option<&AdjustPreview> {
         if let Some(p) = app.adjust_preview.as_mut() {
             (p.hash, p.layer_path, p.shown) = (0, false, None);
         }
+        crate::render_path::adjust_preview_ok(app);
         return None;
     };
     let st = app.session.documents().get(idx)?;
@@ -236,7 +237,16 @@ fn update(app: &mut PhotocraftApp, idx: usize) -> Option<&AdjustPreview> {
     }
     if app.adjust_preview.as_ref().is_none_or(|p| (p.doc, p.session) != (doc_id, session)) {
         let doc = st.doc.clone();
-        let base = if channel_target { None } else { base_document(&doc, target).ok().filter(|b| cheap(app, b)).map(Arc::new) };
+        let base = if channel_target { None } else { base_document(&doc, target).ok() };
+        // A target the layer path can't preview (or the GPU can't draw) falls to the CPU proxy: say
+        // why (#7487), in the preview's own slot. A channel target's proxy is by design, not a
+        // fallback.
+        let gpu_refuses = app.gpu.as_ref().zip(base.as_ref()).is_some_and(|(g, b)| !g.supports(b));
+        match (!channel_target).then(|| unsupported(&doc, target)).flatten().or(gpu_refuses.then_some("the GPU can't draw the result")) {
+            Some(why) => crate::render_path::adjust_preview_cpu(app, doc_id.0, why),
+            None => crate::render_path::adjust_preview_ok(app),
+        }
+        let base = base.filter(|b| cheap(app, b)).map(Arc::new);
         let region = if base.is_some() { region(&doc, target) } else { Rect::EMPTY };
         app.adjust_preview = Some(AdjustPreview {
             doc: doc_id,
diff --git a/crates/ui-egui/src/dialogs/adjust_preview/tests.rs b/crates/ui-egui/src/dialogs/adjust_preview/tests.rs
index 0b5337da7a..a90040125a 100644
--- a/crates/ui-egui/src/dialogs/adjust_preview/tests.rs
+++ b/crates/ui-egui/src/dialogs/adjust_preview/tests.rs
@@ -300,6 +300,77 @@ fn ineligible_dialogs_keep_the_proxy_preview() {
     assert!(!on_layer(&mut app, 0));
 }
 
+/// The proxy preview of a clipped target records why it doesn't preview through the layer
+/// instead of dropping the reason (#7487).
+#[test]
+fn a_clipped_adjustment_preview_records_why_it_uses_the_proxy() {
+    let (doc, _) = document(ColorMode::Rgb, SampleType::U8, false);
+    let clipped = doc.layers[2].id;
+    let mut app = app_with(doc, clipped);
+    app.render_path.assume_gpu = true;
+    let dialog = crate::adjust_dialog::open(&mut app, "image.adjustments.curves").unwrap();
+    assert!(!on_layer(&mut app, 0));
+    let doc = app.session.active().unwrap().doc.id.0;
+    assert_eq!(app.render_path.current(doc), Some(&crate::render_path::CpuReason::AdjustPreview("the target is clipped")));
+    let path = crate::render_path::inspect(&app);
+    assert_eq!(path["current"]["kind"], "adjustPreview");
+    assert!(path["current"]["detail"].as_str().is_some_and(|d| d.contains("the target is clipped")), "{path}");
+    // Asked again with nothing changed: no new entry.
+    assert!(!on_layer(&mut app, 0));
+    assert_eq!(app.render_path.history().count(), 1);
+    // A GPU refresh of the canvas while the dialog is open doesn't end the preview's reason.
+    crate::render_path::note(&mut app, doc, crate::render_path::Path::Gpu { full: true });
+    assert_eq!(app.render_path.current(doc), Some(&crate::render_path::CpuReason::AdjustPreview("the target is clipped")));
+    assert_eq!(app.render_path.history().count(), 1);
+    // Closing the dialog ends the reason, though the canvas is still current (no refresh).
+    app.ui.close_dialog(dialog);
+    assert!(!on_layer(&mut app, 0));
+    assert_eq!(app.render_path.current(doc), None);
+    assert_eq!(app.render_path.history().count(), 2);
+    let path = crate::render_path::inspect(&app);
+    assert_eq!(path["history"][1]["kind"], "adjustPreview", "the preview's end isn't the canvas back on the GPU: {path}");
+    assert!(path["history"][1]["detail"].is_null(), "{path}");
+}
+
+/// A document the canvas already draws on the CPU keeps that reason through an adjustment
+/// dialog's proxy preview, and closing the dialog doesn't report "back on the GPU".
+#[test]
+fn an_adjustment_preview_keeps_the_canvas_reason() {
+    use crate::render_path::{CpuReason, Path};
+    let (doc, _) = document(ColorMode::Rgb, SampleType::U8, false);
+    let clipped = doc.layers[2].id;
+    let canvas_back_on_gpu = |app: &crate::PhotocraftApp| app.render_path.history().any(|c| !c.preview && c.reason.is_none());
+    let mut app = app_with(doc.clone(), clipped);
+    app.render_path.assume_gpu = true;
+    let doc_id = app.session.active().unwrap().doc.id.0;
+    let canvas = CpuReason::Unsupported("Advanced Blending on Layer 1".into());
+    crate::render_path::note(&mut app, doc_id, Path::Cpu(canvas.clone()));
+    let dialog = crate::adjust_dialog::open(&mut app, "image.adjustments.curves").unwrap();
+    assert!(!on_layer(&mut app, 0));
+    assert_eq!(app.render_path.current(doc_id), Some(&canvas));
+    app.ui.close_dialog(dialog);
+    assert!(!on_layer(&mut app, 0));
+    assert_eq!(app.render_path.current(doc_id), Some(&canvas));
+    // The canvas entry, then the preview's start and end: never the canvas back on the GPU.
+    assert_eq!(app.render_path.history().filter(|c| !c.preview).count(), 1);
+    assert!(!canvas_back_on_gpu(&app));
+
+    // A window without the GPU (`--safe-gpu`): the preview adds nothing, before or after closing.
+    let mut app = app_with(doc, clipped);
+    app.render_path.assume_gpu = true;
+    let doc_id = app.session.active().unwrap().doc.id.0;
+    let cpu = CpuReason::CpuMode("--safe-gpu".into());
+    crate::render_path::note_app(&mut app, Some(cpu.clone()));
+    let dialog = crate::adjust_dialog::open(&mut app, "image.adjustments.curves").unwrap();
+    assert!(!on_layer(&mut app, 0));
+    assert_eq!(app.render_path.current(doc_id), Some(&cpu));
+    app.ui.close_dialog(dialog);
+    assert!(!on_layer(&mut app, 0));
+    assert_eq!(app.render_path.current(doc_id), Some(&cpu));
+    assert_eq!(app.render_path.history().count(), 1, "the app-wide entry only");
+    assert!(!canvas_back_on_gpu(&app));
+}
+
 #[test]
 fn proxy_factor_follows_the_zoom() {
     assert_eq!(proxy_factor(1.0), 1);
diff --git a/crates/ui-egui/src/dialogs/caf_ui/controls.rs b/crates/ui-egui/src/dialogs/caf_ui/controls.rs
index f01d4d6852..edb3087d00 100644
--- a/crates/ui-egui/src/dialogs/caf_ui/controls.rs
+++ b/crates/ui-egui/src/dialogs/caf_ui/controls.rs
@@ -1,6 +1,6 @@
 use super::lifecycle::{apply, cancel, close, fill_edit, redo, report, reset, set_sampling, undo};
 use super::preview::{rebase, wait_preview};
-use super::*;
+use super::{CafTool, CafWorkspace, LASSO_OPS, PhotocraftApp, ToolEvent, Value, json};
 
 /// Control channel: `edit.contentAwareFill {"ui": {...}}` while the workspace is open.
 pub fn control(app: &mut PhotocraftApp, ui: &Value) -> Result<Value, String> {
diff --git a/crates/ui-egui/src/dialogs/caf_ui/lifecycle.rs b/crates/ui-egui/src/dialogs/caf_ui/lifecycle.rs
index 5bc21da079..fc3cb922f1 100644
--- a/crates/ui-egui/src/dialogs/caf_ui/lifecycle.rs
+++ b/crates/ui-egui/src/dialogs/caf_ui/lifecycle.rs
@@ -1,5 +1,5 @@
 use super::preview::{Base, Preview, cancel_preview, compute_base, plan_params, points_limit, rebase, refresh};
-use super::*;
+use super::{CMD, CafOpts, CafTool, CafWorkspace, MAX_CAF_EDITS, MAX_CAF_POINTS, PROXY_SIDE, PhotocraftApp, REMEMBERED, Rect, Step, Value};
 
 /// Opens the workspace on the active layer and its selection.
 pub fn open(app: &mut PhotocraftApp) -> Result<(), String> {
diff --git a/crates/ui-egui/src/dialogs/caf_ui/preview.rs b/crates/ui-egui/src/dialogs/caf_ui/preview.rs
index 628893bf1b..cf17506e3d 100644
--- a/crates/ui-egui/src/dialogs/caf_ui/preview.rs
+++ b/crates/ui-egui/src/dialogs/caf_ui/preview.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{CMD, CafWorkspace, Color32, LayerId, MAX_CAF_POINTS, MAX_OUTLINE_EDGES, PhotocraftApp, Rect, TextureHandle, Value, json, stroke_json};
 
 /// What the plan (without the brush strokes) says: the window, the fill area and the sampling
 /// option's area, over `rect`.
diff --git a/crates/ui-egui/src/dialogs/caf_ui/view.rs b/crates/ui-egui/src/dialogs/caf_ui/view.rs
index f9987ff822..a2124c9ef5 100644
--- a/crates/ui-egui/src/dialogs/caf_ui/view.rs
+++ b/crates/ui-egui/src/dialogs/caf_ui/view.rs
@@ -1,7 +1,10 @@
 use super::controls::{pointer, tool_icon, tool_tip};
 use super::lifecycle::{apply, bounds, cancel, commit, fill_edit, report, reset, set_sampling};
 use super::preview::{drive_preview, rebase, refresh};
-use super::*;
+use super::{
+    Align2, BAR_H, CafTool, CafWorkspace, Color32, ERect, FontId, LEFT_W, PANEL_W, PREVIEW_W, PhotocraftApp, Pos2, Rect, Sense, Stroke, Tokens, ToolEvent,
+    Value, json, pos2, vec2, widgets,
+};
 
 /// A view: screen px per document px and the document point at the centre of `area`.
 #[derive(Clone, Copy)]
@@ -26,6 +29,52 @@ impl View {
 }
 
 /// Upload what changed: the document proxy, the overlay, a finished preview.
+/// The options bar of the Content-Aware Fill workspace, for the active tool.
+fn caf_options_bar(bui: &mut egui::Ui, w: &mut CafWorkspace, fill_btn: &mut Option<Value>, reset_what: &mut Option<&str>) {
+    match w.tool {
+        CafTool::Brush => {
+            if crate::icons::button(bui, "plus", 26.0, w.brush_add, tl!("Add")).clicked() {
+                w.brush_add = true;
+            }
+            if crate::icons::button(bui, "minus", 26.0, !w.brush_add, tl!("Subtract")).clicked() {
+                w.brush_add = false;
+            }
+            bui.add_space(8.0);
+            bui.label(tl!("Size:"));
+            let mut size = w.brush_size as f32;
+            if widgets::value_field(bui, &mut size, 1.0..=5000.0, " px", 64.0).accessible_name(tl!("Size:")).changed() {
+                w.brush_size = f64::from(size);
+            }
+        }
+        CafTool::Lasso => {
+            // The selection tools' mode buttons (the lasso here edits the fill area).
+            let tips = [
+                tl!("New selection").to_string(),
+                crate::i18n::fmt(tl!("Add to selection  ({key})"), &[("key", &crate::shortcuts::pretty("Shift"))]),
+                crate::i18n::fmt(tl!("Subtract from selection  ({key})"), &[("key", &crate::shortcuts::pretty("Alt"))]),
+                crate::i18n::fmt(tl!("Intersect with selection  ({key})"), &[("key", &crate::shortcuts::pretty("Shift+Alt"))]),
+            ];
+            for (i, (icon, tip)) in ["square", "plus", "minus", "squares-subtract"].into_iter().zip(tips.iter()).enumerate() {
+                if crate::icons::button(bui, icon, 26.0, w.lasso_op == i, tip).clicked() {
+                    w.lasso_op = i;
+                }
+            }
+            bui.add_space(8.0);
+            if widgets::secondary_button(bui, tl!("Expand"), 70.0).clicked() {
+                *fill_btn = Some(json!({"op": "expand", "by": w.expand_by}));
+            }
+            if widgets::secondary_button(bui, tl!("Contract"), 70.0).clicked() {
+                *fill_btn = Some(json!({"op": "contract", "by": w.expand_by}));
+            }
+            widgets::value_field(bui, &mut w.expand_by, 1.0..=100.0, " px", 56.0).accessible_name(tl!("Expand"));
+            if crate::icons::button(bui, "undo-2", 26.0, false, tl!("Reset")).clicked() {
+                *reset_what = Some("lasso");
+            }
+        }
+        _ => {}
+    }
+}
+
 fn upload(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let need_image = app.distort.caf.as_ref().is_some_and(|w| w.image_tex.is_none());
     if need_image {
@@ -65,6 +114,153 @@ pub(super) fn view_image(app: &PhotocraftApp) -> Option<egui::ColorImage> {
     Some(crate::canvas::display_image(display.as_deref(), &buf))
 }
 
+/// The Content-Aware Fill panel's scrolling settings: sampling area, fill and output options.
+fn caf_props_panel(
+    ui: &mut egui::Ui,
+    w: &mut CafWorkspace,
+    t: &Tokens,
+    reset_what: &mut Option<&str>,
+    new_sampling: &mut Option<&str>,
+    rebase_needed: &mut bool,
+) {
+    ui.spacing_mut().item_spacing.y = 6.0;
+    egui::CollapsingHeader::new(tl!("Sampling Area Overlay")).id_salt("caf-overlay").default_open(false).show(ui, |ui| {
+        widgets::checkbox(ui, &mut w.opts.show_overlay, tl!("Show Sampling Area"));
+        widgets::slider_row(ui, tl!("Opacity"), &mut w.opts.opacity, 0.0..=100.0, "%", None);
+        ui.horizontal(|ui| {
+            ui.label(tl!("Color"));
+            widgets::color_edit_button_srgb(ui, &mut w.opts.color);
+            ui.add_space(8.0);
+            ui.label(tl!("Indicates"));
+            widgets::dropdown(
+                ui,
+                "caf-indicates",
+                tl!("Indicates"),
+                &mut w.opts.excluded,
+                &[(false, tl!("Sampling Area")), (true, tl!("Excluded Area"))],
+                120.0,
+            );
+        });
+    });
+    widgets::hairline(ui);
+    ui.horizontal(|ui| {
+        widgets::section_label(ui, tl!("Sampling Area Options"));
+        ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+            if crate::icons::button(ui, "undo-2", 22.0, false, tl!("Reset")).clicked() {
+                *reset_what = Some("sampling");
+            }
+        });
+    });
+    ui.horizontal(|ui| {
+        for (k, l) in [("auto", tl!("Auto")), ("rectangular", tl!("Rectangular")), ("custom", tl!("Custom"))] {
+            if ui.selectable_label(w.opts.sampling == k, l).clicked() && w.opts.sampling != k {
+                *new_sampling = Some(k);
+            }
+        }
+    });
+    if widgets::checkbox(ui, &mut w.opts.sample_all, tl!("Sample All Layers")).changed() {
+        *rebase_needed = true;
+    }
+    widgets::hairline(ui);
+    ui.horizontal(|ui| {
+        widgets::section_label(ui, tl!("Fill Settings"));
+        ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+            if crate::icons::button(ui, "undo-2", 22.0, false, tl!("Reset")).clicked() {
+                *reset_what = Some("fill");
+            }
+        });
+    });
+    ui.horizontal(|ui| {
+        ui.label(tl!("Color Adaptation"));
+        let o = [
+            ("none".to_string(), tl!("None")),
+            ("default".to_string(), tl!("Default")),
+            ("high".to_string(), tl!("High")),
+            ("veryHigh".to_string(), tl!("Very High")),
+        ];
+        widgets::dropdown(ui, "caf-color", tl!("Color Adaptation"), &mut w.opts.color_adaptation, &o, 110.0);
+    });
+    ui.horizontal(|ui| {
+        ui.label(tl!("Rotation Adaptation"));
+        let o = [
+            ("none".to_string(), tl!("None")),
+            ("low".to_string(), tl!("Low")),
+            ("medium".to_string(), tl!("Medium")),
+            ("high".to_string(), tl!("High")),
+            ("full".to_string(), tl!("Full")),
+        ];
+        widgets::dropdown(ui, "caf-rotation", tl!("Rotation Adaptation"), &mut w.opts.rotation, &o, 110.0);
+    });
+    ui.horizontal(|ui| {
+        widgets::checkbox(ui, &mut w.opts.scale, tl!("Scale"));
+        widgets::checkbox(ui, &mut w.opts.mirror, tl!("Mirror"));
+    });
+    widgets::hairline(ui);
+    widgets::section_label(ui, tl!("Output Settings"));
+    ui.horizontal(|ui| {
+        ui.label(tl!("Output To"));
+        let o = [("current".to_string(), tl!("Current Layer")), ("new".to_string(), tl!("New Layer")), ("duplicate".to_string(), tl!("Duplicate Layer"))];
+        widgets::dropdown(ui, "caf-output", tl!("Output To"), &mut w.opts.output, &o, 140.0);
+    });
+    if let Some(e) = w.error.as_ref().or(w.preview.error.as_ref()) {
+        ui.label(egui::RichText::new(e.as_str()).color(t.danger).size(11.0));
+    }
+}
+
+/// The Preview panel: the sampled result in its own pan / zoom view, and the zoom row under it.
+fn caf_preview_panel(ui: &mut egui::Ui, painter: &egui::Painter, t: &Tokens, w: &mut CafWorkspace, pv_rect: ERect) {
+    painter.rect_filled(pv_rect, 0.0, t.dock);
+    painter.line_segment([pv_rect.left_top(), pv_rect.left_bottom()], Stroke::new(1.0, t.separator));
+    painter.text(pv_rect.left_top() + vec2(12.0, 10.0), Align2::LEFT_TOP, tl!("Preview"), FontId::proportional(12.0), t.text);
+    let pv_area = ERect::from_min_max(pv_rect.min + vec2(0.0, 30.0), pv_rect.max - vec2(0.0, 44.0));
+    painter.rect_filled(pv_area, 0.0, t.canvas);
+    if w.preview.zoom <= 0.0 {
+        // Opens framed on the sampling window, as Photoshop's.
+        let win = w.base.window;
+        if !win.is_empty() {
+            w.preview.zoom = (pv_area.width() / win.width().max(win.height()) as f32).clamp(0.01, 32.0);
+            w.preview.center = [f64::from(win.x0 + win.x1) / 2.0, f64::from(win.y0 + win.y1) / 2.0];
+        }
+    }
+    let pv = View { area: pv_area, zoom: w.preview.zoom.max(0.01), center: w.preview.center };
+    let pclip = painter.with_clip_rect(pv_area);
+    let uv = ERect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0));
+    let img_rect = pv.rect(w.canvas);
+    widgets::checker(&pclip, img_rect.intersect(pv_area), 8.0);
+    if let Some(tex) = &w.image_tex {
+        pclip.image(tex.id(), img_rect, uv, Color32::WHITE);
+    }
+    if let Some((tex, r)) = &w.preview.tex {
+        pclip.image(tex.id(), pv.rect(*r), uv, Color32::WHITE);
+    }
+    if w.preview.shown != w.preview.want {
+        // Being recomputed: a spinner in the corner.
+        let sp = ERect::from_min_size(pv_area.right_bottom() - vec2(26.0, 26.0), vec2(18.0, 18.0));
+        ui.put(sp, egui::Spinner::new().size(16.0));
+    }
+    let presp = ui.interact(pv_area, egui::Id::unique("caf-preview-view"), Sense::click_and_drag());
+    if presp.dragged() {
+        let d = presp.drag_delta();
+        w.preview.center = [w.preview.center[0] - f64::from(d.x / pv.zoom), w.preview.center[1] - f64::from(d.y / pv.zoom)];
+    }
+    if presp.hovered() {
+        let scroll = ui.input(|i| i.smooth_scroll_delta.y);
+        if scroll != 0.0 {
+            w.preview.zoom = (w.preview.zoom * (scroll / 200.0).exp()).clamp(0.01, 32.0);
+        }
+    }
+    let zrow = ERect::from_min_size(pos2(pv_rect.left() + 10.0, pv_rect.bottom() - 38.0), vec2(PREVIEW_W - 20.0, 30.0));
+    let mut zr = ui.new_child(egui::UiBuilder::new().max_rect(zrow).layout(egui::Layout::left_to_right(egui::Align::Center)));
+    let mut pct = (w.preview.zoom * 100.0).round();
+    if widgets::value_field(&mut zr, &mut pct, 1.0..=3200.0, "%", 64.0).accessible_name(tl!("Zoom")).changed() {
+        w.preview.zoom = pct / 100.0;
+    }
+    let mut lz = pct.max(1.0).ln();
+    if zr.add(egui::Slider::new(&mut lz, 0.0..=3200f32.ln()).show_value(false)).accessible_name(tl!("Zoom")).changed() {
+        w.preview.zoom = lz.exp() / 100.0;
+    }
+}
+
 /// Draws the workspace (a full-window layer over the app).
 pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     // An Apply (or anything else) changed the document: refresh.
@@ -108,48 +304,8 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
         painter.line_segment([bar.left_bottom(), bar.right_bottom()], Stroke::new(1.0, t.separator));
         let mut bui =
             ui.new_child(egui::UiBuilder::new().max_rect(bar.shrink2(vec2(LEFT_W + 8.0, 4.0))).layout(egui::Layout::left_to_right(egui::Align::Center)));
-        match w.tool {
-            CafTool::Brush => {
-                if crate::icons::button(&mut bui, "plus", 26.0, w.brush_add, tl!("Add")).clicked() {
-                    w.brush_add = true;
-                }
-                if crate::icons::button(&mut bui, "minus", 26.0, !w.brush_add, tl!("Subtract")).clicked() {
-                    w.brush_add = false;
-                }
-                bui.add_space(8.0);
-                bui.label(tl!("Size:"));
-                let mut size = w.brush_size as f32;
-                if widgets::value_field(&mut bui, &mut size, 1.0..=5000.0, " px", 64.0).accessible_name(tl!("Size:")).changed() {
-                    w.brush_size = f64::from(size);
-                }
-            }
-            CafTool::Lasso => {
-                // The selection tools' mode buttons (the lasso here edits the fill area).
-                let tips = [
-                    tl!("New selection").to_string(),
-                    crate::i18n::fmt(tl!("Add to selection  ({key})"), &[("key", &crate::shortcuts::pretty("Shift"))]),
-                    crate::i18n::fmt(tl!("Subtract from selection  ({key})"), &[("key", &crate::shortcuts::pretty("Alt"))]),
-                    crate::i18n::fmt(tl!("Intersect with selection  ({key})"), &[("key", &crate::shortcuts::pretty("Shift+Alt"))]),
-                ];
-                for (i, (icon, tip)) in ["square", "plus", "minus", "squares-subtract"].into_iter().zip(tips.iter()).enumerate() {
-                    if crate::icons::button(&mut bui, icon, 26.0, w.lasso_op == i, tip).clicked() {
-                        w.lasso_op = i;
-                    }
-                }
-                bui.add_space(8.0);
-                if widgets::secondary_button(&mut bui, tl!("Expand"), 70.0).clicked() {
-                    fill_btn = Some(json!({"op": "expand", "by": w.expand_by}));
-                }
-                if widgets::secondary_button(&mut bui, tl!("Contract"), 70.0).clicked() {
-                    fill_btn = Some(json!({"op": "contract", "by": w.expand_by}));
-                }
-                widgets::value_field(&mut bui, &mut w.expand_by, 1.0..=100.0, " px", 56.0).accessible_name(tl!("Expand"));
-                if crate::icons::button(&mut bui, "undo-2", 26.0, false, tl!("Reset")).clicked() {
-                    reset_what = Some("lasso");
-                }
-            }
-            _ => {}
-        }
+        caf_options_bar(&mut bui, w, &mut fill_btn, &mut reset_what);
+
         let body = ERect::from_min_max(pos2(full.left(), bar.bottom()), full.max);
         // Left tool strip.
         let left = ERect::from_min_size(pos2(full.left(), title.bottom()), vec2(LEFT_W, full.height() - title.height()));
@@ -168,91 +324,9 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
         painter.line_segment([right.left_top(), right.left_bottom()], Stroke::new(1.0, t.separator));
         let mut props =
             ui.new_child(egui::UiBuilder::new().max_rect(ERect::from_min_max(right.min + vec2(14.0, 12.0), pos2(right.right() - 14.0, right.bottom() - 60.0))));
-        egui::ScrollArea::vertical().id_salt("caf-props").show(&mut props, |ui| {
-            ui.spacing_mut().item_spacing.y = 6.0;
-            egui::CollapsingHeader::new(tl!("Sampling Area Overlay")).id_salt("caf-overlay").default_open(false).show(ui, |ui| {
-                widgets::checkbox(ui, &mut w.opts.show_overlay, tl!("Show Sampling Area"));
-                widgets::slider_row(ui, tl!("Opacity"), &mut w.opts.opacity, 0.0..=100.0, "%", None);
-                ui.horizontal(|ui| {
-                    ui.label(tl!("Color"));
-                    widgets::color_edit_button_srgb(ui, &mut w.opts.color);
-                    ui.add_space(8.0);
-                    ui.label(tl!("Indicates"));
-                    widgets::dropdown(
-                        ui,
-                        "caf-indicates",
-                        tl!("Indicates"),
-                        &mut w.opts.excluded,
-                        &[(false, tl!("Sampling Area")), (true, tl!("Excluded Area"))],
-                        120.0,
-                    );
-                });
-            });
-            widgets::hairline(ui);
-            ui.horizontal(|ui| {
-                widgets::section_label(ui, tl!("Sampling Area Options"));
-                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                    if crate::icons::button(ui, "undo-2", 22.0, false, tl!("Reset")).clicked() {
-                        reset_what = Some("sampling");
-                    }
-                });
-            });
-            ui.horizontal(|ui| {
-                for (k, l) in [("auto", tl!("Auto")), ("rectangular", tl!("Rectangular")), ("custom", tl!("Custom"))] {
-                    if ui.selectable_label(w.opts.sampling == k, l).clicked() && w.opts.sampling != k {
-                        new_sampling = Some(k);
-                    }
-                }
-            });
-            if widgets::checkbox(ui, &mut w.opts.sample_all, tl!("Sample All Layers")).changed() {
-                rebase_needed = true;
-            }
-            widgets::hairline(ui);
-            ui.horizontal(|ui| {
-                widgets::section_label(ui, tl!("Fill Settings"));
-                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                    if crate::icons::button(ui, "undo-2", 22.0, false, tl!("Reset")).clicked() {
-                        reset_what = Some("fill");
-                    }
-                });
-            });
-            ui.horizontal(|ui| {
-                ui.label(tl!("Color Adaptation"));
-                let o = [
-                    ("none".to_string(), tl!("None")),
-                    ("default".to_string(), tl!("Default")),
-                    ("high".to_string(), tl!("High")),
-                    ("veryHigh".to_string(), tl!("Very High")),
-                ];
-                widgets::dropdown(ui, "caf-color", tl!("Color Adaptation"), &mut w.opts.color_adaptation, &o, 110.0);
-            });
-            ui.horizontal(|ui| {
-                ui.label(tl!("Rotation Adaptation"));
-                let o = [
-                    ("none".to_string(), tl!("None")),
-                    ("low".to_string(), tl!("Low")),
-                    ("medium".to_string(), tl!("Medium")),
-                    ("high".to_string(), tl!("High")),
-                    ("full".to_string(), tl!("Full")),
-                ];
-                widgets::dropdown(ui, "caf-rotation", tl!("Rotation Adaptation"), &mut w.opts.rotation, &o, 110.0);
-            });
-            ui.horizontal(|ui| {
-                widgets::checkbox(ui, &mut w.opts.scale, tl!("Scale"));
-                widgets::checkbox(ui, &mut w.opts.mirror, tl!("Mirror"));
-            });
-            widgets::hairline(ui);
-            widgets::section_label(ui, tl!("Output Settings"));
-            ui.horizontal(|ui| {
-                ui.label(tl!("Output To"));
-                let o =
-                    [("current".to_string(), tl!("Current Layer")), ("new".to_string(), tl!("New Layer")), ("duplicate".to_string(), tl!("Duplicate Layer"))];
-                widgets::dropdown(ui, "caf-output", tl!("Output To"), &mut w.opts.output, &o, 140.0);
-            });
-            if let Some(e) = w.error.as_ref().or(w.preview.error.as_ref()) {
-                ui.label(egui::RichText::new(e.as_str()).color(t.danger).size(11.0));
-            }
-        });
+        egui::ScrollArea::vertical()
+            .id_salt("caf-props")
+            .show(&mut props, |ui| caf_props_panel(ui, w, &t, &mut reset_what, &mut new_sampling, &mut rebase_needed));
         // Footer, in Photoshop's order on every platform: reset all at the left, then OK, Apply,
         // Cancel against the right edge.
         let foot = ERect::from_min_size(pos2(right.left() + 10.0, right.bottom() - 48.0), vec2(PANEL_W - 20.0, 32.0));
@@ -271,56 +345,8 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
         }
         // The Preview panel.
         let pv_rect = ERect::from_min_size(pos2(right.left() - PREVIEW_W, body.top()), vec2(PREVIEW_W, body.height()));
-        painter.rect_filled(pv_rect, 0.0, t.dock);
-        painter.line_segment([pv_rect.left_top(), pv_rect.left_bottom()], Stroke::new(1.0, t.separator));
-        painter.text(pv_rect.left_top() + vec2(12.0, 10.0), Align2::LEFT_TOP, tl!("Preview"), FontId::proportional(12.0), t.text);
-        let pv_area = ERect::from_min_max(pv_rect.min + vec2(0.0, 30.0), pv_rect.max - vec2(0.0, 44.0));
-        painter.rect_filled(pv_area, 0.0, t.canvas);
-        if w.preview.zoom <= 0.0 {
-            // Opens framed on the sampling window, as Photoshop's.
-            let win = w.base.window;
-            if !win.is_empty() {
-                w.preview.zoom = (pv_area.width() / win.width().max(win.height()) as f32).clamp(0.01, 32.0);
-                w.preview.center = [f64::from(win.x0 + win.x1) / 2.0, f64::from(win.y0 + win.y1) / 2.0];
-            }
-        }
-        let pv = View { area: pv_area, zoom: w.preview.zoom.max(0.01), center: w.preview.center };
-        let pclip = painter.with_clip_rect(pv_area);
         let uv = ERect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0));
-        let img_rect = pv.rect(w.canvas);
-        widgets::checker(&pclip, img_rect.intersect(pv_area), 8.0);
-        if let Some(tex) = &w.image_tex {
-            pclip.image(tex.id(), img_rect, uv, Color32::WHITE);
-        }
-        if let Some((tex, r)) = &w.preview.tex {
-            pclip.image(tex.id(), pv.rect(*r), uv, Color32::WHITE);
-        }
-        if w.preview.shown != w.preview.want {
-            // Being recomputed: a spinner in the corner.
-            let sp = ERect::from_min_size(pv_area.right_bottom() - vec2(26.0, 26.0), vec2(18.0, 18.0));
-            ui.put(sp, egui::Spinner::new().size(16.0));
-        }
-        let presp = ui.interact(pv_area, egui::Id::unique("caf-preview-view"), Sense::click_and_drag());
-        if presp.dragged() {
-            let d = presp.drag_delta();
-            w.preview.center = [w.preview.center[0] - f64::from(d.x / pv.zoom), w.preview.center[1] - f64::from(d.y / pv.zoom)];
-        }
-        if presp.hovered() {
-            let scroll = ui.input(|i| i.smooth_scroll_delta.y);
-            if scroll != 0.0 {
-                w.preview.zoom = (w.preview.zoom * (scroll / 200.0).exp()).clamp(0.01, 32.0);
-            }
-        }
-        let zrow = ERect::from_min_size(pos2(pv_rect.left() + 10.0, pv_rect.bottom() - 38.0), vec2(PREVIEW_W - 20.0, 30.0));
-        let mut zr = ui.new_child(egui::UiBuilder::new().max_rect(zrow).layout(egui::Layout::left_to_right(egui::Align::Center)));
-        let mut pct = (w.preview.zoom * 100.0).round();
-        if widgets::value_field(&mut zr, &mut pct, 1.0..=3200.0, "%", 64.0).accessible_name(tl!("Zoom")).changed() {
-            w.preview.zoom = pct / 100.0;
-        }
-        let mut lz = pct.max(1.0).ln();
-        if zr.add(egui::Slider::new(&mut lz, 0.0..=3200f32.ln()).show_value(false)).accessible_name(tl!("Zoom")).changed() {
-            w.preview.zoom = lz.exp() / 100.0;
-        }
+        caf_preview_panel(ui, &painter, &t, w, pv_rect);
         // The document view.
         let area = ERect::from_min_max(pos2(left.right(), body.top()), pos2(pv_rect.left(), body.bottom()));
         painter.rect_filled(area, 0.0, t.canvas);
diff --git a/crates/ui-egui/src/dialogs/camera_raw_ui.rs b/crates/ui-egui/src/dialogs/camera_raw_ui.rs
index e920b95da8..1b71ef3306 100644
--- a/crates/ui-egui/src/dialogs/camera_raw_ui.rs
+++ b/crates/ui-egui/src/dialogs/camera_raw_ui.rs
@@ -19,6 +19,7 @@ use photocraft_algo::camera_raw::{CameraRaw, Wheel, curve_lut};
 use photocraft_algo::histogram::RgbHistogram;
 
 use crate::camera_raw_scope_ui::{MAX_SAMPLERS, ToneZone};
+
 use photocraft_doc::LayerId;
 use photocraft_geom::Rect;
 use serde_json::{Value, json};
diff --git a/crates/ui-egui/src/dialogs/camera_raw_ui/controls.rs b/crates/ui-egui/src/dialogs/camera_raw_ui/controls.rs
index 3f9e8ba19b..389af64d96 100644
--- a/crates/ui-egui/src/dialogs/camera_raw_ui/controls.rs
+++ b/crates/ui-egui/src/dialogs/camera_raw_ui/controls.rs
@@ -1,6 +1,9 @@
 use super::open::{Target, cancel, commit_open_raw, open_raw, raw_stage};
 use super::sidecar::{load_settings, report_file_error, save_settings};
-use super::*;
+use super::{
+    Align2, BANDS, CameraRaw, CameraRawDialog, Color32, ERect, FontId, PANEL_W, PhotocraftApp, Pos2, Sense, Stroke, Tokens, ToneZone, Value, Wheel, curve_lut,
+    json, pos2, vec2, widgets,
+};
 
 const RAW_UNDO_LIMIT: usize = 40;
 
@@ -101,6 +104,16 @@ fn tint_stops() -> Vec<Color32> {
 }
 
 /// One labelled slider; marks the dialog dirty when it moves.
+/// The track of Color Mixer band `k` on `tab` (0 Hue, 1 Saturation, 2 Luminance). A Hue slider
+/// turns its band towards the neighbouring bands, so its track runs from the previous band's hue
+/// through its own to the next one's (Reds: magenta, red, orange; #9550); Saturation and Luminance
+/// run from grey to the band's colour.
+pub(super) fn mixer_gradient(tab: usize, k: usize) -> Vec<Color32> {
+    let bands = &photocraft_algo::camera_raw::HSL_BANDS;
+    let hue = |i: usize| widgets::hue_color(bands.get(i % bands.len()).copied().unwrap_or(0.0));
+    if tab == 0 { vec![hue(k + bands.len() - 1), hue(k), hue(k + 1)] } else { vec![Color32::from_gray(128), hue(k)] }
+}
+
 fn row(ui: &mut egui::Ui, dirty: &mut bool, label: &str, v: &mut f32, range: std::ops::RangeInclusive<f32>, grad: Option<&[Color32]>) {
     let _ = slider(ui, dirty, label, v, range, grad);
 }
@@ -398,9 +411,7 @@ fn draw(app: &mut PhotocraftApp, ctx: &egui::Context, own_window: bool) {
                     _ => &mut p.hsl_lum,
                 };
                 for (k, name) in BANDS.iter().enumerate() {
-                    let c = photocraft_algo::camera_raw::HSL_BANDS[k];
-                    let base = widgets::hue_color(c);
-                    let grad = [Color32::from_gray(128), base];
+                    let grad = mixer_gradient(d.mixer_tab, k);
                     row(ui, &mut dirty, name, &mut arr[k], -100.0..=100.0, Some(&grad));
                 }
             });
diff --git a/crates/ui-egui/src/dialogs/camera_raw_ui/convert.rs b/crates/ui-egui/src/dialogs/camera_raw_ui/convert.rs
index 873db1a826..908f01e1f1 100644
--- a/crates/ui-egui/src/dialogs/camera_raw_ui/convert.rs
+++ b/crates/ui-egui/src/dialogs/camera_raw_ui/convert.rs
@@ -1,5 +1,5 @@
 use super::open::{Coverage, Target};
-use super::*;
+use super::{CameraRaw, CameraRawDialog, LayerId, MAX_SAMPLERS, PROXY_SIDE, PhotocraftApp, Rect, RgbHistogram, Value, json};
 
 /// Camera Raw Defaults › Sharpen For: output sharpening, folded into the Camera Raw step `rest`
 /// as the workflow's Sharpen For is. Returns what it applied.
diff --git a/crates/ui-egui/src/dialogs/camera_raw_ui/menu.rs b/crates/ui-egui/src/dialogs/camera_raw_ui/menu.rs
index 91b938e14c..ead69eba2b 100644
--- a/crates/ui-egui/src/dialogs/camera_raw_ui/menu.rs
+++ b/crates/ui-egui/src/dialogs/camera_raw_ui/menu.rs
@@ -1,7 +1,7 @@
 use super::controls::{commit, redo_edit, remember_edit, undo_edit};
 use super::open::{cancel, open, open_smart_filter};
 use super::sidecar::{load_settings, save_settings};
-use super::*;
+use super::{CameraRaw, LayerId, PhotocraftApp, Value, json};
 
 /// Menu / control-channel entry point. `None` when the call isn't for this dialog.
 pub fn menu(app: &mut PhotocraftApp, ctx: &egui::Context, id: &str, params: &Value) -> Option<Result<Value, String>> {
diff --git a/crates/ui-egui/src/dialogs/camera_raw_ui/open.rs b/crates/ui-egui/src/dialogs/camera_raw_ui/open.rs
index 429e245eb0..87e1035a85 100644
--- a/crates/ui-egui/src/dialogs/camera_raw_ui/open.rs
+++ b/crates/ui-egui/src/dialogs/camera_raw_ui/open.rs
@@ -1,6 +1,6 @@
 use super::convert::{apply_raw_conversions, open_pixels, output_sharpening, raw_conversions};
 use super::sidecar::{read_sidecar, write_sidecar};
-use super::*;
+use super::{CameraRaw, LayerId, PhotocraftApp, Rect, Value, json};
 
 /// Opens the dialog on the active layer.
 /// Where OK writes: a new filter on the layer, or an existing smart filter (by index).
diff --git a/crates/ui-egui/src/dialogs/camera_raw_ui/proxy.rs b/crates/ui-egui/src/dialogs/camera_raw_ui/proxy.rs
index 93e00960b0..de5e054cb7 100644
--- a/crates/ui-egui/src/dialogs/camera_raw_ui/proxy.rs
+++ b/crates/ui-egui/src/dialogs/camera_raw_ui/proxy.rs
@@ -1,5 +1,7 @@
+#[cfg(not(target_arch = "wasm32"))]
+use super::PARALLEL_MIN_PIXELS;
 use super::open::raw_stage;
-use super::*;
+use super::{CameraRaw, CameraRawDialog, RgbHistogram};
 
 /// Everything one develop of the proxy reads, owned, so it can run off the UI thread.
 pub(super) struct ProxyJob {
diff --git a/crates/ui-egui/src/dialogs/camera_raw_ui/sidecar.rs b/crates/ui-egui/src/dialogs/camera_raw_ui/sidecar.rs
index 1b5b6c9a3d..dfb03a13b9 100644
--- a/crates/ui-egui/src/dialogs/camera_raw_ui/sidecar.rs
+++ b/crates/ui-egui/src/dialogs/camera_raw_ui/sidecar.rs
@@ -1,6 +1,6 @@
 use super::controls::remember_edit;
 use super::open::RawOpen;
-use super::*;
+use super::{CameraRaw, PhotocraftApp, Value, json};
 
 /// The sidecar beside a raw file: `IMG_0001.xmp` for `IMG_0001.CR2`, as Camera Raw names it.
 pub fn sidecar_path(path: &str) -> String {
diff --git a/crates/ui-egui/src/dialogs/camera_raw_ui/tests.rs b/crates/ui-egui/src/dialogs/camera_raw_ui/tests.rs
index fd3fc82869..bcae932f5e 100644
--- a/crates/ui-egui/src/dialogs/camera_raw_ui/tests.rs
+++ b/crates/ui-egui/src/dialogs/camera_raw_ui/tests.rs
@@ -1,5 +1,19 @@
 use super::*;
 
+/// #9550: a Color Mixer Hue track runs through the neighbouring bands' hues (Reds: magenta to
+/// orange, wrapping round), not from grey; Saturation and Luminance keep grey to the colour.
+#[test]
+fn hue_tracks_run_between_the_neighbouring_bands() {
+    use super::controls::mixer_gradient;
+    let hue = |d: f32| widgets::hue_color(d);
+    assert_eq!(mixer_gradient(0, 0), vec![hue(300.0), hue(0.0), hue(30.0)], "Reds");
+    assert_eq!(mixer_gradient(0, 7), vec![hue(270.0), hue(300.0), hue(0.0)], "Magentas");
+    assert_eq!(mixer_gradient(0, 3), vec![hue(60.0), hue(120.0), hue(180.0)], "Greens");
+    for tab in [1, 2] {
+        assert_eq!(mixer_gradient(tab, 3), vec![Color32::from_gray(128), hue(120.0)]);
+    }
+}
+
 #[test]
 fn preview_texture_uses_linear_document_display_encoding() {
     let mut doc = photocraft_doc::Document::new("test", photocraft_geom::Size::new(1, 1), photocraft_doc::ColorMode::Rgb, photocraft_doc::SampleType::F32);
diff --git a/crates/ui-egui/src/dialogs/credits.rs b/crates/ui-egui/src/dialogs/credits.rs
index dd10ec47e4..1ca9792e16 100644
--- a/crates/ui-egui/src/dialogs/credits.rs
+++ b/crates/ui-egui/src/dialogs/credits.rs
@@ -266,7 +266,7 @@ fn contributors_in(app: &mut PhotocraftApp, ui: &mut egui::Ui, contributors: &[C
         ui.separator();
         ui.label(tl!("Sort"));
         let (press, close) = crate::press_menu::PressCombo::before(ui, "credits_sort");
-        let sort = egui::ComboBox::from_id_salt("credits_sort").selected_text(v.key.label().0).close_behavior(close).show_ui(ui, |ui| {
+        let sort = craft_ui::ComboBox::from_id_salt("credits_sort").selected_text(v.key.label().0).close_behavior(close).show_ui(ui, |ui| {
             for k in SortKey::ALL {
                 let item = ui.selectable_label(v.key == k, k.label().0);
                 if press.chosen(ui, &item) {
diff --git a/crates/ui-egui/src/dialogs/dialog_blend_ui.rs b/crates/ui-egui/src/dialogs/dialog_blend_ui.rs
index 8ff086cebe..927f82891c 100644
--- a/crates/ui-egui/src/dialogs/dialog_blend_ui.rs
+++ b/crates/ui-egui/src/dialogs/dialog_blend_ui.rs
@@ -54,7 +54,7 @@ fn label(ui: &mut egui::Ui, text: &str) {
 }
 
 /// The `mode` param naming a blend mode ("normal", "colorBurn"…), parsed by the engine.
-fn mode_key(m: photocraft_color::BlendMode) -> String {
+pub(crate) fn mode_key(m: photocraft_color::BlendMode) -> String {
     let s = format!("{m:?}");
     let mut c = s.chars();
     c.next().map(|f| f.to_ascii_lowercase().to_string() + c.as_str()).unwrap_or_default()
diff --git a/crates/ui-egui/src/dialogs/file_ui/print.rs b/crates/ui-egui/src/dialogs/file_ui/print.rs
index 8ed54e6644..c077259f92 100644
--- a/crates/ui-egui/src/dialogs/file_ui/print.rs
+++ b/crates/ui-egui/src/dialogs/file_ui/print.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Arc, DialogKind, Map, PhotocraftApp, Tokens, Value, b, check, dropdown_str, json, n, number, params, s};
 
 /// Print's Printer menu: the default printer (value ""), then every printer `file.printers`
 /// listed. A saved name the spooler no longer lists stays selectable rather than vanishing.
@@ -31,9 +31,6 @@ pub fn open_print(app: &mut PhotocraftApp) -> u64 {
     let mut f = Map::new();
     f.insert("__print".into(), json!(true));
     f.insert("__label".into(), json!("PhotoCraft Print Settings"));
-    // Asked once per opening: the Printer menu lists what the spooler knows now.
-    let printers = app.session.execute("file.printers", json!({})).unwrap_or_default();
-    f.insert("__systemPrinters".into(), printers["printers"].clone());
     // The settings of the last print, also from an earlier session (#7410).
     if let Some(Value::Object(m)) = photocraft_engine::print_cmds::last_print(&app.session) {
         f.extend(m);
@@ -63,17 +60,31 @@ pub fn open_print(app: &mut PhotocraftApp) -> u64 {
     ] {
         f.entry(k.to_string()).or_insert(v);
     }
-    // Windows: the system's printers, and the paper from the chosen printer's driver settings.
-    if let Ok(list) = craft_print::rgb::printers() {
+    refresh_printers(app, &mut f);
+    app.ui.open_dialog(DialogKind::Command, f)
+}
+
+fn refresh_printers(app: &mut PhotocraftApp, f: &mut Map<String, Value>) {
+    if photocraft_engine::print_cmds::try_with_spooler(|| take_printer_lists(app, f)).is_some() {
+        f.remove("__printerListingPending");
+    } else {
+        take_printer_lists(app, f);
+        f.insert("__printerListingPending".into(), json!(true));
+    }
+}
+
+fn take_printer_lists(app: &mut PhotocraftApp, f: &mut Map<String, Value>) {
+    let printers = photocraft_engine::print_cmds::printers_without_waiting(&mut app.session);
+    f.insert("__systemPrinters".into(), printers["printers"].clone());
+    if let Ok(list) = photocraft_engine::print_cmds::rgb_printers_without_waiting(&app.session) {
         f.insert("__printers".into(), json!(list.iter().map(|p| p.name.clone()).collect::<Vec<_>>()));
         let known = |n: &str| list.iter().any(|p| p.name == n);
-        if !known(&s(&f, "printer", "")) {
+        if !list.is_empty() && !known(&s(f, "printer", "")) {
             let fallback = list.iter().find(|p| p.default).or(list.first()).map(|p| p.name.clone()).unwrap_or_default();
             f.insert("printer".into(), json!(fallback));
             f.remove("printerSettings");
         }
     }
-    app.ui.open_dialog(DialogKind::Command, f)
 }
 
 /// Whether the driver's paper, as `driver_page` took it, is wider than tall: the Orientation
@@ -91,11 +102,14 @@ pub(super) fn turn_driver(app: &mut PhotocraftApp, f: &mut Map<String, Value>, l
     if let (Some(h), Some(o)) = (f.get("printerSettings").cloned(), q.as_object_mut()) {
         o.insert("printerSettings".into(), h);
     }
-    match app.session.execute("file.print.page", q) {
-        Ok(r) => take_turned_page(f, &r),
-        Err(e) => {
+    match photocraft_engine::print_cmds::try_with_spooler(|| app.session.execute("file.print.page", q)) {
+        Some(Ok(r)) => take_turned_page(f, &r),
+        Some(Err(e)) => {
             f.insert("__pageError".into(), json!(e.to_string()));
         }
+        None => {
+            f.insert("__pageError".into(), json!(photocraft_engine::print_cmds::SPOOLER_BUSY));
+        }
     }
 }
 
@@ -115,21 +129,27 @@ pub(super) fn take_turned_page(f: &mut Map<String, Value>, r: &Value) {
 }
 
 /// Takes the paper from the printer's driver settings (Windows), as Photoshop does.
-fn driver_page(f: &mut Map<String, Value>) {
+pub(super) fn driver_page(f: &mut Map<String, Value>) -> bool {
     let printer = s(f, "printer", "");
     let settings = f.get("printerSettings").and_then(Value::as_str).and_then(|h| craft_print::rgb::DevMode::from_hex(h).ok());
-    match craft_print::rgb::page(&printer, settings.as_ref()) {
-        Ok(pg) => {
+    match photocraft_engine::print_cmds::try_with_spooler(|| craft_print::rgb::page(&printer, settings.as_ref())) {
+        Some(Ok(pg)) => {
             f.insert("paper".into(), json!([pg.paper.0, pg.paper.1]));
             f.insert("printable".into(), json!([pg.printable.0, pg.printable.1, pg.printable.2, pg.printable.3]));
             f.insert("orientation".into(), json!("portrait"));
             f.remove("__pageError");
         }
-        Err(e) => {
+        Some(Err(e)) => {
             f.remove("printable");
             f.insert("__pageError".into(), json!(e.to_string()));
         }
+        None => {
+            f.insert("__pageError".into(), json!(photocraft_engine::print_cmds::SPOOLER_BUSY));
+            f.remove("__driverPageInitialized");
+            return false;
+        }
     }
+    true
 }
 
 /// Points per unit for the Position and Size fields.
@@ -280,6 +300,12 @@ pub(super) fn print_preview_image(l: photocraft_engine::print_cmds::PrintLayout,
 /// Dragging the visible image updates dialog offsets live from a fixed gesture origin;
 /// the position row stays present while centered so switching to manual cannot move the page.
 pub(super) fn print_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Value>, id: u64) {
+    if b(f, "__printerListingPending", false) {
+        refresh_printers(app, f);
+        if b(f, "__printerListingPending", false) {
+            ui.ctx().request_repaint_after(std::time::Duration::from_millis(100));
+        }
+    }
     let t = Tokens::get(ui.ctx());
     let Some(doc) = app.session.active().map(|d| d.doc.clone()) else { return };
     // PDF exports and previews retain editable paper on Windows too. Only a real native
@@ -292,8 +318,11 @@ pub(super) fn print_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map
     };
     if printers.is_some() {
         if !b(f, "__driverPageInitialized", false) {
-            driver_page(f);
-            f.insert("__driverPageInitialized".into(), json!(true));
+            if driver_page(f) {
+                f.insert("__driverPageInitialized".into(), json!(true));
+            } else {
+                ui.ctx().request_repaint_after(std::time::Duration::from_millis(100));
+            }
         }
     } else {
         // PDF output and previews have no driver page: Scale to Fit Media uses the paper.
@@ -416,15 +445,18 @@ pub(super) fn print_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map
                     if ui.button(tl!("Print Settings…")).clicked() {
                         let printer = s(f, "printer", "");
                         let current = f.get("printerSettings").and_then(Value::as_str).and_then(|h| craft_print::rgb::DevMode::from_hex(h).ok());
-                        match craft_print::rgb::settings_dialog(&printer, current.as_ref(), None) {
-                            Ok(Some(dm)) => {
+                        match photocraft_engine::print_cmds::try_with_spooler(|| craft_print::rgb::settings_dialog(&printer, current.as_ref(), None)) {
+                            Some(Ok(Some(dm))) => {
                                 f.insert("printerSettings".into(), json!(dm.to_hex()));
                                 driver_page(f);
                             }
-                            Ok(None) => {}
-                            Err(e) => {
+                            Some(Ok(None)) => {}
+                            Some(Err(e)) => {
                                 f.insert("__pageError".into(), json!(e.to_string()));
                             }
+                            None => {
+                                f.insert("__pageError".into(), json!(photocraft_engine::print_cmds::SPOOLER_BUSY));
+                            }
                         }
                     }
                 });
diff --git a/crates/ui-egui/src/dialogs/file_ui/tests.rs b/crates/ui-egui/src/dialogs/file_ui/tests.rs
index 1bc5273cad..19f7b1ceff 100644
--- a/crates/ui-egui/src/dialogs/file_ui/tests.rs
+++ b/crates/ui-egui/src/dialogs/file_ui/tests.rs
@@ -1,5 +1,164 @@
 use super::*;
 
+#[test]
+fn busy_driver_page_requests_a_retry_without_input() {
+    let (mut app, ctx) = app();
+    let mut fields = json!({"printer": "Test printer", "__printers": ["Test printer"], "paper": "letter"}).as_object().unwrap().clone();
+    let (held_tx, held) = std::sync::mpsc::channel();
+    let (release, released_rx) = std::sync::mpsc::channel::<()>();
+    let holder = std::thread::spawn(move || {
+        photocraft_engine::print_cmds::with_spooler(|| {
+            held_tx.send(()).unwrap();
+            let _ = released_rx.recv_timeout(std::time::Duration::from_secs(5));
+        });
+    });
+    held.recv().unwrap();
+    let mut delay = std::time::Duration::MAX;
+    for _ in 0..6 {
+        let mut output = ctx.run_ui(Default::default(), |ui| print_body(&mut app, ui, &mut fields, 1));
+        delay = output.viewport_output[&egui::ViewportId::ROOT].repaint_delay;
+        output.textures_delta.clear();
+    }
+    let busy = fields.get("__pageError").cloned();
+    let initialized = fields.get("__driverPageInitialized").cloned();
+    let _ = release.send(());
+    holder.join().unwrap();
+    assert_eq!(busy, Some(json!(photocraft_engine::print_cmds::SPOOLER_BUSY)));
+    assert_ne!(initialized, Some(json!(true)));
+    assert!(delay <= std::time::Duration::from_millis(100), "busy driver repaint delay: {delay:?}");
+    photocraft_engine::print_cmds::with_spooler(|| {
+        ctx.run_ui(Default::default(), |ui| print_body(&mut app, ui, &mut fields, 1)).textures_delta.clear();
+        assert_eq!(fields.get("__driverPageInitialized"), Some(&json!(true)));
+        assert_ne!(fields.get("__pageError"), Some(&json!(photocraft_engine::print_cmds::SPOOLER_BUSY)));
+    });
+}
+
+#[cfg(windows)]
+#[test]
+fn print_dialog_keeps_saved_settings_when_the_cached_printer_list_is_empty() {
+    use std::sync::atomic::{AtomicBool, Ordering};
+    let (mut app, ctx) = app();
+    let available = Arc::new(AtomicBool::new(false));
+    let listed = Arc::clone(&available);
+    app.session.printer_source = Some(Arc::new(move || {
+        if listed.load(Ordering::SeqCst) {
+            vec![craft_print::Printer { name: "Saved printer".into(), default: true, two_sided: None, description: String::new() }]
+        } else {
+            Vec::new()
+        }
+    }));
+    app.session.prefs.edit(|p| {
+        p.dialogs.insert(photocraft_engine::print_cmds::REMEMBERED.into(), json!({"printer": "Saved printer", "printerSettings": "0011"}));
+    });
+    let mut lister = photocraft_engine::Session::new();
+    lister.printer_source = app.session.printer_source.clone();
+    let (held_tx, held) = std::sync::mpsc::channel();
+    let (release, released_rx) = std::sync::mpsc::channel::<()>();
+    let holder = std::thread::spawn(move || {
+        photocraft_engine::print_cmds::with_spooler(|| {
+            assert!(photocraft_engine::print_cmds::rgb_printers(&lister).unwrap().is_empty());
+            available.store(true, Ordering::SeqCst);
+            held_tx.send(()).unwrap();
+            let _ = released_rx.recv_timeout(std::time::Duration::from_secs(5));
+        });
+    });
+    held.recv().unwrap();
+    let id = open_print(&mut app);
+    let mut fields = app.ui.dialog_mut(id).unwrap().fields.clone();
+    let before_retry = (fields.get("printer").cloned(), fields.get("printerSettings").cloned());
+    let pending = fields.get("__printerListingPending").cloned();
+    let _ = release.send(());
+    holder.join().unwrap();
+    assert_eq!(pending, Some(json!(true)));
+    assert_eq!(before_retry, (Some(json!("Saved printer")), Some(json!("0011"))));
+    fields.insert("dryRun".into(), json!(true));
+    photocraft_engine::print_cmds::with_spooler(|| {
+        ctx.run_ui(Default::default(), |ui| print_body(&mut app, ui, &mut fields, id)).textures_delta.clear();
+        assert_eq!(fields["printer"], "Saved printer");
+        assert_eq!(fields["printerSettings"], "0011");
+        assert!(!fields.contains_key("__printerListingPending"));
+    });
+}
+
+#[test]
+fn print_dialog_retries_an_uncached_printer_list_after_the_spooler_is_released() {
+    use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+    let (mut app, ctx) = app();
+    let asked = Arc::new(AtomicUsize::new(0));
+    let counted = Arc::clone(&asked);
+    app.session.printer_source = Some(Arc::new(move || {
+        counted.fetch_add(1, Ordering::SeqCst);
+        vec![craft_print::Printer { name: "Retry printer".into(), default: true, two_sided: None, description: String::new() }]
+    }));
+    let (held_tx, held) = std::sync::mpsc::channel();
+    let (release, released_rx) = std::sync::mpsc::channel::<()>();
+    let released = Arc::new(AtomicBool::new(false));
+    let done = Arc::clone(&released);
+    let holder = std::thread::spawn(move || {
+        photocraft_engine::print_cmds::with_spooler(|| {
+            held_tx.send(()).unwrap();
+            let _ = released_rx.recv_timeout(std::time::Duration::from_secs(5));
+            done.store(true, Ordering::SeqCst);
+        });
+    });
+    held.recv().unwrap();
+    let id = open_print(&mut app);
+    let mut fields = app.ui.dialog_mut(id).unwrap().fields.clone();
+    fields.insert("dryRun".into(), json!(true));
+    ctx.run_ui(Default::default(), |ui| print_body(&mut app, ui, &mut fields, id)).textures_delta.clear();
+    let waited = released.load(Ordering::SeqCst);
+    let calls_while_busy = asked.load(Ordering::SeqCst);
+    let _ = release.send(());
+    holder.join().unwrap();
+    assert!(!waited, "opening or drawing Print waited for the spooler");
+    assert_eq!(calls_while_busy, 0);
+    assert_eq!(fields["__systemPrinters"], json!([]));
+    photocraft_engine::print_cmds::with_spooler(|| {
+        ctx.run_ui(Default::default(), |ui| print_body(&mut app, ui, &mut fields, id)).textures_delta.clear();
+        assert_eq!(fields["__systemPrinters"], json!([{"name": "Retry printer", "default": true}]));
+        assert_eq!(fields.get("__printers"), cfg!(windows).then(|| json!(["Retry printer"])).as_ref());
+        assert!(!fields.contains_key("__printerListingPending"));
+        assert!(asked.load(Ordering::SeqCst) > 0);
+    });
+}
+
+#[test]
+fn driver_calls_do_not_wait_while_the_spooler_is_busy() {
+    use std::sync::atomic::{AtomicBool, Ordering};
+    let (mut app, _) = app();
+    let (held_tx, held) = std::sync::mpsc::channel();
+    let (release, released_rx) = std::sync::mpsc::channel::<()>();
+    let released = Arc::new(AtomicBool::new(false));
+    let holder = {
+        let released = Arc::clone(&released);
+        std::thread::spawn(move || {
+            photocraft_engine::print_cmds::with_spooler(|| {
+                held_tx.send(()).unwrap();
+                let _ = released_rx.recv_timeout(std::time::Duration::from_secs(5));
+                released.store(true, Ordering::SeqCst);
+            });
+        })
+    };
+    held.recv().unwrap();
+    let mut page = Map::new();
+    page.insert("printer".into(), json!("Test printer"));
+    page.insert("__driverPageInitialized".into(), json!(true));
+    let answered = print::driver_page(&mut page);
+    let mut turn = Map::new();
+    turn.insert("printer".into(), json!("Test printer"));
+    turn.insert("paper".into(), json!([595.28, 841.89]));
+    turn_driver(&mut app, &mut turn, true);
+    let waited = released.load(Ordering::SeqCst);
+    let _ = release.send(());
+    holder.join().unwrap();
+    assert!(!waited, "a driver call waited for the spooler");
+    assert!(!answered);
+    assert!(page.get("__driverPageInitialized").is_none());
+    assert_eq!(page["__pageError"], photocraft_engine::print_cmds::SPOOLER_BUSY);
+    assert_eq!(turn["__pageError"], photocraft_engine::print_cmds::SPOOLER_BUSY);
+    assert_eq!((turn.get("paper"), turn.get("printerSettings")), (Some(&json!([595.28, 841.89])), None));
+}
+
 /// Checks no-jump centering and nonaccumulating screen displacement against shared layout
 /// across fit, percentage scaling, orientation and mirroring combinations.
 #[test]
@@ -59,6 +218,8 @@ fn print_drag_rejects_nonfinite_input_and_bounds_offsets() {
 
 fn app() -> (PhotocraftApp, egui::Context) {
     let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+    app.session.printer_source =
+        Some(Arc::new(|| vec![craft_print::Printer { name: "Test printer".into(), default: true, two_sided: None, description: String::new() }]));
     app.run("file.new", json!({"width": 120, "height": 80, "name": "web"})).unwrap();
     (app, egui::Context::default())
 }
@@ -432,11 +593,16 @@ fn printer_menu_lists_the_spooler_printers_after_the_default() {
     assert_eq!(printer_options(None, "").len(), 1);
     // The dialog asks the engine, and the list never reaches file.print's params.
     let (mut app, ctx) = app();
-    let id = crate::menus::invoke(&mut app, &ctx, "file.print", json!({})).unwrap()["dialog"].as_u64().unwrap();
+    let id = photocraft_engine::print_cmds::with_spooler(|| crate::menus::invoke(&mut app, &ctx, "file.print", json!({})).unwrap()["dialog"].as_u64().unwrap());
     let f = &app.ui.dialog_mut(id).unwrap().fields;
-    assert!(f.get("__systemPrinters").is_some_and(Value::is_array));
+    assert_eq!(f["__systemPrinters"], json!([{"name": "Test printer", "default": true}]));
+    assert_eq!(f.get("__printers"), cfg!(windows).then(|| json!(["Test printer"])).as_ref());
+    if cfg!(windows) {
+        assert_eq!(f["printer"], "Test printer");
+    }
     assert!(params(f).get("__systemPrinters").is_none());
     assert!(params(f).get("__printers").is_none());
+    assert_eq!(photocraft_engine::print_cmds::system_printer_listings(), 0, "a test asked the system spooler for its printers");
 }
 
 /// An output path or a preview typed and confirmed in one frame doesn't take the driver's area.
@@ -478,7 +644,10 @@ fn save_as_pdf_browse_fills_the_output_from_a_save_dialog() {
     let (show, asked) = crate::file_dialog::fake(vec![Some(FileDialogAnswer::SaveTo(out.clone()))]);
     let mut h = Harness::builder().with_size(egui::vec2(1440.0, 900.0)).with_max_steps(64).build_eframe(move |cc| {
         PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
-        PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services { file_dialog: Some(show), ..Default::default() })
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services { file_dialog: Some(show), ..Default::default() });
+        app.session.printer_source =
+            Some(Arc::new(|| vec![craft_print::Printer { name: "Test printer".into(), default: true, two_sided: None, description: String::new() }]));
+        app
     });
     h.state_mut().run("file.new", json!({"width": 120, "height": 80, "name": "poster"})).unwrap();
     let id = open_print(h.state_mut());
diff --git a/crates/ui-egui/src/dialogs/file_ui/web.rs b/crates/ui-egui/src/dialogs/file_ui/web.rs
index ca1433b150..06e4a899e5 100644
--- a/crates/ui-egui/src/dialogs/file_ui/web.rs
+++ b/crates/ui-egui/src/dialogs/file_ui/web.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Arc, DialogKind, Map, PhotocraftApp, Tokens, Value, WebSettings, b, check, dropdown_str, json, n, number, params, s, web_cmds, web_preview};
 
 const WEB_FORMATS: [(&str, &str); 5] = [("gif", "GIF"), ("png8", "PNG-8"), ("png24", "PNG-24"), ("jpeg", "JPEG"), ("wbmp", "WBMP")];
 
diff --git a/crates/ui-egui/src/dialogs/file_ui/web_preview.rs b/crates/ui-egui/src/dialogs/file_ui/web_preview.rs
index 44399b7d52..ef2a6a5475 100644
--- a/crates/ui-egui/src/dialogs/file_ui/web_preview.rs
+++ b/crates/ui-egui/src/dialogs/file_ui/web_preview.rs
@@ -1,5 +1,5 @@
 //! Save for Web navigation and indexed palette UI. Draft state is serialized in dialog fields.
-use super::*;
+use super::{Arc, Map, Optimized, PhotocraftApp, Tokens, Value, WebSettings, json, n, params, s, web_cmds};
 
 /// Export dimensions, using the same percent/width/height precedence as web_document.
 pub fn dimensions(doc: &photocraft_doc::Document, p: &Value) -> Result<(f64, f64), String> {
diff --git a/crates/ui-egui/src/dialogs/filter_dialog.rs b/crates/ui-egui/src/dialogs/filter_dialog.rs
index 24b9609b20..d042a1fb6b 100644
--- a/crates/ui-egui/src/dialogs/filter_dialog.rs
+++ b/crates/ui-egui/src/dialogs/filter_dialog.rs
@@ -325,6 +325,7 @@ pub fn has_dialog(command: &str) -> bool {
                 | "image.mode.colorTable"
                 | "edit.definePattern"
                 | "select.convertToShape"
+                | "layer.new.artboardFromLayers"
         ))
         && photocraft_engine::commands::find(command).is_some_and(|c| !parse_spec(c.params).is_empty())
 }
@@ -343,6 +344,15 @@ fn rememberable(kind: &Kind, value: &Value) -> bool {
 
 fn restore_remembered(app: &PhotocraftApp, command: &str, spec: &str, fields: &mut Map<String, Value>) {
     let Some(Value::Object(saved)) = app.session.prefs().dialogs.get(command) else { return };
+    // Select and Mask starts from its defaults unless Remember Settings was on, as in Photoshop
+    // (#9423).
+    if command == crate::select_mask_view::COMMAND {
+        let remember = crate::select_mask_view::remembers(saved);
+        fields.insert(crate::select_mask_view::REMEMBER.into(), json!(remember));
+        if !remember {
+            return;
+        }
+    }
     for p in parse_spec(spec) {
         if let Some(v) = saved.get(&p.key).filter(|v| rememberable(&p.kind, v)) {
             fields.insert(p.key, v.clone());
@@ -356,8 +366,17 @@ pub(crate) fn remember(app: &mut PhotocraftApp, command: &str, fields: &Map<Stri
         return;
     }
     let Some(spec) = photocraft_engine::commands::find(command) else { return };
-    let saved: Map<String, Value> =
+    let mut saved: Map<String, Value> =
         parse_spec(spec.params).into_iter().filter_map(|p| fields.get(&p.key).filter(|v| rememberable(&p.kind, v)).map(|v| (p.key, v.clone()))).collect();
+    // Select and Mask with Remember Settings off keeps only that choice, so the next one starts
+    // from the defaults (#9423).
+    if command == crate::select_mask_view::COMMAND {
+        let remember = crate::select_mask_view::remembers(fields);
+        if !remember {
+            saved.clear();
+        }
+        saved.insert(crate::select_mask_view::REMEMBER.into(), json!(remember));
+    }
     if !saved.is_empty() {
         app.session.prefs.edit(|prefs| prefs.dialogs.insert(command.into(), Value::Object(saved)));
     }
@@ -404,6 +423,17 @@ fn apply_command_defaults(app: &PhotocraftApp, command: &str, fields: &mut Map<S
     if command == "edit.definePattern" {
         fields.insert("name".into(), json!(photocraft_engine::pattern_cmds::default_name(&app.session)));
     }
+    // The reference application's Artboard from Layers opens at the next Artboard N and the
+    // selected layers' size every time, never a remembered size; past the field's 30000 px
+    // range, 0 keeps the bounds.
+    if command == "layer.new.artboardFromLayers"
+        && let Some((name, [w, h])) = photocraft_engine::artboard_cmds::from_layers_defaults(&app.session)
+    {
+        let fits = w <= 30_000 && h <= 30_000;
+        fields.insert("name".into(), json!(name));
+        fields.insert("width".into(), json!(if fits { w } else { 0 }));
+        fields.insert("height".into(), json!(if fits { h } else { 0 }));
+    }
     if command == "layer.layerStyle.globalLight" {
         global_light_defaults(app, fields);
     }
diff --git a/crates/ui-egui/src/dialogs/filter_dialog/tests.rs b/crates/ui-egui/src/dialogs/filter_dialog/tests.rs
index fdd6ad04e4..92daea2528 100644
--- a/crates/ui-egui/src/dialogs/filter_dialog/tests.rs
+++ b/crates/ui-egui/src/dialogs/filter_dialog/tests.rs
@@ -533,6 +533,45 @@ fn every_filter_command_spec_parses() {
     assert!(!has_dialog("filter.stylize.findEdges"));
 }
 
+/// #9423: Select and Mask starts from its defaults each time, as in Photoshop, unless Remember
+/// Settings was on when it was last OKed; turning it off forgets the settings again.
+#[test]
+fn select_and_mask_remembers_settings_only_when_asked() {
+    let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+    app.run("file.new", json!({"width": 64, "height": 64})).unwrap();
+    app.run("select.all", json!({})).unwrap();
+    let cmd = crate::select_mask_view::COMMAND;
+    let fields = |app: &PhotocraftApp, id: u64| app.ui.dialogs.iter().find(|d| d.id == id).unwrap().fields.clone();
+    let opened = |app: &mut PhotocraftApp| {
+        let id = open(app, cmd).unwrap();
+        let f = fields(app, id);
+        app.ui.dialogs.retain(|d| d.id != id);
+        f
+    };
+    let first = opened(&mut app);
+    assert_eq!(first["smooth"], json!(0.0));
+    assert_eq!(first.get(crate::select_mask_view::REMEMBER), None, "off by default");
+    // OK with Smooth 10 and Remember Settings off: the next one starts from the defaults.
+    let mut f = first.clone();
+    f.insert("smooth".into(), json!(10.0));
+    f.insert(crate::select_mask_view::REMEMBER.into(), json!(false));
+    remember(&mut app, cmd, &f);
+    let next = opened(&mut app);
+    assert_eq!(next["smooth"], json!(0.0), "not remembered");
+    assert_eq!(next[crate::select_mask_view::REMEMBER], json!(false));
+    // With Remember Settings on, the next one starts from them.
+    f.insert(crate::select_mask_view::REMEMBER.into(), json!(true));
+    remember(&mut app, cmd, &f);
+    let next = opened(&mut app);
+    assert_eq!(next["smooth"], json!(10.0), "remembered");
+    assert_eq!(next[crate::select_mask_view::REMEMBER], json!(true));
+    // Turning it off again forgets them.
+    let mut off = next.clone();
+    off.insert(crate::select_mask_view::REMEMBER.into(), json!(false));
+    remember(&mut app, cmd, &off);
+    assert_eq!(opened(&mut app)["smooth"], json!(0.0));
+}
+
 /// Select and Mask's Output To lists all six output targets.
 #[test]
 fn select_and_mask_output_lists_all_six_targets() {
@@ -1368,6 +1407,30 @@ fn assign_profile_offers_only_profiles_of_the_documents_colour_mode() {
     assert!(cmyk.iter().any(|o| o == "coated-cmyk") && !cmyk.iter().any(|o| o == "srgb"), "a CMYK document gets CMYK profiles");
 }
 
+/// #9087: Artboard from Layers opens at the selected layers' size and the next Artboard N, as
+/// in the reference application, never at a size remembered from other layers.
+#[test]
+fn artboard_from_layers_opens_at_the_selected_layers_size() {
+    let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+    app.run("file.new", json!({"width": 100, "height": 80})).unwrap();
+    app.run("layer.new.layer", json!({})).unwrap();
+    app.run("select.rect", json!({"x": 10, "y": 5, "width": 20, "height": 30})).unwrap();
+    app.run("edit.fill", json!({"color": "#ff0000"})).unwrap();
+    app.run("select.deselect", json!({})).unwrap();
+    app.session.prefs.edit(|prefs| {
+        prefs.dialogs.insert("layer.new.artboardFromLayers".into(), json!({"width": 1080, "height": 1350}));
+    });
+    let id = open(&mut app, "layer.new.artboardFromLayers").unwrap();
+    let fields = &app.ui.dialog_mut(id).unwrap().fields;
+    assert_eq!((&fields["width"], &fields["height"]), (&json!(20), &json!(30)), "not the remembered 1080 x 1350");
+    assert_eq!(fields["name"], json!("Artboard 1"));
+    crate::dialogs::confirm(&mut app, id).unwrap();
+    let doc = &app.session.active().unwrap().doc;
+    let boards = doc.artboards();
+    assert_eq!(boards.len(), 1);
+    assert_eq!((boards[0].1, boards[0].2.rect), ("Artboard 1", photocraft_geom::Rect::new(10, 5, 30, 35)));
+}
+
 /// #4951: a profile remembered from a document of another colour mode isn't preselected.
 #[test]
 fn assign_profile_drops_a_remembered_profile_that_does_not_fit() {
diff --git a/crates/ui-egui/src/dialogs/gallery_ui.rs b/crates/ui-egui/src/dialogs/gallery_ui.rs
index d37eec865d..2f2269b892 100644
--- a/crates/ui-egui/src/dialogs/gallery_ui.rs
+++ b/crates/ui-egui/src/dialogs/gallery_ui.rs
@@ -582,7 +582,7 @@ fn poll_job(d: &mut GalleryDialog, ctx: &egui::Context) {
 #[cfg(not(target_arch = "wasm32"))]
 fn start_job(d: &mut GalleryDialog, ctx: &egui::Context, key: u64, vis: Rect, k: u32, params: &Value, now: f64) {
     if let Some(job) = &d.job {
-        let settled = d.latest.is_some_and(|(k0, t)| k0 == key && now - t >= crate::filter_preview_worker::SETTLE_MS);
+        let settled = d.latest.is_some_and(|(k0, t)| k0 == key && now - t >= crate::dialogs::filter_preview_worker::SETTLE_MS);
         if job.key != key && settled {
             job.ctl.cancel();
         }
diff --git a/crates/ui-egui/src/dialogs/history_options_ui.rs b/crates/ui-egui/src/dialogs/history_options_ui.rs
new file mode 100644
index 0000000000..2d4756543b
--- /dev/null
+++ b/crates/ui-egui/src/dialogs/history_options_ui.rs
@@ -0,0 +1,98 @@
+//! The History Options dialog (History panel menu › History Options…, #2966): a form over the
+//! engine's `history.options` with its two checkboxes, filled with the current values. OK runs
+//! the command with the dialog's values (the generic command-dialog confirm), Cancel changes
+//! nothing. Agents can also run `history.options` with params directly, or `prefs.set
+//! historyOptions.*`; a call with params skips the dialog.
+
+use serde_json::{Map, Value, json};
+
+use crate::PhotocraftApp;
+use crate::state::DialogKind;
+
+pub const COMMAND: &str = "history.options";
+
+/// Opens the dialog for a parameterless `history.options`; anything else is not handled here.
+pub fn menu(app: &mut PhotocraftApp, id: &str, params: &Value) -> Option<Result<Value, String>> {
+    if id != COMMAND || params.as_object().is_some_and(|m| m.keys().any(|k| !k.starts_with("__"))) {
+        return None;
+    }
+    Some(Ok(json!({ "dialog": open(app) })))
+}
+
+/// Open the dialog on the current options; returns its id.
+pub fn open(app: &mut PhotocraftApp) -> u64 {
+    let current = photocraft_engine::history_options_cmds::current(&app.session);
+    let mut f = Map::new();
+    f.insert("__command".into(), json!(COMMAND));
+    f.insert("__label".into(), json!("History Options…"));
+    f.insert("__form".into(), json!(true));
+    f.insert("__choices".into(), json!({}));
+    // Photoshop's capitalised labels, in the UI language (the form would sentence-case the keys).
+    f.insert(
+        "__labels".into(),
+        json!({
+            "allowNonLinearHistory": tl!("Allow Non-Linear History"),
+            "makeLayerVisibilityChangesUndoable": tl!("Make Layer Visibility Changes Undoable"),
+        }),
+    );
+    for key in photocraft_engine::history_options_cmds::OPTIONS {
+        f.insert(key.into(), current.get(key).cloned().unwrap_or(Value::Bool(false)));
+    }
+    app.ui.open_dialog(DialogKind::Command, f)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn app() -> PhotocraftApp {
+        PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default())
+    }
+
+    #[test]
+    fn the_command_opens_the_dialog_on_the_current_values_and_ok_applies_them() {
+        let mut app = app();
+        let ctx = egui::Context::default();
+        let r = crate::menus::invoke(&mut app, &ctx, COMMAND, json!({})).unwrap();
+        let id = r["dialog"].as_u64().unwrap();
+        let d = app.ui.dialogs.iter().find(|d| d.id == id).unwrap();
+        assert_eq!(d.fields["allowNonLinearHistory"], json!(false));
+        assert_eq!(d.fields["makeLayerVisibilityChangesUndoable"], json!(true));
+        assert_eq!(crate::dialogs::title(d), "History Options");
+        // Cancel changes nothing.
+        app.ui.dialog_mut(id).unwrap().fields.insert("allowNonLinearHistory".into(), json!(true));
+        crate::dialogs::cancel(&mut app, id).unwrap();
+        assert!(!app.session.prefs().history_options.allow_non_linear_history);
+        // OK applies both checkboxes.
+        let id = open(&mut app);
+        let fields = &mut app.ui.dialog_mut(id).unwrap().fields;
+        fields.insert("allowNonLinearHistory".into(), json!(true));
+        fields.insert("makeLayerVisibilityChangesUndoable".into(), json!(false));
+        crate::dialogs::confirm(&mut app, id).unwrap();
+        let o = &app.session.prefs().history_options;
+        assert!(o.allow_non_linear_history && !o.make_layer_visibility_changes_undoable);
+        assert!(app.ui.dialogs.is_empty());
+        // Reopened, it shows what was chosen; with params the command runs without a dialog.
+        let id = open(&mut app);
+        assert_eq!(app.ui.dialogs.iter().find(|d| d.id == id).unwrap().fields["allowNonLinearHistory"], json!(true));
+        crate::dialogs::cancel(&mut app, id).unwrap();
+        let r = crate::menus::invoke(&mut app, &ctx, COMMAND, json!({"allowNonLinearHistory": false})).unwrap();
+        assert_eq!(r["allowNonLinearHistory"], json!(false));
+        assert!(app.ui.dialogs.is_empty());
+        assert!(crate::menus::invoke(&mut app, &ctx, COMMAND, json!({"allowNonLinearHistory": "no"})).is_err());
+    }
+
+    #[test]
+    fn the_dialog_draws_both_checkboxes_with_photoshops_labels() {
+        use egui_kittest::{Harness, kittest::Queryable};
+        let mut h = Harness::builder().with_size(egui::vec2(700.0, 400.0)).build_ui_state(|ui, app| crate::dialogs::show(app, ui.ctx()), app());
+        PhotocraftApp::setup_context(&h.ctx, crate::theme::ThemeKind::ALL[0]);
+        open(h.state_mut());
+        h.run_steps(3);
+        h.get_by_label("History Options");
+        h.get_by_label("Allow Non-Linear History");
+        h.get_by_label("Make Layer Visibility Changes Undoable");
+        h.get_by_label("OK");
+        h.get_by_label("Cancel");
+    }
+}
diff --git a/crates/ui-egui/src/dialogs/jpeg_options_ui.rs b/crates/ui-egui/src/dialogs/jpeg_options_ui.rs
index 025bcd2b9e..e59d694b58 100644
--- a/crates/ui-egui/src/dialogs/jpeg_options_ui.rs
+++ b/crates/ui-egui/src/dialogs/jpeg_options_ui.rs
@@ -207,7 +207,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
             let quality_caption = ui.label(tl!("Quality"));
             ui.add(egui::DragValue::new(&mut quality).range(0..=MAX_QUALITY).speed(0.1)).labelled_by(quality_caption.id);
             // Photoshop's presets: picking one sets the quality it starts at.
-            let preset = egui::ComboBox::from_id_salt("jpeg-quality-preset").selected_text(quality_label(quality)).show_ui(ui, |ui| {
+            let preset = craft_ui::ComboBox::from_id_salt("jpeg-quality-preset").selected_text(quality_label(quality)).show_ui(ui, |ui| {
                 for q in [3, 5, 8, 10] {
                     if ui.selectable_label(quality_label(quality) == quality_label(q), quality_label(q)).clicked() {
                         quality = q;
diff --git a/crates/ui-egui/src/dialogs/liquify_ui.rs b/crates/ui-egui/src/dialogs/liquify_ui.rs
index 5d4da05bff..29536064a5 100644
--- a/crates/ui-egui/src/dialogs/liquify_ui.rs
+++ b/crates/ui-egui/src/dialogs/liquify_ui.rs
@@ -885,6 +885,68 @@ fn backdrop_layering<T: Copy>(backdrop: Option<T>, mode: BackdropMode, opacity:
 }
 
 /// Draws the dialog (a full-window layer over the app).
+fn draw_tool_strip(ui: &mut egui::Ui, painter: &egui::Painter, t: &Tokens, d: &mut LiquifyDialog, body: ERect) -> ERect {
+    // Left tool strip.
+    let left = ERect::from_min_size(body.min, vec2(LEFT_W, body.height()));
+    painter.rect_filled(left, 0.0, t.dock);
+    painter.line_segment([left.right_top(), left.right_bottom()], Stroke::new(1.0, t.separator));
+    let mut strip = ui.new_child(egui::UiBuilder::new().max_rect(left.shrink2(vec2(6.0, 8.0))));
+    strip.spacing_mut().item_spacing.y = 4.0;
+    for tool in LiquifyTool::ALL {
+        let tip = match tool {
+            // The lasso works on the same freeze mask as Freeze/Thaw.
+            LiquifyTool::LassoMask => tl!("Freeze Lasso: drag to freeze an area, Alt-drag to thaw it (L)").to_string(),
+            _ => format!("{} ({})", tl!(tool.label()), shortcut(tool)),
+        };
+        if crate::icons::button(&mut strip, tool_icon(tool), 34.0, d.opts.tool == tool, &tip).clicked() {
+            d.opts.tool = tool;
+        }
+        if matches!(tool, LiquifyTool::Smooth | LiquifyTool::PushLeft | LiquifyTool::Thaw) {
+            strip.add_space(6.0);
+        }
+    }
+    left
+}
+
+/// The preview's wheel and trackpad input: zoom about the pointer, or pan.
+fn apply_preview_wheel(
+    ctx: &egui::Context,
+    d: &mut LiquifyDialog,
+    area: ERect,
+    resp: &egui::Response,
+    wheel_id: egui::Id,
+    pinch_zooms: bool,
+    animated_zoom: bool,
+) {
+    let wheel = crate::wheel_nav::read(ctx, true, pinch_zooms, animated_zoom, wheel_id, resp.hovered());
+    if let Some(hp) = resp.hover_pos() {
+        let zoom = match wheel {
+            Some(crate::wheel_nav::Wheel::Zoom(f)) => {
+                let z = d.zoom * f;
+                // At a limit, drop the rest of an eased notch, or it would swallow the first notch back.
+                if z != z.clamp(ZOOM_MIN, ZOOM_MAX) {
+                    crate::wheel_nav::settle(ctx, wheel_id);
+                }
+                Some(z.clamp(ZOOM_MIN, ZOOM_MAX))
+            }
+            Some(crate::wheel_nav::Wheel::SnapZoom(n)) => {
+                Some((0..n.unsigned_abs()).fold(d.zoom, |z, _| crate::zoom_levels::step_in_range(z, n.signum(), ZOOM_MIN, ZOOM_MAX)))
+            }
+            Some(crate::wheel_nav::Wheel::Pan(v)) => {
+                d.center = [d.center[0] - f64::from(v.x / d.zoom), d.center[1] - f64::from(v.y / d.zoom)];
+                None
+            }
+            None => None,
+        };
+        if let Some(z) = zoom {
+            let before = to_doc(d, area, hp);
+            d.zoom = z;
+            let after = to_doc(d, area, hp);
+            d.center = [d.center[0] + before[0] - after[0], d.center[1] + before[1] - after[1]];
+        }
+    }
+}
+
 pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let t = Tokens::get(ctx);
     let screen = ctx.content_rect();
@@ -924,25 +986,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
             t.text,
         );
         let body = ERect::from_min_max(pos2(full.left(), title.bottom()), full.max);
-        // Left tool strip.
-        let left = ERect::from_min_size(body.min, vec2(LEFT_W, body.height()));
-        painter.rect_filled(left, 0.0, t.dock);
-        painter.line_segment([left.right_top(), left.right_bottom()], Stroke::new(1.0, t.separator));
-        let mut strip = ui.new_child(egui::UiBuilder::new().max_rect(left.shrink2(vec2(6.0, 8.0))));
-        strip.spacing_mut().item_spacing.y = 4.0;
-        for tool in LiquifyTool::ALL {
-            let tip = match tool {
-                // The lasso works on the same freeze mask as Freeze/Thaw.
-                LiquifyTool::LassoMask => tl!("Freeze Lasso: drag to freeze an area, Alt-drag to thaw it (L)").to_string(),
-                _ => format!("{} ({})", tl!(tool.label()), shortcut(tool)),
-            };
-            if crate::icons::button(&mut strip, tool_icon(tool), 34.0, d.opts.tool == tool, &tip).clicked() {
-                d.opts.tool = tool;
-            }
-            if matches!(tool, LiquifyTool::Smooth | LiquifyTool::PushLeft | LiquifyTool::Thaw) {
-                strip.add_space(6.0);
-            }
-        }
+        let left = draw_tool_strip(ui, &painter, &t, d, body);
         // Right properties panel.
         let right = ERect::from_min_size(pos2(body.right() - RIGHT_W, body.top()), vec2(RIGHT_W, body.height()));
         painter.rect_filled(right, 0.0, t.dock);
@@ -1047,33 +1091,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
         // Preferences › Enhanced Controls › Zoom with Trackpad Pinch is off); a sideways scroll
         // pans (#7210). Read every frame, as `wheel_nav` asks, so its modifier state follows.
         let wheel_id = egui::Id::unique("liquify-preview-wheel");
-        let wheel = crate::wheel_nav::read(ctx, true, pinch_zooms, animated_zoom, wheel_id, resp.hovered());
-        if let Some(hp) = resp.hover_pos() {
-            let zoom = match wheel {
-                Some(crate::wheel_nav::Wheel::Zoom(f)) => {
-                    let z = d.zoom * f;
-                    // At a limit, drop the rest of an eased notch, or it would swallow the first notch back.
-                    if z != z.clamp(ZOOM_MIN, ZOOM_MAX) {
-                        crate::wheel_nav::settle(ctx, wheel_id);
-                    }
-                    Some(z.clamp(ZOOM_MIN, ZOOM_MAX))
-                }
-                Some(crate::wheel_nav::Wheel::SnapZoom(n)) => {
-                    Some((0..n.unsigned_abs()).fold(d.zoom, |z, _| crate::zoom_levels::step_in_range(z, n.signum(), ZOOM_MIN, ZOOM_MAX)))
-                }
-                Some(crate::wheel_nav::Wheel::Pan(v)) => {
-                    d.center = [d.center[0] - f64::from(v.x / d.zoom), d.center[1] - f64::from(v.y / d.zoom)];
-                    None
-                }
-                None => None,
-            };
-            if let Some(z) = zoom {
-                let before = to_doc(d, area, hp);
-                d.zoom = z;
-                let after = to_doc(d, area, hp);
-                d.center = [d.center[0] + before[0] - after[0], d.center[1] + before[1] - after[1]];
-            }
-        }
+        apply_preview_wheel(ctx, d, area, &resp, wheel_id, pinch_zooms, animated_zoom);
         d.update_view_preview(ctx, area);
         let img = ERect::from_min_max(
             to_screen(d, area, [f64::from(d.canvas.x0), f64::from(d.canvas.y0)]),
diff --git a/crates/ui-egui/src/dialogs/new_group_ui.rs b/crates/ui-egui/src/dialogs/new_group_ui.rs
new file mode 100644
index 0000000000..676e90f913
--- /dev/null
+++ b/crates/ui-egui/src/dialogs/new_group_ui.rs
@@ -0,0 +1,126 @@
+//! Photoshop's New Group dialog (Name, Color, Mode, Opacity), opened by Layer › New › Group… and
+//! Group from Layers…, the Layers panel menu's New Group… / New Group from Layers… and ⌥-click on
+//! the panel's New Group button. OK runs `layer.new.group` / `layer.new.groupFromLayers` with the
+//! options as one history step; explicit params from Actions, CLI and MCP run the engine directly.
+
+use egui::{Align2, Sense, pos2, vec2};
+use photocraft_color::BlendMode;
+use photocraft_doc::LabelColor;
+use serde_json::{Map, Value, json};
+
+use crate::PhotocraftApp;
+use crate::theme::Tokens;
+
+pub const NEW_GROUP: &str = "layer.new.group";
+pub const FROM_LAYERS: &str = "layer.new.groupFromLayers";
+const MARK: &str = "__newGroup";
+const KEYS: [&str; 4] = ["name", "color", "mode", "opacity"];
+
+pub fn owns(fields: &Map<String, Value>) -> bool {
+    fields.contains_key(MARK)
+}
+
+/// Whether the dialog fronts command `id`.
+pub fn fronts(id: &str) -> bool {
+    id == NEW_GROUP || id == FROM_LAYERS
+}
+
+/// Photoshop's defaults: the next "Group N", no colour, Pass Through, 100 %. Unlike Stroke the
+/// choices are not remembered, as in Photoshop.
+pub fn fields(app: &PhotocraftApp, command: &str) -> Map<String, Value> {
+    let name = app.session.active().map(|st| st.doc.next_layer_name("Group")).unwrap_or_else(|| "Group 1".into());
+    let mut f = Map::new();
+    f.insert(MARK.into(), json!(true));
+    f.insert("__command".into(), json!(if command == FROM_LAYERS { FROM_LAYERS } else { NEW_GROUP }));
+    // The window title, as in Photoshop.
+    f.insert("__label".into(), json!(if command == FROM_LAYERS { "New Group from Layers…" } else { "New Group…" }));
+    f.insert("name".into(), json!(name));
+    f.insert("color".into(), json!(LabelColor::None.id()));
+    f.insert("mode".into(), json!(crate::dialog_blend_ui::mode_key(BlendMode::PassThrough)));
+    f.insert("opacity".into(), json!(100.0));
+    f
+}
+
+pub fn open(app: &mut PhotocraftApp, command: &str) -> u64 {
+    let f = fields(app, command);
+    app.ui.open_dialog(crate::state::DialogKind::Command, f)
+}
+
+/// Only the New Group params are passed to the engine; private UI markers are ignored.
+pub fn params(f: &Map<String, Value>) -> Value {
+    Value::Object(KEYS.iter().filter_map(|k| f.get(*k).map(|v| (k.to_string(), v.clone()))).collect())
+}
+
+pub fn confirm(app: &mut PhotocraftApp, f: &Map<String, Value>) -> Result<Value, String> {
+    let command = f.get("__command").and_then(Value::as_str).filter(|c| fronts(c)).unwrap_or(NEW_GROUP).to_string();
+    app.run(&command, params(f))
+}
+
+fn label(ui: &mut egui::Ui, text: &str) {
+    let t = Tokens::get(ui.ctx());
+    let (r, _) = ui.allocate_exact_size(vec2(64.0, 22.0), Sense::hover());
+    ui.painter().text(pos2(r.right() - 6.0, r.center().y), Align2::RIGHT_CENTER, text, egui::FontId::proportional(12.0), t.text_dim);
+}
+
+/// The label colour's swatch beside its menu: a crossed box for No Color, as in the layer menu.
+fn swatch(ui: &mut egui::Ui, color: LabelColor) {
+    let t = Tokens::get(ui.ctx());
+    let (r, _) = ui.allocate_exact_size(vec2(16.0, 16.0), Sense::hover());
+    let p = ui.painter();
+    if let Some((fill, _)) = t.layer_label_colors(color) {
+        p.rect_filled(r, t.radius_sm, fill);
+    } else {
+        let stroke = egui::Stroke::new(1.0, t.text_dim);
+        p.rect_stroke(r, t.radius_sm, stroke, egui::StrokeKind::Inside);
+        let x = r.shrink(4.0);
+        p.line_segment([x.left_top(), x.right_bottom()], stroke);
+        p.line_segment([x.right_top(), x.left_bottom()], stroke);
+    }
+}
+
+pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
+    ui.spacing_mut().item_spacing.y = 8.0;
+    ui.horizontal(|ui| {
+        label(ui, tl!("Name:"));
+        let mut name = f.get("name").and_then(Value::as_str).unwrap_or_default().to_string();
+        let r = ui.add(egui::TextEdit::singleline(&mut name).desired_width(252.0));
+        if r.changed() {
+            f.insert("name".into(), json!(name));
+        }
+        crate::field_tab::register(ui.ctx(), r.id);
+        // Photoshop opens the dialog with the name selected, so typing replaces it.
+        if !f.contains_key("__focused") {
+            f.insert("__focused".into(), json!(true));
+            crate::field_tab::focus(ui.ctx(), r.id);
+        }
+        if r.gained_focus() {
+            crate::field_tab::select_all(ui.ctx(), r.id, &name);
+        }
+    });
+    ui.horizontal(|ui| {
+        label(ui, tl!("Color:"));
+        let mut color = f.get("color").and_then(Value::as_str).and_then(LabelColor::from_id).unwrap_or(LabelColor::None);
+        let options: Vec<(LabelColor, &str)> = LabelColor::ALL.iter().map(|c| (*c, crate::layer_menu_ui::color_name(*c))).collect();
+        if crate::widgets::dropdown(ui, "new-group-color", tl!("Color"), &mut color, &options, 130.0) {
+            f.insert("color".into(), json!(color.id()));
+        }
+        swatch(ui, color);
+    });
+    ui.horizontal(|ui| {
+        label(ui, tl!("Mode:"));
+        let mut mode = f.get("mode").and_then(Value::as_str).and_then(photocraft_engine::commands::blend_from_str).unwrap_or(BlendMode::PassThrough);
+        let options = crate::panels::blend_options(true, mode);
+        if crate::widgets::dropdown(ui, "new-group-mode", tl!("Mode"), &mut mode, &options, 130.0) {
+            f.insert("mode".into(), json!(crate::dialog_blend_ui::mode_key(mode)));
+        }
+        ui.add_space(6.0);
+        ui.label(egui::RichText::new(tl!("Opacity:")).size(12.0).color(Tokens::get(ui.ctx()).text_dim));
+        let mut opacity = f.get("opacity").and_then(Value::as_f64).unwrap_or(100.0) as f32;
+        if crate::widgets::value_field(ui, &mut opacity, 0.0..=100.0, "%", 64.0).changed() {
+            f.insert("opacity".into(), json!(opacity.round()));
+        }
+    });
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/ui-egui/src/dialogs/new_group_ui/tests.rs b/crates/ui-egui/src/dialogs/new_group_ui/tests.rs
new file mode 100644
index 0000000000..2ff93afd3d
--- /dev/null
+++ b/crates/ui-egui/src/dialogs/new_group_ui/tests.rs
@@ -0,0 +1,136 @@
+use photocraft_color::BlendMode;
+use photocraft_doc::{LabelColor, Layer, LayerContent, LayerId};
+use serde_json::json;
+
+use super::*;
+
+/// Background, then `A` and `B` (`B` active).
+fn app() -> (PhotocraftApp, LayerId, LayerId) {
+    let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+    app.run("file.new", json!({"width": 40, "height": 30})).unwrap();
+    let a = LayerId(app.run("layer.new.layer", json!({"name": "A"})).unwrap()["layer"].as_u64().unwrap());
+    let b = LayerId(app.run("layer.new.layer", json!({"name": "B"})).unwrap()["layer"].as_u64().unwrap());
+    (app, a, b)
+}
+
+fn groups(app: &PhotocraftApp) -> Vec<Layer> {
+    app.session.active().unwrap().doc.walk().into_iter().map(|(_, _, l)| l).filter(|l| l.is_group()).cloned().collect()
+}
+
+fn steps(app: &PhotocraftApp) -> usize {
+    app.session.active().unwrap().history.past_len()
+}
+
+#[test]
+fn menu_invocations_open_the_dialog_but_explicit_params_run_directly() {
+    let (mut app, _, _) = app();
+    let ctx = egui::Context::default();
+    for (command, title) in [(NEW_GROUP, "New Group…"), (FROM_LAYERS, "New Group from Layers…")] {
+        let opened = crate::menus::invoke(&mut app, &ctx, command, json!({})).unwrap();
+        let id = opened["dialog"].as_u64().unwrap();
+        let fields = &app.ui.dialogs.last().unwrap().fields;
+        assert!(owns(fields));
+        assert_eq!((fields["__command"].as_str(), fields["__label"].as_str()), (Some(command), Some(title)));
+        assert!(groups(&app).is_empty(), "nothing happens until OK");
+        app.ui.close_dialog(id);
+        // `ui.dialog.open {kind: "command"}` gets the same dialog.
+        let id = crate::dialogs::open_command_dialog(&mut app, command, "Group…");
+        assert!(owns(&app.ui.dialogs.last().unwrap().fields));
+        app.ui.close_dialog(id);
+    }
+    // Explicit params (Actions, CLI, MCP) run the engine without asking.
+    crate::menus::invoke(&mut app, &ctx, NEW_GROUP, json!({"name": "Direct"})).unwrap();
+    assert!(app.ui.dialogs.is_empty());
+    assert_eq!(groups(&app)[0].name, "Direct");
+    // Group Layers (⌘G) never asks.
+    crate::menus::invoke(&mut app, &ctx, "layer.groupLayers", json!({})).unwrap();
+    assert!(app.ui.dialogs.is_empty());
+    // Without a document nothing opens.
+    let mut empty = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+    assert!(crate::menus::invoke(&mut empty, &ctx, NEW_GROUP, json!({})).is_err());
+    assert!(crate::menus::invoke(&mut empty, &ctx, FROM_LAYERS, json!({})).is_err());
+    assert!(empty.ui.dialogs.is_empty());
+}
+
+#[test]
+fn defaults_are_photoshops_and_private_fields_do_not_leak() {
+    let (app, _, _) = app();
+    let f = fields(&app, NEW_GROUP);
+    let out = params(&f);
+    assert_eq!(out, json!({"name": "Group 1", "color": "none", "mode": "passThrough", "opacity": 100.0}));
+    assert!(out.as_object().unwrap().keys().all(|k| !k.starts_with("__")));
+}
+
+#[test]
+fn ok_creates_the_group_with_the_options_in_one_step_and_cancel_changes_nothing() {
+    let (mut app, _, b) = app();
+    let initial = steps(&app);
+    let cancelled = open(&mut app, NEW_GROUP);
+    app.ui.dialog_mut(cancelled).unwrap().fields.insert("name".into(), json!("Nope"));
+    app.ui.close_dialog(cancelled);
+    assert_eq!(steps(&app), initial);
+    assert!(groups(&app).is_empty());
+
+    let id = open(&mut app, NEW_GROUP);
+    let d = app.ui.dialog_mut(id).unwrap();
+    d.fields.insert("name".into(), json!("Sky"));
+    d.fields.insert("color".into(), json!("blue"));
+    d.fields.insert("mode".into(), json!("multiply"));
+    d.fields.insert("opacity".into(), json!(60.0));
+    crate::dialogs::confirm(&mut app, id).unwrap();
+    assert_eq!(steps(&app), initial + 1, "one history step");
+    let g = &groups(&app)[0];
+    assert_eq!((g.name.as_str(), g.label, g.blend), ("Sky", LabelColor::Blue, BlendMode::Multiply));
+    assert!((g.opacity - 0.6).abs() < 1e-6);
+    let top: Vec<LayerId> = app.session.active().unwrap().doc.layers.iter().map(|l| l.id).collect();
+    assert_eq!(top.last(), Some(&g.id), "an empty group above the active layer B");
+    assert_eq!(top[top.len() - 2], b);
+}
+
+#[test]
+fn ok_from_layers_groups_the_selection_collapsed() {
+    let (mut app, a, b) = app();
+    app.run("layer.select", json!({"layer": a.0})).unwrap();
+    app.run("layer.select", json!({"layer": b.0, "mode": "add"})).unwrap();
+    let id = open(&mut app, FROM_LAYERS);
+    app.ui.dialog_mut(id).unwrap().fields.insert("name".into(), json!("Pair"));
+    crate::dialogs::confirm(&mut app, id).unwrap();
+    let g = &groups(&app)[0];
+    assert_eq!(g.name, "Pair");
+    assert_eq!(g.children().unwrap().iter().map(|l| l.id).collect::<Vec<_>>(), vec![a, b]);
+    assert!(matches!(&g.content, LayerContent::Group(g) if !g.expanded), "collapsed, as in Photoshop");
+}
+
+/// The dialog draws its fields, opens with the name selected so typing replaces it, and Enter
+/// runs OK.
+#[test]
+fn typing_replaces_the_selected_name_and_enter_confirms() {
+    use egui_kittest::kittest::Queryable;
+    let (app, _, _) = app();
+    let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1000.0, 700.0)).build_ui_state(|ui, app| crate::dialogs::show(app, ui.ctx()), app);
+    PhotocraftApp::setup_context(&h.ctx, crate::theme::ThemeKind::ALL[0]);
+    open(h.state_mut(), NEW_GROUP);
+    h.run_steps(4);
+    for label in ["OK", "Cancel"] {
+        assert!(h.query_by_label(label).is_some(), "{label} is shown");
+    }
+    let name = h.get_by_role(egui::accesskit::Role::TextInput);
+    assert!(name.is_focused(), "the dialog opens on the name");
+    name.type_text("Clouds");
+    h.run_steps(2);
+    assert_eq!(h.state().ui.dialogs.last().unwrap().fields["name"], "Clouds");
+    h.key_press(egui::Key::Enter);
+    h.run_steps(2);
+    assert!(h.state().ui.dialogs.is_empty());
+    assert_eq!(groups(h.state())[0].name, "Clouds");
+}
+
+#[test]
+fn new_group_dialog_labels_are_translated_in_every_catalog() {
+    const LABELS: &[&str] = &["New Group…", "New Group from Layers…", "Name:", "Color:", "Mode:", "Opacity:", "Pass Through"];
+    for lang in crate::i18n::Lang::all().filter(|lang| lang.complete_menus()) {
+        for label in LABELS {
+            assert!(crate::i18n::has(lang, label), "{} is missing New Group dialog label: {label}", lang.code());
+        }
+    }
+}
diff --git a/crates/ui-egui/src/gpu_status.rs b/crates/ui-egui/src/gpu_status.rs
index 9ddd08bee1..75f1a05e85 100644
--- a/crates/ui-egui/src/gpu_status.rs
+++ b/crates/ui-egui/src/gpu_status.rs
@@ -148,7 +148,8 @@ fn save_for_recovery(app: &mut PhotocraftApp) -> Result<(), String> {
 /// path, record why, and tell the user. Documents are untouched.
 pub fn fall_back(app: &mut PhotocraftApp, fault: &photocraft_gpu::Fault) {
     let Some(gpu) = app.gpu.take() else { return };
-    log::error!("{fault}; using the CPU renderer");
+    // The GPU canvas is gone (that's this error); the switch to the CPU is `render_path`'s line.
+    log::error!("{fault}; GPU canvas dropped");
     gpu.release();
     app.gpu_fault = Some(fault.clone());
     // Canvas caches pointed at GPU textures: rebuild them as egui textures.
@@ -156,7 +157,7 @@ pub fn fall_back(app: &mut PhotocraftApp, fault: &photocraft_gpu::Fault) {
     app.proxy_uploaded = None;
     app.prefs_rt.gpu_style = None;
     app.perf.gpu = false;
-    app.perf.gpu_fallback = Some(fault.to_string());
+    crate::render_path::note_app(app, Some(crate::render_path::CpuReason::from_fault(fault)));
     // The CPU canvas has no GPU memory budget: GPU Memory Full no longer applies.
     app.perf.gpu_layer_fit = None;
     app.perf.gpu_info.canvas = "cpu".into();
@@ -221,7 +222,7 @@ fn retry_now(app: &mut PhotocraftApp) -> bool {
     // The CPU canvas's egui textures: rebuild every view on the GPU.
     app.canvases.clear();
     app.proxy_uploaded = None;
-    app.perf.gpu_fallback = None;
+    crate::render_path::note_app(app, None);
     app.perf.gpu_info.lost = None;
     app.ui.status = tl!("GPU acceleration resumed.").to_string();
     app.ui.status_error = false;
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 925d19568b..ad024ccd97 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -312,6 +312,7 @@
 	Layer…	Vrstva…
 	Group…	Skupina…
 	Group from Layers…	Skupina z vrstev…
+	New Group from Layers…	Nová skupina z vrstev…
 	Artboard…	Kreslicí plocha…
 	Artboard from Group…	Kreslicí plocha ze skupiny…
 	Artboard from Layers…	Kreslicí plocha z vrstev…
@@ -1966,7 +1967,7 @@
 	Full size tip	Hrot v plné velikosti
 	Gamut warning color	Barva upozornění na gamut
 	Gamut warning opacity	Krytí upozornění na gamut
-	Generator enabled	Generátor zapnut
+	Enable Generator	Zapnout generátor
 	Gif	GIF
 	Glossy	Lesklý
 	Grid color	Barva mřížky
@@ -3618,6 +3619,9 @@ curves	Smooth	Vyhladit
 	Clear History	Vymazat historii
 	New Snapshot…	Nový snímek…
 	History Options…	Volby historie…
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	Povolit nelineární historii
+	Make Layer Visibility Changes Undoable	Umožnit vrácení změn viditelnosti vrstev
 	Drag (lasso) or click points (polygonal) · {add} add · {sub} subtract	Táhněte (laso) nebo klikejte na body (mnohoúhelník) · {add} přidat · {sub} odečíst
 	The current gradient (pick one in Window › Gradients)	Aktuální přechod (vyberte v Okno › Přechody)
 # Canvas context menus, Channels panel menu, Layer Style blending page (labels rendered through a variable).
@@ -3860,6 +3864,33 @@ navigator	Zoom	Zvětšení
 	Sent to {printer}	Odesláno do {printer}
 	set in Print Settings…	nastavuje se v nastavení tisku…
 	ICO is limited to 256 × 256 pixels	ICO je omezen na 256 × 256 pixelů
+	Show Favorite Fonts	Zobrazit oblíbená písma
+	No favorite fonts yet: click the star beside a font to add it.	Zatím žádná oblíbená písma: přidejte písmo kliknutím na hvězdičku vedle něj.
+	Favorite fonts	Oblíbená písma
+	Add to Favorites	Přidat do oblíbených
+	Remove from Favorites	Odebrat z oblíbených
+	Show All Fonts	Zobrazit všechna písma
+	All Classes	Všechny třídy
+	Blackletter	Lomená písma
+	Decorative	Dekorativní
+	Font preview:	Náhled písma:
+	Handwritten	Ručně psaná
+	Hide Font Classes	Skrýt třídy písem
+	Hide Styles	Skrýt řezy
+	Monospace	Neproporcionální
+	No fonts match these filters.	Filtrům neodpovídají žádná písma.
+	No similar fonts: the current font doesn't say what it looks like.	Žádná podobná písma: u aktuálního písma chybí popis vzhledu.
+	OpenType font	Písmo OpenType
+	Sans Serif	Bezpatková
+	Script	Skriptová
+	Serif	Patková
+	Show Font Classes	Zobrazit třídy písem
+	Show Similar Fonts	Zobrazit podobná písma
+	Show Styles	Zobrazit řezy
+	Show Variable Fonts	Zobrazit variabilní písma
+	Slab Serif	Slabová patková
+	TrueType font	Písmo TrueType
+	Variable font	Variabilní písmo
 	Calibration	Kalibrace
 	Red Primary	Červená základní
 	Green Primary	Zelená základní
@@ -4201,3 +4232,6 @@ cameraRaw	Dehaze	Odstranění oparu
 
 # Egui 0.37 migration controls (Aspect Ratio, Category, Color Table, Gamma, Interpolation, Profile, Target, Units, Demosaic)
 	Aspect Ratio	Poměr stran
+	Font size presets	Předvolby velikosti písma
+	Leading presets	Předvolby prokladu
+	Tracking presets	Předvolby prostrkání
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 6558daa51d..c1dfc027ed 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -311,6 +311,7 @@
 	Layer…	Ebene…
 	Group…	Gruppe…
 	Group from Layers…	Gruppe aus Ebenen…
+	New Group from Layers…	Neue Gruppe aus Ebenen…
 	Artboard…	Zeichenbereich…
 	Artboard from Group…	Zeichenbereich aus Gruppe…
 	Artboard from Layers…	Zeichenbereich aus Ebenen…
@@ -1941,7 +1942,7 @@
 	Full size tip	Spitze in voller Größe
 	Gamut warning color	Farbumfang-Warnfarbe
 	Gamut warning opacity	Deckkraft der Farbumfang-Warnung
-	Generator enabled	Generator aktiviert
+	Enable Generator	Generator aktivieren
 	Gif	GIF
 	Glossy	Glänzend
 	Grid color	Rasterfarbe
@@ -2814,6 +2815,9 @@ curves	Smooth	Glätten
 	Clear History	Protokoll löschen
 	New Snapshot…	Neuer Schnappschuss…
 	History Options…	Protokolloptionen…
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	Nicht-lineare Protokolle zulassen
+	Make Layer Visibility Changes Undoable	Änderungen der Ebenensichtbarkeit widerrufbar machen
 # Print dialog (#2697)
 	Emulsion Down	Schichtseite unten
 	Functions	Funktionen
@@ -3264,6 +3268,33 @@ curves	Smooth	Glätten
 	Sent to {printer}	An {printer} gesendet
 	set in Print Settings…	in den Druckeinstellungen festlegen…
 	ICO is limited to 256 × 256 pixels	ICO ist auf 256 × 256 Pixel begrenzt
+	Show Favorite Fonts	Favorisierte Schriften anzeigen
+	No favorite fonts yet: click the star beside a font to add it.	Noch keine favorisierten Schriften: Klicken Sie auf den Stern neben einer Schrift, um sie hinzuzufügen.
+	Favorite fonts	Favorisierte Schriften
+	Add to Favorites	Zu Favoriten hinzufügen
+	Remove from Favorites	Aus Favoriten entfernen
+	Show All Fonts	Alle Schriften anzeigen
+	All Classes	Alle Klassen
+	Blackletter	Gebrochene Schriften
+	Decorative	Dekorativ
+	Font preview:	Schriftvorschau:
+	Handwritten	Handschriftlich
+	Hide Font Classes	Schriftklassen ausblenden
+	Hide Styles	Schnitte ausblenden
+	Monospace	Nichtproportional
+	No fonts match these filters.	Keine Schriften entsprechen diesen Filtern.
+	No similar fonts: the current font doesn't say what it looks like.	Keine ähnlichen Schriften: Die aktuelle Schrift beschreibt ihr Aussehen nicht.
+	OpenType font	OpenType-Schrift
+	Sans Serif	Serifenlos
+	Script	Schreibschrift
+	Serif	Serifen
+	Show Font Classes	Schriftklassen einblenden
+	Show Similar Fonts	Ähnliche Schriften anzeigen
+	Show Styles	Schnitte einblenden
+	Show Variable Fonts	Variable Schriften anzeigen
+	Slab Serif	Serifenbetont
+	TrueType font	TrueType-Schrift
+	Variable font	Variable Schrift
 	Calibration	Kalibrierung
 	Red Primary	Rot-Primärfarbe
 	Green Primary	Grün-Primärfarbe
@@ -3475,3 +3506,6 @@ curves	Smooth	Glätten
 	Interpolation	Interpolation
 	Target	Ziel
 	Units	Einheiten
+	Font size presets	Schriftgrößen-Vorgaben
+	Leading presets	Zeilenabstand-Vorgaben
+	Tracking presets	Laufweiten-Vorgaben
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index 5f1a3d3538..b2b35dbbdc 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -224,6 +224,7 @@
 	Tools…	Εργαλεία…
 	History Log…	Καταγραφή ιστορικού…
 	Group from Layers…	Ομαδοποίηση από επίπεδα…
+	New Group from Layers…	Νέα ομάδα από επίπεδα…
 	Artboard from Layers…	Πίνακας σχεδίασης από επίπεδα…
 	Delete Filter Mask	Διαγραφή μάσκας φίλτρου
 	Disable Filter Mask	Απενεργοποίηση μάσκας φίλτρου
@@ -1714,7 +1715,7 @@
 	Full size tip	Άκρη πλήρους μεγέθους
 	Gamut warning color	Χρώμα προειδοποίησης χρωματικής γκάμας
 	Gamut warning opacity	Αδιαφάνεια προειδοποίησης χρωματικής γκάμας
-	Generator enabled	Ενεργοποίηση γεννήτριας
+	Enable Generator	Ενεργοποίηση γεννήτριας
 	Click the first point or press ↵ to close · Esc cancels	Κάντε κλικ στο πρώτο σημείο ή πατήστε ↵ για κλείσιμο · Esc για ακύρωση
 	Click to add a point · drag off or ⌘/Ctrl-click or Delete to remove	Κλικ για προσθήκη σημείου · σύρσιμο εκτός ή ⌘/Ctrl-κλικ ή Delete για αφαίρεση
 	Click to apply, ⌥-click to clear overrides, double-click for Style Options	Κλικ για εφαρμογή, ⌥-κλικ για εκκαθάριση παρακάμψεων, διπλό κλικ για επιλογές στυλ
@@ -3860,6 +3861,9 @@ curves	Smooth	Εξομάλυνση
 # History panel menu (#2966)
 	New Snapshot…	Νέο στιγμιότυπο…
 	History Options…	Επιλογές ιστορικού…
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	Να επιτρέπεται μη γραμμικό ιστορικό
+	Make Layer Visibility Changes Undoable	Οι αλλαγές ορατότητας επιπέδων να αναιρούνται
 # Print dialog (#2697)
 	Emulsion Down	Γαλάκτωμα προς τα κάτω
 	Functions	Λειτουργίες
@@ -3946,6 +3950,33 @@ curves	Smooth	Εξομάλυνση
 	Sent to {printer}	Στάλθηκε στον {printer}
 	set in Print Settings…	ορίζεται στις ρυθμίσεις εκτύπωσης…
 	ICO is limited to 256 × 256 pixels	Το ICO περιορίζεται σε 256 × 256 εικονοστοιχεία
+	Show Favorite Fonts	Εμφάνιση αγαπημένων γραμματοσειρών
+	No favorite fonts yet: click the star beside a font to add it.	Δεν υπάρχουν ακόμη αγαπημένες γραμματοσειρές: κάντε κλικ στο αστέρι δίπλα σε μια γραμματοσειρά για να την προσθέσετε.
+	Favorite fonts	Αγαπημένες γραμματοσειρές
+	Add to Favorites	Προσθήκη στα αγαπημένα
+	Remove from Favorites	Αφαίρεση από τα αγαπημένα
+	Show All Fonts	Εμφάνιση όλων των γραμματοσειρών
+	All Classes	Όλες οι κατηγορίες
+	Blackletter	Γοτθικές
+	Decorative	Διακοσμητικές
+	Font preview:	Προεπισκόπηση γραμματοσειράς:
+	Handwritten	Χειρόγραφες
+	Hide Font Classes	Απόκρυψη κατηγοριών γραμματοσειρών
+	Hide Styles	Απόκρυψη στυλ
+	Monospace	Σταθερού πλάτους
+	No fonts match these filters.	Καμία γραμματοσειρά δεν ταιριάζει με αυτά τα φίλτρα.
+	No similar fonts: the current font doesn't say what it looks like.	Καμία παρόμοια γραμματοσειρά: η τρέχουσα γραμματοσειρά δεν περιγράφει την εμφάνισή της.
+	OpenType font	Γραμματοσειρά OpenType
+	Sans Serif	Χωρίς πατούρες
+	Script	Καλλιγραφικές
+	Serif	Με πατούρες
+	Show Font Classes	Εμφάνιση κατηγοριών γραμματοσειρών
+	Show Similar Fonts	Εμφάνιση παρόμοιων γραμματοσειρών
+	Show Styles	Εμφάνιση στυλ
+	Show Variable Fonts	Εμφάνιση μεταβλητών γραμματοσειρών
+	Slab Serif	Με πλακοειδείς πατούρες
+	TrueType font	Γραμματοσειρά TrueType
+	Variable font	Μεταβλητή γραμματοσειρά
 	Calibration	Βαθμονόμηση
 	Red Primary	Κόκκινο πρωτεύον
 	Green Primary	Πράσινο πρωτεύον
@@ -4154,3 +4185,6 @@ curves	Smooth	Εξομάλυνση
 
 # Egui 0.37 migration controls (Aspect Ratio, Category, Color Table, Gamma, Interpolation, Profile, Target, Units, Demosaic)
 	Target	Στόχος
+	Font size presets	Προεπιλογές μεγέθους γραμματοσειράς
+	Leading presets	Προεπιλογές διάστιχου
+	Tracking presets	Προεπιλογές διαστήματος χαρακτήρων
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 879572c9f4..b42f3be02c 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -308,6 +308,7 @@
 	Layer…	Capa…
 	Group…	Grupo…
 	Group from Layers…	Grupo a partir de capas…
+	New Group from Layers…	Nuevo grupo a partir de capas…
 	Artboard…	Mesa de trabajo…
 	Artboard from Group…	Mesa de trabajo a partir de grupo…
 	Artboard from Layers…	Mesa de trabajo a partir de capas…
@@ -1954,7 +1955,7 @@
 	Full size tip	Punta a tamaño real
 	Gamut warning color	Color de advertencia de gama
 	Gamut warning opacity	Opacidad de advertencia de gama
-	Generator enabled	Generador activado
+	Enable Generator	Activar generador
 	Gif	GIF
 	Glossy	Brillante
 	Grid color	Color de la cuadrícula
@@ -2848,6 +2849,9 @@ curves	Smooth	Suavizar
 # History panel menu (#2966)
 	New Snapshot…	Nueva instantánea…
 	History Options…	Opciones de historial…
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	Permitir historia no lineal
+	Make Layer Visibility Changes Undoable	Permitir deshacer los cambios de visibilidad de capas
 # Print dialog (#2697)
 	Emulsion Down	Emulsión hacia abajo
 	Functions	Funciones
@@ -4209,6 +4213,33 @@ navigator	Zoom	Zoom
 	Sent to {printer}	Enviado a {printer}
 	set in Print Settings…	se establece en Ajustes de impresión…
 	ICO is limited to 256 × 256 pixels	ICO está limitado a 256 × 256 píxeles
+	Show Favorite Fonts	Mostrar fuentes favoritas
+	No favorite fonts yet: click the star beside a font to add it.	Aún no hay fuentes favoritas: haz clic en la estrella junto a una fuente para añadirla.
+	Favorite fonts	Fuentes favoritas
+	Add to Favorites	Añadir a favoritos
+	Remove from Favorites	Quitar de favoritos
+	Show All Fonts	Mostrar todas las fuentes
+	All Classes	Todas las clases
+	Blackletter	Gótica
+	Decorative	Decorativa
+	Font preview:	Vista previa de fuente:
+	Handwritten	Manuscrita
+	Hide Font Classes	Ocultar clases de fuente
+	Hide Styles	Ocultar estilos
+	Monospace	Monoespaciada
+	No fonts match these filters.	Ninguna fuente coincide con estos filtros.
+	No similar fonts: the current font doesn't say what it looks like.	No hay fuentes similares: la fuente actual no describe su aspecto.
+	OpenType font	Fuente OpenType
+	Sans Serif	Sans serif
+	Script	Caligráfica
+	Serif	Serif
+	Show Font Classes	Mostrar clases de fuente
+	Show Similar Fonts	Mostrar fuentes similares
+	Show Styles	Mostrar estilos
+	Show Variable Fonts	Mostrar fuentes variables
+	Slab Serif	Serif egipcia
+	TrueType font	Fuente TrueType
+	Variable font	Fuente variable
 	Calibration	Calibración
 	Red Primary	Primario rojo
 	Green Primary	Primario verde
@@ -4413,3 +4444,6 @@ navigator	Zoom	Zoom
 	Tight Curl	Rizo apretado
 	Loose Curl	Rizo suelto
 	Stylized dabs from a history state	Toques estilizados desde un estado del historial
+	Font size presets	Valores predefinidos de tamaño de fuente
+	Leading presets	Valores predefinidos de interlineado
+	Tracking presets	Valores predefinidos de tracking
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 9692437211..3bad30d474 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -304,6 +304,7 @@
 	Layer…	Calque…
 	Group…	Groupe…
 	Group from Layers…	Groupe d'après des calques…
+	New Group from Layers…	Nouveau groupe d'après des calques…
 	Artboard…	Plan de travail…
 	Artboard from Group…	Plan de travail d'après un groupe…
 	Artboard from Layers…	Plan de travail d'après des calques…
@@ -1922,7 +1923,7 @@
 	Full size tip	Pointe en taille réelle
 	Gamut warning color	Couleur de l'alerte de gamut
 	Gamut warning opacity	Opacité de l'alerte de gamut
-	Generator enabled	Générateur activé
+	Enable Generator	Activer le générateur
 	Gif	GIF
 	Glossy	Brillant
 	Grid color	Couleur de la grille
@@ -3184,6 +3185,9 @@ curves	Smooth	Lisser
 # History panel menu (#2966)
 	New Snapshot…	Nouvel instantané…
 	History Options…	Options d'historique…
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	Autoriser l'historique non linéaire
+	Make Layer Visibility Changes Undoable	Permettre d'annuler les changements de visibilité des calques
 # Print dialog (#2697)
 	Emulsion Down	Émulsion verso
 	Functions	Fonctions
@@ -3256,6 +3260,33 @@ curves	Smooth	Lisser
 	Sent to {printer}	Envoyé à {printer}
 	set in Print Settings…	défini dans les paramètres d’impression…
 	ICO is limited to 256 × 256 pixels	Le format ICO est limité à 256 × 256 pixels
+	Show Favorite Fonts	Afficher les polices favorites
+	No favorite fonts yet: click the star beside a font to add it.	Aucune police favorite pour l’instant : cliquez sur l’étoile à côté d’une police pour l’ajouter.
+	Favorite fonts	Polices favorites
+	Add to Favorites	Ajouter aux favoris
+	Remove from Favorites	Retirer des favoris
+	Show All Fonts	Afficher toutes les polices
+	All Classes	Toutes les classes
+	Blackletter	Gothique
+	Decorative	Décorative
+	Font preview:	Aperçu de la police :
+	Handwritten	Manuscrite
+	Hide Font Classes	Masquer les classes de polices
+	Hide Styles	Masquer les styles
+	Monospace	Chasse fixe
+	No fonts match these filters.	Aucune police ne correspond à ces filtres.
+	No similar fonts: the current font doesn't say what it looks like.	Aucune police similaire : la police actuelle ne décrit pas son apparence.
+	OpenType font	Police OpenType
+	Sans Serif	Sans empattement
+	Script	Scripte
+	Serif	Avec empattement
+	Show Font Classes	Afficher les classes de polices
+	Show Similar Fonts	Afficher les polices similaires
+	Show Styles	Afficher les styles
+	Show Variable Fonts	Afficher les polices variables
+	Slab Serif	Égyptienne
+	TrueType font	Police TrueType
+	Variable font	Police variable
 	Calibration	Étalonnage
 	Red Primary	Primaire rouge
 	Green Primary	Primaire verte
@@ -4493,3 +4524,6 @@ shape	Appearance	Apparence
 	Tight Curl	Boucle serrée
 	Loose Curl	Boucle lâche
 	Stylized dabs from a history state	Touches stylisées depuis un état d'historique
+	Font size presets	Tailles de police prédéfinies
+	Leading presets	Interlignages prédéfinis
+	Tracking presets	Approches prédéfinies
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 1931aaa2b0..d632cb52f1 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -611,6 +611,8 @@
 	High Pass…	Felüláteresztő…
 	Histogram	Hisztogram
 	History	Előzmények
+	Allow Non-Linear History	Nem lineáris előzmények engedélyezése
+	Make Layer Visibility Changes Undoable	A rétegláthatósági változások visszavonhatók
 	Horizontal	Vízszintes
 	HSB/HSL	HSB/HSL
 	Huge	Óriási
@@ -3278,7 +3280,7 @@ cameraRaw	Yellow	Sárga
 	Full size tip	Teljes méretű hegy
 	Fullscreen	Teljes képernyő
 	General…	Általános…
-	Generator enabled	Generátor bekapcsolva
+	Enable Generator	Generátor bekapcsolása
 	Generators	Generátorok
 	Generic	Általános
 	GitHub	GitHub
@@ -3417,6 +3419,7 @@ cameraRaw	Yellow	Sárga
 	New Document With Mask	Új dokumentum maszkkal
 	New document…	Új dokumentum…
 	New Group	Új csoport
+	New Group from Layers…	Új csoport rétegekből…
 	New Guide	Új segédvonal
 	New Layer	Új réteg
 	New Layer Comp	Új rétegkompozíció
@@ -4154,6 +4157,33 @@ cameraRaw	Yellow	Sárga
 	Kept {name}: written by another application	{name} megtartva: egy másik alkalmazás írta
 	Shadow Tint	Árnyék színezet
 	Redrawing	Újrarajzolás
+	Show Favorite Fonts	Kedvenc betűtípusok megjelenítése
+	No favorite fonts yet: click the star beside a font to add it.	Még nincsenek kedvenc betűtípusok: kattintson a betűtípus melletti csillagra a hozzáadáshoz.
+	Favorite fonts	Kedvenc betűtípusok
+	Add to Favorites	Hozzáadás a kedvencekhez
+	Remove from Favorites	Eltávolítás a kedvencek közül
+	Show All Fonts	Összes betűtípus megjelenítése
+	All Classes	Összes osztály
+	Blackletter	Gót betűs
+	Decorative	Díszítő
+	Font preview:	Betűtípus előnézete:
+	Handwritten	Kézírásos
+	Hide Font Classes	Betűtípus-osztályok elrejtése
+	Hide Styles	Stílusok elrejtése
+	Monospace	Fix szélességű
+	No fonts match these filters.	Egy betűtípus sem felel meg ezeknek a szűrőknek.
+	No similar fonts: the current font doesn't say what it looks like.	Nincsenek hasonló betűtípusok: a jelenlegi betűtípus nem írja le a megjelenését.
+	OpenType font	OpenType betűtípus
+	Sans Serif	Talpatlan
+	Script	Írott
+	Serif	Talpas
+	Show Font Classes	Betűtípus-osztályok megjelenítése
+	Show Similar Fonts	Hasonló betűtípusok megjelenítése
+	Show Styles	Stílusok megjelenítése
+	Show Variable Fonts	Változó betűtípusok megjelenítése
+	Slab Serif	Talpas (szögletes)
+	TrueType font	TrueType betűtípus
+	Variable font	Változó betűtípus
 # Bevel & Emboss shading controls.
 	Highlight Mode	Csúcsfény módja
 	Highlight Color	Csúcsfény színe
@@ -4366,3 +4396,6 @@ cameraRaw	Yellow	Sárga
 	Tight Curl	Szoros göndör
 	Loose Curl	Laza göndör
 	Stylized dabs from a history state	Stilizált pöttyök egy előzményállapotból
+	Font size presets	Betűméret-előbeállítások
+	Leading presets	Sorköz-előbeállítások
+	Tracking presets	Betűköz-előbeállítások
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index eb890e9bce..771e04e80a 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -297,6 +297,7 @@
 	Layer…	Layer…
 	Group…	Grup…
 	Group from Layers…	Grup dari Layer…
+	New Group from Layers…	Grup Baru dari Layer…
 	Artboard…	Artboard…
 	Artboard from Group…	Artboard dari Grup…
 	Artboard from Layers…	Artboard dari Layer…
@@ -1932,7 +1933,7 @@
 	Full size tip	Ujung ukuran penuh
 	Gamut warning color	Warna peringatan gamut
 	Gamut warning opacity	Opasitas peringatan gamut
-	Generator enabled	Generator aktif
+	Enable Generator	Aktifkan Generator
 	Gif	GIF
 	Glossy	Mengilap
 	Grid color	Warna grid
@@ -3187,6 +3188,9 @@ curves	Smooth	Haluskan
 # History panel menu (#2966)
 	New Snapshot…	Snapshot Baru…
 	History Options…	Opsi Riwayat…
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	Izinkan Riwayat Non-Linier
+	Make Layer Visibility Changes Undoable	Perubahan Visibilitas Layer Dapat Diurungkan
 # Print dialog (#2697)
 	Emulsion Down	Emulsi di Bawah
 	Functions	Fungsi
@@ -3259,6 +3263,33 @@ curves	Smooth	Haluskan
 	Sent to {printer}	Dikirim ke {printer}
 	set in Print Settings…	diatur di Pengaturan Cetak…
 	ICO is limited to 256 × 256 pixels	ICO dibatasi hingga 256 × 256 piksel
+	Show Favorite Fonts	Tampilkan Font Favorit
+	No favorite fonts yet: click the star beside a font to add it.	Belum ada font favorit: klik bintang di samping font untuk menambahkannya.
+	Favorite fonts	Font favorit
+	Add to Favorites	Tambahkan ke Favorit
+	Remove from Favorites	Hapus dari Favorit
+	Show All Fonts	Tampilkan Semua Font
+	All Classes	Semua Kelas
+	Blackletter	Blackletter
+	Decorative	Dekoratif
+	Font preview:	Pratinjau font:
+	Handwritten	Tulisan tangan
+	Hide Font Classes	Sembunyikan Kelas Font
+	Hide Styles	Sembunyikan Gaya
+	Monospace	Monospasi
+	No fonts match these filters.	Tidak ada font yang cocok dengan filter ini.
+	No similar fonts: the current font doesn't say what it looks like.	Tidak ada font serupa: font saat ini tidak menjelaskan tampilannya.
+	OpenType font	Font OpenType
+	Sans Serif	Sans Serif
+	Script	Skrip
+	Serif	Serif
+	Show Font Classes	Tampilkan Kelas Font
+	Show Similar Fonts	Tampilkan Font Serupa
+	Show Styles	Tampilkan Gaya
+	Show Variable Fonts	Tampilkan Font Variabel
+	Slab Serif	Slab Serif
+	TrueType font	Font TrueType
+	Variable font	Font variabel
 	Calibration	Kalibrasi
 	Red Primary	Primer merah
 	Green Primary	Primer hijau
@@ -3473,3 +3504,6 @@ curves	Smooth	Haluskan
 	Gamma	Gamma
 	Profile	Profil
 	Target	Target
+	Font size presets	Preset ukuran font
+	Leading presets	Preset leading
+	Tracking presets	Preset tracking
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 661192d7b6..b1598ac237 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -305,6 +305,7 @@
 	Layer…	Livello…
 	Group…	Gruppo…
 	Group from Layers…	Gruppo da livelli…
+	New Group from Layers…	Nuovo gruppo da livelli…
 	Artboard…	Tavola da disegno…
 	Artboard from Group…	Tavola da gruppo…
 	Artboard from Layers…	Tavola da livelli…
@@ -1948,7 +1949,7 @@
 	Full size tip	Punta dimensione reale
 	Gamut warning color	Colore avviso gamma
 	Gamut warning opacity	Opacità avviso gamma
-	Generator enabled	Generatore abilitato
+	Enable Generator	Abilita generatore
 	Gif	GIF
 	Glossy	Lucido
 	Grid color	Colore griglia
@@ -2833,6 +2834,9 @@ curves	Smooth	Leviga
 # History panel menu (#2966)
 	New Snapshot…	Nuova istantanea…
 	History Options…	Opzioni cronologia…
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	Consenti cronologia non lineare
+	Make Layer Visibility Changes Undoable	Rendi annullabili le modifiche di visibilità dei livelli
 # Print dialog (#2697)
 	Emulsion Down	Emulsione sotto
 	Functions	Funzioni
@@ -4212,6 +4216,33 @@ navigator	Zoom	Zoom
 	Sent to {printer}	Inviato a {printer}
 	set in Print Settings…	impostato nelle impostazioni di stampa…
 	ICO is limited to 256 × 256 pixels	ICO è limitato a 256 × 256 pixel
+	Show Favorite Fonts	Mostra font preferiti
+	No favorite fonts yet: click the star beside a font to add it.	Ancora nessun font preferito: fai clic sulla stella accanto a un font per aggiungerlo.
+	Favorite fonts	Font preferiti
+	Add to Favorites	Aggiungi ai preferiti
+	Remove from Favorites	Rimuovi dai preferiti
+	Show All Fonts	Mostra tutti i font
+	All Classes	Tutte le classi
+	Blackletter	Gotico
+	Decorative	Decorativo
+	Font preview:	Anteprima font:
+	Handwritten	Scrittura a mano
+	Hide Font Classes	Nascondi classi di font
+	Hide Styles	Nascondi stili
+	Monospace	Monospaziato
+	No fonts match these filters.	Nessun font corrisponde a questi filtri.
+	No similar fonts: the current font doesn't say what it looks like.	Nessun font simile: il font corrente non descrive il proprio aspetto.
+	OpenType font	Font OpenType
+	Sans Serif	Senza grazie
+	Script	Corsivo calligrafico
+	Serif	Con grazie
+	Show Font Classes	Mostra classi di font
+	Show Similar Fonts	Mostra font simili
+	Show Styles	Mostra stili
+	Show Variable Fonts	Mostra font variabili
+	Slab Serif	Egiziano
+	TrueType font	Font TrueType
+	Variable font	Font variabile
 	Calibration	Calibrazione
 	Red Primary	Primario rosso
 	Green Primary	Primario verde
@@ -4568,3 +4599,6 @@ shape	Appearance	Aspetto
 	Tight Curl	Riccio stretto
 	Loose Curl	Riccio largo
 	Stylized dabs from a history state	Tocchi stilizzati da uno stato della storia
+	Font size presets	Predefiniti dimensione font
+	Leading presets	Predefiniti interlinea
+	Tracking presets	Predefiniti spaziatura
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index c5c0b02fc0..435813b0c7 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -307,6 +307,7 @@
 	Layer…	レイヤー…
 	Group…	グループ…
 	Group from Layers…	レイヤーからグループ…
+	New Group from Layers…	レイヤーから新規グループ…
 	Artboard…	アートボード…
 	Artboard from Group…	グループからアートボード…
 	Artboard from Layers…	レイヤーからアートボード…
@@ -1950,7 +1951,7 @@
 	Full size tip	実寸の先端
 	Gamut warning color	色域外警告の色
 	Gamut warning opacity	色域外警告の不透明度
-	Generator enabled	自動生成を有効にする
+	Enable Generator	自動生成を有効にする
 	Gif	GIF
 	Glossy	光沢
 	Grid color	グリッドの色
@@ -3774,6 +3775,9 @@ curves	Smooth	スムーズ
 # History panel menu (#2966)
 	New Snapshot…	新規スナップショット…
 	History Options…	ヒストリーオプション…
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	非線形のヒストリーを許可
+	Make Layer Visibility Changes Undoable	レイヤーの表示/非表示の変更を取り消し可能にする
 # Print dialog (#2697)
 	Emulsion Down	乳剤面を下
 	Functions	機能
@@ -3927,6 +3931,33 @@ curves	Smooth	スムーズ
 	Reset All Locked Settings	ロックされた設定をすべて初期化
 	Copy Texture to Other Tools	テクスチャを他のツールにコピー
 	ICO is limited to 256 × 256 pixels	ICO は 256 × 256 ピクセルまでです
+	Show Favorite Fonts	お気に入りのフォントを表示
+	No favorite fonts yet: click the star beside a font to add it.	お気に入りのフォントはまだありません。フォントの横の星をクリックして追加してください。
+	Favorite fonts	お気に入りのフォント
+	Add to Favorites	お気に入りに追加
+	Remove from Favorites	お気に入りから削除
+	Show All Fonts	すべてのフォントを表示
+	All Classes	すべての分類
+	Blackletter	ブラックレター
+	Decorative	装飾
+	Font preview:	フォントのプレビュー:
+	Handwritten	手書き
+	Hide Font Classes	フォントの分類を隠す
+	Hide Styles	スタイルを隠す
+	Monospace	等幅
+	No fonts match these filters.	このフィルターに一致するフォントはありません。
+	No similar fonts: the current font doesn't say what it looks like.	類似フォントはありません。現在のフォントは外観の情報を持っていません。
+	OpenType font	OpenType フォント
+	Sans Serif	サンセリフ
+	Script	スクリプト
+	Serif	セリフ
+	Show Font Classes	フォントの分類を表示
+	Show Similar Fonts	類似フォントを表示
+	Show Styles	スタイルを表示
+	Show Variable Fonts	バリアブルフォントを表示
+	Slab Serif	スラブセリフ
+	TrueType font	TrueType フォント
+	Variable font	バリアブルフォント
 	Calibration	キャリブレーション
 	Red Primary	レッド原色
 	Green Primary	グリーン原色
@@ -4130,3 +4161,6 @@ curves	Smooth	スムーズ
 	Tight Curl	タイトカール
 	Loose Curl	ルーズカール
 	Stylized dabs from a history state	履歴状態から様式化したダブを描きます
+	Font size presets	フォントサイズのプリセット
+	Leading presets	行送りのプリセット
+	Tracking presets	トラッキングのプリセット
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 2c730c1877..30ab8cb165 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -294,6 +294,7 @@
 	Layer…	레이어…
 	Group…	그룹…
 	Group from Layers…	레이어로 그룹 만들기…
+	New Group from Layers…	레이어에서 새 그룹…
 	Artboard…	아트보드…
 	Artboard from Group…	그룹으로 아트보드 만들기…
 	Artboard from Layers…	레이어로 아트보드 만들기…
@@ -1938,7 +1939,7 @@
 	Full size tip	전체 크기 브러시 끝
 	Gamut warning color	색상 범위 경고 색상
 	Gamut warning opacity	색상 범위 경고 불투명도
-	Generator enabled	생성기 활성화
+	Enable Generator	생성기 활성화
 	Gif	GIF
 	Glossy	광택
 	Grid color	격자 색상
@@ -3379,6 +3380,9 @@ curves	Smooth	매끄럽게
 	Clear History	작업 내역 지우기
 	New Snapshot…	새 스냅샷…
 	History Options…	작업 내역 옵션…
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	비선형 작업 내역 허용
+	Make Layer Visibility Changes Undoable	레이어 표시 여부 변경을 실행 취소할 수 있게 하기
 # Print dialog (#2697)
 	Emulsion Down	감광면 아래로
 	Functions	기능
@@ -3451,6 +3455,33 @@ curves	Smooth	매끄럽게
 	Sent to {printer}	{printer}(으)로 전송됨
 	set in Print Settings…	인쇄 설정에서 지정…
 	ICO is limited to 256 × 256 pixels	ICO는 256 × 256픽셀로 제한됩니다
+	Show Favorite Fonts	즐겨찾는 글꼴 표시
+	No favorite fonts yet: click the star beside a font to add it.	아직 즐겨찾는 글꼴이 없습니다. 글꼴 옆의 별을 클릭하여 추가하세요.
+	Favorite fonts	즐겨찾는 글꼴
+	Add to Favorites	즐겨찾기에 추가
+	Remove from Favorites	즐겨찾기에서 제거
+	Show All Fonts	모든 글꼴 표시
+	All Classes	모든 분류
+	Blackletter	블랙레터
+	Decorative	장식
+	Font preview:	글꼴 미리 보기:
+	Handwritten	손글씨
+	Hide Font Classes	글꼴 분류 숨기기
+	Hide Styles	스타일 숨기기
+	Monospace	고정폭
+	No fonts match these filters.	이 필터와 일치하는 글꼴이 없습니다.
+	No similar fonts: the current font doesn't say what it looks like.	비슷한 글꼴 없음: 현재 글꼴에 모양 정보가 없습니다.
+	OpenType font	OpenType 글꼴
+	Sans Serif	산세리프
+	Script	스크립트
+	Serif	세리프
+	Show Font Classes	글꼴 분류 표시
+	Show Similar Fonts	비슷한 글꼴 표시
+	Show Styles	스타일 표시
+	Show Variable Fonts	가변 글꼴 표시
+	Slab Serif	슬래브 세리프
+	TrueType font	TrueType 글꼴
+	Variable font	가변 글꼴
 	Calibration	보정
 	Red Primary	빨강 원색
 	Green Primary	녹색 원색
@@ -3670,3 +3701,6 @@ curves	Smooth	매끄럽게
 	Category	카테고리
 	Target	대상
 	Units	단위
+	Font size presets	글꼴 크기 사전 설정
+	Leading presets	행간 사전 설정
+	Tracking presets	자간 사전 설정
diff --git a/crates/ui-egui/src/i18n/nl.tsv b/crates/ui-egui/src/i18n/nl.tsv
index a8539cd159..d03260ecaf 100644
--- a/crates/ui-egui/src/i18n/nl.tsv
+++ b/crates/ui-egui/src/i18n/nl.tsv
@@ -298,6 +298,7 @@
 	Layer…	Laag…
 	Group…	Groep…
 	Group from Layers…	Groep uit lagen…
+	New Group from Layers…	Nieuwe groep uit lagen…
 	Artboard…	Tekengebied…
 	Artboard from Group…	Tekengebied uit groep…
 	Artboard from Layers…	Tekengebied uit lagen…
@@ -1922,7 +1923,7 @@
 	Full size tip	Punt op volledige grootte
 	Gamut warning color	Kleur waarschuwing kleurbereik
 	Gamut warning opacity	Dekking waarschuwing kleurbereik
-	Generator enabled	Generator ingeschakeld
+	Enable Generator	Generator inschakelen
 	Gif	GIF
 	Glossy	Glanzend
 	Grid color	Rasterkleur
@@ -3922,6 +3923,9 @@ curves	Smooth	Vloeiend maken
 # History panel menu (#2966)
 	New Snapshot…	Nieuwe momentopname…
 	History Options…	Geschiedenisopties…
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	Niet-lineaire geschiedenis toestaan
+	Make Layer Visibility Changes Undoable	Wijzigingen in laagzichtbaarheid ongedaan kunnen maken
 # Print dialog (#2697)
 	Emulsion Down	Emulsie omlaag
 	Functions	Functies
@@ -4008,6 +4012,33 @@ curves	Smooth	Vloeiend maken
 	Sent to {printer}	Verzonden naar {printer}
 	set in Print Settings…	instellen in de afdrukinstellingen…
 	ICO is limited to 256 × 256 pixels	ICO is beperkt tot 256 × 256 pixels
+	Show Favorite Fonts	Favoriete lettertypen tonen
+	No favorite fonts yet: click the star beside a font to add it.	Nog geen favoriete lettertypen: klik op de ster naast een lettertype om het toe te voegen.
+	Favorite fonts	Favoriete lettertypen
+	Add to Favorites	Toevoegen aan favorieten
+	Remove from Favorites	Verwijderen uit favorieten
+	Show All Fonts	Alle lettertypen tonen
+	All Classes	Alle klassen
+	Blackletter	Gebroken letter
+	Decorative	Decoratief
+	Font preview:	Lettertypevoorbeeld:
+	Handwritten	Handgeschreven
+	Hide Font Classes	Lettertypeklassen verbergen
+	Hide Styles	Stijlen verbergen
+	Monospace	Monospace
+	No fonts match these filters.	Geen lettertypen voldoen aan deze filters.
+	No similar fonts: the current font doesn't say what it looks like.	Geen vergelijkbare lettertypen: het huidige lettertype beschrijft zijn uiterlijk niet.
+	OpenType font	OpenType-lettertype
+	Sans Serif	Schreefloos
+	Script	Script
+	Serif	Schreef
+	Show Font Classes	Lettertypeklassen tonen
+	Show Similar Fonts	Vergelijkbare lettertypen tonen
+	Show Styles	Stijlen tonen
+	Show Variable Fonts	Variabele lettertypen tonen
+	Slab Serif	Slab-schreef
+	TrueType font	TrueType-lettertype
+	Variable font	Variabel lettertype
 	Calibration	Kalibratie
 	Red Primary	Primair rood
 	Green Primary	Primair groen
@@ -4211,3 +4242,6 @@ curves	Smooth	Vloeiend maken
 	Tight Curl	Strakke krul
 	Loose Curl	Losse krul
 	Stylized dabs from a history state	Gestileerde tikken uit een historiestatus
+	Font size presets	Voorinstellingen lettergrootte
+	Leading presets	Voorinstellingen interlinie
+	Tracking presets	Voorinstellingen spatiëring
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 6b2ad286a0..ba41a4e34d 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -305,6 +305,7 @@
 	Layer…	Warstwa…
 	Group…	Grupa…
 	Group from Layers…	Grupa z warstw…
+	New Group from Layers…	Nowa grupa z warstw…
 	Artboard…	Obszar roboczy…
 	Artboard from Group…	Obszar roboczy z grupy…
 	Artboard from Layers…	Obszar roboczy z warstw…
@@ -1960,7 +1961,7 @@
 	Full size tip	Końcówka w pełnym rozmiarze
 	Gamut warning color	Kolor ostrzeżenia o gamucie
 	Gamut warning opacity	Krycie ostrzeżenia o gamucie
-	Generator enabled	Generator włączony
+	Enable Generator	Włącz generator
 	Gif	GIF
 	Glossy	Błyszczący
 	Grid color	Kolor siatki
@@ -3792,6 +3793,9 @@ curves	Smooth	Wygładź
 # History panel menu (#2966)
 	New Snapshot…	Nowa migawka…
 	History Options…	Opcje historii…
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	Zezwalaj na nieliniową historię
+	Make Layer Visibility Changes Undoable	Pozwalaj cofać zmiany widoczności warstw
 # Print dialog (#2697)
 	Emulsion Down	Emulsja w dół
 	Functions	Funkcje
@@ -3863,6 +3867,33 @@ curves	Smooth	Wygładź
 	Sent to {printer}	Wysłano do {printer}
 	set in Print Settings…	ustawiane w ustawieniach druku…
 	ICO is limited to 256 × 256 pixels	ICO jest ograniczony do 256 × 256 pikseli
+	Show Favorite Fonts	Pokaż ulubione czcionki
+	No favorite fonts yet: click the star beside a font to add it.	Brak ulubionych czcionek: kliknij gwiazdkę obok czcionki, aby ją dodać.
+	Favorite fonts	Ulubione czcionki
+	Add to Favorites	Dodaj do ulubionych
+	Remove from Favorites	Usuń z ulubionych
+	Show All Fonts	Pokaż wszystkie czcionki
+	All Classes	Wszystkie klasy
+	Blackletter	Pismo gotyckie
+	Decorative	Ozdobne
+	Font preview:	Podgląd czcionki:
+	Handwritten	Odręczne
+	Hide Font Classes	Ukryj klasy czcionek
+	Hide Styles	Ukryj style
+	Monospace	O stałej szerokości
+	No fonts match these filters.	Żadna czcionka nie pasuje do tych filtrów.
+	No similar fonts: the current font doesn't say what it looks like.	Brak podobnych czcionek: bieżąca czcionka nie opisuje swojego wyglądu.
+	OpenType font	Czcionka OpenType
+	Sans Serif	Bezszeryfowe
+	Script	Pisane
+	Serif	Szeryfowe
+	Show Font Classes	Pokaż klasy czcionek
+	Show Similar Fonts	Pokaż podobne czcionki
+	Show Styles	Pokaż style
+	Show Variable Fonts	Pokaż czcionki zmienne
+	Slab Serif	Szeryfowe prostokątne
+	TrueType font	Czcionka TrueType
+	Variable font	Czcionka zmienna
 	Calibration	Kalibracja
 	Red Primary	Czerwień podstawowa
 	Green Primary	Zieleń podstawowa
@@ -4071,3 +4102,6 @@ curves	Smooth	Wygładź
 
 # Egui 0.37 migration controls (Aspect Ratio, Category, Color Table, Gamma, Interpolation, Profile, Target, Units, Demosaic)
 	Target	Cel
+	Font size presets	Ustawienia wstępne rozmiaru czcionki
+	Leading presets	Ustawienia wstępne interlinii
+	Tracking presets	Ustawienia wstępne światła
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 098ca1f8a6..f3335cd9c6 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -299,6 +299,7 @@
 	Layer…	Camada…
 	Group…	Grupo…
 	Group from Layers…	Grupo a partir de camadas…
+	New Group from Layers…	Novo grupo a partir de camadas…
 	Artboard…	Prancheta…
 	Artboard from Group…	Prancheta a partir de grupo…
 	Artboard from Layers…	Prancheta a partir de camadas…
@@ -1916,7 +1917,7 @@
 	Full size tip	Ponta em tamanho real
 	Gamut warning color	Cor do aviso de gama
 	Gamut warning opacity	Opacidade do aviso de gama
-	Generator enabled	Gerador ativado
+	Enable Generator	Ativar gerador
 	Gif	GIF
 	Glossy	Brilhante
 	Grid color	Cor da grade
@@ -3952,6 +3953,9 @@ layerLabel	No Color	Sem cor
 # History panel menu (#2966)
 	New Snapshot…	Novo instantâneo…
 	History Options…	Opções de histórico…
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	Permitir histórico não linear
+	Make Layer Visibility Changes Undoable	Permitir desfazer alterações de visibilidade das camadas
 # Print dialog (#2697)
 	Emulsion Down	Emulsão para baixo
 	Functions	Funções
@@ -4038,6 +4042,33 @@ layerLabel	No Color	Sem cor
 	Sent to {printer}	Enviado para {printer}
 	set in Print Settings…	definido nas configurações de impressão…
 	ICO is limited to 256 × 256 pixels	ICO é limitado a 256 × 256 pixels
+	Show Favorite Fonts	Mostrar fontes favoritas
+	No favorite fonts yet: click the star beside a font to add it.	Ainda não há fontes favoritas: clique na estrela ao lado de uma fonte para adicioná-la.
+	Favorite fonts	Fontes favoritas
+	Add to Favorites	Adicionar aos favoritos
+	Remove from Favorites	Remover dos favoritos
+	Show All Fonts	Mostrar todas as fontes
+	All Classes	Todas as classes
+	Blackletter	Gótica
+	Decorative	Decorativa
+	Font preview:	Visualização da fonte:
+	Handwritten	Manuscrita
+	Hide Font Classes	Ocultar classes de fonte
+	Hide Styles	Ocultar estilos
+	Monospace	Monoespaçada
+	No fonts match these filters.	Nenhuma fonte corresponde a estes filtros.
+	No similar fonts: the current font doesn't say what it looks like.	Nenhuma fonte semelhante: a fonte atual não descreve sua aparência.
+	OpenType font	Fonte OpenType
+	Sans Serif	Sem serifa
+	Script	Cursiva
+	Serif	Com serifa
+	Show Font Classes	Mostrar classes de fonte
+	Show Similar Fonts	Mostrar fontes semelhantes
+	Show Styles	Mostrar estilos
+	Show Variable Fonts	Mostrar fontes variáveis
+	Slab Serif	Serifa egípcia
+	TrueType font	Fonte TrueType
+	Variable font	Fonte variável
 	Calibration	Calibração
 	Red Primary	Primária vermelha
 	Green Primary	Primária verde
@@ -4381,3 +4412,6 @@ layerLabel	No Color	Sem cor
 	Tight Curl	Curva cerrada
 	Loose Curl	Curva solta
 	Stylized dabs from a history state	Toques estilizados a partir de um estado do histórico
+	Font size presets	Predefinições de tamanho da fonte
+	Leading presets	Predefinições de entrelinha
+	Tracking presets	Predefinições de tracking
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index d3e6033306..b74c398312 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -190,9 +190,10 @@
 	Background from Layer	Фон из слоя
 	Background From Layer	Фон из слоя
 	Group Layers	Сгруппировать слои
-	Group…	Группировать…
+	Group…	Группа…
 	Ungroup Layers	Разгруппировать слои
 	Group from Layers…	Группа из слоёв…
+	New Group from Layers…	Новая группа из слоёв…
 	Hide Layers	Скрыть слои
 	Arrange	Упорядочить
 	Bring to Front	На передний план
@@ -2376,7 +2377,7 @@
 	Gamut warning color	Цвет предупреждения об охвате
 	Gamut warning opacity	Непрозрачность предупреждения об охвате
 	General	Основные
-	Generator enabled	Генератор включён
+	Enable Generator	Включить генератор
 	Gif	GIF
 	Glossy	Глянцевая
 	Grid color	Цвет сетки
@@ -3115,6 +3116,9 @@ curves	Smooth	Сгладить
 # History panel menu (#2966)
 	New Snapshot…	Новый снимок…
 	History Options…	Параметры истории…
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	Разрешить нелинейную историю
+	Make Layer Visibility Changes Undoable	Разрешить отмену изменений видимости слоёв
 # Print dialog (#2697)
 	Emulsion Down	Эмульсией вниз
 	Functions	Функции
@@ -3236,6 +3240,33 @@ curves	Smooth	Сгладить
 	Gray Value (Median)	Уровень серого (медиана)
 	Integrated Density	Интегральная плотность
 	Length	Длина
+	Show Favorite Fonts	Показать избранные шрифты
+	No favorite fonts yet: click the star beside a font to add it.	Избранных шрифтов пока нет: нажмите на звёздочку рядом со шрифтом, чтобы добавить его.
+	Favorite fonts	Избранные шрифты
+	Add to Favorites	Добавить в избранное
+	Remove from Favorites	Удалить из избранного
+	Show All Fonts	Показать все шрифты
+	All Classes	Все классы
+	Blackletter	Готические
+	Decorative	Декоративные
+	Font preview:	Предпросмотр шрифта:
+	Handwritten	Рукописные
+	Hide Font Classes	Скрыть классы шрифтов
+	Hide Styles	Скрыть начертания
+	Monospace	Моноширинные
+	No fonts match these filters.	Нет шрифтов, подходящих под эти фильтры.
+	No similar fonts: the current font doesn't say what it looks like.	Нет похожих шрифтов: текущий шрифт не описывает свой вид.
+	OpenType font	Шрифт OpenType
+	Sans Serif	Без засечек
+	Script	Каллиграфические
+	Serif	С засечками
+	Show Font Classes	Показать классы шрифтов
+	Show Similar Fonts	Показать похожие шрифты
+	Show Styles	Показать начертания
+	Show Variable Fonts	Показать вариативные шрифты
+	Slab Serif	С брусковыми засечками
+	TrueType font	Шрифт TrueType
+	Variable font	Вариативный шрифт
 # Bevel & Emboss shading controls.
 	Highlight Mode	Режим светлых тонов
 	Highlight Color	Цвет светлых тонов
@@ -4654,3 +4685,6 @@ shape	Appearance	Оформление
 	Tight Curl	Плотный завиток
 	Loose Curl	Свободный завиток
 	Stylized dabs from a history state	Стилизованные мазки из состояния истории
+	Font size presets	Наборы размеров шрифта
+	Leading presets	Наборы интерлиньяжа
+	Tracking presets	Наборы трекинга
diff --git a/crates/ui-egui/src/i18n/sr.tsv b/crates/ui-egui/src/i18n/sr.tsv
index 6a6dfb425f..a81eb06da2 100644
--- a/crates/ui-egui/src/i18n/sr.tsv
+++ b/crates/ui-egui/src/i18n/sr.tsv
@@ -1895,7 +1895,7 @@
 	Full size tip	Vrh pune veličine
 	Gamut warning color	Boja upozorenja o gamutu
 	Gamut warning opacity	Neprozirnost upozorenja o gamutu
-	Generator enabled	Generator je omogućen
+	Enable Generator	Omogući generator
 	Gif	GIF
 	Glossy	Sjajno
 	Grid color	Boja mreže
@@ -2238,6 +2238,7 @@
 	Create new set	Napravi novi skup
 	Technology Previews	Probne tehnologije
 	New Group	Nova grupa
+	New Group from Layers…	Nova grupa od slojeva…
 	Layer Comp	Kompozicija slojeva
 	Create new layer	Napravi novi sloj
 	Group · {n} layer	Grupa · slojeva: {n}
@@ -2304,6 +2305,8 @@
 	Automatically Create New Snapshot When Saving	Automatski napravi novi snimak stanja pri čuvanju
 	Show New Snapshot Dialog by Default	Podrazumevano prikaži dijalog za novi snimak stanja
 	Clear History	Obriši istoriju
+	Allow Non-Linear History	Dozvoli nelinearnu istoriju
+	Make Layer Visibility Changes Undoable	Omogući opozivanje promena vidljivosti slojeva
 	Panel Options…	Opcije panela…
 	View menu	Meni prikaza
 	Keep view in sync	Drži prikaz usklađenim
@@ -4288,6 +4291,33 @@ shape	Appearance	Izgled
 	Kept {name}: written by another application	{name} je zadržan: upisala ga je druga aplikacija
 	Shadow Tint	Nijansa senki
 	Redrawing	Ponovno iscrtavanje
+	Show Favorite Fonts	Прикажи омиљене фонтове
+	No favorite fonts yet: click the star beside a font to add it.	Још нема омиљених фонтова: кликните на звездицу поред фонта да бисте га додали.
+	Favorite fonts	Омиљени фонтови
+	Add to Favorites	Додај у омиљене
+	Remove from Favorites	Уклони из омиљених
+	Show All Fonts	Прикажи све фонтове
+	All Classes	Све класе
+	Blackletter	Готица
+	Decorative	Декоративни
+	Font preview:	Преглед фонта:
+	Handwritten	Рукописни
+	Hide Font Classes	Сакриј класе фонтова
+	Hide Styles	Сакриј стилове
+	Monospace	Фиксне ширине
+	No fonts match these filters.	Ниједан фонт не одговара овим филтерима.
+	No similar fonts: the current font doesn't say what it looks like.	Нема сличних фонтова: тренутни фонт не описује свој изглед.
+	OpenType font	OpenType фонт
+	Sans Serif	Без серифа
+	Script	Скрипт
+	Serif	Са серифима
+	Show Font Classes	Прикажи класе фонтова
+	Show Similar Fonts	Прикажи сличне фонтове
+	Show Styles	Прикажи стилове
+	Show Variable Fonts	Прикажи варијабилне фонтове
+	Slab Serif	Плочасти серифи
+	TrueType font	TrueType фонт
+	Variable font	Варијабилни фонт
 
 # Bevel & Emboss shading controls.
 	Highlight Mode	Режим осветљења
@@ -4524,3 +4554,6 @@ shape	Appearance	Izgled
 	Tight Curl	Usko uvijeno
 	Loose Curl	Labavo uvijeno
 	Stylized dabs from a history state	Stilizovane mrlje iz stanja istorije
+	Font size presets	Unapred podešene veličine fonta
+	Leading presets	Unapred podešeni proredi
+	Tracking presets	Unapred podešeni razmaci slova
diff --git a/crates/ui-egui/src/i18n/tests.rs b/crates/ui-egui/src/i18n/tests.rs
index cca640fbba..a8497bb5ec 100644
--- a/crates/ui-egui/src/i18n/tests.rs
+++ b/crates/ui-egui/src/i18n/tests.rs
@@ -54,6 +54,11 @@ fn picker_lists_english_first_then_names_alphabetically() {
 
 #[test]
 fn tags_map_to_languages() {
+    western_and_legacy_tags_resolve();
+    chinese_tags_resolve_by_region_and_script();
+}
+
+fn western_and_legacy_tags_resolve() {
     assert_eq!(lang_from_tag("ja_JP.UTF-8"), Some(JA()));
     assert_eq!(lang_from_tag("ja-JP"), Some(JA()));
     assert_eq!(lang_from_tag("en_US.UTF-8"), Some(Lang::EN));
@@ -73,6 +78,9 @@ fn tags_map_to_languages() {
     assert_eq!(lang_from_tag("tr_TR.UTF-8"), Lang::from_code("tr"));
     assert_eq!(lang_from_tag("tr-TR"), Lang::from_code("tr"));
     assert_eq!(lang_from_tag("tr"), Lang::from_code("tr"));
+}
+
+fn chinese_tags_resolve_by_region_and_script() {
     // Traditional Chinese: by region, by script, and with a region after the script.
     assert_eq!(lang_from_tag("zh_TW.UTF-8"), Some(ZH()));
     assert_eq!(lang_from_tag("zh-TW"), Some(ZH()));
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index d725b8c9ac..f5b9d13fd6 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -749,6 +749,8 @@
 	Gradients	Degradeler
 	Histogram	Histogram
 	History	Geçmiş
+	Allow Non-Linear History	Doğrusal Olmayan Geçmişe İzin Ver
+	Make Layer Visibility Changes Undoable	Katman Görünürlüğü Değişikliklerini Geri Alınabilir Yap
 	Info	Bilgi
 	Measurement Log	Ölçüm Günlüğü
 	Modifier Keys	Değiştirici Tuşlar
@@ -1894,7 +1896,7 @@
 	Full size tip	Tam boyutlu uç
 	Gamut warning color	Gamut uyarı rengi
 	Gamut warning opacity	Gamut uyarı opaklığı
-	Generator enabled	Oluşturucu etkin
+	Enable Generator	Oluşturucuyu etkinleştir
 	Gif	GIF
 	Glossy	parlak
 	Grid color	Izgara rengi
@@ -2202,6 +2204,7 @@
 	Sets the source for the history brush	Geçmiş fırçasının kaynağını ayarlar
 	Color Replacement	Renk Değiştirme
 	New Group	Yeni Grup
+	New Group from Layers…	Katmanlardan Yeni Grup…
 	Layer Comp	Katman Kompozisyonu
 	Alpha	Alfa
 	Make	Üretici
@@ -3966,6 +3969,33 @@ cameraData	Lens	Lens
 	Kept {name}: written by another application	{name} korundu: başka bir uygulama tarafından yazılmış
 	Shadow Tint	Gölge tonu
 	Redrawing	Yeniden çiziliyor
+	Show Favorite Fonts	Favori yazı tiplerini göster
+	No favorite fonts yet: click the star beside a font to add it.	Henüz favori yazı tipi yok: eklemek için bir yazı tipinin yanındaki yıldıza tıklayın.
+	Favorite fonts	Favori yazı tipleri
+	Add to Favorites	Favorilere ekle
+	Remove from Favorites	Favorilerden kaldır
+	Show All Fonts	Tüm yazı tiplerini göster
+	All Classes	Tüm sınıflar
+	Blackletter	Gotik
+	Decorative	Dekoratif
+	Font preview:	Yazı tipi önizlemesi:
+	Handwritten	El yazısı
+	Hide Font Classes	Yazı tipi sınıflarını gizle
+	Hide Styles	Stilleri gizle
+	Monospace	Eş aralıklı
+	No fonts match these filters.	Bu filtrelerle eşleşen yazı tipi yok.
+	No similar fonts: the current font doesn't say what it looks like.	Benzer yazı tipi yok: geçerli yazı tipi görünümünü tanımlamıyor.
+	OpenType font	OpenType yazı tipi
+	Sans Serif	Tırnaksız
+	Script	Kaligrafik
+	Serif	Tırnaklı
+	Show Font Classes	Yazı tipi sınıflarını göster
+	Show Similar Fonts	Benzer yazı tiplerini göster
+	Show Styles	Stilleri göster
+	Show Variable Fonts	Değişken yazı tiplerini göster
+	Slab Serif	Kalın tırnaklı
+	TrueType font	TrueType yazı tipi
+	Variable font	Değişken yazı tipi
 # Bevel & Emboss shading controls.
 	Highlight Mode	Vurgu Modu
 	Highlight Color	Vurgu Rengi
@@ -4180,3 +4210,6 @@ cameraData	Lens	Lens
 	Tight Curl	Sıkı Kıvrım
 	Loose Curl	Gevşek Kıvrım
 	Stylized dabs from a history state	Bir geçmiş durumundan stilize benekler
+	Font size presets	Yazı tipi boyutu hazır ayarları
+	Leading presets	Satır aralığı hazır ayarları
+	Tracking presets	İzleme hazır ayarları
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 777f03f60a..8d911b19a8 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -182,6 +182,7 @@
 	Group…	Група…
 	Ungroup Layers	Розгрупувати шари
 	Group from Layers…	Група із шарів…
+	New Group from Layers…	Нова група із шарів…
 	Hide Layers	Приховати шари
 	Arrange	Упорядкувати
 	Bring to Front	На передній план
@@ -2347,7 +2348,7 @@
 	Gamut warning color	Колір попередження про колірне охоплення
 	Gamut warning opacity	Непрозорість попередження про колірне охоплення
 	General	Загальні
-	Generator enabled	Генератор увімкнено
+	Enable Generator	Увімкнути генератор
 	Gif	GIF
 	Glossy	Глянцевий
 	Grid color	Колір сітки
@@ -3862,6 +3863,9 @@ curves	Smooth	Згладити
 # History panel menu (#2966)
 	New Snapshot…	Новий знімок стану…
 	History Options…	Параметри історії…
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	Дозволити нелінійну історію
+	Make Layer Visibility Changes Undoable	Дозволити скасування змін видимості шарів
 # Print dialog (#2697)
 	Emulsion Down	Емульсією донизу
 	Functions	Функції
@@ -3948,6 +3952,33 @@ curves	Smooth	Згладити
 	Sent to {printer}	Надіслано на {printer}
 	set in Print Settings…	задається в параметрах друку…
 	ICO is limited to 256 × 256 pixels	ICO обмежено розміром 256 × 256 пікселів
+	Show Favorite Fonts	Показати вибрані шрифти
+	No favorite fonts yet: click the star beside a font to add it.	Вибраних шрифтів ще немає: натисніть зірочку біля шрифту, щоб додати його.
+	Favorite fonts	Вибрані шрифти
+	Add to Favorites	Додати до вибраного
+	Remove from Favorites	Видалити з вибраного
+	Show All Fonts	Показати всі шрифти
+	All Classes	Усі класи
+	Blackletter	Готичні
+	Decorative	Декоративні
+	Font preview:	Попередній перегляд шрифту:
+	Handwritten	Рукописні
+	Hide Font Classes	Сховати класи шрифтів
+	Hide Styles	Сховати накреслення
+	Monospace	Моноширинні
+	No fonts match these filters.	Жоден шрифт не відповідає цим фільтрам.
+	No similar fonts: the current font doesn't say what it looks like.	Немає схожих шрифтів: поточний шрифт не описує свій вигляд.
+	OpenType font	Шрифт OpenType
+	Sans Serif	Без засічок
+	Script	Каліграфічні
+	Serif	Із засічками
+	Show Font Classes	Показати класи шрифтів
+	Show Similar Fonts	Показати схожі шрифти
+	Show Styles	Показати накреслення
+	Show Variable Fonts	Показати варіативні шрифти
+	Slab Serif	Із брускуватими засічками
+	TrueType font	Шрифт TrueType
+	Variable font	Варіативний шрифт
 	Calibration	Калібрування
 	Red Primary	Червоний основний
 	Green Primary	Зелений основний
@@ -4164,3 +4195,6 @@ curves	Smooth	Згладити
 
 # Egui 0.37 migration controls (Aspect Ratio, Category, Color Table, Gamma, Interpolation, Profile, Target, Units, Demosaic)
 	Target	Ціль
+	Font size presets	Набори розмірів шрифту
+	Leading presets	Набори інтерліньяжу
+	Tracking presets	Набори трекінгу
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index 397b02d38d..f348662975 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -290,6 +290,7 @@
 	Gradient…	Chuyển sắc…
 	Grayscale	Thang xám
 	Group from Layers…	Nhóm từ các lớp…
+	New Group from Layers…	Nhóm mới từ các lớp…
 	Group Layers	Nhóm các lớp
 	Group…	Nhóm…
 	HDR Toning…	Tông HDR…
@@ -2719,7 +2720,7 @@ shape	Appearance	Diện mạo
 	Extra large	Rất lớn
 	Fill new type layers with placeholder	Tô lớp chữ mới bằng nội dung tạm
 	Font preview	Xem trước phông chữ
-	Generator enabled	Đã bật bộ tạo
+	Enable Generator	Bật bộ tạo
 	Glossy	Bóng
 	Gutter	Lề
 	Ignore exif profile tag	Bỏ qua thẻ hồ sơ exif
@@ -3697,6 +3698,9 @@ curves	Smooth	Làm mượt
 	Clear History	Xóa lịch sử
 	History Options…	Tùy chọn lịch sử…
 	Background (Default)	Nền (mặc định)
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	Cho phép lịch sử không tuyến tính
+	Make Layer Visibility Changes Undoable	Cho phép hoàn tác thay đổi hiển thị lớp
 	Presentation	Trình bày
 # Batch / Image Processor
 	Include All Subfolders	Bao gồm tất cả thư mục con
@@ -3712,6 +3716,33 @@ curves	Smooth	Làm mượt
 	Sent to {printer}	Đã gửi tới {printer}
 	set in Print Settings…	đặt trong thiết lập in…
 	ICO is limited to 256 × 256 pixels	ICO giới hạn ở 256 × 256 pixel
+	Show Favorite Fonts	Hiển thị phông chữ yêu thích
+	No favorite fonts yet: click the star beside a font to add it.	Chưa có phông chữ yêu thích: nhấp vào ngôi sao bên cạnh phông chữ để thêm.
+	Favorite fonts	Phông chữ yêu thích
+	Add to Favorites	Thêm vào mục yêu thích
+	Remove from Favorites	Xóa khỏi mục yêu thích
+	Show All Fonts	Hiển thị tất cả phông chữ
+	All Classes	Tất cả các lớp
+	Blackletter	Blackletter
+	Decorative	Trang trí
+	Font preview:	Xem trước phông chữ:
+	Handwritten	Viết tay
+	Hide Font Classes	Ẩn lớp phông chữ
+	Hide Styles	Ẩn kiểu
+	Monospace	Đơn cách
+	No fonts match these filters.	Không có phông chữ nào khớp với các bộ lọc này.
+	No similar fonts: the current font doesn't say what it looks like.	Không có phông chữ tương tự: phông chữ hiện tại không mô tả hình dáng của nó.
+	OpenType font	Phông chữ OpenType
+	Sans Serif	Không chân
+	Script	Viết tay nghệ thuật
+	Serif	Có chân
+	Show Font Classes	Hiện lớp phông chữ
+	Show Similar Fonts	Hiện phông chữ tương tự
+	Show Styles	Hiện kiểu
+	Show Variable Fonts	Hiện phông chữ biến thiên
+	Slab Serif	Chân vuông
+	TrueType font	Phông chữ TrueType
+	Variable font	Phông chữ biến thiên
 	Calibration	Hiệu chuẩn
 	Red Primary	Màu đỏ cơ bản
 	Green Primary	Màu lục cơ bản
@@ -3949,3 +3980,6 @@ curves	Smooth	Làm mượt
 
 # Egui 0.37 migration controls (Aspect Ratio, Category, Color Table, Gamma, Interpolation, Profile, Target, Units, Demosaic)
 	Aspect Ratio	Tỷ lệ khung hình
+	Font size presets	Cỡ chữ đặt sẵn
+	Leading presets	Giãn dòng đặt sẵn
+	Tracking presets	Khoảng cách chữ đặt sẵn
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index e6b9080ae6..d9f437214a 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -311,6 +311,7 @@
 	Layer…	图层…
 	Group…	组…
 	Group from Layers…	从图层创建组…
+	New Group from Layers…	从图层新建组…
 	Artboard…	画板…
 	Artboard from Group…	从组创建画板…
 	Artboard from Layers…	从图层创建画板…
@@ -1992,7 +1993,7 @@
 	Full size tip	全尺寸笔尖
 	Gamut warning color	色域警告颜色
 	Gamut warning opacity	色域警告不透明度
-	Generator enabled	启用生成器
+	Enable Generator	启用生成器
 	Gif	GIF
 	Glossy	光面
 	Grid color	网格颜色
@@ -2826,6 +2827,9 @@ curves	Smooth	平滑
 	Clear History	清除历史记录
 	New Snapshot…	新建快照…
 	History Options…	历史记录选项…
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	允许非线性历史记录
+	Make Layer Visibility Changes Undoable	允许撤销图层可见性更改
 # Print dialog (#2697)
 	Emulsion Down	药膜朝下
 	Functions	功能
@@ -2899,6 +2903,33 @@ curves	Smooth	平滑
 	Sent to {printer}	已发送到 {printer}
 	set in Print Settings…	在打印设置中设置…
 	ICO is limited to 256 × 256 pixels	ICO 最大为 256 × 256 像素
+	Show Favorite Fonts	显示收藏的字体
+	No favorite fonts yet: click the star beside a font to add it.	还没有收藏的字体：点击字体旁边的星标即可添加。
+	Favorite fonts	收藏的字体
+	Add to Favorites	添加到收藏
+	Remove from Favorites	从收藏中移除
+	Show All Fonts	显示所有字体
+	All Classes	所有类别
+	Blackletter	哥特体
+	Decorative	装饰体
+	Font preview:	字体预览：
+	Handwritten	手写体
+	Hide Font Classes	隐藏字体类别
+	Hide Styles	隐藏样式
+	Monospace	等宽
+	No fonts match these filters.	没有符合这些筛选条件的字体。
+	No similar fonts: the current font doesn't say what it looks like.	没有相似字体：当前字体没有描述其外观。
+	OpenType font	OpenType 字体
+	Sans Serif	无衬线
+	Script	手写花体
+	Serif	衬线
+	Show Font Classes	显示字体类别
+	Show Similar Fonts	显示相似字体
+	Show Styles	显示样式
+	Show Variable Fonts	显示可变字体
+	Slab Serif	粗衬线
+	TrueType font	TrueType 字体
+	Variable font	可变字体
 	Calibration	校准
 	Red Primary	红原色
 	Green Primary	绿原色
@@ -3134,3 +3165,6 @@ curves	Smooth	平滑
 	Profile	配置文件
 	Target	目标
 	Units	单位
+	Font size presets	字号预设
+	Leading presets	行距预设
+	Tracking presets	字距调整预设
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 1586d47bf8..9d46dcb21e 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -316,6 +316,7 @@
 	Layer…	圖層…
 	Group…	群組…
 	Group from Layers…	從圖層建立群組…
+	New Group from Layers…	從圖層新增群組…
 	Artboard…	工作區域…
 	Artboard from Group…	從群組建立工作區域…
 	Artboard from Layers…	從圖層建立工作區域…
@@ -1964,7 +1965,7 @@
 	Full size tip	完整大小筆尖
 	Gamut warning color	色域警告顏色
 	Gamut warning opacity	色域警告不透明度
-	Generator enabled	啟用 Generator
+	Enable Generator	啟用 Generator
 	Gif	GIF
 	Glossy	光亮
 	Grid color	格點顏色
@@ -2775,6 +2776,9 @@ curves	Smooth	平滑
 	Clear History	清除步驟記錄
 	New Snapshot…	新增快照…
 	History Options…	步驟記錄選項…
+# History panel › History Options… (#2966)
+	Allow Non-Linear History	允許非線性步驟記錄
+	Make Layer Visibility Changes Undoable	允許復原圖層可見度變更
 # Print dialog (#2697)
 	Emulsion Down	感光乳劑面朝下
 	Functions	功能
@@ -2863,6 +2867,33 @@ curves	Smooth	平滑
 	Sent to {printer}	已傳送至 {printer}
 	set in Print Settings…	在列印設定中設定…
 	ICO is limited to 256 × 256 pixels	ICO 最大為 256 × 256 像素
+	Show Favorite Fonts	顯示我的最愛字體
+	No favorite fonts yet: click the star beside a font to add it.	尚無我的最愛字體：按一下字體旁的星號即可加入。
+	Favorite fonts	我的最愛字體
+	Add to Favorites	加入我的最愛
+	Remove from Favorites	從我的最愛移除
+	Show All Fonts	顯示所有字體
+	All Classes	所有類別
+	Blackletter	哥德體
+	Decorative	裝飾體
+	Font preview:	字體預覽：
+	Handwritten	手寫體
+	Hide Font Classes	隱藏字體類別
+	Hide Styles	隱藏樣式
+	Monospace	等寬
+	No fonts match these filters.	沒有符合這些篩選條件的字體。
+	No similar fonts: the current font doesn't say what it looks like.	沒有相似字體：目前的字體沒有描述其外觀。
+	OpenType font	OpenType 字體
+	Sans Serif	無襯線
+	Script	手寫花體
+	Serif	襯線
+	Show Font Classes	顯示字體類別
+	Show Similar Fonts	顯示相似字體
+	Show Styles	顯示樣式
+	Show Variable Fonts	顯示可變字體
+	Slab Serif	粗襯線
+	TrueType font	TrueType 字體
+	Variable font	可變字體
 	Calibration	校準
 	Red Primary	紅原色
 	Green Primary	綠原色
@@ -3090,3 +3121,6 @@ curves	Smooth	平滑
 	Profile	描述檔
 	Target	目標
 	Units	單位
+	Font size presets	字體大小預設
+	Leading presets	行距預設
+	Tracking presets	字距調整預設
diff --git a/crates/ui-egui/src/icon_data.rs b/crates/ui-egui/src/icon_data.rs
index a255fe094b..18101a5903 100644
--- a/crates/ui-egui/src/icon_data.rs
+++ b/crates/ui-egui/src/icon_data.rs
@@ -144,6 +144,9 @@ pub static ICONS: &[(&str, &[u8])] = &[
     ("stamp", include_bytes!("../../../assets/icons/stamp.svg")),
     ("star", include_bytes!("../../../assets/icons/star.svg")),
     ("star-filled", include_bytes!("../../../assets/icons/star-filled.svg")),
+    // PhotoCraft originals: the font menu's Show Similar Fonts and Show Variable Fonts filters.
+    ("font-similar", include_bytes!("../../../assets/icons/font-similar.svg")),
+    ("font-variable", include_bytes!("../../../assets/icons/font-variable.svg")),
     ("sun", include_bytes!("../../../assets/icons/sun.svg")),
     ("symmetry-diagonal", include_bytes!("../../../assets/icons/symmetry-diagonal.svg")),
     ("symmetry-dual", include_bytes!("../../../assets/icons/symmetry-dual.svg")),
diff --git a/crates/ui-egui/src/input/shortcut_dispatch/tests.rs b/crates/ui-egui/src/input/shortcut_dispatch/tests.rs
index 2dbae38ebf..3536d58afe 100644
--- a/crates/ui-egui/src/input/shortcut_dispatch/tests.rs
+++ b/crates/ui-egui/src/input/shortcut_dispatch/tests.rs
@@ -21,13 +21,14 @@ fn realistic() -> photocraft_engine::Session {
     s.execute("file.new", json!({"width": 240, "height": 160})).unwrap();
     s.execute("layer.new.layer", json!({"name": "in-group"})).unwrap();
     s.execute("layer.groupLayers", json!({"name": "group"})).unwrap();
-    // Group Layers creates collapsed groups (#5571); the walk below expects it open.
-    s.execute("layer.setExpanded", json!({"all": true, "expanded": true})).unwrap();
     s.execute("type.create", json!({"x": 20, "y": 60, "text": "Hello"})).unwrap();
     let paint = s.execute("layer.new.layer", json!({"name": "paint"})).unwrap()["layer"].as_u64().unwrap();
     s.execute("select.rect", json!({"x": 20, "y": 20, "width": 80, "height": 60})).unwrap();
     s.execute("edit.fill", json!({"color": "#3070c0"})).unwrap();
     s.execute("layer.select", json!({"layer": paint})).unwrap();
+    // Group Layers makes a collapsed group; open it so the panel shows the layer inside. (Opened
+    // last: an open active group would take the new layers above inside it, as in Photoshop.)
+    s.execute("layer.setExpanded", json!({"all": true, "expanded": true})).unwrap();
     s
 }
 
diff --git a/crates/ui-egui/src/input/shortcuts.rs b/crates/ui-egui/src/input/shortcuts.rs
index 807f748a49..40ebeb1804 100644
--- a/crates/ui-egui/src/input/shortcuts.rs
+++ b/crates/ui-egui/src/input/shortcuts.rs
@@ -479,11 +479,11 @@ pub fn handle(app: &mut PhotocraftApp, ctx: &egui::Context) {
     }
 }
 
-fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
+fn preflight_keys(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
     // A held tool letter released: a temporary tool gives the previous one back (#2672).
     crate::spring_tools::tick(app, ctx);
     if crate::canvas::cancel_mixer_on_context_change(app, ctx) {
-        return;
+        return false;
     }
     // However the tool was picked (toolbar, flyout, shortcut, automation), its group's key brings
     // it back later (#2608).
@@ -492,12 +492,12 @@ fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
     // tools) runs beneath it, and it handles its own keys (Y, U, O, S). Unlike the other dialogs
     // below it covers the canvas, so canvas zoom keys are blocked too.
     if app.camera_raw.is_some() {
-        return;
+        return false;
     }
     // A foreground save (Save in Background off, #6207) blocks the app until the file is written;
     // only Esc reaches it, to cancel while it still encodes (see `jobs_ui::tick`).
     if crate::jobs_ui::foreground_save(app).is_some() {
-        return;
+        return false;
     }
     // An open menu owns the keyboard (arrows, ↩, Esc), like a native menu; so does the menu bar
     // once Alt or F10 put the keyboard on it (#4988), and an open dropdown list, whose letters
@@ -505,7 +505,7 @@ fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
     // off the bar first and runs, as with a native menu bar (#6573).
     crate::menu_keys::leave_for_shortcut(ctx);
     if crate::menu_nav::is_open(ctx) || crate::menu_keys::is_focused(ctx) || crate::widgets::dropdown_list_open(ctx) {
-        return;
+        return false;
     }
     // ⌘Z in a filter or adjustment dialog steps the dialog's settings, not the document (#4697).
     crate::edit_history::keys(app, ctx);
@@ -514,18 +514,18 @@ fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
     // the editor's explicit state; otherwise Escape deselects or commits a pending Pen path.
     // Modified commands such as Undo still follow the ordinary dispatch below.
     if app.ui.stroke_editor.is_some() && !ctx.input(|i| i.modifiers.command || i.modifiers.ctrl) {
-        return;
+        return false;
     }
     // So does the right-click menu of text being edited: Esc closes only it, and keys typed while
     // it is open don't reach the text beneath. The crop menu's likewise: Esc and ↵ don't cancel or
     // commit the crop under it (#6561).
     if app.ui.canvas_tool_menu.as_ref().is_some_and(|m| m.text || m.crop.is_some()) {
-        return;
+        return false;
     }
     let symmetry_editing = app.ui.symmetry_transform.is_some();
     crate::symmetry_ui::track(app, ctx);
     if symmetry_editing && (app.ui.symmetry_transform.is_none() || egui::Popup::is_any_open(ctx)) {
-        return;
+        return false;
     }
     // Before any key handler: per-layout symbol keys and the bracket fallback (#3102, #3109).
     if !ctx.text_edit_focused() {
@@ -552,8 +552,11 @@ fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
     if app.distort.caf.is_some() && !ctx.text_edit_focused() {
         crate::caf_ui::keys(app, ctx);
     }
+    true
+}
+
+fn handle_modal_canvas_keys(app: &mut PhotocraftApp, ctx: &egui::Context, focus: crate::shortcut_dispatch::Focus) -> bool {
     use crate::shortcut_dispatch::{Focus, dispatch_pressed};
-    let focus = Focus::of(ctx);
     // Dialogs (and Liquify's panel while one of its controls has focus) keep canvas zoom; a
     // focused text field keeps its keys.
     let liquify_focus = (app.distort.liquify.is_some() || app.distort.caf.is_some()) && focus != Focus::None;
@@ -561,57 +564,57 @@ fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
         if focus != Focus::Text {
             nav_keys(app, ctx);
         }
-        return;
+        return true;
     }
     if focus == Focus::Text {
         // A focused field keeps its typing and editing keys; menu shortcuts (⌘J, ⌘S, F7…) still
         // fire, as in Photoshop.
         dispatch_pressed(app, ctx, focus, false);
-        return;
+        return true;
     }
     // Liquify / Puppet Warp / Perspective Warp: ↩ commits, Esc cancels.
     if crate::distort_ui::keys(app, ctx) {
-        return;
+        return true;
     }
     // Free Transform: ↩ commits, Esc cancels.
     if app.ui.transform.is_some() {
         if ctx.input_mut(|i| i.consume_key(Modifiers::NONE, Key::Enter)) {
             crate::transform_tool::commit(app);
-            return;
+            return true;
         }
         if ctx.input_mut(|i| i.consume_key(Modifiers::NONE, Key::Escape)) {
             crate::transform_tool::cancel(app);
-            return;
+            return true;
         }
     }
     // Content-Aware Move's Transform On Drop box: ↩ computes the move, Esc drops it.
     if crate::cam_transform::active(app) {
         if ctx.input_mut(|i| i.consume_key(Modifiers::NONE, Key::Enter)) {
             crate::cam_transform::commit(app);
-            return;
+            return true;
         }
         if ctx.input_mut(|i| i.consume_key(Modifiers::NONE, Key::Escape)) {
             crate::cam_transform::cancel(app);
-            return;
+            return true;
         }
     }
     // A Properties Levels/Curves eyedropper: Esc disarms it.
     if crate::layer_picker::armed(app).is_some() && ctx.input_mut(|i| i.consume_key(Modifiers::NONE, Key::Escape)) {
         crate::layer_picker::cancel(app);
-        return;
+        return true;
     }
     // Crop tool with a pending frame: arrows nudge it (⇧ ×10) and X swaps its orientation, before
     // the selection / layer nudge and the X colour swap (#1919).
     if focus == Focus::None && crate::crop_ui::keys(app, ctx) {
-        return;
+        return true;
     }
     // Perspective Crop with a pending quad: ↵ commits, Esc cancels.
     if focus == Focus::None && crate::perspective_crop_ui::keys(app, ctx) {
-        return;
+        return true;
     }
     // Move tool / Free Transform: arrows nudge (⇧ ×10, ⌥ duplicates first).
     if focus == Focus::None && crate::move_mods::arrow_keys(app, ctx) {
-        return;
+        return true;
     }
     // Moved pixels still floating: ↩ drops them.
     if focus == Focus::None
@@ -622,8 +625,50 @@ fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
             app.ui.status = e;
             app.ui.status_error = true;
         }
+        return true;
+    }
+    false
+}
+
+fn handle_lasso_vertex_keys(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
+    // While placing polygonal lasso vertices, Backspace/Delete retracts the last point;
+    // it must win over the regular Edit › Clear shortcut, which edits document pixels.
+    if crate::lasso_ui::waiting_for_vertex(app) {
+        let mods = ctx.input(|i| i.modifiers);
+        if !mods.command && !mods.ctrl && !mods.shift && ctx.input_mut(|i| i.consume_key(mods, Key::Backspace) || i.consume_key(mods, Key::Delete)) {
+            crate::lasso_ui::undo_last_vertex(app);
+            return true;
+        }
+    }
+    // The Polygonal Lasso tool likewise: ⌫/Delete removes the last vertex (#1229), and never
+    // reaches Edit › Clear while a polygon is being drawn.
+    if !app.ui.polygon.is_empty() {
+        let mods = ctx.input(|i| i.modifiers);
+        if !mods.command && !mods.ctrl && !mods.shift && ctx.input_mut(|i| i.consume_key(mods, Key::Backspace) || i.consume_key(mods, Key::Delete)) {
+            crate::canvas::polygon_retract(app);
+            return true;
+        }
+    }
+    false
+}
+
+fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    if !preflight_keys(app, ctx) {
         return;
     }
+    let focus = crate::shortcut_dispatch::Focus::of(ctx);
+    if handle_modal_canvas_keys(app, ctx, focus) || handle_pen_and_work_path_keys(app, ctx, focus) || handle_object_tool_keys(app, ctx) {
+        return;
+    }
+    if handle_registry_and_tool_keys(app, ctx, focus) {
+        return;
+    }
+    handle_escape_and_view_keys(app, ctx);
+}
+
+/// Pen path keys (#1466, #1769), the work-path delete key (#5702), and in-progress lasso state.
+/// Returns true when one of them consumed the key.
+fn handle_pen_and_work_path_keys(app: &mut PhotocraftApp, ctx: &egui::Context, focus: crate::shortcut_dispatch::Focus) -> bool {
     // A Pen path's points are uncommitted gesture state, not History entries (#1466).
     // Intercept Cmd/Ctrl+Z before the normal Edit › Undo shortcut, as well as unmodified
     // Backspace/Delete. Once the last anchor is removed, regular Undo works again.
@@ -639,17 +684,17 @@ fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
             && ctx.input_mut(|i| i.consume_key(mods, Key::Backspace) || i.consume_key(mods, Key::Delete));
         if command_undo || remove {
             crate::vector_ui::pen_undo_last_point(app);
-            return;
+            return true;
         }
     }
     // Pen path in progress: ↩ and Esc both end it as an open path and keep it, as in Photoshop (#1769).
     if app.ui.pen.is_some() && ctx.input_mut(|i| i.consume_key(Modifiers::NONE, Key::Enter) || i.consume_key(Modifiers::NONE, Key::Escape)) {
         crate::vector_ui::pen_commit(app, false);
-        return;
+        return true;
     }
     // A finished work path shown by the Pen or Path Selection: ⌫/Delete deletes it, as in
     // Photoshop (#5702), never Edit › Clear on the pixels under it.
-    if focus != Focus::DeletingWidget && crate::vector_ui::delete_key_deletes_work_path(app) {
+    if focus != crate::shortcut_dispatch::Focus::DeletingWidget && crate::vector_ui::delete_key_deletes_work_path(app) {
         let mods = ctx.input(|i| i.modifiers);
         if !mods.command && !mods.ctrl && !mods.shift && !mods.alt && ctx.input_mut(|i| i.consume_key(mods, Key::Backspace) || i.consume_key(mods, Key::Delete))
         {
@@ -657,79 +702,63 @@ fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 app.ui.status = e;
                 app.ui.status_error = true;
             }
-            return;
+            return true;
         }
     }
+    false
+}
+
+/// Magnetic Lasso, lasso vertices, guides, slices and smart-filter rows: each owns ⌫/Delete (and ↩/Esc)
+/// in its own context, so none of them reaches Edit › Clear. Returns true when one consumed the key.
+fn handle_object_tool_keys(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
     // Magnetic Lasso: ↩ closes, Esc cancels, ⌫ removes a fastening point (not Edit › Clear),
     // [ ] change the detection width (not the brush size).
-    if crate::magnetic_lasso_ui::keys(app, ctx) {
-        return;
-    }
-    // While placing polygonal lasso vertices, Backspace/Delete retracts the last point;
-    // it must win over the regular Edit › Clear shortcut, which edits document pixels.
-    if crate::lasso_ui::waiting_for_vertex(app) {
-        let mods = ctx.input(|i| i.modifiers);
-        if !mods.command && !mods.ctrl && !mods.shift && ctx.input_mut(|i| i.consume_key(mods, Key::Backspace) || i.consume_key(mods, Key::Delete)) {
-            crate::lasso_ui::undo_last_vertex(app);
-            return;
-        }
-    }
-    // The Polygonal Lasso tool likewise: ⌫/Delete removes the last vertex (#1229), and never
-    // reaches Edit › Clear while a polygon is being drawn.
-    if !app.ui.polygon.is_empty() {
-        let mods = ctx.input(|i| i.modifiers);
-        if !mods.command && !mods.ctrl && !mods.shift && ctx.input_mut(|i| i.consume_key(mods, Key::Backspace) || i.consume_key(mods, Key::Delete)) {
-            crate::canvas::polygon_retract(app);
-            return;
-        }
+    if crate::magnetic_lasso_ui::keys(app, ctx) || handle_lasso_vertex_keys(app, ctx) {
+        return true;
     }
     // A selected guide: ⌫/Delete removes it (`guide_select`), never Edit › Clear's pixels.
     if crate::guide_select::keys(app, ctx) {
-        return;
+        return true;
     }
     // A slice selected with Slice Select: ⌫/Delete deletes the slice, not the layer (#7862).
     if crate::slice_ui::keys(app, ctx) {
-        return;
+        return true;
     }
     // A selected smart filter row: ⌫/Delete removes the filter, not its smart object (#4751).
-    if crate::smart_ui::keys(app, ctx) {
-        return;
-    }
+    crate::smart_ui::keys(app, ctx)
+}
+
+/// Registry shortcuts, inline type, and the crop-tool and single-key tool shortcuts. Returns true
+/// when one consumed the key.
+fn handle_registry_and_tool_keys(app: &mut PhotocraftApp, ctx: &egui::Context, focus: crate::shortcut_dispatch::Focus) -> bool {
     // Space+F (⇧Space+F backwards) cycles the pasteboard colour, as in Photoshop: F while the
     // Hand key is held, before F's own Cycle Screen Mode.
-    if !matches!(focus, Focus::Text) && app.ui.text_edit.is_none() && crate::hold_keys::reposition_held(app, ctx) {
+    if !matches!(focus, crate::shortcut_dispatch::Focus::Text) && app.ui.text_edit.is_none() && crate::hold_keys::reposition_held(app, ctx) {
         let back = ctx.input_mut(|i| i.consume_key(Modifiers::SHIFT, Key::F));
         if back || ctx.input_mut(|i| i.consume_key(Modifiers::NONE, Key::F)) {
             if let Err(e) = crate::canvas_tool_menu::cycle_canvas_color(app, back) {
                 app.ui.status = e;
             }
-            return;
+            return true;
         }
     }
     // Inline type editing eats text and navigation keys; ⌘-shortcuts still reach the menus.
     let editing = crate::type_tool::handle_keys(app, ctx);
     // ⌥⇧⌘N: a new layer at once, without the New Layer dialog ⇧⌘N opens (#4794).
     if new_layer_without_dialog(app, ctx) {
-        return;
+        return true;
     }
     // Registry, UI and menu-catalogue shortcuts (see [`crate::shortcut_dispatch::bindings`]).
-    if dispatch_pressed(app, ctx, focus, editing) {
-        return;
+    if crate::shortcut_dispatch::dispatch_pressed(app, ctx, focus, editing) {
+        return true;
     }
     if editing {
-        return;
+        return true;
     }
     // Crop tool showing a box: O cycles its overlay, ⇧O the overlay's orientation (#1919).
-    if crate::crop_overlay::keys(app, ctx) {
-        return;
-    }
-    // ... and H toggles Show Cropped Area.
-    if crate::crop_shield::keys(app, ctx) {
-        return;
-    }
-    // ... and I fills W x H x Resolution from the document (Front Image, #2443).
-    if crate::crop_size::keys(app, ctx) {
-        return;
+    // ... and H toggles Show Cropped Area, and I fills W x H x Resolution from the document (#2443).
+    if crate::crop_overlay::keys(app, ctx) || crate::crop_shield::keys(app, ctx) || crate::crop_size::keys(app, ctx) {
+        return true;
     }
     // Single-key tools (no modifiers). D and X (`tools.defaultColors` / `tools.swapColors`) and the
     // brush keys [ ] ⇧[ ⇧] (`tools.decreaseBrushSize`…) are commands, dispatched above with any
@@ -739,11 +768,11 @@ fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
     if !app.remove_pending.is_empty() {
         if pressed(Key::Enter) {
             crate::retouch_ui::remove_pending_commit(app);
-            return;
+            return true;
         }
         if pressed(Key::Escape) {
             crate::retouch_ui::remove_pending_cancel(app);
-            return;
+            return true;
         }
     }
     // Enter / Escape commit or cancel in-progress tool state (polygonal lasso, crop).
@@ -751,11 +780,11 @@ fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
         let mods = ctx.input(|i| i.modifiers);
         if ctx.input_mut(|i| i.consume_key(mods, Key::Escape)) {
             app.drag = None;
-            return;
+            return true;
         }
         if ctx.input_mut(|i| i.consume_key(mods, Key::Enter)) {
             crate::lasso_ui::commit(app);
-            return;
+            return true;
         }
     }
     // An open options bar popup (the Crop Ratio list, the overlay and gear menus) takes the keys
@@ -768,7 +797,7 @@ fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
             } else {
                 crate::canvas::commit_crop(app);
             }
-            return;
+            return true;
         }
         // In a full screen mode, the Crop tool's untouched default frame (Straighten off) has nothing to cancel: cancelling only
         // makes the next one, so Esc goes on to leave full screen (#7315).
@@ -777,9 +806,16 @@ fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
             app.ui.polygon.clear();
             app.ui.polygon_mode.clear();
             crate::crop_ui::cancel(app);
-            return;
+            return true;
         }
     }
+    false
+}
+
+/// Esc (leave full screen, else deselect), the tool-letter keys, Page/Home/End scrolling and the
+/// opacity keys. Runs last, so every state that owns Esc has already had its chance.
+fn handle_escape_and_view_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    let pressed = |k: Key| ctx.input_mut(|i| i.consume_key(Modifiers::NONE, k));
     // Esc with no active operation leaves a full screen mode, else deselects (#2674), like ⌘D.
     // The key is never taken from a state that handles Esc itself: menus, dialogs, text fields
     // and inline type returned above, transform, pen, lasso and crop consumed it, and these own
@@ -822,6 +858,20 @@ fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
     // A held tool letter is a spring-loaded tool (#2672), not a burst of presses: its key
     // repeats are dropped rather than cycling the group.
     ctx.input_mut(|i| i.events.retain(|e| !matches!(e, egui::Event::Key { key, pressed: true, repeat: true, .. } if crate::spring_tools::is_tool_key(*key))));
+    if select_tool_by_key(app, ctx, &pressed) {
+        return;
+    }
+    // Page Up / Page Down (⌘ sideways, ⇧ a small step), Home and End scroll the canvas (#8057).
+    if crate::page_keys::handle(app, ctx) {
+        return;
+    }
+    // 1–0 set opacity, ⇧1–0 flow or fill (`opacity_keys`).
+    crate::opacity_keys::handle(app, ctx);
+}
+
+/// Selects a tool from its letter key. Pressing the key of the current group cycles within it; with
+/// the Shift-switch preference only ⇧+key cycles. Returns true when a tool key was handled.
+fn select_tool_by_key(app: &mut PhotocraftApp, ctx: &egui::Context, pressed: &impl Fn(Key) -> bool) -> bool {
     let shift_switch = app.session.prefs().tools.use_shift_key_for_tool_switch;
     for t in Tool::ALL {
         if !crate::tool_shortcuts::uses_default(app, t) {
@@ -844,15 +894,10 @@ fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 // Permanent key choices own the tool; held-key switches keep the pen marker.
                 app.stylus.tool_before_eraser = None;
             }
-            return;
+            return true;
         }
     }
-    // Page Up / Page Down (⌘ sideways, ⇧ a small step), Home and End scroll the canvas (#8057).
-    if crate::page_keys::handle(app, ctx) {
-        return;
-    }
-    // 1–0 set opacity, ⇧1–0 flow or fill (`opacity_keys`).
-    crate::opacity_keys::handle(app, ctx);
+    false
 }
 
 #[cfg(test)]
diff --git a/crates/ui-egui/src/jobs_ui/tests.rs b/crates/ui-egui/src/jobs_ui/tests.rs
index 6b58786a85..4377074ed5 100644
--- a/crates/ui-egui/src/jobs_ui/tests.rs
+++ b/crates/ui-egui/src/jobs_ui/tests.rs
@@ -808,6 +808,8 @@ fn printing_keeps_drawing_and_reports_only_the_final_spooler_result() {
             assert!(h.state().ui.status_error);
         }
     }
+    // The job and its status do not ask the system spooler for its printers.
+    assert_eq!(photocraft_engine::print_cmds::system_printer_listings(), 0, "a test asked the system spooler for its printers");
 }
 
 fn layer_count(app: &PhotocraftApp) -> usize {
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 3434054400..67b54ef73e 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -33,6 +33,7 @@ pub mod notices;
 pub mod panels;
 pub mod preset_files_ui;
 pub mod proxy;
+pub mod render_path;
 pub mod screenshot;
 pub mod state;
 pub mod texel_guard;
@@ -128,16 +129,16 @@ pub use dialogs::file_ui;
 pub use dialogs::fill_ui;
 pub use dialogs::filter_dialog;
 use dialogs::filter_preview_ui;
-#[cfg(not(target_arch = "wasm32"))]
-use dialogs::filter_preview_worker;
 pub use dialogs::gallery_ui;
 pub use dialogs::guide_layout_ui;
+pub use dialogs::history_options_ui;
 pub use dialogs::jpeg_options_ui;
 pub use dialogs::layer_picker;
 pub use dialogs::layer_style;
 pub use dialogs::liquify_ui;
 pub use dialogs::mask_trash_prompt;
 pub use dialogs::new_doc_ui;
+pub use dialogs::new_group_ui;
 pub use dialogs::new_guide_ui;
 pub use dialogs::new_layer_ui;
 pub use dialogs::open_prompt;
@@ -236,6 +237,7 @@ pub use text::bidi_text;
 pub use text::cjk_fonts;
 pub use text::direction;
 pub use text::egui_fonts;
+use text::font_filters;
 use text::font_preview;
 pub use text::served_fonts;
 use tools::align_bar;
@@ -470,7 +472,7 @@ pub struct PhotocraftApp {
     pub(crate) filter_preview: Option<filter_dialog::FilterPreview>,
     pub(crate) smart_filter_targets: smart_filter_dialog::Targets,
     #[cfg(not(target_arch = "wasm32"))]
-    filter_preview_worker: filter_preview_worker::Worker,
+    filter_preview_worker: crate::dialogs::filter_preview_worker::Worker,
     /// Full CPU canvas redraws running in the background, by document (#4024).
     pub(crate) redraws: std::collections::HashMap<photocraft_doc::DocId, background_redraw::Redraw>,
     /// The last finished background redraws, for going back to a state drawn a moment ago (#6528).
@@ -614,6 +616,8 @@ pub struct PhotocraftApp {
     pub perf: gpu_canvas::Perf,
     /// Per-frame stroke timings for latency reports (`PHOTOCRAFT_STROKE_TRACE`, see `stroke_trace`).
     pub stroke_trace: stroke_trace::StrokeTrace,
+    /// Why each document's view is drawn on the CPU, and the history of changes (`render_path`).
+    pub render_path: render_path::RenderPath,
     /// Preferences, autosave and snapping runtime state (see `prefs_ui`, `snap_ui`).
     pub(crate) prefs_rt: prefs_ui::Runtime,
     pub(crate) updates_rt: updates_ui::Runtime,
diff --git a/crates/ui-egui/src/menus/bar.rs b/crates/ui-egui/src/menus/bar.rs
index f146390e06..db9e8aeac3 100644
--- a/crates/ui-egui/src/menus/bar.rs
+++ b/crates/ui-egui/src/menus/bar.rs
@@ -2,7 +2,7 @@ use super::invoke::invoke;
 use super::items::{ItemCache, MenuItem, menu_items};
 use super::render::{alt_click, render_level, render_level_rows};
 use super::search::help_search;
-use super::*;
+use super::{PhotocraftApp, TOP_MENUS, Value, json};
 
 /// Draws the menu bar; returns the inner edge of the menu titles, facing the rest of the title bar
 /// (the right edge of the last title, or its left edge in a right-to-left UI, where File is at the
diff --git a/crates/ui-egui/src/menus/invoke.rs b/crates/ui-egui/src/menus/invoke.rs
index ef12f52d23..381b8b5184 100644
--- a/crates/ui-egui/src/menus/invoke.rs
+++ b/crates/ui-egui/src/menus/invoke.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{DOCUMENT_ITEM, DialogKind, PhotocraftApp, Value, json};
 
 /// Photoshop's Window › <panel> ids for the panels the shell already has, as `window.toggle.*`.
 pub(crate) fn panel_alias(id: &str) -> Option<&'static str> {
@@ -57,110 +57,117 @@ pub fn invoke(app: &mut PhotocraftApp, ctx: &egui::Context, id: &str, params: Va
 }
 
 /// [`invoke`] without the unsaved-changes prompt, for once the user has already answered it.
-pub(crate) fn invoke_unguarded(app: &mut PhotocraftApp, ctx: &egui::Context, id: &str, params: Value) -> Result<Value, String> {
+fn invoke_early_commands(app: &mut PhotocraftApp, ctx: &egui::Context, id: &str, params: &Value) -> Option<Result<Value, String>> {
     if let Some(tool) = crate::tool_shortcuts::tool(id) {
         crate::tool_memory::select(app, tool);
-        return Ok(json!({"tool": tool}));
+        return Some(Ok(json!({"tool": tool})));
     }
     if id == "help.checkForUpdates" {
-        return crate::updates_ui::check(app, ctx, params);
+        return Some(crate::updates_ui::check(app, ctx, params.clone()));
     }
     if id == "ui.symmetryTransform" {
-        return crate::symmetry_ui::begin(app).map(|_| Value::Null);
+        return Some(crate::symmetry_ui::begin(app).map(|_| Value::Null));
     }
-    if let Some(r) = crate::tool_reset::invoke(app, id, &params) {
-        return r;
+    if let Some(r) = crate::tool_reset::invoke(app, id, params) {
+        return Some(r);
     }
     // A filter on a type layer asks to rasterize it first (#4303).
-    if let Some(r) = crate::rasterize_prompt::intercept_filter(app, id, &params) {
-        return r;
+    if let Some(r) = crate::rasterize_prompt::intercept_filter(app, id, params) {
+        return Some(r);
     }
     // A pending Pen anchor is gesture state; Edit › Undo must match the keyboard.
     if id == "edit.undo" && crate::vector_ui::pen_undo_last_point(app) {
-        return Ok(Value::Null);
+        return Some(Ok(Value::Null));
     }
     // Image › Crop while the Crop tool has a pending frame commits that frame (#1918).
     if id == "image.crop" && crate::crop_ui::pending(app) {
         crate::canvas::commit_crop(app);
-        return Ok(json!({"committed": true}));
+        return Some(Ok(json!({"committed": true})));
     }
-    if let Some(result) = crate::panel_docking::command(app, id, &params) {
-        return result;
+    if let Some(result) = crate::panel_docking::command(app, id, params) {
+        return Some(result);
     }
     // Help › Discord, website, GitHub, Report an Issue.
     if let Some(url) = crate::links::url_for(id) {
-        return Ok(crate::links::open(app, ctx, url));
+        return Some(Ok(crate::links::open(app, ctx, url)));
     }
     if id == "view.proofSetup.custom" {
-        return Ok(json!({"dialog": crate::filter_dialog::open(app, "view.proofSetup")}));
+        return Some(Ok(json!({"dialog": crate::filter_dialog::open(app, "view.proofSetup")})));
     }
     // Image › Analysis tools/dialogs, Measurement Log and Notes panels, File › Import › Notes.
-    if let Some(r) = crate::analysis_ui::menu(app, id, &params) {
-        return r;
+    if let Some(r) = crate::analysis_ui::menu(app, id, params) {
+        return Some(r);
     }
     // Workspace New/Delete/Lock, Modifier Keys, custom pixel aspect, Extras/32-bit options.
-    if let Some(r) = crate::workspace_ui::menu(app, id, &params) {
-        return r;
+    if let Some(r) = crate::workspace_ui::menu(app, id, params) {
+        return Some(r);
     }
     // Window › Gradients, Patterns, Styles, Shapes, Tool Presets, Clone Source.
-    if let Some(r) = crate::preset_panels::menu(app, id, &params) {
-        return r;
+    if let Some(r) = crate::preset_panels::menu(app, id, params) {
+        return Some(r);
     }
     // Character/Paragraph Styles, Glyphs, Edit › Check Spelling dialog.
-    if let Some(r) = crate::type_panels_ui::menu(app, id, &params) {
-        return r;
+    if let Some(r) = crate::type_panels_ui::menu(app, id, params) {
+        return Some(r);
     }
     // Image > Variables (Define / Data Sets), Apply Data Set.
-    if let Some(r) = crate::variables_ui::menu(app, id, &params) {
-        return r;
+    if let Some(r) = crate::variables_ui::menu(app, id, params) {
+        return Some(r);
     }
     // Window > Timeline panel.
-    if let Some(r) = crate::timeline_ui::menu(app, id, &params) {
-        return r;
+    if let Some(r) = crate::timeline_ui::menu(app, id, params) {
+        return Some(r);
     }
     // Filter › Plug-ins (installed WebAssembly plug-ins, Install Plug-in…).
-    if let Some(r) = crate::plugin_ui::menu(app, id, &params) {
-        return r;
+    if let Some(r) = crate::plugin_ui::menu(app, id, params) {
+        return Some(r);
     }
+    // History panel menu › History Options… (without params: its dialog).
+    if let Some(r) = crate::history_options_ui::menu(app, id, params) {
+        return Some(r);
+    }
+    None
+}
+
+fn invoke_shell_commands(app: &mut PhotocraftApp, ctx: &egui::Context, id: &str, params: &Value) -> Option<Result<Value, String>> {
     if id == "window.panel.brushSettings" {
         app.ui.brush_tab = 0;
     }
     // View/Window/Type shell items, and dialogs/pickers in front of File commands.
     // Edit › Preferences, Keyboard Shortcuts, Color Settings and other Edit dialogs.
-    if let Some(r) = crate::prefs_ui::invoke(app, ctx, id, &params) {
-        return r;
+    if let Some(r) = crate::prefs_ui::invoke(app, ctx, id, params) {
+        return Some(r);
     }
     // Save for Web's dialog would export the committed document, not the open Free Transform (#6737).
     if id == crate::transform_tool::SAVE_FOR_WEB
         && let Some(r) = crate::transform_tool::intercept(app, id)
     {
-        return r;
+        return Some(r);
     }
     // Save for Web, Print and the other File-menu dialogs added with slices.
-    if let Some(r) = crate::file_ui::invoke(app, ctx, id, &params) {
-        return r;
+    if let Some(r) = crate::file_ui::invoke(app, ctx, id, params) {
+        return Some(r);
     }
-    if let Some(r) = crate::view_cmds::invoke(app, ctx, id, &params) {
-        return r;
+    if let Some(r) = crate::view_cmds::invoke(app, ctx, id, params) {
+        return Some(r);
     }
     // Liquify dialog, Puppet Warp and Perspective Warp modes (and their control params).
-    if let Some(r) = crate::distort_ui::menu(app, ctx, id, &params) {
-        return r;
+    if let Some(r) = crate::distort_ui::menu(app, ctx, id, params) {
+        return Some(r);
     }
     // Camera Raw Filter dialog (and its control params).
-    if let Some(r) = crate::camera_raw_ui::menu(app, ctx, id, &params) {
-        return r;
+    if let Some(r) = crate::camera_raw_ui::menu(app, ctx, id, params) {
+        return Some(r);
     }
-    if let Some(r) = crate::wide_angle_ui::menu(app, ctx, id, &params) {
-        return r;
+    if let Some(r) = crate::wide_angle_ui::menu(app, ctx, id, params) {
+        return Some(r);
     }
     if let Some(profile) = proof_preset(id) {
         // View › Proof Setup presets: set the proof profile and turn Proof Colors on.
-        app.run("view.proofSetup", json!({"profile": profile}))?;
-        return app.run("view.proofColors", json!({"on": true}));
+        return Some(app.run("view.proofSetup", json!({"profile": profile})).and_then(|_| app.run("view.proofColors", json!({"on": true}))));
     }
     if let Some(alias) = panel_alias(id) {
-        return invoke(app, ctx, alias, params);
+        return Some(invoke(app, ctx, alias, params.clone()));
     }
     if let Some(ws) = workspace_name(id) {
         // Reset re-applies the current workspace; Essentials is the default layout.
@@ -170,12 +177,16 @@ pub(crate) fn invoke_unguarded(app: &mut PhotocraftApp, ctx: &egui::Context, id:
             (name, _) => app.ui.workspace = name.into(),
         }
         apply_workspace(app);
-        return Ok(json!({"workspace": app.ui.workspace}));
+        return Some(Ok(json!({"workspace": app.ui.workspace})));
     }
-    match id {
+    None
+}
+
+fn invoke_file_commands(app: &mut PhotocraftApp, ctx: &egui::Context, id: &str, params: &Value) -> Result<Option<Value>, String> {
+    let result = match id {
         // ⌘↩ / Ctrl+Enter (#306): load the path selected in the Paths panel (or the one being
         // drawn) as a selection.
-        "path.toSelection" if params.get("name").is_none() => crate::vector_ui::path_to_selection(app, params),
+        "path.toSelection" if params.get("name").is_none() => crate::vector_ui::path_to_selection(app, params.clone()),
         // Layer › Rename Layer from a menu starts in-place renaming in the Layers panel.
         "layer.renameLayer" if params.get("name").is_none() => {
             let st = app.session.active().ok_or("no document")?;
@@ -218,7 +229,7 @@ pub(crate) fn invoke_unguarded(app: &mut PhotocraftApp, ctx: &egui::Context, id:
         "file.save" => {
             // Writes back only to a layered file that holds the whole document; anything else
             // goes through Save As, so the original is never overwritten with less (#3806).
-            let choices = crate::FormatChoices::from_params(&params, id)?;
+            let choices = crate::FormatChoices::from_params(params, id)?;
             match params.get("path").and_then(Value::as_str) {
                 Some(path) => app.save_as_with(Some(path.to_string()), choices),
                 None => {
@@ -276,56 +287,37 @@ pub(crate) fn invoke_unguarded(app: &mut PhotocraftApp, ctx: &egui::Context, id:
             }
         }
         "file.saveAs" => {
-            let choices = crate::FormatChoices::from_params(&params, id)?;
+            let choices = crate::FormatChoices::from_params(params, id)?;
             app.save_as_with(params.get("path").and_then(Value::as_str).map(str::to_string), choices)
         }
-        "view.zoomIn" | "view.zoomOut" | "view.fitOnScreen" | "view.actualPixels" => app.run(id, params),
-        "window.newWindowForDocument" => {
-            let doc = app.session.active_index().ok_or("no document")?;
-            let wid = app.ui.alloc_id();
-            let view = app.ui.views[doc].clone();
-            app.ui.windows.push(crate::state::DocWindow { id: wid, document: doc, view, open: true, position: None });
-            Ok(json!({"window": wid}))
-        }
-        "window.theme.toggle" => {
-            crate::prefs_ui::cycle_appearance(app, ctx);
-            Ok(Value::Null)
-        }
-        "view.darkenInterface" | "view.lightenInterface" => {
-            crate::prefs_ui::step_brightness(app, ctx, id == "view.lightenInterface")?;
-            Ok(json!({"theme": app.ui.theme.id()}))
-        }
-        "window.theme.system" => {
-            app.run("prefs.set", json!({"path": "interface.appearanceMode", "value": "auto"}))?;
-            crate::prefs_ui::sync_appearance(app, ctx);
-            Ok(Value::Null)
-        }
-        "window.theme.pro"
-        | "window.theme.proMedium"
-        | "window.theme.proLightGray"
-        | "window.theme.proLight"
-        | "window.theme.studio"
-        | "window.theme.studioLight"
-        | "window.theme.classic"
-        | "window.theme.solarizedDark"
-        | "window.theme.adwaita"
-        | "window.theme.adwaitaDark"
-        | "window.theme.breezeLight"
-        | "window.theme.breezeDark"
-        | "window.theme.softLight"
-        | "window.theme.softDark" => {
-            let k = crate::theme::ThemeKind::from_name(&id["window.theme.".len()..]).unwrap_or_default();
-            app.set_theme(ctx, k);
-            Ok(Value::Null)
-        }
-        // The macOS app menu's Language (`native_menu::language_node`).
-        i if i.starts_with(crate::native_menu::LANGUAGE_PREFIX) => {
-            let code = &i[crate::native_menu::LANGUAGE_PREFIX.len()..];
-            if code != "auto" && !crate::i18n::Lang::all().any(|l| l.code() == code) {
-                return Err(format!("unknown UI language `{code}`"));
-            }
-            app.run("prefs.set", json!({"values": {"interface.language": code}}))
-        }
+        _ => return Ok(None),
+    };
+    result.map(Some)
+}
+
+pub(crate) fn invoke_unguarded(app: &mut PhotocraftApp, ctx: &egui::Context, id: &str, params: Value) -> Result<Value, String> {
+    if let Some(result) = invoke_early_commands(app, ctx, id, &params) {
+        return result;
+    }
+    if let Some(result) = invoke_shell_commands(app, ctx, id, &params) {
+        return result;
+    }
+    if let Some(result) = invoke_file_commands(app, ctx, id, &params)? {
+        return Ok(result);
+    }
+    if let Some(result) = invoke_window_command(app, ctx, id) {
+        return result;
+    }
+    if let Some(result) = invoke_export_command(app, id, &params)? {
+        return result;
+    }
+    if let Some(result) = invoke_type_command(app, ctx, id, &params) {
+        return result;
+    }
+    if let Some(result) = invoke_view_command(app, ctx, id, &params) {
+        return result;
+    }
+    match id {
         "edit.search" => {
             app.ui.palette_open = !app.ui.palette_open;
             Ok(Value::Null)
@@ -337,39 +329,6 @@ pub(crate) fn invoke_unguarded(app: &mut PhotocraftApp, ctx: &egui::Context, id:
             let dialog = app.ui.open_dialog(DialogKind::About, fields);
             Ok(json!({"dialog": dialog, "info": crate::gpu_status::system_info_json(app)}))
         }
-        "file.export.exportAs" => Ok(json!({"dialog": crate::export_dialog::open(app)?})),
-        "file.export.quickExportAsPng" => crate::export_dialog::quick_export_png(app),
-        // Render Video exports a sequence of frames into a folder, not a named file.
-        // Keep explicit directory arguments from automation and the control channel unchanged.
-        "file.export.renderVideo" if params.get("dir").is_none() => {
-            #[cfg(target_arch = "wasm32")]
-            {
-                Err("Render Video to a local directory is unavailable on the web".into())
-            }
-            #[cfg(not(target_arch = "wasm32"))]
-            {
-                let doc = app.session.active().ok_or("no document")?.doc.id;
-                let mut render_params = params.as_object().cloned().unwrap_or_default();
-                app.ask_folder(move |app, dir| {
-                    render_params.insert("dir".into(), json!(dir));
-                    app.with_document(doc, |app| app.run("file.export.renderVideo", Value::Object(render_params)))
-                })
-            }
-        }
-        // Layer › Export As… / Quick Export as PNG: the export pipeline on just the active layer.
-        l if matches!(l, "layer.exportAs" | "layer.quickExportAsPng") && params.as_object().is_none_or(|o| o.is_empty()) => {
-            let layer = app.session.active().and_then(|d| d.active_layer).ok_or("no active layer")?;
-            if l == "layer.exportAs" {
-                // Several layers (artboards, say) selected: one file each (#3629).
-                let layers = app.session.active().map(|d| d.selected_layers()).unwrap_or_default();
-                if layers.len() > 1 {
-                    return Ok(json!({"dialog": crate::export_dialog::open_layers(app, &layers)?}));
-                }
-                Ok(json!({"dialog": crate::export_dialog::open_layer(app, layer)?}))
-            } else {
-                crate::export_dialog::quick_export_selected_layers_png(app)
-            }
-        }
         "layer.smartFilter.blendingOptions" if params.get("blend").is_none() && params.get("opacity").is_none() => {
             let st = app.session.active().ok_or("no document open")?;
             let layer = params.get("layer").and_then(Value::as_u64).map(photocraft_doc::LayerId).or(st.active_layer).ok_or("no layer selected")?;
@@ -385,36 +344,6 @@ pub(crate) fn invoke_unguarded(app: &mut PhotocraftApp, ctx: &egui::Context, id:
         "layer.layerStyle.blendingOptions" if params.as_object().is_none_or(|o| o.is_empty()) => {
             crate::layer_style::open(app, Some(crate::layer_style::BLENDING)).map(|d| json!({"dialog": d})).ok_or_else(|| "no active layer".to_string())
         }
-        // ⇧⌘> / ⇧⌘<: the selected characters while typing, else the whole type layer.
-        "type.increaseSize" | "type.decreaseSize" | "type.increaseSizeMore" | "type.decreaseSizeMore" if params.as_object().is_none_or(|o| o.is_empty()) => {
-            let p = crate::type_tool::with_target(app, json!({})).ok_or("the active layer is not a type layer")?;
-            app.run(id, p)
-        }
-        // Formatting menus follow an inline text selection when editing. Outside an edit,
-        // snapshot the selected type layers; explicit automation targets retain their scope.
-        t if (t.starts_with("type.antiAlias.")
-            || t.starts_with("type.orientation.")
-            || t.starts_with("type.openType.")
-            || matches!(t, "type.warpText" | "type.loadDefaultTypeStyles"))
-            && params.get("layer").is_none()
-            && params.get("layers").is_none()
-            && params.get("range").is_none() =>
-        {
-            let Some(mut p) = crate::type_tool::formatting_params(app) else { return app.run(id, params) };
-            if let Some(props) = params.as_object() {
-                for (key, value) in props {
-                    p[key] = value.clone();
-                }
-            }
-            app.run(id, p)
-        }
-        "type.editText" => {
-            crate::type_tool::edit_active(app)?;
-            if let Some(focus) = ctx.memory(|m| m.focused()) {
-                ctx.memory_mut(|m| m.surrender_focus(focus));
-            }
-            Ok(Value::Null)
-        }
         // Only interactive creation opens the Color Picker; it creates the layer on OK,
         // so Cancel leaves neither an orphan layer nor an undo/redo history entry.
         // Explicit parameters continue straight to the engine.
@@ -444,6 +373,15 @@ pub(crate) fn invoke_unguarded(app: &mut PhotocraftApp, ctx: &egui::Context, id:
             }
             Ok(json!({"dialog": crate::stroke_ui::open(app)}))
         }
+        // Layer › New › Group… / Group from Layers… (and the Layers panel's menu, ⌥-click on its
+        // New Group button): Photoshop's New Group dialog. Explicit params run the engine directly,
+        // and Group Layers (⌘G) never asks.
+        _ if crate::new_group_ui::fronts(id) && params.as_object().is_none_or(|o| o.is_empty()) => {
+            if let Some(Err(why)) = photocraft_engine::commands::find(id).map(|c| (c.enabled)(&app.session)) {
+                return Err(why);
+            }
+            Ok(json!({"dialog": crate::new_group_ui::open(app, id)}))
+        }
         // Channels › Channel Options… without params: the dialog on the targeted alpha/spot
         // channel, Layer Mask Display Options on a targeted layer mask, or Quick Mask Options while
         // in Quick Mask (with params: the engine directly).
@@ -484,23 +422,6 @@ pub(crate) fn invoke_unguarded(app: &mut PhotocraftApp, ctx: &egui::Context, id:
         "select.transformSelection" if params.as_object().is_none_or(|o| o.is_empty()) => {
             crate::transform_tool::begin_selection(app, ctx).map(|_| json!({"transform": app.ui.transform}))
         }
-        // While editing type, the clipboard rows and Select > All work on the text (#1355, #2893).
-        "edit.cut" if app.ui.text_edit.is_some() => {
-            crate::type_tool::cut_selection(app, ctx);
-            Ok(Value::Null)
-        }
-        "edit.copy" if app.ui.text_edit.is_some() => {
-            crate::type_tool::copy_selection(app, ctx);
-            Ok(Value::Null)
-        }
-        "edit.paste" if app.ui.text_edit.is_some() => {
-            crate::type_tool::request_paste(ctx);
-            Ok(Value::Null)
-        }
-        "select.all" if app.ui.text_edit.is_some() => {
-            crate::type_tool::select_all(app);
-            Ok(Value::Null)
-        }
         "edit.paste" if params.as_object().is_none_or(|o| o.is_empty()) => {
             // Photoshop: paste in place when the copied area is visible, else centred in the view;
             // images from other apps are always centred.
@@ -522,138 +443,8 @@ pub(crate) fn invoke_unguarded(app: &mut PhotocraftApp, ctx: &egui::Context, id:
             };
             app.run("edit.paste", p)
         }
-        "view.rulers" | "view.show.grid" | "view.show.guides" | "view.snap" | "view.lockGuides" => {
-            let e = &mut app.ui.extras;
-            let slot = match id {
-                "view.rulers" => &mut e.rulers,
-                "view.show.grid" => &mut e.grid,
-                "view.show.guides" => &mut e.guides,
-                "view.snap" => &mut e.snap,
-                _ => &mut e.lock_guides,
-            };
-            *slot = !*slot;
-            let on = *slot;
-            if id == "view.show.grid" && on {
-                // Like the other Show items, enabling Grid also restores hidden Extras.
-                app.ui.view.extras = true;
-            }
-            if id == "view.rulers" {
-                crate::prefs_ui::remember_rulers(app, on);
-            }
-            Ok(json!(on))
-        }
-        "edit.freeTransform"
-        | "edit.transform.scale"
-        | "edit.transform.rotate"
-        | "edit.transform.skew"
-        | "edit.transform.distort"
-        | "edit.transform.perspective" => {
-            // While a box is up, Scale / Rotate / Skew / Distort / Perspective (and Free Transform)
-            // switch its mode; otherwise they start one in that mode.
-            if app.ui.transform.as_ref().is_some_and(|t| t.content_aware.is_some()) {
-                return Err(crate::transform_tool::CAS_ONLY_SCALES.into());
-            }
-            if app.ui.transform.is_none() {
-                crate::transform_tool::begin(app, ctx)?;
-            }
-            if let Some(t) = app.ui.transform.as_mut() {
-                t.mode = crate::state::TransformMode::for_command(id);
-            }
-            Ok(json!({"transform": app.ui.transform}))
-        }
-        "edit.freeTransformCopy" => crate::transform_tool::begin_copy(app, ctx).map(|_| json!({"transform": app.ui.transform})),
-        // Edit › Transform › Warp from the menu: interactive Warp mode (with params: the engine).
-        "edit.transform.warp" | "layer.smartObjects.warp" if params.as_object().is_none_or(|o| o.is_empty()) => {
-            crate::transform_tool::begin_warp(app, ctx).map(|_| json!({"transform": app.ui.transform}))
-        }
-        // Split warps edit the mesh of an active Warp session.
-        "edit.transform.splitWarpCrosswise"
-        | "edit.transform.splitWarpHorizontally"
-        | "edit.transform.splitWarpVertically"
-        | "edit.transform.removeWarpSplit"
-            if app.ui.transform.as_ref().is_some_and(|t| t.warp.is_some()) && params.get("warp").is_none() =>
-        {
-            let at = params.get("at").and_then(Value::as_array).and_then(|a| Some([a.first()?.as_f64()?, a.get(1)?.as_f64()?]));
-            crate::transform_tool::split(app, id, at).map(|_| json!({"transform": app.ui.transform}))
-        }
-        "edit.transform.warpGrid" if app.ui.transform.as_ref().is_some_and(|t| t.warp.is_some()) && params.get("warp").is_none() => {
-            crate::transform_tool::edit_session_warp(app, id, &params).map(|_| json!({"transform": app.ui.transform}))
-        }
         // Layer › New › Layer… (⇧⌘N) asks first, as in Photoshop; with params it runs as is.
         crate::new_layer_ui::COMMAND if params.as_object().is_none_or(|o| o.is_empty()) => Ok(json!({"dialog": crate::new_layer_ui::open(app)?})),
-        sz if crate::sizing::is_sizing(sz) && params.as_object().is_none_or(|o| o.is_empty()) => {
-            Ok(json!({"dialog": crate::sizing::open(app, sz).ok_or("no document")?}))
-        }
-        "view.newGuide" if params.as_object().is_none_or(|o| o.is_empty()) => Ok(json!({"dialog": crate::new_guide_ui::open(app)})),
-        fl if crate::filter_dialog::has_dialog(fl) && params.as_object().is_none_or(|o| o.is_empty()) => {
-            Ok(json!({"dialog": crate::filter_dialog::open(app, fl)}))
-        }
-        a if crate::adjust_dialog::has_dialog(a) && params.as_object().is_none_or(|o| o.is_empty()) => {
-            Ok(json!({"dialog": crate::adjust_dialog::open(app, a).ok_or("no document")?}))
-        }
-        "window.togglePanels" => {
-            // Tab hides the Tools panel, the options bar and the dock; Tab again shows what it hid.
-            if app.ui.view.hides_chrome() {
-                // Full Screen Mode: Tab only shows or hides the chrome for now (#6760); the panels'
-                // own state, `hidden_by_tab` included, stays as it was before entering.
-                app.ui.panels.full_screen_chrome = !app.ui.panels.full_screen_chrome;
-                return Ok(Value::Null);
-            }
-            let p = &mut app.ui.panels;
-            match p.hidden_by_tab.take() {
-                Some([toolbar, options, dock]) if !(p.toolbar || p.options_bar || p.dock) => {
-                    (p.toolbar, p.options_bar, p.dock) = (toolbar, options, dock);
-                }
-                _ if p.toolbar || p.options_bar || p.dock => {
-                    p.hidden_by_tab = Some([p.toolbar, p.options_bar, p.dock]);
-                    (p.toolbar, p.options_bar, p.dock) = (false, false, false);
-                }
-                _ => (p.toolbar, p.options_bar, p.dock) = (true, true, true),
-            }
-            Ok(Value::Null)
-        }
-        "window.nextDocument" | "window.previousDocument" => {
-            // Tabs are in document order, so the next tab is the next document, wrapping around.
-            let n = app.session.documents().len();
-            let at = app.session.active_index().ok_or("no document open")?;
-            let to = if id == "window.nextDocument" { (at + 1) % n } else { (at + n - 1) % n };
-            app.session.set_active(to);
-            app.jobs.focus = None;
-            Ok(json!({"document": to}))
-        }
-        id if let Some(index) = id.strip_prefix(DOCUMENT_ITEM) => {
-            let n = app.session.documents().len();
-            let to = index.parse::<usize>().ok().filter(|i| *i < n).ok_or("no such document")?;
-            app.session.set_active(to);
-            app.jobs.focus = None;
-            Ok(json!({"document": to}))
-        }
-        t if t.starts_with("window.toggle.") => {
-            // A shown but collapsed dock group is expanded rather than hidden (#129).
-            if let Some(g) = crate::dock::Group::from_key(&t["window.toggle.".len()..]).filter(|g| g.shown(&app.ui.panels) && app.ui.dock.is_collapsed(*g)) {
-                crate::dock::reveal(app, g);
-                return Ok(Value::Null);
-            }
-            let p = &mut app.ui.panels;
-            let slot = match &t["window.toggle.".len()..] {
-                "layers" => &mut p.layers,
-                "history" => &mut p.history,
-                "properties" => &mut p.properties,
-                "color" => &mut p.color,
-                "navigator" => &mut p.navigator,
-                "toolbar" => &mut p.toolbar,
-                "options" => &mut p.options_bar,
-                "brushSettings" => &mut p.brush_settings,
-                "brushes" => &mut p.brushes,
-                "dock" => &mut p.dock,
-                _ => return Err(format!("unknown panel in {t}")),
-            };
-            *slot = !*slot;
-            if let Some(g) = crate::dock::Group::from_key(&t["window.toggle.".len()..]).filter(|g| g.shown(&app.ui.panels)) {
-                crate::dock::reveal(app, g);
-            }
-            Ok(Value::Null)
-        }
         // Layer › Layer Style › <effect>… opens the Layer Style dialog on that effect.
         ls if params.as_object().is_none_or(|o| o.is_empty())
             && ls.strip_prefix("layer.layerStyle.").is_some_and(|k| crate::layer_style::KINDS.iter().any(|(kind, _)| *kind == k)) =>
@@ -676,6 +467,299 @@ fn open_path(app: &mut PhotocraftApp, path: &str) -> Result<Value, String> {
     app.open_path(path).map(|w| json!({"warnings": w}))
 }
 
+fn invoke_export_command(app: &mut PhotocraftApp, id: &str, params: &Value) -> Result<Option<Result<Value, String>>, String> {
+    let result = match id {
+        "file.export.exportAs" => Some(Ok(json!({"dialog": crate::export_dialog::open(app)?}))),
+        "file.export.quickExportAsPng" => Some(crate::export_dialog::quick_export_png(app)),
+        "file.export.renderVideo" if params.get("dir").is_none() => {
+            #[cfg(target_arch = "wasm32")]
+            {
+                Some(Err("Render Video to a local directory is unavailable on the web".into()))
+            }
+            #[cfg(not(target_arch = "wasm32"))]
+            {
+                let document = app.session.active().ok_or("no document")?.doc.id;
+                let mut render_params = params.as_object().cloned().unwrap_or_default();
+                Some(app.ask_folder(move |app, dir| {
+                    render_params.insert("dir".into(), json!(dir));
+                    app.with_document(document, |app| app.run("file.export.renderVideo", Value::Object(render_params)))
+                }))
+            }
+        }
+        layer if matches!(layer, "layer.exportAs" | "layer.quickExportAsPng") && params.as_object().is_none_or(|object| object.is_empty()) => {
+            let selected = app.session.active().and_then(|document| document.active_layer).ok_or("no active layer")?;
+            if layer == "layer.exportAs" {
+                // Several layers (artboards, say) selected: one file each (#3629).
+                let layers = app.session.active().map(|document| document.selected_layers()).unwrap_or_default();
+                if layers.len() > 1 {
+                    Some(Ok(json!({"dialog": crate::export_dialog::open_layers(app, &layers)?})))
+                } else {
+                    Some(Ok(json!({"dialog": crate::export_dialog::open_layer(app, selected)?})))
+                }
+            } else {
+                Some(crate::export_dialog::quick_export_selected_layers_png(app))
+            }
+        }
+        _ => None,
+    };
+    Ok(result)
+}
+
+fn invoke_type_command(app: &mut PhotocraftApp, ctx: &egui::Context, id: &str, params: &Value) -> Option<Result<Value, String>> {
+    match id {
+        "type.increaseSize" | "type.decreaseSize" | "type.increaseSizeMore" | "type.decreaseSizeMore"
+            if params.as_object().is_none_or(|object| object.is_empty()) =>
+        {
+            Some((|| {
+                let target = type_command_target(app).ok_or("the active layer is not a type layer")?;
+                app.run(id, target)
+            })())
+        }
+        command
+            if (command.starts_with("type.antiAlias.")
+                || command.starts_with("type.orientation.")
+                || command.starts_with("type.openType.")
+                || matches!(command, "type.warpText" | "type.loadDefaultTypeStyles"))
+                && params.get("layer").is_none()
+                && params.get("layers").is_none()
+                && params.get("range").is_none() =>
+        {
+            Some((|| {
+                let Some(mut target) = crate::type_tool::formatting_params(app) else { return app.run(id, params.clone()) };
+                if let Some(properties) = params.as_object() {
+                    for (key, value) in properties {
+                        target[key] = value.clone();
+                    }
+                }
+                app.run(id, target)
+            })())
+        }
+        "type.editText" => Some((|| {
+            crate::type_tool::edit_active(app)?;
+            if let Some(focus) = ctx.memory(|memory| memory.focused()) {
+                ctx.memory_mut(|memory| memory.surrender_focus(focus));
+            }
+            Ok(Value::Null)
+        })()),
+        // While editing type, the clipboard rows and Select > All work on the text (#1355, #2893).
+        "edit.cut" if app.ui.text_edit.is_some() => {
+            crate::type_tool::cut_selection(app, ctx);
+            Some(Ok(Value::Null))
+        }
+        "edit.copy" if app.ui.text_edit.is_some() => {
+            crate::type_tool::copy_selection(app, ctx);
+            Some(Ok(Value::Null))
+        }
+        "edit.paste" if app.ui.text_edit.is_some() => {
+            crate::type_tool::request_paste(ctx);
+            Some(Ok(Value::Null))
+        }
+        "select.all" if app.ui.text_edit.is_some() => {
+            crate::type_tool::select_all(app);
+            Some(Ok(Value::Null))
+        }
+        _ => None,
+    }
+}
+
+fn type_command_target(app: &PhotocraftApp) -> Option<Value> {
+    let (layer, range) = crate::type_tool::target(app)?;
+    let mut params = json!({"layer": layer});
+    if let Some(range) = range {
+        params["range"] = json!(range);
+    }
+    if let Some(session) = app.ui.text_edit.as_ref().map(|edit| edit.session.clone()) {
+        params["coalesce"] = json!(session);
+    }
+    Some(params)
+}
+
+fn invoke_view_command(app: &mut PhotocraftApp, ctx: &egui::Context, id: &str, params: &Value) -> Option<Result<Value, String>> {
+    match id {
+        "view.zoomIn" | "view.zoomOut" | "view.fitOnScreen" | "view.actualPixels" => Some(app.run(id, params.clone())),
+        "view.rulers" | "view.show.grid" | "view.show.guides" | "view.snap" | "view.lockGuides" => {
+            let extras = &mut app.ui.extras;
+            let slot = match id {
+                "view.rulers" => &mut extras.rulers,
+                "view.show.grid" => &mut extras.grid,
+                "view.show.guides" => &mut extras.guides,
+                "view.snap" => &mut extras.snap,
+                _ => &mut extras.lock_guides,
+            };
+            *slot = !*slot;
+            let enabled = *slot;
+            if id == "view.show.grid" && enabled {
+                app.ui.view.extras = true;
+            }
+            if id == "view.rulers" {
+                crate::prefs_ui::remember_rulers(app, enabled);
+            }
+            Some(Ok(json!(enabled)))
+        }
+        "edit.freeTransform"
+        | "edit.transform.scale"
+        | "edit.transform.rotate"
+        | "edit.transform.skew"
+        | "edit.transform.distort"
+        | "edit.transform.perspective" => Some((|| {
+            if app.ui.transform.as_ref().is_some_and(|transform| transform.content_aware.is_some()) {
+                return Err(crate::transform_tool::CAS_ONLY_SCALES.into());
+            }
+            if app.ui.transform.is_none() {
+                crate::transform_tool::begin(app, ctx)?;
+            }
+            if let Some(transform) = app.ui.transform.as_mut() {
+                transform.mode = crate::state::TransformMode::for_command(id);
+            }
+            Ok(json!({"transform": app.ui.transform}))
+        })()),
+        "edit.freeTransformCopy" => Some(crate::transform_tool::begin_copy(app, ctx).map(|_| json!({"transform": app.ui.transform}))),
+        "edit.transform.warp" | "layer.smartObjects.warp" if params.as_object().is_none_or(|object| object.is_empty()) => {
+            Some(crate::transform_tool::begin_warp(app, ctx).map(|_| json!({"transform": app.ui.transform})))
+        }
+        "edit.transform.splitWarpCrosswise"
+        | "edit.transform.splitWarpHorizontally"
+        | "edit.transform.splitWarpVertically"
+        | "edit.transform.removeWarpSplit"
+            if app.ui.transform.as_ref().is_some_and(|transform| transform.warp.is_some()) && params.get("warp").is_none() =>
+        {
+            let at = params.get("at").and_then(Value::as_array).and_then(|array| Some([array.first()?.as_f64()?, array.get(1)?.as_f64()?]));
+            Some(crate::transform_tool::split(app, id, at).map(|_| json!({"transform": app.ui.transform})))
+        }
+        "edit.transform.warpGrid" if app.ui.transform.as_ref().is_some_and(|transform| transform.warp.is_some()) && params.get("warp").is_none() => {
+            Some(crate::transform_tool::edit_session_warp(app, id, params).map(|_| json!({"transform": app.ui.transform})))
+        }
+        sz if crate::sizing::is_sizing(sz) && params.as_object().is_none_or(|object| object.is_empty()) => {
+            Some(crate::sizing::open(app, sz).map(|dialog| json!({"dialog": dialog})).ok_or_else(|| "no document".to_string()))
+        }
+        "view.newGuide" if params.as_object().is_none_or(|object| object.is_empty()) => Some(Ok(json!({"dialog": crate::new_guide_ui::open(app)}))),
+        fl if crate::filter_dialog::has_dialog(fl) && params.as_object().is_none_or(|object| object.is_empty()) => {
+            Some(Ok(json!({"dialog": crate::filter_dialog::open(app, fl)})))
+        }
+        a if crate::adjust_dialog::has_dialog(a) && params.as_object().is_none_or(|object| object.is_empty()) => {
+            Some(crate::adjust_dialog::open(app, a).map(|dialog| json!({"dialog": dialog})).ok_or_else(|| "no document".to_string()))
+        }
+        _ => None,
+    }
+}
+
+fn invoke_window_command(app: &mut PhotocraftApp, ctx: &egui::Context, id: &str) -> Option<Result<Value, String>> {
+    match id {
+        "window.newWindowForDocument" => Some((|| {
+            let doc = app.session.active_index().ok_or("no document")?;
+            let wid = app.ui.alloc_id();
+            let view = app.ui.views[doc].clone();
+            app.ui.windows.push(crate::state::DocWindow { id: wid, document: doc, view, open: true, position: None });
+            Ok(json!({"window": wid}))
+        })()),
+        "window.theme.toggle" => {
+            crate::prefs_ui::cycle_appearance(app, ctx);
+            Some(Ok(Value::Null))
+        }
+        "view.darkenInterface" | "view.lightenInterface" => {
+            Some(crate::prefs_ui::step_brightness(app, ctx, id == "view.lightenInterface").map(|()| json!({"theme": app.ui.theme.id()})))
+        }
+        "window.theme.system" => Some(app.run("prefs.set", json!({"path": "interface.appearanceMode", "value": "auto"})).map(|_| {
+            crate::prefs_ui::sync_appearance(app, ctx);
+            Value::Null
+        })),
+        "window.theme.pro"
+        | "window.theme.proMedium"
+        | "window.theme.proLightGray"
+        | "window.theme.proLight"
+        | "window.theme.studio"
+        | "window.theme.studioLight"
+        | "window.theme.classic"
+        | "window.theme.solarizedDark"
+        | "window.theme.adwaita"
+        | "window.theme.adwaitaDark"
+        | "window.theme.breezeLight"
+        | "window.theme.breezeDark"
+        | "window.theme.softLight"
+        | "window.theme.softDark" => {
+            let theme = crate::theme::ThemeKind::from_name(&id["window.theme.".len()..]).unwrap_or_default();
+            app.set_theme(ctx, theme);
+            Some(Ok(Value::Null))
+        }
+        _ if id.starts_with(crate::native_menu::LANGUAGE_PREFIX) => {
+            let code = &id[crate::native_menu::LANGUAGE_PREFIX.len()..];
+            if code != "auto" && !crate::i18n::Lang::all().any(|lang| lang.code() == code) {
+                Some(Err(format!("unknown UI language `{code}`")))
+            } else {
+                Some(app.run("prefs.set", json!({"values": {"interface.language": code}})))
+            }
+        }
+        "window.togglePanels" => Some(toggle_panels(app)),
+        "window.nextDocument" | "window.previousDocument" => Some((|| {
+            let count = app.session.documents().len();
+            let active = app.session.active_index().ok_or("no document open")?;
+            let next = if id == "window.nextDocument" { (active + 1) % count } else { (active + count - 1) % count };
+            app.session.set_active(next);
+            app.jobs.focus = None;
+            Ok(json!({"document": next}))
+        })()),
+        _ if id.starts_with(DOCUMENT_ITEM) => Some((|| {
+            let count = app.session.documents().len();
+            let next =
+                id.strip_prefix(DOCUMENT_ITEM).ok_or("no such document")?.parse::<usize>().ok().filter(|index| *index < count).ok_or("no such document")?;
+            app.session.set_active(next);
+            app.jobs.focus = None;
+            Ok(json!({"document": next}))
+        })()),
+        _ if id.starts_with("window.toggle.") => Some(toggle_panel(app, id)),
+        _ => None,
+    }
+}
+
+fn toggle_panels(app: &mut PhotocraftApp) -> Result<Value, String> {
+    if app.ui.view.hides_chrome() {
+        // Full Screen Mode: Tab only shows or hides the chrome for now (#6760); the panels'
+        // own state, `hidden_by_tab` included, stays as it was before entering.
+        app.ui.panels.full_screen_chrome = !app.ui.panels.full_screen_chrome;
+        return Ok(Value::Null);
+    }
+    let panels = &mut app.ui.panels;
+    match panels.hidden_by_tab.take() {
+        Some([toolbar, options, dock]) if !(panels.toolbar || panels.options_bar || panels.dock) => {
+            (panels.toolbar, panels.options_bar, panels.dock) = (toolbar, options, dock);
+        }
+        _ if panels.toolbar || panels.options_bar || panels.dock => {
+            panels.hidden_by_tab = Some([panels.toolbar, panels.options_bar, panels.dock]);
+            (panels.toolbar, panels.options_bar, panels.dock) = (false, false, false);
+        }
+        _ => (panels.toolbar, panels.options_bar, panels.dock) = (true, true, true),
+    }
+    Ok(Value::Null)
+}
+
+fn toggle_panel(app: &mut PhotocraftApp, id: &str) -> Result<Value, String> {
+    let key = &id["window.toggle.".len()..];
+    // A shown but collapsed dock group is expanded rather than hidden (#129).
+    if let Some(group) = crate::dock::Group::from_key(key).filter(|group| group.shown(&app.ui.panels) && app.ui.dock.is_collapsed(*group)) {
+        crate::dock::reveal(app, group);
+        return Ok(Value::Null);
+    }
+    let panels = &mut app.ui.panels;
+    let slot = match key {
+        "layers" => &mut panels.layers,
+        "history" => &mut panels.history,
+        "properties" => &mut panels.properties,
+        "color" => &mut panels.color,
+        "navigator" => &mut panels.navigator,
+        "toolbar" => &mut panels.toolbar,
+        "options" => &mut panels.options_bar,
+        "brushSettings" => &mut panels.brush_settings,
+        "brushes" => &mut panels.brushes,
+        "dock" => &mut panels.dock,
+        _ => return Err(format!("unknown panel in {id}")),
+    };
+    *slot = !*slot;
+    if let Some(group) = crate::dock::Group::from_key(key).filter(|group| group.shown(&app.ui.panels)) {
+        crate::dock::reveal(app, group);
+    }
+    Ok(Value::Null)
+}
+
 /// Workspace presets (Window → Workspace): which panels are visible.
 pub fn apply_workspace(app: &mut PhotocraftApp) {
     // Saved workspaces (Window › Workspace › New Workspace…) restore their own layout.
diff --git a/crates/ui-egui/src/menus/items.rs b/crates/ui-egui/src/menus/items.rs
index e5b029136d..37944cca5f 100644
--- a/crates/ui-egui/src/menus/items.rs
+++ b/crates/ui-egui/src/menus/items.rs
@@ -1,6 +1,6 @@
 use super::invoke::{panel_alias, proof_preset, workspace_name};
 use super::state::{checked, is_enabled, reveal_label};
-use super::*;
+use super::{DOCUMENT_ITEM, PhotocraftApp, UI_COMMANDS};
 
 /// Menu tree entry for rendering and for `ui.inspect`.
 #[derive(Clone, Debug, serde::Serialize)]
diff --git a/crates/ui-egui/src/menus/state.rs b/crates/ui-egui/src/menus/state.rs
index 754f14d8ce..7baa0b9bf6 100644
--- a/crates/ui-egui/src/menus/state.rs
+++ b/crates/ui-egui/src/menus/state.rs
@@ -1,6 +1,6 @@
 use super::invoke::{panel_alias, proof_preset, workspace_name};
 use super::items::MenuItem;
-use super::*;
+use super::{DOCUMENT_ITEM, PhotocraftApp, Value};
 
 pub fn is_enabled(app: &PhotocraftApp, id: &str) -> bool {
     if crate::tool_shortcuts::tool(id).is_some() {
diff --git a/crates/ui-egui/src/menus/view_cmds/arrange.rs b/crates/ui-egui/src/menus/view_cmds/arrange.rs
index 209d743252..0759cf4b56 100644
--- a/crates/ui-egui/src/menus/view_cmds/arrange.rs
+++ b/crates/ui-egui/src/menus/view_cmds/arrange.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{LAYOUTS, PhotocraftApp, Value, json};
 
 /// View › Fit Layer(s) on Screen: zoom and centre on the selected layers' bounds.
 pub(super) fn fit_layers(app: &mut PhotocraftApp) -> Result<Value, String> {
diff --git a/crates/ui-egui/src/menus/view_cmds/dialogs.rs b/crates/ui-egui/src/menus/view_cmds/dialogs.rs
index dd280efed0..f4bcd87542 100644
--- a/crates/ui-egui/src/menus/view_cmds/dialogs.rs
+++ b/crates/ui-egui/src/menus/view_cmds/dialogs.rs
@@ -1,5 +1,5 @@
 use super::dispatch::no_params;
-use super::*;
+use super::{DialogKind, Map, PhotocraftApp, Value, json};
 
 // ---------- dialogs and pickers in front of engine commands ----------
 
diff --git a/crates/ui-egui/src/menus/view_cmds/dispatch.rs b/crates/ui-egui/src/menus/view_cmds/dispatch.rs
index 6667f83283..4a9884c6c0 100644
--- a/crates/ui-egui/src/menus/view_cmds/dispatch.rs
+++ b/crates/ui-egui/src/menus/view_cmds/dispatch.rs
@@ -1,7 +1,7 @@
 use super::arrange::{arrange, fit_layers};
 use super::dialogs::front;
 use super::options::{panel_state, panel_tab, pixel_aspect_ratio, screen_mode_commands, show_slot, snap_slot, was_maximized_id};
-use super::*;
+use super::{FONT_PREVIEW, LANGUAGE, LAYOUTS, PIXEL_ASPECTS, PhotocraftApp, SCREEN_MODES, Show, SnapTo, Value, json};
 
 /// Ids handled here (live menu items).
 pub fn handles(id: &str) -> bool {
diff --git a/crates/ui-egui/src/menus/view_cmds/options.rs b/crates/ui-egui/src/menus/view_cmds/options.rs
index 07aefac75b..8f0c9df909 100644
--- a/crates/ui-egui/src/menus/view_cmds/options.rs
+++ b/crates/ui-egui/src/menus/view_cmds/options.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Map, PhotocraftApp, Show, SnapTo, Value, ViewOptions};
 
 /// Whether the window was maximized when a screen mode took it full screen (egui temp data).
 pub(super) fn was_maximized_id() -> egui::Id {
diff --git a/crates/ui-egui/src/new_group_button_tests.rs b/crates/ui-egui/src/new_group_button_tests.rs
index 529972a418..54d8ff42a2 100644
--- a/crates/ui-egui/src/new_group_button_tests.rs
+++ b/crates/ui-egui/src/new_group_button_tests.rs
@@ -1,13 +1,154 @@
-//! The Layers panel New Group button groups multiple selected layers on a plain click.
-//! Shift-click also groups a single selected layer; otherwise it creates an empty group.
+//! #2561: the Layers panel New Group button. Like Photoshop CC 2014 and later, a click with two or
+//! more layers selected puts them in a new, collapsed group, and with one layer it adds an empty
+//! group. Shift-click (the older way) groups the selection too, ⌥-click asks in the New Group
+//! dialog first and ⌘-click adds the empty group below the active layer.
 
 use egui::Modifiers;
 use egui_kittest::kittest::Queryable;
-use photocraft_doc::{Layer, LayerId};
+use photocraft_doc::{Layer, LayerContent, LayerId};
 use serde_json::json;
 
 use crate::PhotocraftApp;
 
+/// Background, then `A` and `B` on top of it; `A` and `B` are selected when `both`, otherwise
+/// only `B` is (`B` active either way).
+fn selected(both: bool) -> (egui_kittest::Harness<'static, PhotocraftApp>, LayerId, LayerId) {
+    let mut s = photocraft_engine::Session::new();
+    s.execute("file.new", json!({"width": 8, "height": 8})).unwrap();
+    let a = LayerId(s.execute("layer.new.layer", json!({"name": "A"})).unwrap()["layer"].as_u64().unwrap());
+    let b = LayerId(s.execute("layer.new.layer", json!({"name": "B"})).unwrap()["layer"].as_u64().unwrap());
+    if both {
+        s.execute("layer.select", json!({"layer": a.0})).unwrap();
+        s.execute("layer.select", json!({"layer": b.0, "mode": "add"})).unwrap();
+    }
+    let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1200.0, 800.0)).with_max_steps(64).build_eframe(|cc| {
+        PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
+        PhotocraftApp::new(s, crate::Services::default())
+    });
+    h.run_steps(4);
+    (h, a, b)
+}
+
+fn groups(h: &egui_kittest::Harness<'static, PhotocraftApp>) -> Vec<Layer> {
+    h.state().session.active().unwrap().doc.walk().into_iter().map(|(_, _, l)| l).filter(|l| l.is_group()).cloned().collect()
+}
+
+/// The one group holds `[a, b]` in order, sits next to the background, is the only selected layer
+/// and, as in Photoshop, is collapsed: its layers' rows are not drawn.
+fn assert_grouped(h: &egui_kittest::Harness<'static, PhotocraftApp>, a: LayerId, b: LayerId) {
+    let groups = groups(h);
+    assert_eq!(groups.len(), 1);
+    let children: Vec<LayerId> = groups[0].children().unwrap().iter().map(|l| l.id).collect();
+    assert_eq!(children, vec![a, b]);
+    let st = h.state().session.active().unwrap();
+    assert_eq!(st.doc.layers.len(), 2, "background and the new group stay at the top level");
+    assert_eq!(st.selected_layers(), vec![groups[0].id], "the new group is selected");
+    assert!(matches!(&groups[0].content, LayerContent::Group(g) if !g.expanded), "the new group is collapsed");
+    let rows: Vec<u64> = crate::layer_row_ui::recorded(&h.ctx).into_iter().map(|r| r.layer).collect();
+    assert!(rows.contains(&groups[0].id.0) && !rows.contains(&a.0) && !rows.contains(&b.0), "only the group's row shows: {rows:?}");
+}
+
+#[test]
+fn plain_click_groups_the_selected_layers_in_order() {
+    let (mut h, a, b) = selected(true);
+    h.get_by_label("Create a new group").click();
+    h.run_steps(4);
+    assert_grouped(&h, a, b);
+    // One step: a single undo puts both layers back where they were.
+    h.state_mut().run("edit.undo", json!({})).unwrap();
+    h.run_steps(2);
+    assert!(groups(&h).is_empty());
+    let top: Vec<LayerId> = h.state().session.active().unwrap().doc.layers.iter().map(|l| l.id).collect();
+    assert_eq!(top[1..], [a, b]);
+}
+
+#[test]
+fn shift_click_groups_the_selected_layers_in_order() {
+    let (mut h, a, b) = selected(true);
+    h.get_by_label("Create a new group").click_modifiers(Modifiers::SHIFT);
+    h.run_steps(4);
+    assert_grouped(&h, a, b);
+}
+
+#[test]
+fn plain_click_with_one_selected_layer_adds_an_empty_group() {
+    let (mut h, a, b) = selected(false);
+    h.get_by_label("Create a new group").click();
+    h.run_steps(4);
+    let groups = groups(&h);
+    assert_eq!(groups.len(), 1);
+    assert!(groups[0].children().unwrap().is_empty());
+    let top: Vec<LayerId> = h.state().session.active().unwrap().doc.layers.iter().map(|l| l.id).collect();
+    assert_eq!(top[1..], [a, b, groups[0].id], "the layers stay where they were; the group goes above the active one");
+}
+
+/// Selecting a layer inside the collapsed group opens it, as in Photoshop.
+#[test]
+fn selecting_a_grouped_layer_opens_the_group() {
+    let (mut h, a, b) = selected(true);
+    h.get_by_label("Create a new group").click();
+    h.run_steps(4);
+    assert_grouped(&h, a, b);
+    h.state_mut().run("layer.select", json!({"layer": a.0})).unwrap();
+    h.run_steps(4);
+    let rows: Vec<u64> = crate::layer_row_ui::recorded(&h.ctx).into_iter().map(|r| r.layer).collect();
+    assert!(rows.contains(&a.0) && rows.contains(&b.0), "{rows:?}");
+}
+
+/// ⌥-click asks in the New Group dialog first: New Group from Layers with several layers
+/// selected, New Group with one. Nothing changes until OK.
+#[test]
+fn alt_click_opens_the_new_group_dialog() {
+    for (both, command) in [(true, "layer.new.groupFromLayers"), (false, "layer.new.group")] {
+        let (mut h, a, b) = selected(both);
+        h.get_by_label("Create a new group").click_modifiers(Modifiers::ALT);
+        h.run_steps(4);
+        assert!(groups(&h).is_empty(), "nothing happens before OK");
+        let (id, fields) = h.state().ui.dialogs.last().map(|d| (d.id, d.fields.clone())).expect("the New Group dialog opened");
+        assert!(crate::new_group_ui::owns(&fields));
+        assert_eq!(fields["__command"], command);
+        crate::dialogs::confirm(h.state_mut(), id).unwrap();
+        h.run_steps(4);
+        if both {
+            assert_grouped(&h, a, b);
+        } else {
+            let groups = groups(&h);
+            assert_eq!(groups.len(), 1);
+            assert!(groups[0].children().unwrap().is_empty());
+        }
+    }
+}
+
+/// ⌘-click adds an empty group below the active layer, even with several layers selected.
+#[test]
+fn command_click_adds_an_empty_group_below_the_active_layer() {
+    for both in [true, false] {
+        let (mut h, a, b) = selected(both);
+        h.get_by_label("Create a new group").click_modifiers(Modifiers::COMMAND);
+        h.run_steps(4);
+        let groups = groups(&h);
+        assert_eq!(groups.len(), 1);
+        assert!(groups[0].children().unwrap().is_empty());
+        let top: Vec<LayerId> = h.state().session.active().unwrap().doc.layers.iter().map(|l| l.id).collect();
+        assert_eq!(top[1..], [a, groups[0].id, b]);
+    }
+}
+
+/// Its neighbour, the New Layer button: ⌘-click adds the layer below the active one, a plain
+/// click above it, as in Photoshop.
+#[test]
+fn command_click_on_new_layer_adds_it_below_the_active_layer() {
+    for (modifiers, below) in [(Modifiers::COMMAND, true), (Modifiers::NONE, false)] {
+        let (mut h, a, b) = selected(false);
+        h.get_by_label("Create a new layer").click_modifiers(modifiers);
+        h.run_steps(4);
+        let top: Vec<LayerId> = h.state().session.active().unwrap().doc.layers.iter().map(|l| l.id).collect();
+        assert_eq!(top.len(), 4);
+        let new = *top.iter().find(|id| ![a, b].contains(id) && **id != top[0]).unwrap();
+        assert_eq!(top[1..], if below { [a, new, b] } else { [a, b, new] });
+    }
+}
+
 /// Background, then `A` and `B` on top of it with both selected (`B` active).
 fn two_selected() -> (egui_kittest::Harness<'static, PhotocraftApp>, LayerId, LayerId) {
     let mut s = photocraft_engine::Session::new();
@@ -24,23 +165,6 @@ fn two_selected() -> (egui_kittest::Harness<'static, PhotocraftApp>, LayerId, La
     (h, a, b)
 }
 
-fn groups(h: &egui_kittest::Harness<'static, PhotocraftApp>) -> Vec<Layer> {
-    h.state().session.active().unwrap().doc.walk().into_iter().map(|(_, _, l)| l).filter(|l| l.is_group()).cloned().collect()
-}
-
-#[test]
-fn shift_click_groups_the_selected_layers_in_order() {
-    let (mut h, a, b) = two_selected();
-    h.get_by_label("Create a new group").click_modifiers(Modifiers::SHIFT);
-    h.run_steps(4);
-    let groups = groups(&h);
-    assert_eq!(groups.len(), 1);
-    let children: Vec<LayerId> = groups[0].children().unwrap().iter().map(|l| l.id).collect();
-    assert_eq!(children, vec![a, b]);
-    let doc = &h.state().session.active().unwrap().doc;
-    assert_eq!(doc.layers.len(), 2, "background and the new group stay at the top level");
-}
-
 #[test]
 fn plain_click_groups_all_selected_layers_in_order_and_undoes_in_one_step() {
     for active in ["A", "B"] {
@@ -72,19 +196,3 @@ fn plain_click_groups_all_selected_layers_in_order_and_undoes_in_one_step() {
         assert_eq!(children, vec![a, b]);
     }
 }
-
-#[test]
-fn plain_click_with_one_selected_layer_still_adds_an_empty_group() {
-    let (mut h, a, b) = two_selected();
-    h.state_mut().session.execute("layer.select", json!({"layer": a.0})).unwrap();
-    h.run_steps(4);
-    h.get_by_label("Create a new group").click();
-    h.run_steps(4);
-    let groups = groups(&h);
-    assert_eq!(groups.len(), 1);
-    assert!(groups[0].children().unwrap().is_empty());
-    let doc = &h.state().session.active().unwrap().doc;
-    let top: Vec<LayerId> = doc.layers.iter().map(|l| l.id).collect();
-    assert_eq!(top[1], a, "the selected layer stays where it was");
-    assert_eq!(top[3], b, "the unselected layer stays above the new group");
-}
diff --git a/crates/ui-egui/src/notices.rs b/crates/ui-egui/src/notices.rs
index 52597597a8..4b3ae45cac 100644
--- a/crates/ui-egui/src/notices.rs
+++ b/crates/ui-egui/src/notices.rs
@@ -119,7 +119,7 @@ pub fn clipboard_unreadable(app: &mut PhotocraftApp) {
 /// A full refresh of document `doc` fell back to the CPU compositor (`reason`, the GPU's) and took
 /// `ms`. The canvas doesn't respond while it runs, so once per document say why it was slow and
 /// which edits will do it again (#1015).
-pub fn slow_cpu_refresh(app: &mut PhotocraftApp, doc: u64, ms: f64, reason: Option<&str>) {
+pub fn slow_cpu_refresh(app: &mut PhotocraftApp, doc: u64, ms: f64, reason: Option<&crate::render_path::CpuReason>) {
     if ms.is_nan() || ms < SLOW_CPU_REFRESH_MS || app.ui.slow_refresh_noticed.contains(&doc) {
         return;
     }
@@ -129,11 +129,11 @@ pub fn slow_cpu_refresh(app: &mut PhotocraftApp, doc: u64, ms: f64, reason: Opti
         crate::i18n::fmt(tl!("This redraw took {seconds} s on the CPU."), &[("seconds", &seconds)]),
         tl!("Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.").into(),
     ];
-    if reason == Some(crate::gpu_canvas::OVER_BUDGET) {
-        if let Some(fit) = app.perf.gpu_layer_fit.filter(|f| f.doc == doc && !f.fits()) {
+    if let Some(&crate::render_path::CpuReason::OverBudget { needed, budget }) = reason {
+        if needed > budget {
             lines.push(crate::i18n::fmt(
                 tl!("Its layers need {needed} of GPU memory; the budget leaves them {budget}."),
-                &[("needed", &crate::chrome_ui::fmt_bytes(fit.needed)), ("budget", &crate::chrome_ui::fmt_bytes(fit.budget))],
+                &[("needed", &crate::chrome_ui::fmt_bytes(needed)), ("budget", &crate::chrome_ui::fmt_bytes(budget))],
             ));
         }
         lines.push(
@@ -141,7 +141,7 @@ pub fn slow_cpu_refresh(app: &mut PhotocraftApp, doc: u64, ms: f64, reason: Opti
                 .into(),
         );
     } else if let Some(r) = reason {
-        lines.push(crate::i18n::fmt(tl!("The GPU compositor wasn't used: {reason}"), &[("reason", r)]));
+        lines.push(crate::i18n::fmt(tl!("The GPU compositor wasn't used: {reason}"), &[("reason", &r.to_string())]));
     }
     post(app, tl!("Large document: redrawing on the CPU"), lines, false, None);
 }
@@ -405,13 +405,13 @@ mod tests {
     #[test]
     fn a_slow_cpu_refresh_is_explained_once_per_document() {
         let mut app = PhotocraftApp::new(Session::new(), Services::default());
-        slow_cpu_refresh(&mut app, 1, 400.0, Some(crate::gpu_canvas::OVER_BUDGET));
-        slow_cpu_refresh(&mut app, 1, f64::NAN, Some(crate::gpu_canvas::OVER_BUDGET));
+        let over = crate::render_path::CpuReason::OverBudget { needed: 3600 << 20, budget: 3400 << 20 };
+        slow_cpu_refresh(&mut app, 1, 400.0, Some(&over));
+        slow_cpu_refresh(&mut app, 1, f64::NAN, Some(&over));
         assert!(app.ui.notices.is_empty(), "a quick refresh needs no explanation");
 
         // The layers of document 1 need 3.6 GB and may hold 3.4 GB: the notice says so.
-        app.perf.gpu_layer_fit = Some(crate::gpu_canvas::LayerFit { doc: 1, needed: 3600 << 20, budget: 3400 << 20 });
-        slow_cpu_refresh(&mut app, 1, 55_000.0, Some(crate::gpu_canvas::OVER_BUDGET));
+        slow_cpu_refresh(&mut app, 1, 55_000.0, Some(&over));
         assert_eq!(app.ui.notices.len(), 1);
         let text = app.ui.notices[0].lines.join(" ");
         assert!(text.contains("55.0 s"), "{text}");
@@ -420,10 +420,10 @@ mod tests {
         assert!(text.contains("GPU Memory in Preferences › Performance"), "{text}");
         assert!(!app.ui.notices[0].error);
 
-        slow_cpu_refresh(&mut app, 1, 55_000.0, Some(crate::gpu_canvas::OVER_BUDGET));
+        slow_cpu_refresh(&mut app, 1, 55_000.0, Some(&over));
         assert_eq!(app.ui.notices.len(), 1, "once per document");
 
-        slow_cpu_refresh(&mut app, 2, 3_000.0, Some("Blend If on `Overlay` (composited on the CPU)"));
+        slow_cpu_refresh(&mut app, 2, 3_000.0, Some(&crate::render_path::CpuReason::Unsupported("Blend If on `Overlay` (composited on the CPU)".into())));
         assert_eq!(app.ui.notices.len(), 2);
         let text = app.ui.notices[1].lines.join(" ");
         assert!(text.contains("Blend If on `Overlay`"), "{text}");
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index a726eb13ac..f2173c9829 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -87,6 +87,7 @@ pub(crate) use layer_drag::{dropped_on, layer_drag_edge_scroll};
 pub(crate) use layer_row::thumb_load_badge;
 #[cfg(test)]
 use layer_row::{layer_thumb_fit, paint_clipping_indicator};
+pub(crate) use layers::blend_options;
 #[cfg(test)]
 use layers::{layers, opacity_row_layout, simple_lock_toggle};
 #[cfg(test)]
@@ -861,6 +862,49 @@ mod snapshot_row_tests {
         assert_eq!(st.snapshots.len(), 2, "the snapshot is kept");
     }
 
+    /// With Allow Non-Linear History and only the oldest state current, a click on the trash has
+    /// nothing to delete (the oldest state stays, as in Photoshop), so the trash is disabled; a
+    /// later (dimmed) state dragged onto it is still deleted, and once a past state exists again
+    /// the click works.
+    #[test]
+    fn non_linear_trash_click_never_targets_the_oldest_state() {
+        let mut h = pro_history();
+        h.state_mut().run("history.options", json!({"allowNonLinearHistory": true})).unwrap();
+        for _ in 0..3 {
+            h.state_mut().run("edit.undo", json!({})).unwrap();
+        }
+        h.run_steps(3);
+        let history = |h: &Harness<'static, PhotocraftApp>| {
+            let st = h.state().session.active().unwrap();
+            (st.history.past_len(), st.history.redo_labels().count())
+        };
+        assert_eq!(history(&h), (0, 3), "Open current, New Layer, Fill, Fill dimmed");
+        assert!(h.state().session.is_enabled("history.deleteState"), "the engine still offers a later state to delete");
+        let enabled = |h: &Harness<'static, PhotocraftApp>| {
+            let p = trash(h);
+            h.ctx.viewport(|v| {
+                v.prev_pass.widgets.layers().flat_map(|(_, w)| w.iter()).find(|w| w.rect.size() == vec2(26.0, 26.0) && w.rect.center() == p).map(|w| w.enabled)
+            })
+        };
+        assert_eq!(enabled(&h), Some(false), "a click would only target the oldest state");
+        let p = trash(&h);
+        click(&mut h, p);
+        assert_eq!(history(&h), (0, 3), "the click deletes nothing");
+        assert!(!h.state().ui.status_error, "and reports no error: {}", h.state().ui.status);
+
+        // The last dimmed Fill dragged onto the trash: only it goes.
+        let row = h.get_all_by_label("Fill").last().expect("the dimmed Fill row").rect().center();
+        drag(&mut h, row, p);
+        assert_eq!(history(&h), (0, 2), "the dragged later state is deleted");
+
+        // A past state again: the click deletes the current one.
+        h.state_mut().run("edit.redo", json!({})).unwrap();
+        h.run_steps(3);
+        assert_eq!(enabled(&h), Some(true));
+        click(&mut h, p);
+        assert_eq!(history(&h).0, 0, "the click deleted the current state");
+    }
+
     /// Snapshot rows scroll with the states: many snapshots in a short dock leave the footer and
     /// its camera button in view.
     #[test]
diff --git a/crates/ui-egui/src/panels/actions.rs b/crates/ui-egui/src/panels/actions.rs
index a4a5969544..092ada6a43 100644
--- a/crates/ui-egui/src/panels/actions.rs
+++ b/crates/ui-egui/src/panels/actions.rs
@@ -11,6 +11,7 @@ use serde_json::{Value, json};
 use photocraft_engine::actions_cmds::{self, Action};
 
 use crate::PhotocraftApp;
+use crate::icons;
 use crate::theme::Tokens;
 
 /// Which row is selected and which rows are expanded. The action list itself is
@@ -821,6 +822,87 @@ fn display_order(rows: &[Row]) -> Vec<usize> {
     order
 }
 
+struct SetHeaderResult {
+    toggled: bool,
+    save: bool,
+}
+
+fn draw_set_header(ui: &mut egui::Ui, set: &str, count: u64, collapsed: bool, tokens: &Tokens) -> SetHeaderResult {
+    let (rect, response) = ui.allocate_exact_size(vec2(ui.available_width(), 24.0), Sense::click());
+    response.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, !collapsed, set));
+    if response.hovered() {
+        ui.painter().rect_filled(rect, 0.0, tokens.hover.gamma_multiply(0.5));
+    }
+    let triangle = Rect::from_center_size(pos2(rect.left() + 12.0, rect.center().y), vec2(8.0, 8.0));
+    let points = if collapsed {
+        vec![triangle.left_top(), triangle.right_center(), triangle.left_bottom()]
+    } else {
+        vec![triangle.left_top(), triangle.right_top(), triangle.center_bottom()]
+    };
+    ui.painter().add(egui::Shape::convex_polygon(points, tokens.text_dim, Stroke::NONE));
+    icons::paint(
+        ui,
+        Rect::from_center_size(pos2(rect.left() + 30.0, rect.center().y), vec2(16.0, 16.0)),
+        if collapsed { "folder" } else { "folder-open" },
+        12.0,
+        tokens.icon,
+    );
+    ui.painter().text(pos2(rect.left() + 44.0, rect.center().y), Align2::LEFT_CENTER, set, egui::FontId::proportional(12.0), tokens.text);
+    let summary = crate::i18n::trn(crate::i18n::current(), count, "{n} action", "{n} actions");
+    ui.painter().text(pos2(rect.right() - 8.0, rect.center().y), Align2::RIGHT_CENTER, summary, egui::FontId::proportional(11.0), tokens.text_faint);
+    let toggled = response.clicked();
+    let mut save = false;
+    response.context_menu(|ui| {
+        if ui.button(tl!("Save Set…")).clicked() {
+            save = true;
+            ui.close();
+        }
+    });
+    SetHeaderResult { toggled, save }
+}
+
+fn action_context_menu(app: &mut PhotocraftApp, response: &egui::Response, index: usize, name: &str, swatch: &str) {
+    egui::Popup::context_menu(response).close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside).show(|ui| {
+        ui.label(tl!("Keyboard Shortcuts"));
+        let current = app.session.prefs().shortcuts.get(&shortcut_id(name)).cloned().unwrap_or_default();
+        // Photoshop's Action Options: a function key, with Shift and Command (#7646).
+        let (key, mut shift, mut command) = photocraft_engine::atn_cmds::parse_function_key(&current).unwrap_or((0, false, false));
+        for number in std::iter::once(0).chain(1..=12) {
+            let label = if number == 0 { tl!("None").to_string() } else { format!("F{number}") };
+            if ui.selectable_label(key == number, label).clicked() {
+                let chosen = if number == 0 { String::new() } else { photocraft_engine::atn_cmds::function_key_name(number, shift, command) };
+                let _ = assign_shortcut(app, name, &chosen);
+                ui.close();
+            }
+        }
+        ui.add_enabled_ui(key > 0, |ui| {
+            let command_label = if cfg!(target_os = "macos") { tl!("Command") } else { tl!("Ctrl") };
+            let toggled = ui.checkbox(&mut shift, tl!("Shift")).changed() | ui.checkbox(&mut command, command_label).changed();
+            if toggled {
+                let _ = assign_shortcut(app, name, &photocraft_engine::atn_cmds::function_key_name(key, shift, command));
+            }
+        });
+        ui.separator();
+        ui.menu_button(tl!("Color"), |ui| {
+            for (id, label) in [
+                ("", tl!("None")),
+                ("red", tl!("Red")),
+                ("orange", tl!("Orange")),
+                ("yellow", tl!("Yellow")),
+                ("green", tl!("Green")),
+                ("blue", tl!("Blue")),
+                ("violet", tl!("Violet")),
+                ("gray", tl!("Gray")),
+            ] {
+                if ui.selectable_label(swatch == id, label).clicked() {
+                    let _ = app.run("actions.setColor", json!({"action": index, "color": id}));
+                    ui.close();
+                }
+            }
+        });
+    });
+}
+
 pub fn panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
     let recording = app.session.actions.recording;
@@ -875,22 +957,7 @@ pub fn panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         if rows.is_empty() {
             ui.label(egui::RichText::new(tl!("Record ● a sequence of edits, then play ▶ it on any document.")).color(t.text_faint).size(11.5));
         }
-        if egui::DragAndDrop::has_payload_of_type::<DragRow>(ui.ctx()) {
-            let clip = ui.clip_rect();
-            if let Some(p) = ui.input(|i| i.pointer.hover_pos()).filter(|p| clip.contains(*p)) {
-                let delta = if p.y < clip.top() + 22.0 {
-                    8.0
-                } else if p.y > clip.bottom() - 22.0 {
-                    -8.0
-                } else {
-                    0.0
-                };
-                if delta != 0.0 {
-                    ui.scroll_with_delta(vec2(0.0, delta));
-                    ui.ctx().request_repaint();
-                }
-            }
-        }
+        scroll_actions_during_drag(ui);
         let mut shown_set: Option<&str> = None;
         for i in display_order(&rows) {
             let Row { name, steps, disabled, dialogs, set, color: swatch } = &rows[i];
@@ -900,38 +967,14 @@ pub fn panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             {
                 shown_set = Some(set);
                 let collapsed = app.ui.actions.collapsed_sets.iter().any(|c| c == set);
-                let (hr, hresp) = ui.allocate_exact_size(vec2(ui.available_width(), 24.0), Sense::click());
-                hresp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, !collapsed, set));
-                if hresp.hovered() {
-                    ui.painter().rect_filled(hr, 0.0, t.hover.gamma_multiply(0.5));
-                }
-                let tri = Rect::from_center_size(pos2(hr.left() + 12.0, hr.center().y), vec2(8.0, 8.0));
-                let pts = if collapsed {
-                    vec![tri.left_top(), tri.right_center(), tri.left_bottom()]
-                } else {
-                    vec![tri.left_top(), tri.right_top(), tri.center_bottom()]
-                };
-                ui.painter().add(egui::Shape::convex_polygon(pts, t.text_dim, Stroke::NONE));
-                crate::icons::paint(
-                    ui,
-                    Rect::from_center_size(pos2(hr.left() + 30.0, hr.center().y), vec2(16.0, 16.0)),
-                    if collapsed { "folder" } else { "folder-open" },
-                    12.0,
-                    t.icon,
-                );
-                ui.painter().text(pos2(hr.left() + 44.0, hr.center().y), Align2::LEFT_CENTER, set, egui::FontId::proportional(12.0), t.text);
                 let count = rows.iter().filter(|r| r.set.as_deref() == Some(set)).count() as u64;
-                let summary = crate::i18n::trn(crate::i18n::current(), count, "{n} action", "{n} actions");
-                ui.painter().text(pos2(hr.right() - 8.0, hr.center().y), Align2::RIGHT_CENTER, summary, egui::FontId::proportional(11.0), t.text_faint);
-                if hresp.clicked() {
+                let result = draw_set_header(ui, set, count, collapsed, &t);
+                if result.toggled {
                     set_toggled = Some(set.to_string());
                 }
-                hresp.context_menu(|ui| {
-                    if ui.button(tl!("Save Set…")).clicked() {
-                        save_set = Some(set.to_string());
-                        ui.close();
-                    }
-                });
+                if result.save {
+                    save_set = Some(set.to_string());
+                }
             }
             if set.as_deref().is_some_and(|set| app.ui.actions.collapsed_sets.iter().any(|c| c == set)) {
                 continue;
@@ -1012,45 +1055,7 @@ pub fn panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             }
             // Clicks inside stay open, so Shift and Command can both be ticked; every item that
             // finishes closes the menu itself.
-            egui::Popup::context_menu(&resp).close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside).show(|ui| {
-                ui.label(tl!("Keyboard Shortcuts"));
-                let current = app.session.prefs().shortcuts.get(&shortcut_id(name)).cloned().unwrap_or_default();
-                // Photoshop's Action Options: a function key, with Shift and Command (#7646).
-                let (key, mut shift, mut command) = photocraft_engine::atn_cmds::parse_function_key(&current).unwrap_or((0, false, false));
-                for n in std::iter::once(0).chain(1..=12) {
-                    let label = if n == 0 { tl!("None").to_string() } else { format!("F{n}") };
-                    if ui.selectable_label(key == n, label).clicked() {
-                        let chosen = if n == 0 { String::new() } else { photocraft_engine::atn_cmds::function_key_name(n, shift, command) };
-                        let _ = assign_shortcut(app, name, &chosen);
-                        ui.close();
-                    }
-                }
-                ui.add_enabled_ui(key > 0, |ui| {
-                    let command_label = if cfg!(target_os = "macos") { tl!("Command") } else { tl!("Ctrl") };
-                    let toggled = ui.checkbox(&mut shift, tl!("Shift")).changed() | ui.checkbox(&mut command, command_label).changed();
-                    if toggled {
-                        let _ = assign_shortcut(app, name, &photocraft_engine::atn_cmds::function_key_name(key, shift, command));
-                    }
-                });
-                ui.separator();
-                ui.menu_button(tl!("Color"), |ui| {
-                    for (id, label) in [
-                        ("", tl!("None")),
-                        ("red", tl!("Red")),
-                        ("orange", tl!("Orange")),
-                        ("yellow", tl!("Yellow")),
-                        ("green", tl!("Green")),
-                        ("blue", tl!("Blue")),
-                        ("violet", tl!("Violet")),
-                        ("gray", tl!("Gray")),
-                    ] {
-                        if ui.selectable_label(swatch == id, label).clicked() {
-                            let _ = app.run("actions.setColor", json!({"action": i, "color": id}));
-                            ui.close();
-                        }
-                    }
-                });
-            });
+            action_context_menu(app, &resp, i, name, swatch);
             if resp.double_clicked() && !button_mode {
                 // Photoshop renames in place when the name itself is double-clicked.
                 if resp.interact_pointer_pos().is_some_and(|p| name_rect.expand2(vec2(4.0, 13.0)).contains(p)) {
@@ -1060,56 +1065,11 @@ pub fn panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                 }
             }
             if expanded {
-                for (step, (id, params)) in steps.iter().enumerate() {
-                    let (r, response) = ui.allocate_exact_size(vec2(ui.available_width(), 20.0), Sense::click_and_drag());
-                    if reveal == Some((i, step + 1)) {
-                        ui.scroll_to_rect(r, Some(egui::Align::BOTTOM));
-                    }
-                    let label = step_label(id, params);
-                    let selected = app.ui.actions.selected == Some(i) && app.ui.actions.selected_step == Some(step);
-                    response.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, selected, &label));
-                    if selected {
-                        ui.painter().rect_filled(r, 0.0, t.row_selected);
-                    } else if response.hovered() {
-                        ui.painter().rect_filled(r, 0.0, t.hover.gamma_multiply(0.5));
-                    }
-                    if let Some(change) = drag_row(ui, &response, DragRow { action: i, step: Some(step) }, &t) {
-                        moved = Some(change);
-                    }
-                    let on = !disabled.contains(&step);
-                    let color = if on { t.text_dim } else { t.text_faint };
-                    ui.painter().text(pos2(x0 + 62.0, r.center().y), Align2::LEFT_CENTER, &label, egui::FontId::proportional(11.5), color);
-                    // Photoshop's check column: unchecked steps are skipped by playback, Batch and droplets.
-                    let check = ui.interact(
-                        Rect::from_center_size(pos2(x0 + 30.0, r.center().y), vec2(16.0, 16.0)),
-                        ui.scope_id().with(("action-step-check", i, step)),
-                        Sense::click(),
-                    );
-                    check.widget_info(|| egui::WidgetInfo::selected(egui::Role::CheckBox, true, on, format!("{}: {label}", tl!("Include in playback"))));
-                    paint_check(ui, check.rect, on, &t);
-                    // Photoshop's dialog column: playback shows the step's dialog, seeded with its
-                    // recorded values, and continues when it is confirmed.
-                    let with_dialog = dialogs.contains(&step);
-                    let dialog = ui.interact(
-                        Rect::from_center_size(pos2(x0 + 46.0, r.center().y), vec2(16.0, 16.0)),
-                        ui.scope_id().with(("action-step-dialog", i, step)),
-                        Sense::click(),
-                    );
-                    // A toggle button, not a check box, so the check column stays the only CheckBox role.
-                    dialog.widget_info(|| {
-                        egui::WidgetInfo::selected(egui::Role::Button, true, with_dialog, format!("{}: {label}", tl!("Show dialog during playback")))
-                    });
-                    crate::icons::paint(ui, dialog.rect, "message-square", 11.0, if with_dialog { t.icon } else { t.text_faint.gamma_multiply(0.45) });
-                    let dialog = dialog.on_hover_text(tl!("Show dialog during playback"));
-                    if check.on_hover_text(tl!("Include in playback")).clicked() {
-                        toggled = Some((i, step));
-                    } else if dialog.clicked() {
-                        dialog_toggled = Some((i, step));
-                    } else if response.clicked() {
-                        app.ui.actions.selected = Some(i);
-                        app.ui.actions.selected_step = Some(step);
-                    }
-                }
+                let context = StepRowsContext { action: i, x0, steps, disabled, dialogs, reveal, tokens: &t };
+                let events = draw_step_rows(app, ui, &context);
+                moved = moved.or(events.moved);
+                toggled = toggled.or(events.toggled);
+                dialog_toggled = dialog_toggled.or(events.dialog_toggled);
             }
         }
     });
@@ -1190,5 +1150,103 @@ pub fn panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     }
 }
 
+fn scroll_actions_during_drag(ui: &mut egui::Ui) {
+    if !egui::DragAndDrop::has_payload_of_type::<DragRow>(ui.ctx()) {
+        return;
+    }
+    let clip = ui.clip_rect();
+    let Some(pointer) = ui.input(|input| input.pointer.hover_pos()).filter(|p| clip.contains(*p)) else { return };
+    let delta = if pointer.y < clip.top() + 22.0 {
+        8.0
+    } else if pointer.y > clip.bottom() - 22.0 {
+        -8.0
+    } else {
+        0.0
+    };
+    if delta == 0.0 {
+        return;
+    }
+    ui.scroll_with_delta(vec2(0.0, delta));
+    ui.ctx().request_repaint();
+}
+
+struct StepRowsContext<'a> {
+    action: usize,
+    x0: f32,
+    steps: &'a [(String, Value)],
+    disabled: &'a std::collections::BTreeSet<usize>,
+    dialogs: &'a std::collections::BTreeSet<usize>,
+    reveal: Option<(usize, usize)>,
+    tokens: &'a Tokens,
+}
+
+#[derive(Default)]
+struct StepRowEvents {
+    moved: Option<(DragRow, usize)>,
+    toggled: Option<(usize, usize)>,
+    dialog_toggled: Option<(usize, usize)>,
+}
+
+fn draw_step_rows(app: &mut PhotocraftApp, ui: &mut egui::Ui, context: &StepRowsContext<'_>) -> StepRowEvents {
+    let mut events = StepRowEvents::default();
+    for (step, (id, params)) in context.steps.iter().enumerate() {
+        let (rect, response) = ui.allocate_exact_size(vec2(ui.available_width(), 20.0), Sense::click_and_drag());
+        if context.reveal == Some((context.action, step + 1)) {
+            ui.scroll_to_rect(rect, Some(egui::Align::BOTTOM));
+        }
+        let label = step_label(id, params);
+        draw_step_label(app, ui, rect, &response, step, &label, context);
+        events.moved = drag_row(ui, &response, DragRow { action: context.action, step: Some(step) }, context.tokens).or(events.moved);
+        let (check, dialog) = draw_step_controls(ui, rect, step, &label, context);
+        if check.clicked() {
+            events.toggled = Some((context.action, step));
+        } else if dialog.clicked() {
+            events.dialog_toggled = Some((context.action, step));
+        } else if response.clicked() {
+            app.ui.actions.selected = Some(context.action);
+            app.ui.actions.selected_step = Some(step);
+        }
+    }
+    events
+}
+
+fn draw_step_label(app: &PhotocraftApp, ui: &egui::Ui, rect: Rect, response: &egui::Response, step: usize, label: &str, context: &StepRowsContext<'_>) {
+    let selected = app.ui.actions.selected == Some(context.action) && app.ui.actions.selected_step == Some(step);
+    response.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, selected, label));
+    if selected {
+        ui.painter().rect_filled(rect, 0.0, context.tokens.row_selected);
+    } else if response.hovered() {
+        ui.painter().rect_filled(response.rect, 0.0, context.tokens.hover.gamma_multiply(0.5));
+    }
+    let color = if context.disabled.contains(&step) { context.tokens.text_faint } else { context.tokens.text_dim };
+    ui.painter().text(pos2(context.x0 + 62.0, rect.center().y), Align2::LEFT_CENTER, label, egui::FontId::proportional(11.5), color);
+}
+
+fn draw_step_controls(ui: &mut egui::Ui, rect: Rect, step: usize, label: &str, context: &StepRowsContext<'_>) -> (egui::Response, egui::Response) {
+    let on = !context.disabled.contains(&step);
+    let check = ui.interact(
+        Rect::from_center_size(pos2(context.x0 + 30.0, rect.center().y), vec2(16.0, 16.0)),
+        ui.scope_id().with(("action-step-check", context.action, step)),
+        Sense::click(),
+    );
+    check.widget_info(|| egui::WidgetInfo::selected(egui::Role::CheckBox, true, on, format!("{}: {label}", tl!("Include in playback"))));
+    paint_check(ui, check.rect, on, context.tokens);
+    let with_dialog = context.dialogs.contains(&step);
+    let dialog = ui.interact(
+        Rect::from_center_size(pos2(context.x0 + 46.0, rect.center().y), vec2(16.0, 16.0)),
+        ui.scope_id().with(("action-step-dialog", context.action, step)),
+        Sense::click(),
+    );
+    dialog.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, with_dialog, format!("{}: {label}", tl!("Show dialog during playback"))));
+    crate::icons::paint(
+        ui,
+        dialog.rect,
+        "message-square",
+        11.0,
+        if with_dialog { context.tokens.icon } else { context.tokens.text_faint.gamma_multiply(0.45) },
+    );
+    (check.on_hover_text(tl!("Include in playback")), dialog.on_hover_text(tl!("Show dialog during playback")))
+}
+
 #[cfg(test)]
 mod tests;
diff --git a/crates/ui-egui/src/panels/adjust_ui.rs b/crates/ui-egui/src/panels/adjust_ui.rs
index ae6722e574..2d70592c52 100644
--- a/crates/ui-egui/src/panels/adjust_ui.rs
+++ b/crates/ui-egui/src/panels/adjust_ui.rs
@@ -174,7 +174,7 @@ fn lookup_params(key: &str) -> Value {
 
 pub fn color_lookup_editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, id: LayerId, adj: &Adjustment) {
     let t = Tokens::get(ui.ctx());
-    let Adjustment::ColorLookup { name, lut, size, tetrahedral, dither } = adj else {
+    let Adjustment::ColorLookup { name, lut, size, tetrahedral, dither, .. } = adj else {
         return;
     };
     let builtins = photocraft_engine::adjust_cmds::LOOKS;
diff --git a/crates/ui-egui/src/panels/brush_controls.rs b/crates/ui-egui/src/panels/brush_controls.rs
index b8970a2db0..49cc070205 100644
--- a/crates/ui-egui/src/panels/brush_controls.rs
+++ b/crates/ui-egui/src/panels/brush_controls.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Align2, BlendMode, Color32, PhotocraftApp, Rect, Sense, Stroke, StrokeKind, Tokens, c32, icons, json, pos2, vec2, widgets};
 
 /// A painting tool's Mode dropdown over `modes` (`None` is Clear); the wheel over it steps the
 /// mode. Returns the mode picked this frame.
diff --git a/crates/ui-egui/src/panels/channels_panel.rs b/crates/ui-egui/src/panels/channels_panel.rs
index f073cf8f3c..912d82c298 100644
--- a/crates/ui-egui/src/panels/channels_panel.rs
+++ b/crates/ui-egui/src/panels/channels_panel.rs
@@ -46,6 +46,243 @@ pub fn load_operation(m: egui::Modifiers) -> &'static str {
     }
 }
 
+struct RowPresentationContext<'a> {
+    doc: &'a photocraft_doc::Document,
+    view: &'a photocraft_engine::channel_cmds::ChannelView,
+    mode: photocraft_doc::ColorMode,
+    colors: usize,
+    gray_view: bool,
+    quick: bool,
+    mask_targeted: bool,
+    masked: Option<&'a photocraft_doc::Layer>,
+    shown_colors: usize,
+}
+
+struct RowPresentation {
+    name: String,
+    thumb_idx: usize,
+    slot: Option<usize>,
+    visible: bool,
+    selected: bool,
+}
+
+struct RowInteractions<'a> {
+    row: Row,
+    name: &'a str,
+    cell: Rect,
+    rect: Rect,
+    text_pos: egui::Pos2,
+    response: &'a egui::Response,
+    eye_response: &'a egui::Response,
+    ctx: &'a egui::Context,
+    doc: &'a photocraft_doc::Document,
+    masked: Option<&'a photocraft_doc::Layer>,
+    actions: &'a mut Vec<(String, Value)>,
+    mask_click: &'a mut Option<bool>,
+}
+
+fn handle_row_interactions(ui: &mut egui::Ui, mut row: RowInteractions<'_>) {
+    let rename_id = egui::Id::unique(("chan-rename", row.doc.id.0, format!("{:?}", row.row.reference())));
+    handle_channel_row_click(ui, &mut row);
+    handle_channel_row_double_click(ui, &mut row, rename_id);
+    row.response.context_menu(|ui| draw_row_menu(ui, row.row, row.doc, row.masked, row.actions));
+}
+
+fn handle_channel_row_click(ui: &egui::Ui, row: &mut RowInteractions<'_>) {
+    if !row.response.clicked() || row.eye_response.clicked() {
+        return;
+    }
+    let modifiers = ui.input(|input| input.modifiers);
+    if modifiers.command {
+        let channel = if row.row == Row::LayerMask { json!("mask") } else { row.row.reference() };
+        let layer = row.masked.map(|layer| layer.id.0);
+        let operation = load_operation(modifiers);
+        let params = if row.row == Row::LayerMask {
+            json!({ "channel": channel, "layer": layer, "operation": operation })
+        } else {
+            json!({ "channel": channel, "operation": operation })
+        };
+        row.actions.push(("select.loadSelection".into(), params));
+        return;
+    }
+    if row.row == Row::LayerMask {
+        *row.mask_click = Some(true);
+        row.actions.push(("channel.target".into(), json!({ "channel": "mask" })));
+        return;
+    }
+    if matches!(row.row, Row::Composite | Row::Color(_)) {
+        *row.mask_click = Some(false);
+    }
+    let target = if row.row == Row::QuickMask { json!("composite") } else { row.row.reference() };
+    row.actions.push(("channel.target".into(), json!({ "channel": target })));
+}
+
+fn handle_channel_row_double_click(ui: &mut egui::Ui, row: &mut RowInteractions<'_>, rename_id: egui::Id) {
+    // Like Photoshop: double-clicking the thumbnail opens Channel Options (where an alpha
+    // channel becomes a spot channel, #3761), double-clicking the name renames it.
+    let on_thumb = row.response.interact_pointer_pos().is_some_and(|p| p.x < row.cell.right() + 4.0);
+    match row.row {
+        Row::QuickMask if row.response.double_clicked() => row.actions.push(("ui.channelOptions".into(), json!("quickMask"))),
+        Row::LayerMask if row.response.double_clicked() => row.actions.push(("ui.channelOptions".into(), json!("mask"))),
+        Row::Alpha(index) => {
+            handle_alpha_double_click(ui, row, index, on_thumb, rename_id);
+        }
+        _ => {}
+    }
+}
+
+fn handle_alpha_double_click(ui: &mut egui::Ui, row: &mut RowInteractions<'_>, index: usize, on_thumb: bool, rename_id: egui::Id) {
+    if row.response.double_clicked() {
+        if on_thumb {
+            row.actions.push(("ui.channelOptions".into(), json!(index)));
+        } else {
+            row.ctx.data_mut(|data| data.insert_temp(rename_id, row.name.to_owned()));
+        }
+    }
+    let Some(mut text) = row.ctx.data(|data| data.get_temp::<String>(rename_id)) else { return };
+    let edit_rect = Rect::from_min_max(pos2(row.text_pos.x - 3.0, row.rect.center().y - 11.0), pos2(row.rect.right() - 36.0, row.rect.center().y + 11.0));
+    let edit = ui.put(edit_rect, egui::TextEdit::singleline(&mut text).font(egui::FontId::proportional(12.5))).accessible_name(tl!("Name"));
+    if !edit.has_focus() && !edit.lost_focus() {
+        edit.request_focus();
+    }
+    let (enter, escape) = ui.input(|input| (input.key_pressed(egui::Key::Enter), input.key_pressed(egui::Key::Escape)));
+    if escape || enter || edit.lost_focus() {
+        row.ctx.data_mut(|data| data.remove::<String>(rename_id));
+        if !escape && !text.trim().is_empty() && text != row.name {
+            row.actions.push(("channel.rename".into(), json!({ "channel": index, "name": text.trim() })));
+        }
+    } else {
+        row.ctx.data_mut(|data| data.insert_temp(rename_id, text));
+    }
+}
+
+fn draw_row_menu(ui: &mut egui::Ui, row: Row, doc: &photocraft_doc::Document, masked: Option<&photocraft_doc::Layer>, actions: &mut Vec<(String, Value)>) {
+    crate::widgets::menu_scroll(ui, |ui| {
+        ui.set_min_width(210.0);
+        match row {
+            Row::Alpha(index) => draw_alpha_menu(ui, index, &doc.channels[index], actions),
+            Row::QuickMask => draw_quick_mask_menu(ui, doc, actions),
+            Row::Composite | Row::Color(_) => item(ui, actions, "Duplicate Channel", "channel.duplicate", json!({ "channel": row.reference() })),
+            Row::LayerMask => draw_mask_menu(ui, masked, actions),
+        }
+        ui.separator();
+        item(ui, actions, "New Channel…", "channel.new", json!({}));
+        item(ui, actions, "New Spot Channel…", "ui.newSpotChannel", json!({}));
+        ui.separator();
+        item(ui, actions, "Split Channels", "channel.split", json!({}));
+        item(ui, actions, "Merge Channels…", "channel.merge", json!({}));
+    });
+}
+
+fn draw_alpha_menu(ui: &mut egui::Ui, index: usize, channel: &photocraft_doc::AlphaChannel, actions: &mut Vec<(String, Value)>) {
+    item(ui, actions, "Duplicate Channel", "channel.duplicate", json!({ "channel": index }));
+    item(ui, actions, "Delete Channel", "channel.delete", json!({ "channel": index }));
+    item(ui, actions, "Rename Channel…", "ui.renameChannel", json!(index));
+    item(ui, actions, "Channel Options…", "ui.channelOptions", json!(index));
+    ui.separator();
+    if channel.spot.is_some() {
+        item(ui, actions, "Merge Spot Channel", "channel.mergeSpot", json!({ "channel": index }));
+        item(ui, actions, "Convert to Alpha Channel", "channel.options", json!({ "channel": index, "indicates": "masked" }));
+    } else {
+        indicates_items(ui, actions, json!(index), channel.indicates);
+        overlay_colors(ui, actions, json!(index));
+    }
+}
+
+fn draw_quick_mask_menu(ui: &mut egui::Ui, doc: &photocraft_doc::Document, actions: &mut Vec<(String, Value)>) {
+    item(ui, actions, "Exit Quick Mask", "select.editInQuickMaskMode", json!({ "on": false }));
+    item(ui, actions, "Quick Mask Options…", "ui.channelOptions", json!("quickMask"));
+    indicates_items(ui, actions, json!("quickMask"), doc.quick_mask.as_ref().map(|mask| mask.indicates).unwrap_or_default());
+    overlay_colors(ui, actions, json!("quickMask"));
+}
+
+fn draw_mask_menu(ui: &mut egui::Ui, masked: Option<&photocraft_doc::Layer>, actions: &mut Vec<(String, Value)>) {
+    let enabled = masked.and_then(|layer| layer.mask.as_ref()).is_none_or(|mask| mask.enabled);
+    item(ui, actions, crate::layer_menu_ui::mask_toggle_label(enabled), "layer.layerMask.enabled", json!({}));
+    item(ui, actions, "Delete Layer Mask", "layer.layerMask.delete", json!({}));
+    item(ui, actions, "Layer Mask Display Options…", "ui.channelOptions", json!("mask"));
+}
+
+/// The slot a channel dragged over `row` would take (0 = first alpha) and where its line goes.
+fn drop_insertion(row: Row, pointer_y: f32, rect: Rect, alpha_count: usize) -> (usize, f32) {
+    match row {
+        Row::Alpha(j) if pointer_y < rect.center().y => (j, rect.top()),
+        Row::Alpha(j) => (j + 1, rect.bottom()),
+        Row::QuickMask => (alpha_count, rect.top()),
+        // Above the alpha channels: Photoshop puts it first among them.
+        Row::Composite | Row::Color(_) | Row::LayerMask => (0, f32::NAN),
+    }
+}
+
+/// What clicking `row`'s eye asks for.
+fn eye_action(row: Row, visible: bool, gray_view: bool, layer_id: Option<u64>) -> (String, Value) {
+    let view_cmd = photocraft_engine::mask_view_cmds::ID.to_string();
+    match row {
+        // The mask's eye: the overlay on, or the mask view off.
+        Row::LayerMask => (view_cmd, json!({ "layer": layer_id, "mode": if visible { "off" } else { "overlay" } })),
+        // Showing the composite again over a gray mask view keeps the mask as an overlay.
+        Row::Composite if gray_view => (view_cmd, json!({ "layer": layer_id, "mode": "overlay" })),
+        _ => ("channel.setVisible".into(), json!({ "channel": row.reference(), "visible": !visible })),
+    }
+}
+
+fn paint_row_background(painter: &egui::Painter, t: &Tokens, rect: Rect, selected: bool, hovered: bool) {
+    let radius = if t.pro { 0.0 } else { t.radius };
+    if selected {
+        painter.rect_filled(rect, radius, if t.pro { t.row_selected } else { t.hover });
+    } else if hovered {
+        painter.rect_filled(rect, radius, t.hover.gamma_multiply(0.5));
+    }
+    if t.pro {
+        painter.line_segment([pos2(rect.left() + 30.0, rect.top()), pos2(rect.left() + 30.0, rect.bottom())], Stroke::new(1.0, t.separator));
+        painter.line_segment([rect.left_bottom(), rect.right_bottom()], Stroke::new(1.0, t.separator));
+    }
+}
+
+/// Spot channels: a swatch of the ink on the thumbnail corner.
+fn paint_spot_swatch(painter: &egui::Painter, thumb: Rect, spot: Option<(photocraft_doc::Color, f32)>) {
+    let Some((ink, _)) = spot else { return };
+    let c = ink.to_rgb().map(|v| (v.clamp(0.0, 1.0) * 255.0) as u8);
+    painter.rect_filled(Rect::from_min_size(thumb.right_bottom() - vec2(9.0, 9.0), vec2(9.0, 9.0)), 0.0, Color32::from_rgb(c[0], c[1], c[2]));
+}
+
+fn row_presentation(row: Row, context: &RowPresentationContext<'_>, mask_visible: bool) -> RowPresentation {
+    let (name, thumb_idx, slot, visible, selected) = match row {
+        Row::Composite => (
+            channel_cmds::composite_name(context.mode).to_string(),
+            0,
+            Some(2),
+            context.view.visible_colors(context.colors) == context.colors && !context.gray_view,
+            context.view.target == ChannelTarget::Composite && !context.quick && !context.mask_targeted,
+        ),
+        Row::Color(k) => (
+            channel_cmds::color_names(context.mode)[k].to_string(),
+            1 + k,
+            Some(3 + k),
+            context.view.color_visible(k) && !context.gray_view,
+            (context.view.target == ChannelTarget::Composite && !context.quick && !context.mask_targeted) || context.view.target == ChannelTarget::Color(k),
+        ),
+        Row::Alpha(i) => (
+            context.doc.channels[i].name.clone(),
+            1 + context.shown_colors + i,
+            Some(3 + context.shown_colors + i).filter(|s| *s <= 9),
+            context.view.alpha_shown(i),
+            context.view.target == ChannelTarget::Alpha(i),
+        ),
+        Row::QuickMask => (
+            "Quick Mask".to_string(),
+            1 + context.shown_colors + context.doc.channels.len(),
+            None,
+            !context.view.quick_mask_hidden,
+            context.view.target == ChannelTarget::Composite,
+        ),
+        Row::LayerMask => {
+            (context.masked.map_or_else(String::new, |layer| format!("{} Mask", layer.name)), usize::MAX, None, mask_visible, context.mask_targeted)
+        }
+    };
+    RowPresentation { name, thumb_idx, slot, visible, selected }
+}
+
 pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
     let Some(st) = app.session.active() else {
@@ -101,40 +338,13 @@ pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let pointer = ctx.input(|i| i.pointer.interact_pos());
     let released = ctx.input(|i| i.pointer.any_released());
     let alpha_count = doc.channels.len();
+    let row_context = RowPresentationContext { doc: &doc, view: &view, mode, colors, gray_view, quick, mask_targeted, masked, shown_colors };
     // The slot the dragged channel would take (0 = first alpha) and where its line goes.
     let mut insertion: Option<(usize, f32)> = None;
     let mut alphas_top: Option<f32> = None;
     egui::ScrollArea::vertical().max_height(rows_h).min_scrolled_height(if fill { rows_h } else { 0.0 }).auto_shrink([false, !fill]).show(ui, |ui| {
         for row in rows {
-            let (name, thumb_idx, slot, visible, selected) = match row {
-                Row::Composite => (
-                    channel_cmds::composite_name(mode).to_string(),
-                    0,
-                    Some(2),
-                    view.visible_colors(colors) == colors && !gray_view,
-                    view.target == ChannelTarget::Composite && !quick && !mask_targeted,
-                ),
-                Row::Color(k) => (
-                    channel_cmds::color_names(mode)[k].to_string(),
-                    1 + k,
-                    Some(3 + k),
-                    view.color_visible(k) && !gray_view,
-                    (view.target == ChannelTarget::Composite && !quick && !mask_targeted) || view.target == ChannelTarget::Color(k),
-                ),
-                Row::Alpha(i) => (
-                    doc.channels[i].name.clone(),
-                    1 + shown_colors + i,
-                    Some(3 + shown_colors + i).filter(|s| *s <= 9),
-                    view.alpha_shown(i),
-                    view.target == ChannelTarget::Alpha(i),
-                ),
-                Row::QuickMask => {
-                    ("Quick Mask".to_string(), 1 + shown_colors + doc.channels.len(), None, !view.quick_mask_hidden, view.target == ChannelTarget::Composite)
-                }
-                Row::LayerMask => {
-                    (masked.as_ref().map(|l| format!("{} Mask", l.name)).unwrap_or_default(), usize::MAX, None, mask_view.is_some(), mask_targeted)
-                }
-            };
+            let RowPresentation { name, thumb_idx, slot, visible, selected } = row_presentation(row, &row_context, mask_view.is_some());
             let row_h = if t.pro { 36.0 } else { 40.0 };
             let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), row_h), Sense::click_and_drag());
             if let Row::Alpha(0) = row {
@@ -143,27 +353,13 @@ pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             if dragged_alpha.is_some()
                 && let Some(p) = pointer.filter(|p| rect.contains(*p))
             {
-                insertion = match row {
-                    Row::Alpha(j) if p.y < rect.center().y => Some((j, rect.top())),
-                    Row::Alpha(j) => Some((j + 1, rect.bottom())),
-                    Row::QuickMask => Some((alpha_count, rect.top())),
-                    // Above the alpha channels: Photoshop puts it first among them.
-                    Row::Composite | Row::Color(_) | Row::LayerMask => Some((0, f32::NAN)),
-                };
+                insertion = Some(drop_insertion(row, p.y, rect, alpha_count));
             }
             if resp.drag_started() {
                 ctx.data_mut(|d| d.insert_temp(drag_id(), (row, name.clone())));
             }
             let painter = ui.painter_at(rect.expand(1.0));
-            if selected {
-                painter.rect_filled(rect, if t.pro { 0.0 } else { t.radius }, if t.pro { t.row_selected } else { t.hover });
-            } else if resp.hovered() {
-                painter.rect_filled(rect, if t.pro { 0.0 } else { t.radius }, t.hover.gamma_multiply(0.5));
-            }
-            if t.pro {
-                painter.line_segment([pos2(rect.left() + 30.0, rect.top()), pos2(rect.left() + 30.0, rect.bottom())], Stroke::new(1.0, t.separator));
-                painter.line_segment([rect.left_bottom(), rect.right_bottom()], Stroke::new(1.0, t.separator));
-            }
+            paint_row_background(&painter, &t, rect, selected, resp.hovered());
             let eye = Rect::from_min_size(pos2(rect.left() + 6.0, rect.center().y - 11.0), vec2(22.0, 22.0));
             let eye_resp = ui.interact(eye, ui.scope_id().with(("chan-eye", format!("{:?}", row.reference()))), Sense::click());
             // Like Photoshop, the temporary mask row's eye is empty until the mask is shown.
@@ -174,14 +370,7 @@ pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             eye_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, format!("Visibility {name}")));
             let layer_id = masked.as_ref().map(|l| l.id.0);
             if eye_resp.clicked() {
-                let view_cmd = photocraft_engine::mask_view_cmds::ID.to_string();
-                match row {
-                    // The mask's eye: the overlay on, or the mask view off.
-                    Row::LayerMask => actions.push((view_cmd, json!({ "layer": layer_id, "mode": if visible { "off" } else { "overlay" } }))),
-                    // Showing the composite again over a gray mask view keeps the mask as an overlay.
-                    Row::Composite if gray_view => actions.push((view_cmd, json!({ "layer": layer_id, "mode": "overlay" }))),
-                    _ => actions.push(("channel.setVisible".into(), json!({ "channel": row.reference(), "visible": !visible }))),
-                }
+                actions.push(eye_action(row, visible, gray_view, layer_id));
             }
             let ts = if t.pro { 28.0 } else { 30.0 };
             let cell = Rect::from_min_size(pos2(rect.left() + 36.0, rect.center().y - ts / 2.0), vec2(ts, ts));
@@ -195,11 +384,8 @@ pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             // Rows are painted: name them for screen readers and UI tests.
             resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, selected, &name));
             // Spot channels: a swatch of the ink on the thumbnail corner.
-            if let Row::Alpha(i) = row
-                && let Some((ink, _)) = doc.channels[i].spot
-            {
-                let c = ink.to_rgb().map(|v| (v.clamp(0.0, 1.0) * 255.0) as u8);
-                painter.rect_filled(Rect::from_min_size(thumb.right_bottom() - vec2(9.0, 9.0), vec2(9.0, 9.0)), 0.0, Color32::from_rgb(c[0], c[1], c[2]));
+            if let Row::Alpha(i) = row {
+                paint_spot_swatch(&painter, thumb, doc.channels[i].spot);
             }
             painter.rect_stroke(thumb, 0.0, Stroke::new(1.0, if t.pro { Color32::from_gray(20) } else { t.field_border }), StrokeKind::Outside);
             let italic = matches!(row, Row::QuickMask | Row::LayerMask) || matches!(row, Row::Alpha(i) if doc.channels[i].spot.is_some());
@@ -223,105 +409,23 @@ pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                     t.text_faint,
                 );
             }
-            let rename_id = egui::Id::unique(("chan-rename", doc.id.0, format!("{:?}", row.reference())));
-            if resp.clicked() && !eye_resp.clicked() {
-                let m = ui.input(|i| i.modifiers);
-                if m.command && row == Row::LayerMask {
-                    let layer = masked.as_ref().map(|l| l.id.0);
-                    actions.push(("select.loadSelection".into(), json!({ "channel": "mask", "layer": layer, "operation": load_operation(m) })));
-                } else if m.command {
-                    actions.push(("select.loadSelection".into(), json!({ "channel": row.reference(), "operation": load_operation(m) })));
-                } else if row == Row::LayerMask {
-                    // Targets the mask, as clicking its thumbnail in the Layers panel does.
-                    mask_click = Some(true);
-                    actions.push(("channel.target".into(), json!({ "channel": "mask" })));
-                } else {
-                    if matches!(row, Row::Composite | Row::Color(_)) {
-                        mask_click = Some(false);
-                    }
-                    let target = if row == Row::QuickMask { json!("composite") } else { row.reference() };
-                    actions.push(("channel.target".into(), json!({ "channel": target })));
-                }
-            }
-            // Like Photoshop: double-clicking the thumbnail opens Channel Options (where an alpha
-            // channel becomes a spot channel, #3761), double-clicking the name renames it.
-            let on_thumb = resp.interact_pointer_pos().is_some_and(|p| p.x < cell.right() + 4.0);
-            if row == Row::QuickMask && resp.double_clicked() {
-                actions.push(("ui.channelOptions".into(), json!("quickMask")));
-            }
-            // The layer mask's row: Layer Mask Display Options (the rubylith's colour, opacity).
-            if row == Row::LayerMask && resp.double_clicked() {
-                actions.push(("ui.channelOptions".into(), json!("mask")));
-            }
-            if let Row::Alpha(i) = row {
-                if resp.double_clicked() && on_thumb {
-                    actions.push(("ui.channelOptions".into(), json!(i)));
-                } else if resp.double_clicked() {
-                    ctx.data_mut(|d| d.insert_temp(rename_id, name.clone()));
-                }
-                if let Some(mut text) = ctx.data(|d| d.get_temp::<String>(rename_id)) {
-                    let edit_rect = Rect::from_min_max(pos2(text_pos.x - 3.0, rect.center().y - 11.0), pos2(rect.right() - 36.0, rect.center().y + 11.0));
-                    let te = ui.put(edit_rect, egui::TextEdit::singleline(&mut text).font(egui::FontId::proportional(12.5))).accessible_name(tl!("Name"));
-                    if !te.has_focus() && !te.lost_focus() {
-                        te.request_focus();
-                    }
-                    let (enter, esc) = ui.input(|i| (i.key_pressed(egui::Key::Enter), i.key_pressed(egui::Key::Escape)));
-                    if esc {
-                        ctx.data_mut(|d| d.remove::<String>(rename_id));
-                    } else if enter || te.lost_focus() {
-                        ctx.data_mut(|d| d.remove::<String>(rename_id));
-                        if !text.trim().is_empty() && text != name {
-                            actions.push(("channel.rename".into(), json!({ "channel": i, "name": text.trim() })));
-                        }
-                    } else {
-                        ctx.data_mut(|d| d.insert_temp(rename_id, text));
-                    }
-                }
-            }
-            resp.context_menu(|ui| {
-                crate::widgets::menu_scroll(ui, |ui| {
-                    ui.set_min_width(210.0);
-                    let a = &mut actions;
-                    match row {
-                        Row::Alpha(i) => {
-                            let ch = &doc.channels[i];
-                            item(ui, a, "Duplicate Channel", "channel.duplicate", json!({ "channel": i }));
-                            item(ui, a, "Delete Channel", "channel.delete", json!({ "channel": i }));
-                            item(ui, a, "Rename Channel…", "ui.renameChannel", json!(i));
-                            item(ui, a, "Channel Options…", "ui.channelOptions", json!(i));
-                            ui.separator();
-                            if ch.spot.is_some() {
-                                item(ui, a, "Merge Spot Channel", "channel.mergeSpot", json!({ "channel": i }));
-                                item(ui, a, "Convert to Alpha Channel", "channel.options", json!({ "channel": i, "indicates": "masked" }));
-                            } else {
-                                indicates_items(ui, a, json!(i), ch.indicates);
-                                overlay_colors(ui, a, json!(i));
-                            }
-                        }
-                        Row::QuickMask => {
-                            item(ui, a, "Exit Quick Mask", "select.editInQuickMaskMode", json!({ "on": false }));
-                            item(ui, a, "Quick Mask Options…", "ui.channelOptions", json!("quickMask"));
-                            indicates_items(ui, a, json!("quickMask"), doc.quick_mask.as_ref().map(|q| q.indicates).unwrap_or_default());
-                            overlay_colors(ui, a, json!("quickMask"));
-                        }
-                        Row::Composite | Row::Color(_) => {
-                            item(ui, a, "Duplicate Channel", "channel.duplicate", json!({ "channel": row.reference() }));
-                        }
-                        Row::LayerMask => {
-                            let enabled = masked.as_ref().and_then(|l| l.mask.as_ref()).is_none_or(|m| m.enabled);
-                            item(ui, a, crate::layer_menu_ui::mask_toggle_label(enabled), "layer.layerMask.enabled", json!({}));
-                            item(ui, a, "Delete Layer Mask", "layer.layerMask.delete", json!({}));
-                            item(ui, a, "Layer Mask Display Options…", "ui.channelOptions", json!("mask"));
-                        }
-                    }
-                    ui.separator();
-                    item(ui, a, "New Channel…", "channel.new", json!({}));
-                    item(ui, a, "New Spot Channel…", "ui.newSpotChannel", json!({}));
-                    ui.separator();
-                    item(ui, a, "Split Channels", "channel.split", json!({}));
-                    item(ui, a, "Merge Channels…", "channel.merge", json!({}));
-                });
-            });
+            handle_row_interactions(
+                ui,
+                RowInteractions {
+                    row,
+                    name: &name,
+                    cell,
+                    rect,
+                    text_pos,
+                    response: &resp,
+                    eye_response: &eye_resp,
+                    ctx: &ctx,
+                    doc: &doc,
+                    masked,
+                    actions: &mut actions,
+                    mask_click: &mut mask_click,
+                },
+            );
         }
         if let (Some(from), Some((slot, y))) = (dragged_alpha, insertion) {
             let y = if y.is_nan() { alphas_top.unwrap_or(y) } else { y };
diff --git a/crates/ui-egui/src/panels/chrome_ui.rs b/crates/ui-egui/src/panels/chrome_ui.rs
index 7822d13860..f5e58a455d 100644
--- a/crates/ui-egui/src/panels/chrome_ui.rs
+++ b/crates/ui-egui/src/panels/chrome_ui.rs
@@ -5,6 +5,7 @@ use egui::{RichText, Sense, Stroke, vec2};
 use photocraft_doc::{Document, LayerContent};
 use serde::{Deserialize, Serialize};
 
+use crate::render_path::CpuReason;
 use crate::theme::Tokens;
 use crate::{PhotocraftApp, icons, widgets};
 
@@ -188,21 +189,44 @@ pub fn status_bar_pro(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     status_message(app, ui, &t);
 }
 
-/// The active document's layers don't fit the GPU memory budget (`perf.gpuLayerFit`): edits that
-/// redraw the whole document do it on the CPU, so say so in the status bar until they fit again.
-/// Clicking it opens Preferences › Performance, where GPU Memory raises the budget.
-pub fn gpu_memory_status(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
-    let Some(doc) = app.session.active().map(|st| st.doc.id.0) else { return };
-    let Some(fit) = app.perf.gpu_layer_fit.filter(|f| f.doc == doc && !f.fits()) else { return };
+/// What the status bar says about the active document's render path: its label, tooltip and
+/// the command a click runs, or None on the GPU.
+pub(crate) fn render_path_label(app: &PhotocraftApp) -> Option<(&'static str, String, &'static str)> {
+    let doc = app.session.active().map(|st| st.doc.id.0)?;
+    let reason = app.render_path.current(doc);
+    // The measured fit (also on a switch to a document whose canvas is current) or the reason
+    // of the last full refresh: edits that redraw the whole document do it on the CPU, so say
+    // so until they fit again; GPU Memory in Preferences › Performance raises the budget.
+    let fit = app.perf.gpu_layer_fit.filter(|f| f.doc == doc && !f.fits()).map(|f| (f.needed, f.budget));
+    // Another reason (a flipped view, Advanced Blending…) is the cause: show it, not the fit.
+    let over = match reason {
+        Some(&CpuReason::OverBudget { needed, budget }) => fit.or(Some((needed, budget))),
+        Some(_) => None,
+        None => fit,
+    };
+    if let Some((needed, budget)) = over {
+        let tip = crate::i18n::fmt(
+            tl!(
+                "The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory."
+            ),
+            &[("needed", &fmt_bytes(needed)), ("budget", &fmt_bytes(budget))],
+        );
+        return Some((tl!("GPU Memory Full"), tip, "edit.preferences.performance"));
+    }
+    let reason = reason?;
+    let tip = crate::i18n::fmt(tl!("Drawn on the CPU: {reason}. Click for System Info."), &[("reason", &reason.to_string())]);
+    Some((tl!("CPU Rendering"), tip, "help.systemInfo"))
+}
+
+/// The active document is drawn on the CPU (`render_path`): say so in the status bar, with the
+/// reason in the tooltip. "GPU Memory Full" opens Preferences › Performance; any other reason,
+/// "CPU Rendering", opens Help › System Info.
+pub fn render_path_status(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
+    let Some((label, tip, command)) = render_path_label(app) else { return };
     let t = Tokens::get(ui.ctx());
-    let resp = ui
-        .add(egui::Label::new(RichText::new(tl!("GPU Memory Full")).color(t.warning).size(12.0)).sense(Sense::click()))
-        .on_hover_text(crate::i18n::fmt(
-            tl!("The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory."),
-            &[("needed", &fmt_bytes(fit.needed)), ("budget", &fmt_bytes(fit.budget))],
-        ));
+    let resp = ui.add(egui::Label::new(RichText::new(label).color(t.warning).size(12.0)).sense(Sense::click())).on_hover_text(tip);
     if resp.clicked() {
-        crate::shortcut_dispatch::dispatch(app, ui.ctx(), "edit.preferences.performance");
+        crate::shortcut_dispatch::dispatch(app, ui.ctx(), command);
     }
 }
 
@@ -349,6 +373,56 @@ mod tests {
         }
     }
 
+    /// A reason other than the memory budget is what the status bar shows, even while the
+    /// measured layer fit is over the budget.
+    #[test]
+    fn status_bar_shows_another_cpu_reason_before_gpu_memory_full() {
+        use egui_kittest::{Harness, kittest::Queryable};
+        let mut h = Harness::builder().with_size(vec2(1200.0, 700.0)).with_max_steps(64).build_eframe(|cc| {
+            PhotocraftApp::setup_context(&cc.egui_ctx, crate::theme::ThemeKind::Pro);
+            PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default())
+        });
+        h.state_mut().run("file.new", json!({"width": 800, "height": 600})).unwrap();
+        h.state_mut().sync_views();
+        h.run_steps(4);
+        let doc = h.state().session.active().unwrap().doc.id.0;
+        h.state_mut().perf.gpu_layer_fit = Some(crate::gpu_canvas::LayerFit { doc, needed: 3 << 30, budget: 2 << 30 });
+        let reason = CpuReason::Unsupported("Advanced Blending on `Layer 1`".into());
+        crate::render_path::note(h.state_mut(), doc, crate::render_path::Path::Cpu(reason));
+        h.run_steps(2);
+        assert!(h.query_by_label("GPU Memory Full").is_none());
+        assert!(h.query_by_label("CPU Rendering").is_some());
+        let tip = render_path_label(h.state()).map(|l| l.1).unwrap_or_default();
+        assert!(tip.contains("Advanced Blending"), "{tip}");
+    }
+
+    /// GPU Memory raised in Preferences: once the layers are measured to fit, GPU Memory Full
+    /// clears at once, not at the next full refresh.
+    #[test]
+    fn gpu_memory_full_clears_when_the_budget_is_raised() {
+        use egui_kittest::{Harness, kittest::Queryable};
+        let mut h = Harness::builder().with_size(vec2(1200.0, 700.0)).with_max_steps(64).build_eframe(|cc| {
+            PhotocraftApp::setup_context(&cc.egui_ctx, crate::theme::ThemeKind::Pro);
+            PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default())
+        });
+        h.state_mut().run("file.new", json!({"width": 800, "height": 600})).unwrap();
+        h.state_mut().sync_views();
+        h.run_steps(4);
+        let doc = h.state().session.active().unwrap().doc.id.0;
+        let over = crate::gpu_canvas::LayerFit { doc, needed: 3 << 30, budget: 2 << 30 };
+        h.state_mut().perf.gpu_layer_fit = Some(over);
+        let reason = CpuReason::OverBudget { needed: over.needed, budget: over.budget };
+        crate::render_path::note(h.state_mut(), doc, crate::render_path::Path::Cpu(reason));
+        h.run_steps(2);
+        assert!(h.query_by_label("GPU Memory Full").is_some());
+        // What `gpu_budget` measures after the change of GPU Memory.
+        crate::render_path::layer_fit(h.state_mut(), crate::gpu_canvas::LayerFit { budget: 4 << 30, ..over });
+        h.run_steps(2);
+        assert!(h.query_by_label("GPU Memory Full").is_none());
+        assert!(h.query_by_label("CPU Rendering").is_none());
+        assert!(h.state().perf.gpu_fallback.is_none());
+    }
+
     #[test]
     fn status_bar_updates_dimensions_after_a_ruler_preference_change() {
         use egui_kittest::{Harness, kittest::Queryable};
diff --git a/crates/ui-egui/src/panels/color.rs b/crates/ui-egui/src/panels/color.rs
index 592e4a902b..90cfa9d8e6 100644
--- a/crates/ui-egui/src/panels/color.rs
+++ b/crates/ui-egui/src/panels/color.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Color32, PhotocraftApp, Rect, RichText, Sense, Stroke, StrokeKind, Tokens, c32, pos2, theme, vec2, widgets};
 
 /// The Color panel's foreground and background chips. A click picks the colour the field edits,
 /// framed; a double-click opens the Color Picker on it.
@@ -91,6 +91,12 @@ pub(crate) fn color_field(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         ui.spacing_mut().item_spacing.x = 8.0;
         let (chips, _) = ui.allocate_exact_size(vec2(38.0, h), Sense::hover());
         field_chips(app, ui, chips);
+        // Photoshop's ⚠ under the chips when the colour can't print, as in the slider modes
+        // (#8672); a compact field too short to hold it below the chips leaves it out.
+        if chips.height() >= 38.0 + 15.0 {
+            let rgb = crate::color_panel_ui::active(app);
+            crate::color_panel_ui::alerts(app, ui, chips, rgb, false);
+        }
         // Hue Cube: saturation across and brightness up, hue on the strip. Brightness Cube (the
         // Color Picker's B mode): hue across and saturation up, brightness on the strip.
         let brightness = app.ui.color_panel.mode == crate::state::ColorPanelMode::BrightnessCube;
diff --git a/crates/ui-egui/src/panels/color_panel_ui.rs b/crates/ui-egui/src/panels/color_panel_ui.rs
index 19f223b8a2..798e24dea1 100644
--- a/crates/ui-egui/src/panels/color_panel_ui.rs
+++ b/crates/ui-egui/src/panels/color_panel_ui.rs
@@ -109,7 +109,7 @@ impl Model {
 }
 
 /// The colour the panel edits.
-fn active(app: &PhotocraftApp) -> [f32; 3] {
+pub(crate) fn active(app: &PhotocraftApp) -> [f32; 3] {
     let c = if app.ui.color_panel.background { app.session.tools.background } else { app.session.tools.foreground };
     [c[0], c[1], c[2]].map(|x| x.clamp(0.0, 1.0))
 }
@@ -347,7 +347,7 @@ fn sliders(app: &mut PhotocraftApp, ui: &mut egui::Ui, mode: ColorPanelMode) {
 
 /// Photoshop's alerts under the chips: ⚠ when the colour can't print (click: the nearest CMYK
 /// colour) and, for Web Color sliders, the cube when it isn't a web colour (click: the nearest).
-fn alerts(app: &mut PhotocraftApp, ui: &mut egui::Ui, col: Rect, rgb: [f32; 3], web: bool) {
+pub(crate) fn alerts(app: &mut PhotocraftApp, ui: &mut egui::Ui, col: Rect, rgb: [f32; 3], web: bool) {
     let t = Tokens::get(ui.ctx());
     let background = app.ui.color_panel.background;
     let mut y = col.top() + CHIPS_W + 2.0;
@@ -537,6 +537,7 @@ fn rgb3(c: [f32; 4]) -> [f32; 3] {
 /// other corners; the add-to-swatches button sits under it.
 fn wheel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
+    let top = ui.cursor().top();
     let background = app.ui.color_panel.background;
     let rgb = active(app);
     let v = current_values(ui, Model::Hsb, background, rgb);
@@ -556,9 +557,12 @@ fn wheel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let mut changed = edited.is_some();
     ui.add_space(6.0);
     let fill = ui.data(|d| d.get_temp::<f32>(color_field_fill_id()));
-    let gaps = 2.0 * ui.spacing().item_spacing.y + 6.0;
     let w = ui.available_width();
-    let side = fill.filter(|f| f.is_finite()).map_or(w.min(220.0), |f| (f - top_h - gaps).min(w)).max(80.0);
+    // The wheel takes what the dock group has left under the sliders as drawn (they stand taller
+    // than `ROW_H`), down to 28 pt as the slider modes' ramp: an estimate and an 80 pt floor ran
+    // it past the bottom of the Color group at its default height.
+    let used = ui.cursor().top() - top;
+    let side = fill.filter(|f| f.is_finite()).map_or(w.min(220.0), |f| (f - used).min(w)).max(28.0);
     let (area, resp) = ui.allocate_exact_size(vec2(w, side), Sense::click_and_drag());
     resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Unknown, ui.is_enabled(), "Color Wheel"));
     let (center, inner, outer) = wheel_geometry(area);
diff --git a/crates/ui-egui/src/panels/dock.rs b/crates/ui-egui/src/panels/dock.rs
index 99f2afc7a8..4bc72ab57b 100644
--- a/crates/ui-egui/src/panels/dock.rs
+++ b/crates/ui-egui/src/panels/dock.rs
@@ -3,7 +3,7 @@ use super::info::info_panel;
 use super::layers::{channels, layers};
 use super::navigator::navigator;
 use super::properties::{adjustments_grid, properties_body};
-use super::*;
+use super::{PhotocraftApp, Stroke, Tokens, icons, pos2};
 
 // ----------------------------------------------------------------------------- dock
 
diff --git a/crates/ui-egui/src/panels/history.rs b/crates/ui-egui/src/panels/history.rs
index 9f8d6033cb..939ef07e6b 100644
--- a/crates/ui-egui/src/panels/history.rs
+++ b/crates/ui-egui/src/panels/history.rs
@@ -1,5 +1,5 @@
 use super::layer_drag::dropped_on;
-use super::*;
+use super::{Align2, Color32, HistorySource, PhotocraftApp, Rect, Sense, Stroke, StrokeKind, Tokens, Tool, Value, empty, icons, json, pos2, vec2, widgets};
 
 pub(super) fn history(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
@@ -10,6 +10,7 @@ pub(super) fn history(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let entries = st.history.entries();
     let current = entries.len() - 1;
     let redo: Vec<String> = st.history.redo_labels().map(str::to_string).collect();
+    let non_linear = st.history.non_linear;
     let doc_id = st.doc.id;
     let source = photocraft_engine::history_source_cmds::source(st);
     let selected_snap = selected_snapshot(ui.ctx(), st);
@@ -45,8 +46,9 @@ pub(super) fn history(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         for (i, (e, is_redo)) in all.enumerate() {
             // The current state shows selected unless a snapshot is (Photoshop highlights one row).
             let selected = i == current && selected_snap.is_none();
-            // Past states can be dragged onto the trash; the oldest one can't be deleted.
-            let sense = if is_redo || i == 0 { Sense::click() } else { Sense::click_and_drag() };
+            // Past states can be dragged onto the trash; the oldest one can't be deleted. With
+            // Allow Non-Linear History a later (dimmed) state can be deleted too.
+            let sense = if (is_redo && !non_linear) || i == 0 { Sense::click() } else { Sense::click_and_drag() };
             let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 24.0), sense);
             resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, selected, &e));
             if resp.drag_started() {
@@ -105,15 +107,24 @@ pub(super) fn history(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     {
         let label = match drag {
             HistoryDrag::Snapshot(id) => app.session.active().and_then(|st| st.snapshots.iter().find(|s| s.id == id)).map(|s| s.name.clone()),
-            HistoryDrag::State(i) => entries.get(i).cloned(),
+            // Rows number the past states, then the later (dimmed) ones a non-linear drag can lift.
+            HistoryDrag::State(i) => entries.get(i).or_else(|| i.checked_sub(entries.len()).and_then(|j| redo.get(j))).cloned(),
         };
         crate::layer_transfer::ghost(&ctx, p, &label.unwrap_or_default());
     }
     let mut footer_cmd: Option<(&str, Value)> = None;
     let mut snapshot_dialog = false;
     if t.pro {
-        // With a snapshot selected the trash deletes it, as in Photoshop (#5324).
-        let can_delete = selected_snap.is_some() || app.session.is_enabled("history.deleteState");
+        // With a snapshot selected the trash deletes it, as in Photoshop (#5324). A click deletes
+        // the current state, never the oldest; a drop can delete a later (dimmed) one, which
+        // Allow Non-Linear History offers even while the oldest state is current.
+        let can_click = selected_snap.is_some() || app.session.active().is_some_and(|st| st.history.past_len() > 0);
+        let can_drop = match drag {
+            Some(HistoryDrag::Snapshot(_)) => true,
+            Some(HistoryDrag::State(_)) => app.session.is_enabled("history.deleteState"),
+            None => false,
+        };
+        let can_delete = can_click || can_drop;
         let can_new = app.session.is_enabled("history.newDocument");
         widgets::panel_footer(ui, |ui| {
             let trash = ui.add_enabled_ui(can_delete, |ui| icons::button(ui, "trash", 26.0, false, tl!("Delete current state"))).inner;
diff --git a/crates/ui-egui/src/panels/history_menu_ui.rs b/crates/ui-egui/src/panels/history_menu_ui.rs
index 6e3e197662..245fa986d8 100644
--- a/crates/ui-egui/src/panels/history_menu_ui.rs
+++ b/crates/ui-egui/src/panels/history_menu_ui.rs
@@ -19,8 +19,8 @@ pub const ITEMS: &[(&str, Option<&str>)] = &[
     ("Clear History", Some("history.clear")),
     ("New Document", Some("history.newDocument")),
     ("---", None),
-    // The History Options dialog is not built yet.
-    ("History Options…", None),
+    // Without params `history.options` opens the History Options dialog (#3535).
+    ("History Options…", Some("history.options")),
     ("---", None),
     ("Close", Some("window.panel.close")),
 ];
@@ -63,7 +63,9 @@ pub fn panel_menu(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let Some(cmd) = clicked else { return };
     ui.close();
     let (cmd, params) = resolve(cmd, snapshot);
-    if let Err(e) = app.run(cmd, params) {
+    // History Options… opens its dialog, as the menu bar's command does.
+    let result = crate::history_options_ui::menu(app, cmd, &params).unwrap_or_else(|| app.run(cmd, params));
+    if let Err(e) = result {
         app.ui.status = e;
         app.ui.status_error = true;
     }
@@ -109,7 +111,7 @@ mod tests {
         let mut h = harness(app());
         assert_eq!(states(&h), (4, 0));
         assert!(is_disabled(&h, "Step Forward") && !is_disabled(&h, "Step Backward"));
-        assert!(is_disabled(&h, "History Options…"), "not built yet: greyed");
+        assert!(!is_disabled(&h, "History Options…"));
         assert!(!is_disabled(&h, "New Snapshot…"));
         click(&mut h, "Step Backward");
         assert_eq!(states(&h), (3, 1));
@@ -126,6 +128,9 @@ mod tests {
         click(&mut h, "New Document");
         assert_eq!(h.state().session.documents().len(), 2);
         assert!(!h.state().ui.status_error);
+        click(&mut h, "History Options…");
+        assert_eq!(h.state().ui.dialogs.len(), 1, "History Options… opens its dialog");
+        assert!(!h.state().ui.status_error, "{}", h.state().ui.status);
     }
 
     #[test]
@@ -188,10 +193,12 @@ mod tests {
     }
 
     #[test]
-    fn without_a_document_only_close_is_enabled() {
+    fn without_a_document_only_close_and_history_options_are_enabled() {
         let h = harness(PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default()));
         for &(label, cmd) in ITEMS.iter().filter(|(l, _)| *l != "---") {
-            assert_eq!(is_disabled(&h, label), cmd != Some("window.panel.close"), "{label}");
+            // History Options are preferences, not part of a document.
+            let on = matches!(cmd, Some("window.panel.close" | "history.options"));
+            assert_eq!(is_disabled(&h, label), !on, "{label}");
         }
     }
 }
diff --git a/crates/ui-egui/src/panels/history_panel_select_tests.rs b/crates/ui-egui/src/panels/history_panel_select_tests.rs
index 85be286d6a..071e343d69 100644
--- a/crates/ui-egui/src/panels/history_panel_select_tests.rs
+++ b/crates/ui-egui/src/panels/history_panel_select_tests.rs
@@ -59,6 +59,44 @@ fn clicking_a_state_jumps_there_with_one_command() {
     assert_eq!(state(&h), (4, 0, rev + 2));
 }
 
+/// The ghost label that follows a History row being dragged to the trash (the text painted at
+/// the pointer, `layer_transfer::ghost`), if one is drawn.
+fn ghost_label(h: &Harness<'_, PhotocraftApp>, p: egui::Pos2) -> Option<String> {
+    let at = p + vec2(20.0, -6.0);
+    h.output().shapes.iter().find_map(|c| match &c.shape {
+        egui::Shape::Text(t) if (t.pos - at).length() < 1.0 => Some(t.galley.job.text.clone()),
+        _ => None,
+    })
+}
+
+/// Allow Non-Linear History lets a later (dimmed) state be dragged onto the trash: its row's
+/// label follows the pointer, as a past state's does.
+#[test]
+fn dragging_a_later_state_shows_its_label_at_the_pointer() {
+    let mut h = harness();
+    h.state_mut().run("history.options", json!({"allowNonLinearHistory": true})).unwrap();
+    h.state_mut().run("edit.undo", json!({})).unwrap();
+    h.run_steps(2);
+    // Rows: Open, New Layer, Fill, New Layer (current), the dimmed Fill.
+    for (label, row) in [("New Layer", 1), ("Fill", 1)] {
+        let from = h.get_all_by_label(label).nth(row).expect("the row").rect().center();
+        let to = from + vec2(-60.0, 40.0);
+        h.hover_at(from);
+        h.run_steps(1);
+        h.event(egui::Event::PointerButton { pos: from, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE });
+        h.run_steps(1);
+        for i in 1..=4 {
+            h.hover_at(from + (to - from) * (i as f32 / 4.0));
+            h.run_steps(1);
+        }
+        assert_eq!(ghost_label(&h, to).as_deref(), Some(label), "the dragged {label} row's label follows the pointer");
+        // Released off the trash: nothing is deleted.
+        h.event(egui::Event::PointerButton { pos: to, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE });
+        h.run_steps(2);
+    }
+    assert_eq!(h.state().session.active().unwrap().history.entries().len() + h.state().session.active().unwrap().history.redo_labels().count(), 5);
+}
+
 #[test]
 fn new_history_steps_scroll_the_current_state_into_view() {
     let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
diff --git a/crates/ui-egui/src/panels/info.rs b/crates/ui-egui/src/panels/info.rs
index 41a16d9f97..56a60e82d0 100644
--- a/crates/ui-egui/src/panels/info.rs
+++ b/crates/ui-egui/src/panels/info.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{PhotocraftApp, RichText, Tokens, Value, empty, json, theme, widgets};
 
 /// The active document's pixel under the pointer, if the pointer is over the image.
 pub(crate) fn hover_pixel(app: &PhotocraftApp) -> Option<(i32, i32)> {
diff --git a/crates/ui-egui/src/panels/layer_drag.rs b/crates/ui-egui/src/panels/layer_drag.rs
index fd9a5d9b47..f778ccec75 100644
--- a/crates/ui-egui/src/panels/layer_drag.rs
+++ b/crates/ui-egui/src/panels/layer_drag.rs
@@ -1,5 +1,5 @@
 use super::layers::footer_label;
-use super::*;
+use super::{Layer, LayerId, MaskKind, PhotocraftApp, Pos2, Rect, Sense, Stroke, StrokeKind, Tokens, Value, icons, json, pos2, vec2};
 
 /// Scroll the Layers panel while holding a layer drag over its top/bottom edge or past them.
 ///
diff --git a/crates/ui-egui/src/panels/layer_filter_ui/tests.rs b/crates/ui-egui/src/panels/layer_filter_ui/tests.rs
index aeeb63e7cc..89e1a6a0b9 100644
--- a/crates/ui-egui/src/panels/layer_filter_ui/tests.rs
+++ b/crates/ui-egui/src/panels/layer_filter_ui/tests.rs
@@ -17,7 +17,6 @@ fn session() -> photocraft_engine::Session {
     s.execute("file.new", json!({"width": 64, "height": 48})).unwrap();
     s.execute("layer.new.layer", json!({"name": "Paper"})).unwrap();
     s.execute("layer.groupLayers", json!({"name": "Sheets"})).unwrap();
-    s.execute("layer.setExpanded", json!({"all": true, "expanded": true})).unwrap();
     let paper = layer(&s.active().unwrap().doc, "Paper");
     s.execute("layer.select", json!({"layer": paper})).unwrap();
     let ink = s.execute("layer.new.layer", json!({"name": "Ink"})).unwrap()["layer"].as_u64().unwrap();
@@ -26,6 +25,8 @@ fn session() -> photocraft_engine::Session {
     s.execute("layer.select", json!({"layer": sheets})).unwrap();
     let text = s.execute("type.create", json!({"text": "ink notes", "x": 4, "y": 20, "size": 12})).unwrap()["layer"].as_u64().unwrap();
     s.execute("layer.setProps", json!({"layer": text, "name": "ink notes"})).unwrap();
+    // Opened last: an open active group would take the type layer inside it, as in Photoshop.
+    s.execute("layer.setExpanded", json!({"all": true, "expanded": true})).unwrap();
     s
 }
 
diff --git a/crates/ui-egui/src/panels/layer_menu_ui.rs b/crates/ui-egui/src/panels/layer_menu_ui.rs
index 7ad844027a..f274e28620 100644
--- a/crates/ui-egui/src/panels/layer_menu_ui.rs
+++ b/crates/ui-egui/src/panels/layer_menu_ui.rs
@@ -55,9 +55,9 @@ pub fn entries(l: &Layer, multi: bool, has_selection: bool) -> Vec<Entry> {
     v.push(None);
     v.push(Some((if multi { tl!("Duplicate Layers…") } else { tl!("Duplicate Layer…") }, "layer.duplicate")));
     v.push(Some((if multi { tl!("Delete Layers") } else { tl!("Delete Layer") }, "layer.delete")));
-    if !multi {
-        v.push(Some((tl!("Group from Layers…"), "layer.groupLayers")));
-    }
+    // Groups the clicked layer, or the whole selection when several layers are selected, after
+    // Photoshop's New Group dialog.
+    v.push(Some((tl!("Group from Layers…"), "layer.new.groupFromLayers")));
     v.push(None);
     v.push(Some((tl!("Quick Export As PNG"), "layer.quickExportAsPng")));
     v.push(Some((tl!("Export As…"), "layer.exportAs")));
diff --git a/crates/ui-egui/src/panels/layer_menu_ui/tests.rs b/crates/ui-egui/src/panels/layer_menu_ui/tests.rs
index f0b0b237e5..a7ab70a76e 100644
--- a/crates/ui-egui/src/panels/layer_menu_ui/tests.rs
+++ b/crates/ui-egui/src/panels/layer_menu_ui/tests.rs
@@ -360,6 +360,29 @@ fn rasterize_from_the_menu_converts_every_selected_layer() {
     assert_eq!(h.state().session.active().unwrap().selected_layers().len(), 2, "the selection survives");
 }
 
+/// Group from Layers is offered for a multi-layer selection too (it used to be dropped from
+/// the menu then). As in Photoshop it asks in the New Group from Layers dialog first; OK puts
+/// every selected layer in one new group, leaving the rest alone.
+#[test]
+fn group_from_layers_groups_every_selected_layer() {
+    use egui_kittest::kittest::Queryable;
+    use photocraft_doc::LayerId;
+    let (mut h, [text, shape, other]) = open_multi_selection_menu();
+    let at = h.get_by_label("Group from Layers…").rect().center();
+    click(&mut h, at, egui::PointerButton::Primary);
+    let dialog = h.state().ui.dialogs.last().map(|d| (d.id, d.fields.clone())).expect("the New Group dialog opened");
+    assert!(crate::new_group_ui::owns(&dialog.1));
+    assert_eq!(dialog.1["__command"], "layer.new.groupFromLayers");
+    crate::dialogs::confirm(h.state_mut(), dialog.0).unwrap();
+    h.run_steps(2);
+    let doc = &h.state().session.active().unwrap().doc;
+    let groups: Vec<_> = doc.walk().into_iter().map(|(_, _, l)| l).filter(|l| l.is_group()).collect();
+    assert_eq!(groups.len(), 1);
+    let children: Vec<LayerId> = groups[0].children().unwrap().iter().map(|l| l.id).collect();
+    assert_eq!(children, vec![LayerId(text), LayerId(shape)], "both selected layers, in order");
+    assert!(doc.layers.iter().any(|l| l.id == LayerId(other)), "an unselected layer stays at the top level");
+}
+
 /// Items with no single target are greyed for a multi-layer selection (they used to run on
 /// whichever layer happened to be active, not the one right-clicked); the ones that act on the
 /// whole selection, including adding a mask, stay available.
@@ -376,6 +399,7 @@ fn multi_selection_menu_greys_what_acts_on_one_layer() {
         "Add Layer Mask",
         "Duplicate Layers…",
         "Delete Layers",
+        "Group from Layers…",
         "Convert to Smart Object",
         "Rasterize Layers",
         "Link Layers",
@@ -407,6 +431,7 @@ fn single_layer_only_covers_the_per_layer_commands() {
         "layer.exportAs",
         "layer.duplicate",
         "layer.delete",
+        "layer.new.groupFromLayers",
         "layer.rasterize.layer",
         "layer.smartObjects.convertToSmartObject",
         "layer.createClippingMask",
diff --git a/crates/ui-egui/src/panels/layer_row.rs b/crates/ui-egui/src/panels/layer_row.rs
index 959ca07da8..6bc0ac85b2 100644
--- a/crates/ui-egui/src/panels/layer_row.rs
+++ b/crates/ui-egui/src/panels/layer_row.rs
@@ -1,6 +1,8 @@
 use super::layer_drag::{MaskDrag, fx_drop, layer_drag_and_drop, mask_drag_key, start_fx_drag, starts_mask_drag};
 use super::layers::simple_lock_toggle;
-use super::*;
+use super::{
+    Color32, CornerRadius, Layer, LayerContent, PhotocraftApp, Pos2, Rect, Sense, Stroke, StrokeKind, Tokens, Value, icons, json, pos2, theme, vec2, widgets,
+};
 
 /// How a Layers panel row is selected: in the (multi-)selection, the primary/active layer, and
 /// whether several layers are selected.
@@ -55,28 +57,51 @@ fn eye_sweep(ctx: &egui::Context, l: &Layer, row: Rect, eye: &egui::Response, ac
     let set =
         |visible: bool, key: u64| ("layer.setProps".to_string(), json!({"layer": l.id.0, "visible": visible, "coalesce": format!("layer-eye-sweep:{key}")}));
     if eye.drag_started() {
-        let sweep = EyeSweep { visible: !l.visible, key: ctx.cumulative_pass_nr(), swept: vec![l.id.0] };
-        actions.push(set(sweep.visible, sweep.key));
-        ctx.data_mut(|d| d.insert_temp(id, sweep));
+        start_eye_sweep(ctx, l, id, actions, &set);
+    } else {
+        continue_eye_sweep(ctx, l, row, id, actions, &set);
+    }
+}
+
+fn start_eye_sweep(ctx: &egui::Context, layer: &Layer, id: egui::Id, actions: &mut Vec<(String, Value)>, set: &impl Fn(bool, u64) -> (String, Value)) {
+    let sweep = EyeSweep { visible: !layer.visible, key: ctx.cumulative_pass_nr(), swept: vec![layer.id.0] };
+    actions.push(set(sweep.visible, sweep.key));
+    ctx.data_mut(|data| data.insert_temp(id, sweep));
+}
+
+fn continue_eye_sweep(
+    ctx: &egui::Context,
+    layer: &Layer,
+    row: Rect,
+    id: egui::Id,
+    actions: &mut Vec<(String, Value)>,
+    set: &impl Fn(bool, u64) -> (String, Value),
+) {
+    let Some(mut sweep) = ctx.data(|data| data.get_temp::<EyeSweep>(id)) else { return };
+    if !sweep_pointer_down(ctx) {
+        ctx.data_mut(|data| data.remove::<EyeSweep>(id));
         return;
     }
-    let Some(mut sweep) = ctx.data(|d| d.get_temp::<EyeSweep>(id)) else { return };
-    let (down, pos, delta) = ctx.input(|i| (i.pointer.primary_down(), i.pointer.interact_pos(), i.pointer.delta()));
-    if !down {
-        ctx.data_mut(|d| d.remove::<EyeSweep>(id));
+    let Some((y0, y1)) = swept_pointer_range(ctx) else { return };
+    if y1 < row.top() || y0 >= row.bottom() || sweep.swept.contains(&layer.id.0) {
         return;
     }
-    // Everything the pointer passed since the last frame, so a fast drag skips no row.
-    let Some(p) = pos else { return };
-    let (y0, y1) = ((p.y - delta.y).min(p.y), (p.y - delta.y).max(p.y));
-    if y1 < row.top() || y0 >= row.bottom() || sweep.swept.contains(&l.id.0) {
-        return;
-    }
-    if l.visible != sweep.visible {
+    if layer.visible != sweep.visible {
         actions.push(set(sweep.visible, sweep.key));
     }
-    sweep.swept.push(l.id.0);
-    ctx.data_mut(|d| d.insert_temp(id, sweep));
+    sweep.swept.push(layer.id.0);
+    ctx.data_mut(|data| data.insert_temp(id, sweep));
+}
+
+fn sweep_pointer_down(ctx: &egui::Context) -> bool {
+    ctx.input(|input| input.pointer.primary_down())
+}
+
+/// The pointer segment between frames catches rows even when a fast drag skips them visually.
+fn swept_pointer_range(ctx: &egui::Context) -> Option<(f32, f32)> {
+    let (position, delta) = ctx.input(|input| (input.pointer.interact_pos(), input.pointer.delta()));
+    let p = position?;
+    Some(((p.y - delta.y).min(p.y), (p.y - delta.y).max(p.y)))
 }
 
 /// Marker in the clipped row's existing 12-point slot, beside its thumbnail.
@@ -134,51 +159,9 @@ pub(super) fn layer_row(
     if resp.hovered() {
         app.hover_layer = Some(l.id);
     }
-    if t.pro {
-        if selected {
-            painter.rect_filled(rect, 0.0, t.row_selected);
-        } else if is_hovered {
-            painter.rect_filled(rect, 0.0, t.hover.gamma_multiply(0.5));
-            painter.rect_filled(rect, 0.0, t.accent.gamma_multiply(0.12));
-        }
-    } else if selected {
-        painter.rect_filled(rect, t.radius, t.hover);
-        painter.rect_stroke(rect, t.radius, Stroke::new(1.0, t.field_border), StrokeKind::Inside);
-    } else if is_hovered {
-        painter.rect_filled(rect, t.radius, t.hover.gamma_multiply(0.5));
-        painter.rect_filled(rect, t.radius, t.accent.gamma_multiply(0.12));
-    }
-    let eye_cell = Rect::from_min_max(rect.left_top(), pos2((rect.left() + 30.0).min(rect.right()), rect.bottom()));
-    if let Some((_, background)) = t.layer_label_colors(l.label) {
-        painter.rect_filled(eye_cell, 0.0, background);
-    }
-    if t.pro {
-        // Paint dividers over the label so the eye column stays distinct.
-        painter.line_segment([pos2(rect.left() + 30.0, rect.top()), pos2(rect.left() + 30.0, rect.bottom())], Stroke::new(1.0, t.separator));
-        painter.line_segment([rect.left_bottom(), rect.right_bottom()], Stroke::new(1.0, t.separator));
-    }
+    paint_row_background(&painter, &t, l, rect, selected, is_hovered);
     let mut x = rect.left() + 6.0;
-    // The whole eye column takes drags too (so a drag starting on it never reorders the row): dragging down
-    // the eyes gives every row swept over the visibility the first eye toggled to (#8467).
-    let eye_resp = ui.interact(eye_cell, ui.scope_id().with(("eye", l.id.0)), Sense::click_and_drag());
-    // A hidden layer's eye box is left empty (still clickable; the whole column takes the click, #8467).
-    if l.visible {
-        // Centre the drawing in the column while preserving the visibility hit area.
-        icons::paint(ui, eye_cell, "eye", 15.0, t.layer_label_icon(l.label));
-    }
-    eye_sweep(ctx, l, rect, &eye_resp, actions);
-    if eye_resp.clicked() {
-        // ⌥-click shows only this layer; ⌥-click it again to restore the others.
-        if ui.input(|i| i.modifiers.alt) {
-            actions.push(("layer.showOnly".into(), json!({"layer": l.id.0})));
-        } else {
-            actions.push(("layer.setProps".into(), json!({"layer": l.id.0, "visible": !l.visible})));
-        }
-    }
-    eye_resp.context_menu(|ui| {
-        crate::widgets::style_spectrum_popup_menu(ui);
-        crate::layer_menu_ui::color_choices(app, ui, l, row.multi && selected, actions);
-    });
+    let eye_resp = eye_column(app, ui, l, row, rect, actions);
     // Everything but the thumbnails, the indentation and the name, so a narrow panel squeezes
     // the indentation first, then the thumbnails (a layer with two masks has three).
     let others = 6.0
@@ -205,25 +188,8 @@ pub(super) fn layer_row(
     }
     // With thumbnails disabled the labels and disclosure controls remain interactive.
     let masks = if ts > 0.0 { crate::mask_thumbs_ui::paint(app, ctx, ui, &painter, doc, l, &mut x, rect.center().y, ts, actions) } else { Default::default() };
-    let mask_rect = masks.thumb(crate::mask_thumbs_ui::MaskKind::Pixel);
-    let vector_rect = masks.thumb(crate::mask_thumbs_ui::MaskKind::Vector);
-    // Photoshop frames the targeted thumbnail (pixels, mask or vector mask) of the active layer
-    // with corner brackets.
-    if row.primary && ts > 0.0 {
-        let target = if app.ui.filter_mask_target == Some(l.id.0) && app.filter_mask_targeted() {
-            // The Smart Filters row's filter mask thumbnail carries the brackets.
-            None
-        } else if app.ui.vector_mask_target && vector_rect.is_some() {
-            vector_rect
-        } else if app.ui.mask_target {
-            mask_rect.or(Some(thumb))
-        } else {
-            Some(thumb)
-        };
-        if let Some(r) = target {
-            crate::mask_thumbs_ui::paint_brackets(&painter, r, t.text);
-        }
-    }
+    let rc = RowCtx { l, doc, row, rect, ts, thumb, resp: &resp, masks: &masks };
+    paint_target_brackets(app, &painter, &t, &rc);
     // Right-hand indicators first; the name gets what is left and ends in "…" (#144).
     let fx_open = app.session.active().is_none_or(|d| !d.fx_collapsed.contains(&l.id));
     let (name_right, indicators, fx_toggled) = crate::layer_row_ui::indicators(ui, &painter, rect, x, l, fx_open, actions);
@@ -241,26 +207,7 @@ pub(super) fn layer_row(
     {
         actions.push(simple_lock_toggle(doc.is_background(l.id), l, &json!({"layer": l.id.0})));
     }
-    let name_color = if l.visible { t.text } else { t.text_faint };
-    let font = if selected && !t.pro { theme::medium(13.0) } else { egui::FontId::proportional(if t.pro { 12.0 } else { 13.0 }) };
-    // Photoshop before 2026 set the Background layer's name in italics; 2026 sets it upright.
-    let italic = !t.pro && doc.is_background(l.id);
-    // Photoshop rows show only the name; the kind sub-label is a Studio-theme addition.
-    let is_pixel = t.pro || ts == 0.0 || matches!(l.content, LayerContent::Raster(_));
-    let name_rect = crate::layer_row_ui::truncated(&painter, &l.name, font, name_color, italic, name_right - x).map(|galley| {
-        let text_pos = pos2(x, rect.center().y - galley.size().y / 2.0 - if is_pixel { 0.0 } else { 7.0 });
-        let r = Rect::from_min_size(text_pos, galley.size());
-        painter.galley(text_pos, galley, name_color);
-        r
-    });
-    if !is_pixel {
-        let sub = match &l.content {
-            LayerContent::Adjustment(a) => tl!(a.label()).to_string(),
-            LayerContent::Group(g) => crate::i18n::trn(crate::i18n::current(), g.children.len() as u64, "Group · {n} layer", "Group · {n} layers"),
-            other => tl!(other.kind_name()).to_string(),
-        };
-        crate::layer_row_ui::label(&painter, x, rect.center().y + 8.0, name_right, &sub, egui::FontId::proportional(11.0), t.text_faint);
-    }
+    let name_rect = paint_row_name(&painter, &t, &rc, x, name_right);
     crate::layer_row_ui::record(
         ctx,
         crate::layer_row_ui::RowRects { layer: l.id.0, row: rect, thumbnail: (ts > 0.0).then_some(thumb), name: name_rect, indicators },
@@ -296,43 +243,7 @@ pub(super) fn layer_row(
     } else if let Some(cmd) = mask_toggle {
         actions.push(cmd);
     } else if resp.clicked() && !eye_resp.clicked() && !toggled && !fx_toggled && !masks.clicked {
-        let m = ui.input(|i| i.modifiers);
-        let pos = resp.interact_pointer_pos();
-        let on_thumb = ts > 0.0 && pos.is_some_and(|p| thumb.expand(2.0).contains(p));
-        // ⌘-click on the Background thumbnail stands in for the plain click (there is no
-        // transparency to load): it selects the Background alone, not toggled into the set.
-        let mode = if m.command && on_thumb && doc.is_background(l.id) { "replace" } else { select_mode(m) };
-        actions.push(("layer.select".into(), json!({"layer": l.id.0, "mode": mode})));
-        crate::smart_ui::deselect(ctx, doc.id);
-        // A thumbnail explicitly selects content or a mask. Selecting an adjustment/fill row
-        // defaults to its mask, but clicking its content thumbnail must leave the mask target.
-        let on_mask = mask_rect.zip(pos).is_some_and(|(r, p)| r.expand(2.0).contains(p));
-        let on_vector = pos.and_then(|p| masks.hit(p)) == Some(crate::mask_thumbs_ui::MaskKind::Vector);
-        // Clicking the layer thumbnail leaves mask view (#196).
-        let viewing = app.session.active().and_then(photocraft_engine::mask_view_cmds::current).filter(|v| v.layer == l.id);
-        if let Some(v) = viewing.filter(|_| on_thumb) {
-            let mask = if v.filter { "filter" } else { "layer" };
-            actions.push((photocraft_engine::mask_view_cmds::ID.into(), json!({"layer": l.id.0, "mode": "off", "mask": mask})));
-        }
-        let content_less = matches!(l.content, LayerContent::Adjustment(_) | LayerContent::Fill(_));
-        if on_vector {
-            // The vector mask thumbnail targets the vector mask: the path tools edit it and the
-            // Paths panel selects the layer's path.
-            app.ui.selected_path = Some("layer".into());
-            actions.push(("ui.vectorMaskTarget".into(), json!(true)));
-        } else if on_mask || (content_less && l.mask.is_some() && !on_thumb) {
-            if on_mask {
-                // The mask thumbnail also switches Properties to the mask (#3369).
-                app.ui.properties_layer = None;
-            }
-            actions.push(("ui.maskTarget".into(), json!(true)));
-        } else if on_thumb || !row.primary {
-            actions.push(("ui.maskTarget".into(), json!(false)));
-        }
-        // ⌥-click the layer thumbnail: fit the layer on screen, as Photoshop does.
-        if on_thumb && m.alt && !m.shift && !m.command {
-            actions.push(("view.fitLayersOnScreen".into(), Value::Null));
-        }
+        select_row_on_click(app, ui, &rc, actions);
     }
     // Double-click: the name renames in place (over the row's full height, not just the glyphs:
     // #651); the Background, which can't be renamed while it's locked, becomes a normal layer; an
@@ -340,6 +251,184 @@ pub(super) fn layer_row(
     // #2812) and a Smart Object thumbnail its contents, and a type thumbnail edits its text;
     // anywhere else on the row opens Layer Style (#350, #537).
     // The first click already made this the active layer.
+    handle_row_double_click(app, ui.ctx(), &rc, name_rect, actions);
+    let edit_rect = Rect::from_min_max(pos2(x - 3.0, rect.center().y - 11.0), pos2(name_right.max(x + 40.0), rect.center().y + 11.0));
+    if let Some(done) = crate::layer_row_ui::rename_field(ui, l.id.0, edit_rect) {
+        actions.push(done);
+    }
+    row_context_menu(app, ui, &rc, &eye_resp, actions);
+    rect
+}
+
+/// What the row helpers share once the row's thumbnails are laid out.
+struct RowCtx<'a> {
+    l: &'a Layer,
+    doc: &'a photocraft_doc::Document,
+    row: RowSel,
+    rect: Rect,
+    ts: f32,
+    thumb: Rect,
+    resp: &'a egui::Response,
+    masks: &'a crate::mask_thumbs_ui::MaskRects,
+}
+
+fn eye_cell(rect: Rect) -> Rect {
+    Rect::from_min_max(rect.left_top(), pos2((rect.left() + 30.0).min(rect.right()), rect.bottom()))
+}
+
+/// The row's fill (selection / hover), the label colour behind the eye column and the pro dividers.
+fn paint_row_background(painter: &egui::Painter, t: &Tokens, l: &Layer, rect: Rect, selected: bool, is_hovered: bool) {
+    if t.pro {
+        if selected {
+            painter.rect_filled(rect, 0.0, t.row_selected);
+        } else if is_hovered {
+            painter.rect_filled(rect, 0.0, t.hover.gamma_multiply(0.5));
+            painter.rect_filled(rect, 0.0, t.accent.gamma_multiply(0.12));
+        }
+    } else if selected {
+        painter.rect_filled(rect, t.radius, t.hover);
+        painter.rect_stroke(rect, t.radius, Stroke::new(1.0, t.field_border), StrokeKind::Inside);
+    } else if is_hovered {
+        painter.rect_filled(rect, t.radius, t.hover.gamma_multiply(0.5));
+        painter.rect_filled(rect, t.radius, t.accent.gamma_multiply(0.12));
+    }
+    let eye_cell = eye_cell(rect);
+    if let Some((_, background)) = t.layer_label_colors(l.label) {
+        painter.rect_filled(eye_cell, 0.0, background);
+    }
+    if t.pro {
+        // Paint dividers over the label so the eye column stays distinct.
+        painter.line_segment([pos2(rect.left() + 30.0, rect.top()), pos2(rect.left() + 30.0, rect.bottom())], Stroke::new(1.0, t.separator));
+        painter.line_segment([rect.left_bottom(), rect.right_bottom()], Stroke::new(1.0, t.separator));
+    }
+}
+
+/// The eye column: visibility toggle (⌥ shows only this layer), sweep-drag and its colour menu.
+fn eye_column(app: &mut PhotocraftApp, ui: &mut egui::Ui, l: &Layer, row: RowSel, rect: Rect, actions: &mut Vec<(String, Value)>) -> egui::Response {
+    let ctx = &ui.ctx().clone();
+    let t = Tokens::get(ctx);
+    let selected = row.selected;
+    let eye_cell = eye_cell(rect);
+    // The whole eye column takes drags too (so a drag starting on it never reorders the row): dragging down
+    // the eyes gives every row swept over the visibility the first eye toggled to (#8467).
+    let eye_resp = ui.interact(eye_cell, ui.scope_id().with(("eye", l.id.0)), Sense::click_and_drag());
+    // A hidden layer's eye box is left empty (still clickable; the whole column takes the click, #8467).
+    if l.visible {
+        // Centre the drawing in the column while preserving the visibility hit area.
+        icons::paint(ui, eye_cell, "eye", 15.0, t.layer_label_icon(l.label));
+    }
+    eye_sweep(ctx, l, rect, &eye_resp, actions);
+    if eye_resp.clicked() {
+        // ⌥-click shows only this layer; ⌥-click it again to restore the others.
+        if ui.input(|i| i.modifiers.alt) {
+            actions.push(("layer.showOnly".into(), json!({"layer": l.id.0})));
+        } else {
+            actions.push(("layer.setProps".into(), json!({"layer": l.id.0, "visible": !l.visible})));
+        }
+    }
+    eye_resp.context_menu(|ui| {
+        crate::widgets::style_spectrum_popup_menu(ui);
+        crate::layer_menu_ui::color_choices(app, ui, l, row.multi && selected, actions);
+    });
+    eye_resp
+}
+
+fn paint_target_brackets(app: &PhotocraftApp, painter: &egui::Painter, t: &Tokens, rc: &RowCtx<'_>) {
+    let (l, thumb) = (rc.l, rc.thumb);
+    let mask_rect = rc.masks.thumb(crate::mask_thumbs_ui::MaskKind::Pixel);
+    let vector_rect = rc.masks.thumb(crate::mask_thumbs_ui::MaskKind::Vector);
+    // Photoshop frames the targeted thumbnail (pixels, mask or vector mask) of the active layer
+    // with corner brackets.
+    if rc.row.primary && rc.ts > 0.0 {
+        let target = if app.ui.filter_mask_target == Some(l.id.0) && app.filter_mask_targeted() {
+            // The Smart Filters row's filter mask thumbnail carries the brackets.
+            None
+        } else if app.ui.vector_mask_target && vector_rect.is_some() {
+            vector_rect
+        } else if app.ui.mask_target {
+            mask_rect.or(Some(thumb))
+        } else {
+            Some(thumb)
+        };
+        if let Some(r) = target {
+            crate::mask_thumbs_ui::paint_brackets(painter, r, t.text);
+        }
+    }
+}
+
+/// The layer name (and the kind sub-label of non-pixel rows); returns the name's rect.
+fn paint_row_name(painter: &egui::Painter, t: &Tokens, rc: &RowCtx<'_>, x: f32, name_right: f32) -> Option<Rect> {
+    let (l, doc, rect, ts, selected) = (rc.l, rc.doc, rc.rect, rc.ts, rc.row.selected);
+    let name_color = if l.visible { t.text } else { t.text_faint };
+    let font = if selected && !t.pro { theme::medium(13.0) } else { egui::FontId::proportional(if t.pro { 12.0 } else { 13.0 }) };
+    // Photoshop before 2026 set the Background layer's name in italics; 2026 sets it upright.
+    let italic = !t.pro && doc.is_background(l.id);
+    // Photoshop rows show only the name; the kind sub-label is a Studio-theme addition.
+    let is_pixel = t.pro || ts == 0.0 || matches!(l.content, LayerContent::Raster(_));
+    let name_rect = crate::layer_row_ui::truncated(painter, &l.name, font, name_color, italic, name_right - x).map(|galley| {
+        let text_pos = pos2(x, rect.center().y - galley.size().y / 2.0 - if is_pixel { 0.0 } else { 7.0 });
+        let r = Rect::from_min_size(text_pos, galley.size());
+        painter.galley(text_pos, galley, name_color);
+        r
+    });
+    if !is_pixel {
+        let sub = match &l.content {
+            LayerContent::Adjustment(a) => tl!(a.label()).to_string(),
+            LayerContent::Group(g) => crate::i18n::trn(crate::i18n::current(), g.children.len() as u64, "Group · {n} layer", "Group · {n} layers"),
+            other => tl!(other.kind_name()).to_string(),
+        };
+        crate::layer_row_ui::label(painter, x, rect.center().y + 8.0, name_right, &sub, egui::FontId::proportional(11.0), t.text_faint);
+    }
+    name_rect
+}
+
+/// A plain click on the row: select the layer and retarget pixels / mask / vector mask.
+fn select_row_on_click(app: &mut PhotocraftApp, ui: &egui::Ui, rc: &RowCtx<'_>, actions: &mut Vec<(String, Value)>) {
+    let (l, doc, resp, masks, row, ts, thumb) = (rc.l, rc.doc, rc.resp, rc.masks, rc.row, rc.ts, rc.thumb);
+    let ctx = ui.ctx();
+    let mask_rect = masks.thumb(crate::mask_thumbs_ui::MaskKind::Pixel);
+    let m = ui.input(|i| i.modifiers);
+    let pos = resp.interact_pointer_pos();
+    let on_thumb = ts > 0.0 && pos.is_some_and(|p| thumb.expand(2.0).contains(p));
+    // ⌘-click on the Background thumbnail stands in for the plain click (there is no
+    // transparency to load): it selects the Background alone, not toggled into the set.
+    let mode = if m.command && on_thumb && doc.is_background(l.id) { "replace" } else { select_mode(m) };
+    actions.push(("layer.select".into(), json!({"layer": l.id.0, "mode": mode})));
+    crate::smart_ui::deselect(ctx, doc.id);
+    // A thumbnail explicitly selects content or a mask. Selecting an adjustment/fill row
+    // defaults to its mask, but clicking its content thumbnail must leave the mask target.
+    let on_mask = mask_rect.zip(pos).is_some_and(|(r, p)| r.expand(2.0).contains(p));
+    let on_vector = pos.and_then(|p| masks.hit(p)) == Some(crate::mask_thumbs_ui::MaskKind::Vector);
+    // Clicking the layer thumbnail leaves mask view (#196).
+    let viewing = app.session.active().and_then(photocraft_engine::mask_view_cmds::current).filter(|v| v.layer == l.id);
+    if let Some(v) = viewing.filter(|_| on_thumb) {
+        let mask = if v.filter { "filter" } else { "layer" };
+        actions.push((photocraft_engine::mask_view_cmds::ID.into(), json!({"layer": l.id.0, "mode": "off", "mask": mask})));
+    }
+    let content_less = matches!(l.content, LayerContent::Adjustment(_) | LayerContent::Fill(_));
+    if on_vector {
+        // The vector mask thumbnail targets the vector mask: the path tools edit it and the
+        // Paths panel selects the layer's path.
+        app.ui.selected_path = Some("layer".into());
+        actions.push(("ui.vectorMaskTarget".into(), json!(true)));
+    } else if on_mask || (content_less && l.mask.is_some() && !on_thumb) {
+        if on_mask {
+            // The mask thumbnail also switches Properties to the mask (#3369).
+            app.ui.properties_layer = None;
+        }
+        actions.push(("ui.maskTarget".into(), json!(true)));
+    } else if on_thumb || !row.primary {
+        actions.push(("ui.maskTarget".into(), json!(false)));
+    }
+    // ⌥-click the layer thumbnail: fit the layer on screen, as Photoshop does.
+    if on_thumb && m.alt && !m.shift && !m.command {
+        actions.push(("view.fitLayersOnScreen".into(), Value::Null));
+    }
+}
+
+/// Double-click: rename, un-background, open the thumbnail's settings or the row's Layer Style.
+fn handle_row_double_click(app: &mut PhotocraftApp, ctx: &egui::Context, rc: &RowCtx<'_>, name_rect: Option<Rect>, actions: &mut Vec<(String, Value)>) {
+    let (l, doc, resp, masks, ts, thumb, rect) = (rc.l, rc.doc, rc.resp, rc.masks, rc.ts, rc.thumb, rc.rect);
     if resp.double_clicked() {
         let pos = resp.interact_pointer_pos();
         let on = |r: Rect| pos.is_some_and(|p| r.expand(2.0).contains(p));
@@ -375,10 +464,12 @@ pub(super) fn layer_row(
             }
         }
     }
-    let edit_rect = Rect::from_min_max(pos2(x - 3.0, rect.center().y - 11.0), pos2(name_right.max(x + 40.0), rect.center().y + 11.0));
-    if let Some(done) = crate::layer_row_ui::rename_field(ui, l.id.0, edit_rect) {
-        actions.push(done);
-    }
+}
+
+/// The visibility icon has its own color menu, and the layer-mask thumbnail its mask menu (#4575).
+fn row_context_menu(app: &mut PhotocraftApp, ui: &mut egui::Ui, rc: &RowCtx<'_>, eye_resp: &egui::Response, actions: &mut Vec<(String, Value)>) {
+    let (l, resp, masks, row) = (rc.l, rc.resp, rc.masks, rc.row);
+    let (ctx, selected) = (&ui.ctx().clone(), row.selected);
     // The visibility icon has its own color menu, and the layer-mask thumbnail its mask menu
     // (#4575); elsewhere use the full layer menu.
     let on_mask_id = ui.scope_id().with(("mask-menu", l.id.0));
@@ -402,7 +493,6 @@ pub(super) fn layer_row(
             }
         });
     }
-    rect
 }
 
 /// Screen rect and UVs for a layer thumbnail: the document-shaped part of the square cell and of
diff --git a/crates/ui-egui/src/panels/layer_row_ui.rs b/crates/ui-egui/src/panels/layer_row_ui.rs
index 0aa8341c4f..7e89c50519 100644
--- a/crates/ui-egui/src/panels/layer_row_ui.rs
+++ b/crates/ui-egui/src/panels/layer_row_ui.rs
@@ -265,9 +265,16 @@ pub fn panel_menu(app: &mut crate::PhotocraftApp, ui: &mut egui::Ui) {
         app.ui.layers_panel_dialog = Some(LayersPanelDialog::NewLayer(String::new()));
         ui.close();
     }
-    if ui.add_enabled(has_doc, egui::Button::new(tl!("New Group…"))).clicked() {
-        app.ui.layers_panel_dialog = Some(LayersPanelDialog::NewGroup(String::new()));
-        ui.close();
+    // New Group… and New Group from Layers… open the New Group dialog, like their Layer › New twins.
+    for (label, id) in [(tl!("New Group…"), crate::new_group_ui::NEW_GROUP), (tl!("New Group from Layers…"), crate::new_group_ui::FROM_LAYERS)] {
+        if ui.add_enabled(crate::menus::is_enabled(app, id), egui::Button::new(label)).clicked() {
+            let ctx = ui.ctx().clone();
+            if let Err(e) = crate::menus::invoke(app, &ctx, id, json!({})) {
+                app.ui.status = e;
+                app.ui.status_error = true;
+            }
+            ui.close();
+        }
     }
     ui.separator();
     run_menu_command(app, ui, tl!("Flatten Image"), "layer.flattenImage");
diff --git a/crates/ui-egui/src/panels/layer_row_ui/tests.rs b/crates/ui-egui/src/panels/layer_row_ui/tests.rs
index 70496fb0dd..d1a3dec1e0 100644
--- a/crates/ui-egui/src/panels/layer_row_ui/tests.rs
+++ b/crates/ui-egui/src/panels/layer_row_ui/tests.rs
@@ -116,9 +116,10 @@ fn a_groups_layers_indent_past_the_group() {
     s.execute("file.new", json!({"width": 64, "height": 48})).unwrap();
     let child = s.execute("layer.new.layer", json!({"name": "Child"})).unwrap()["layer"].as_u64().unwrap();
     let group = s.execute("layer.groupLayers", json!({"name": "Group"})).unwrap()["layer"].as_u64().unwrap();
+    // Top goes above the closed group (an open one would take it inside, as in Photoshop).
+    let top = s.execute("layer.new.layer", json!({"name": "Top"})).unwrap()["layer"].as_u64().unwrap();
     // Group Layers creates the group collapsed; open it so the panel lists its layers.
     s.execute("layer.setExpanded", json!({"layer": group, "expanded": true})).unwrap();
-    let top = s.execute("layer.new.layer", json!({"name": "Top"})).unwrap()["layer"].as_u64().unwrap();
     let h = harness(s, 1.0, "promedium", 290.0);
     let rows = recorded(&h.ctx);
     let left = |id: u64| rows.iter().find(|r| r.layer == id).and_then(|r| r.name).map(|n| n.left()).unwrap_or_else(|| panic!("layer {id} drawn"));
@@ -249,6 +250,24 @@ fn collapse_all_groups_from_the_panel_menu_and_it_is_saved() {
     }
 }
 
+/// Photoshop's panel menu has New Group… and New Group from Layers… just above Collapse All
+/// Groups; both open the New Group dialog.
+#[test]
+fn new_group_items_in_the_panel_menu_open_the_dialog() {
+    for (label, command) in [("New Group…", "layer.new.group"), ("New Group from Layers…", "layer.new.groupFromLayers")] {
+        let mut h = harness(busy(), 1.0, "promedium", 290.0);
+        let group = crate::panel_docking::probe::group_rect(h.state(), &h.ctx, "layers").expect("layers group");
+        let menu = h.query_all_by_label("Panel menu").map(|n| n.rect()).find(|r| group.contains(r.center())).expect("Layers panel menu");
+        click(&mut h, menu.center());
+        let item = h.get_by_label(label).rect();
+        assert!(item.top() < h.get_by_label("Collapse All Groups").rect().top(), "{label} comes before Collapse All Groups");
+        click(&mut h, item.center());
+        let fields = h.state().ui.dialogs.last().map(|d| d.fields.clone()).expect("the New Group dialog opened");
+        assert!(crate::new_group_ui::owns(&fields));
+        assert_eq!(fields["__command"], command);
+    }
+}
+
 /// Dragging down the eye column hides (or shows) every layer swept over, in one history step, and
 /// never reorders the layers, even when one pointer move jumps several rows; a hidden layer's eye
 /// box is empty and a click shows it again.
diff --git a/crates/ui-egui/src/panels/layer_tree_ui/tests.rs b/crates/ui-egui/src/panels/layer_tree_ui/tests.rs
index 0b3d4c2724..dfc1f44fb0 100644
--- a/crates/ui-egui/src/panels/layer_tree_ui/tests.rs
+++ b/crates/ui-egui/src/panels/layer_tree_ui/tests.rs
@@ -17,7 +17,7 @@ fn layered() -> photocraft_engine::Session {
     let inner = s.execute("layer.groupLayers", json!({"name": "inner"})).unwrap()["layer"].as_u64().unwrap();
     let outer = s.execute("layer.groupLayers", json!({"layer": inner, "name": "outer"})).unwrap()["layer"].as_u64().unwrap();
     s.execute("layer.select", json!({"layer": inner})).unwrap();
-    // `layer.new.layer` lands above the active layer, inside `outer`.
+    // `layer.new.layer` lands above the active (closed) group `inner`, inside `outer`.
     s.execute("layer.new.layer", json!({"name": "in-outer"})).unwrap();
     s.execute("layer.select", json!({"layer": outer})).unwrap();
     s.execute("layer.new.layer", json!({"name": "top"})).unwrap();
diff --git a/crates/ui-egui/src/panels/layers.rs b/crates/ui-egui/src/panels/layers.rs
index 11251902e8..fe0f8c9577 100644
--- a/crates/ui-egui/src/panels/layers.rs
+++ b/crates/ui-egui/src/panels/layers.rs
@@ -4,7 +4,7 @@ use super::layer_drag::{
 };
 use super::layer_row::{RowSel, layer_row};
 use super::options_bar::{LAYER_PCT_W, body_text_width, pct_action, scrub_pct_label};
-use super::*;
+use super::{BlendMode, Layer, LayerId, MaskKind, PhotocraftApp, Rect, Sense, Tokens, Value, empty, icons, json, label, pos2, theme, vec2, widgets};
 
 // ----------------------------------------------------------------------------- layers
 
@@ -28,7 +28,7 @@ pub(super) fn simple_lock_toggle(background: bool, l: &Layer, targets: &Value) -
 
 /// The Layers panel's blend modes: Photoshop's, plus the layer's own Paint.NET mode when it has one
 /// (an imported `.pdn`), so the menu matches Photoshop's for every other layer.
-fn blend_options(groups: bool, current: BlendMode) -> Vec<(BlendMode, &'static str)> {
+pub(crate) fn blend_options(groups: bool, current: BlendMode) -> Vec<(BlendMode, &'static str)> {
     let own = Some(current).filter(|m| !m.has_psd_equivalent());
     std::iter::once(BlendMode::PassThrough).filter(|_| groups).chain(BlendMode::LAYER_MODES).chain(own).map(|m| (m, m.label())).collect()
 }
@@ -425,10 +425,23 @@ pub(super) fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         actions.extend(footer_drop(ui, &new_layer, footer_drag, "layer.duplicate"));
         let group = icons::button(ui, "folder", 26.0, false, tl!("Create a new group"));
         if group.clicked() {
-            // Multiple selected layers share one group. Shift also groups a single selection.
-            let shift = ui.input(|i| i.modifiers.shift);
-            let cmd = if (shift || selection.len() > 1) && active_layer.is_some() { "layer.groupLayers" } else { "layer.new.group" };
-            actions.push((cmd.into(), json!({})));
+            // Like Photoshop CC 2014 and later, a click with two or more layers selected puts them
+            // in the new group (Layer › Group Layers); with one layer or none it adds an empty
+            // group above the active layer. Shift-click, the older way, groups the selection too
+            // (#2561). ⌥-click asks first in the New Group dialog, ⌘-click adds an empty group
+            // below the active layer.
+            let m = ui.input(|i| i.modifiers);
+            let groups = (m.shift || selection.len() > 1) && active_layer.is_some();
+            if m.alt {
+                // Null params go through the menu path, which opens the dialog.
+                let cmd = if groups { crate::new_group_ui::FROM_LAYERS } else { crate::new_group_ui::NEW_GROUP };
+                actions.push((cmd.into(), Value::Null));
+            } else if m.command {
+                actions.push(("layer.new.group".into(), json!({"position": "below"})));
+            } else {
+                let cmd = if groups { "layer.groupLayers" } else { "layer.new.group" };
+                actions.push((cmd.into(), json!({})));
+            }
         }
         actions.extend(footer_drop(ui, &group, footer_drag, "layer.groupLayers"));
         let adj = footer_menu_button(ui, "adjustment-layer", 26.0, tl!("Create new fill or adjustment layer"));
diff --git a/crates/ui-egui/src/panels/navigator.rs b/crates/ui-egui/src/panels/navigator.rs
index a6bfbf00c8..b588288c47 100644
--- a/crates/ui-egui/src/panels/navigator.rs
+++ b/crates/ui-egui/src/panels/navigator.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Color32, PhotocraftApp, Pos2, Rect, Sense, Stroke, StrokeKind, Tokens, empty, icons, pos2, vec2, widgets};
 
 pub(super) fn navigator(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
diff --git a/crates/ui-egui/src/panels/options_bar.rs b/crates/ui-egui/src/panels/options_bar.rs
index e24c3b4e6b..e03fa24e7a 100644
--- a/crates/ui-egui/src/panels/options_bar.rs
+++ b/crates/ui-egui/src/panels/options_bar.rs
@@ -1,6 +1,7 @@
 use super::brush_controls::{brush_preset_chip, mixer_load_swatch, paint_mode_dropdown, smoothing_field, smoothing_options, tool_mode_dropdown};
 use super::properties::{select_and_mask_button, selection_mode_buttons};
-use super::*;
+use super::{BlendMode, Color32, PhotocraftApp, RichText, Sense, Tokens, Tool, Value, icons, json, vec2, widgets};
+use photocraft_paint::BrushSettings;
 
 // Custom controls also need to bring keyboard focus into a scroll viewport.
 pub(super) fn reveal_focused_control(ui: &egui::Ui) {
@@ -130,511 +131,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                         let brush_before = app.session.tools.brush.clone();
                         let mut brush = brush_before.clone();
                         let b = &mut brush;
-                        match app.ui.tool {
-                            Tool::Brush | Tool::Eraser if t.pro => {
-                                // A Block-mode Eraser has a fixed size, opacity and flow (Photoshop, #2770).
-                                let block = crate::eraser_ui::block_mode(app, app.ui.tool);
-                                ui.add_enabled_ui(!block, |ui| {
-                                    brush_preset_chip(ui, b, &mut app.ui);
-                                    crate::brush_picker::settings_toggle(app, ui);
-                                });
-                                widgets::vline(ui, 22.0);
-                                // The Eraser has no blend mode: its Mode is Brush, Pencil or Block (#2662).
-                                if app.ui.tool == Tool::Eraser {
-                                    crate::eraser_ui::mode_dropdown(ui, &mut app.ui.tool_options.eraser_mode);
-                                } else {
-                                    opt_label(ui, tl!("Mode"));
-                                    let held = app.held_erase;
-                                    paint_mode_dropdown(ui, "brush-mode", b, &mut app.ui.tool_options.brush_clear, held);
-                                }
-                                ui.add_enabled_ui(!block, |ui| {
-                                    percent_field(ui, tl!("Opacity"), &mut b.opacity, 0.0..=100.0, 62.0);
-                                    if icons::button(ui, "circle-dot", 24.0, b.pressure_opacity, tl!("Always use pressure for opacity")).clicked() {
-                                        b.pressure_opacity = !b.pressure_opacity;
-                                    }
-                                });
-                                // A Pencil- or Block-mode Eraser is always full flow, without build-up (Photoshop).
-                                ui.add_enabled_ui(!block && !crate::eraser_ui::pencil_mode(app, app.ui.tool), |ui| {
-                                    percent_field(ui, tl!("Flow"), &mut b.flow, 1.0..=100.0, 62.0);
-                                    let airbrush = icons::button(ui, "sparkles", 24.0, b.build_up, tl!("Enable airbrush-style build-up effects"));
-                                    if crate::brush_picker::named(airbrush, "Enable airbrush-style build-up effects").clicked() {
-                                        b.build_up = !b.build_up;
-                                    }
-                                });
-                                opt_label(ui, tl!("Smoothing"));
-                                smoothing_field(ui, b, 58.0);
-                                smoothing_options(ui, b);
-                                widgets::vline(ui, 22.0);
-                                if icons::button(ui, "circle-dot", 24.0, b.pressure_size, tl!("Always use pressure for size")).clicked() {
-                                    b.pressure_size = !b.pressure_size;
-                                }
-                            }
-                            // Pencil: Photoshop's options (no hardness or flow: the pencil is always hard).
-                            Tool::Pencil => {
-                                brush_preset_chip(ui, b, &mut app.ui);
-                                crate::brush_picker::settings_toggle(app, ui);
-                                widgets::vline(ui, 22.0);
-                                if !t.pro {
-                                    opt_label(ui, tl!("Size"));
-                                    widgets::value_field(ui, &mut b.size, 1.0..=photocraft_engine::paint::MAX_BRUSH_SIZE, "px", 76.0);
-                                    widgets::vline(ui, 22.0);
-                                }
-                                opt_label(ui, tl!("Mode"));
-                                let held = app.held_erase;
-                                paint_mode_dropdown(ui, "pencil-mode", b, &mut app.ui.tool_options.pencil_clear, held);
-                                percent_field(ui, tl!("Opacity"), &mut b.opacity, 0.0..=100.0, if t.pro { 62.0 } else { 66.0 });
-                                opt_label(ui, tl!("Smoothing"));
-                                smoothing_field(ui, b, if t.pro { 58.0 } else { 66.0 });
-                                widgets::vline(ui, 22.0);
-                                widgets::checkbox(ui, &mut app.ui.tool_options.pencil_auto_erase, tl!("Auto Erase"));
-                            }
-                            Tool::Brush | Tool::Eraser => {
-                                brush_preset_chip(ui, b, &mut app.ui);
-                                crate::brush_picker::settings_toggle(app, ui);
-                                widgets::vline(ui, 22.0);
-                                // A Block-mode Eraser has a fixed size, opacity and flow (Photoshop, #2770).
-                                let block = crate::eraser_ui::block_mode(app, app.ui.tool);
-                                ui.add_enabled_ui(!block, |ui| {
-                                    opt_label(ui, tl!("Size"));
-                                    widgets::value_field(ui, &mut b.size, 1.0..=photocraft_engine::paint::MAX_BRUSH_SIZE, "px", 76.0);
-                                });
-                                widgets::vline(ui, 22.0);
-                                if app.ui.tool == Tool::Eraser {
-                                    crate::eraser_ui::mode_dropdown(ui, &mut app.ui.tool_options.eraser_mode);
-                                } else {
-                                    opt_label(ui, tl!("Mode"));
-                                    let held = app.held_erase;
-                                    paint_mode_dropdown(ui, "brush-mode", b, &mut app.ui.tool_options.brush_clear, held);
-                                }
-                                // A Pencil-mode Eraser is always hard and at full flow (Photoshop).
-                                let fixed = block || crate::eraser_ui::pencil_mode(app, app.ui.tool);
-                                ui.add_enabled_ui(!fixed, |ui| percent_field(ui, tl!("Hardness"), &mut b.hardness, 0.0..=100.0, 66.0));
-                                ui.add_enabled_ui(!block, |ui| percent_field(ui, tl!("Opacity"), &mut b.opacity, 0.0..=100.0, 66.0));
-                                ui.add_enabled_ui(!fixed, |ui| percent_field(ui, tl!("Flow"), &mut b.flow, 1.0..=100.0, 66.0));
-                                opt_label(ui, tl!("Smoothing"));
-                                smoothing_field(ui, b, 66.0);
-                                widgets::vline(ui, 22.0);
-                                widgets::toggle(ui, &mut b.pressure_size, tl!("Pressure for Size"));
-                                widgets::toggle(ui, &mut b.pressure_opacity, tl!("Pressure for Opacity"));
-                            }
-                            Tool::MixerBrush => {
-                                brush_preset_chip(ui, b, &mut app.ui);
-                                crate::brush_picker::settings_toggle(app, ui);
-                                widgets::vline(ui, 22.0);
-                                mixer_load_swatch(app, ui);
-                                let m = &mut b.mixer;
-                                for (icon, on, tip) in [
-                                    ("brush", &mut m.load_after_stroke, tl!("Load the brush after each stroke")),
-                                    ("brush-cleaning", &mut m.clean_after_stroke, tl!("Clean the brush after each stroke")),
-                                ] {
-                                    if icons::button(ui, icon, 24.0, *on, tip).clicked() {
-                                        *on = !*on;
-                                    }
-                                }
-                                widgets::vline(ui, 22.0);
-                                for (label, value) in [
-                                    (tl!("Wet"), &mut b.mixer.wet),
-                                    (tl!("Load"), &mut b.mixer.load),
-                                    (tl!("Mix"), &mut b.mixer.mix),
-                                    (tl!("Flow"), &mut b.mixer.flow),
-                                ] {
-                                    percent_field(ui, label, value, 0.0..=100.0, 62.0);
-                                }
-                                widgets::vline(ui, 22.0);
-                                widgets::checkbox(ui, &mut b.mixer.sample_all_layers, tl!("Sample All Layers"));
-                            }
-                            Tool::RectMarquee | Tool::EllipseMarquee | Tool::SingleRowMarquee | Tool::SingleColumnMarquee => {
-                                ui.spacing_mut().item_spacing.x = 2.0;
-                                for (i, (icon, tip)) in [
-                                    ("square", tl!("New selection").to_string()),
-                                    ("plus", crate::i18n::fmt(tl!("Add to selection  ({key})"), &[("key", &crate::shortcuts::pretty("Shift"))])),
-                                    ("minus", crate::i18n::fmt(tl!("Subtract from selection  ({key})"), &[("key", &crate::shortcuts::pretty("Alt"))])),
-                                    (
-                                        "squares-subtract",
-                                        crate::i18n::fmt(tl!("Intersect with selection  ({key})"), &[("key", &crate::shortcuts::pretty("Shift+Alt"))]),
-                                    ),
-                                ]
-                                .iter()
-                                .enumerate()
-                                {
-                                    if icons::button(ui, icon, 24.0, app.ui.selection_mode == i as u8, tip).clicked() {
-                                        app.ui.selection_mode = i as u8;
-                                    }
-                                }
-                                ui.spacing_mut().item_spacing.x = 8.0;
-                                widgets::vline(ui, 22.0);
-                                let (units, size) = fixed_size_units(app);
-                                let o = &mut app.ui.tool_options;
-                                opt_label(ui, tl!("Feather"));
-                                widgets::value_field(ui, &mut o.feather, 0.0..=1000.0, "px", 62.0);
-                                // Photoshop greys Anti-alias for the Rectangular Marquee (its edges are always hard).
-                                ui.add_enabled_ui(app.ui.tool == Tool::EllipseMarquee, |ui| widgets::checkbox(ui, &mut o.anti_alias, tl!("Anti-alias")));
-                                widgets::vline(ui, 22.0);
-                                // A single row or column has no style or size: Photoshop greys them.
-                                let sized = matches!(app.ui.tool, Tool::RectMarquee | Tool::EllipseMarquee);
-                                ui.add_enabled_ui(sized, |ui| opt_label(ui, tl!("Style")));
-                                let styles = [
-                                    ("normal".to_string(), tl!("Normal")),
-                                    ("fixedRatio".to_string(), tl!("Fixed Ratio")),
-                                    ("fixedSize".to_string(), tl!("Fixed Size")),
-                                ];
-                                if ui
-                                    .add_enabled_ui(sized, |ui| widgets::dropdown(ui, "marquee-style", tl!("Style"), &mut o.marquee_style, &styles, 96.0))
-                                    .inner
-                                {
-                                    (o.marquee_width, o.marquee_height) = if o.marquee_style == "fixedSize" { (64.0, 64.0) } else { (1.0, 1.0) };
-                                }
-                                let fixed = sized && o.marquee_style != "normal";
-                                let fixed_size = o.marquee_style == "fixedSize";
-                                // Fixed Size shows its pixels in the unit picked by right-clicking Width or Height (#7910).
-                                let units = widgets::FieldUnits { unit: photocraft_engine::prefs::Unit::parse(&o.marquee_unit).unwrap_or_default(), ..units };
-                                ui.add_enabled_ui(fixed, |ui| {
-                                    let mut picked = None;
-                                    opt_label(ui, tl!("Width"));
-                                    if fixed_size {
-                                        picked = fixed_size_field(ui, &mut o.marquee_width, units, size[0]);
-                                    } else {
-                                        widgets::value_field(ui, &mut o.marquee_width, crate::tool_memory::style_range(&o.marquee_style), "", 62.0);
-                                    }
-                                    if icons::button(ui, "arrow-left-right", 22.0, false, tl!("Swaps height and width")).clicked() {
-                                        std::mem::swap(&mut o.marquee_width, &mut o.marquee_height);
-                                    }
-                                    opt_label(ui, tl!("Height"));
-                                    if fixed_size {
-                                        picked = fixed_size_field(ui, &mut o.marquee_height, units, size[1]).or(picked);
-                                    } else {
-                                        widgets::value_field(ui, &mut o.marquee_height, crate::tool_memory::style_range(&o.marquee_style), "", 62.0);
-                                    }
-                                    if let Some(name) = picked {
-                                        o.marquee_unit = name.into();
-                                    }
-                                });
-                                widgets::vline(ui, 22.0);
-                                select_and_mask_button(app, ui);
-                            }
-                            Tool::Lasso | Tool::PolygonLasso | Tool::MagneticLasso => {
-                                selection_mode_buttons(app, ui);
-                                widgets::vline(ui, 22.0);
-                                opt_label(ui, tl!("Feather"));
-                                widgets::value_field(ui, &mut app.ui.tool_options.feather, 0.0..=1000.0, "px", 62.0);
-                                widgets::checkbox(ui, &mut app.ui.tool_options.anti_alias, tl!("Anti-alias"));
-                                widgets::vline(ui, 22.0);
-                                if app.ui.tool == Tool::MagneticLasso {
-                                    let o = &mut app.ui.tool_options;
-                                    opt_label(ui, tl!("Width"));
-                                    widgets::value_field(ui, &mut o.magnetic_width, 1.0..=256.0, "px", 58.0)
-                                        .on_hover_text(tl!("Follows only edges this close to the pointer ([ and ] change it)"));
-                                    opt_label(ui, tl!("Contrast"));
-                                    widgets::value_field(ui, &mut o.magnetic_contrast, 1.0..=100.0, "%", 58.0)
-                                        .on_hover_text(tl!("Higher values follow only edges that contrast sharply with their surroundings"));
-                                    opt_label(ui, tl!("Frequency"));
-                                    widgets::value_field(ui, &mut o.magnetic_frequency, 0.0..=100.0, "", 50.0)
-                                        .on_hover_text(tl!("How often fastening points are placed by themselves"));
-                                    if icons::button(ui, "circle-dot", 24.0, o.magnetic_pressure, tl!("Use tablet pressure to change pen width")).clicked() {
-                                        o.magnetic_pressure = !o.magnetic_pressure;
-                                    }
-                                    widgets::vline(ui, 22.0);
-                                }
-                                select_and_mask_button(app, ui);
-                                if crate::lasso_ui::active(app) || (app.ui.tool == Tool::PolygonLasso && !app.ui.polygon.is_empty()) {
-                                    hint(
-                                        ui,
-                                        &crate::i18n::fmt(
-                                            tl!("Click the first point or press {key} to close · Esc cancels"),
-                                            &[("key", &crate::shortcuts::pretty("Enter"))],
-                                        ),
-                                    );
-                                } else if app.ui.tool == Tool::Lasso {
-                                    hint(ui, tl!("Hold Alt while drawing for straight segments"));
-                                }
-                                if app.ui.tool == Tool::MagneticLasso && app.ui.magnetic.active() {
-                                    hint(
-                                        ui,
-                                        &crate::i18n::fmt(
-                                            tl!("Click the first point or press {key} to close · {del} removes a point · Esc cancels"),
-                                            &[("key", &crate::shortcuts::pretty("Enter")), ("del", &crate::shortcuts::pretty("Backspace"))],
-                                        ),
-                                    );
-                                }
-                            }
-                            Tool::MagicWand => {
-                                selection_mode_buttons(app, ui);
-                                widgets::vline(ui, 22.0);
-                                opt_label(ui, tl!("Tolerance"));
-                                widgets::value_field(ui, &mut app.ui.tool_options.tolerance, 0.0..=255.0, "", 58.0);
-                                widgets::checkbox(ui, &mut app.ui.tool_options.anti_alias, tl!("Anti-alias"));
-                                widgets::checkbox(ui, &mut app.ui.tool_options.contiguous, tl!("Contiguous"));
-                                widgets::checkbox(ui, &mut app.ui.tool_options.sample_all.magic_wand, tl!("Sample All Layers"));
-                                widgets::vline(ui, 22.0);
-                                if widgets::secondary_button(ui, tl!("Select Subject"), 0.0).clicked() {
-                                    let r = app.run("select.subject", json!({}));
-                                    crate::retouch_ui::report_smart_result(app, r, tl!("No subject found — try Object Selection or the Lasso"));
-                                }
-                                select_and_mask_button(app, ui);
-                            }
-                            Tool::PaintBucket => {
-                                opt_label(ui, tl!("Fill"));
-                                let mut src = u8::from(app.ui.tool_options.bucket_fill_pattern);
-                                if widgets::dropdown(ui, "bucket-src", tl!("Source"), &mut src, &[(0u8, tl!("Foreground")), (1, tl!("Pattern"))], 100.0) {
-                                    app.ui.tool_options.bucket_fill_pattern = src == 1;
-                                }
-                                opt_label(ui, tl!("Mode"));
-                                if let Some(modes) = crate::blend_keys::tool_modes(tool) {
-                                    let o = &mut app.ui.tool_options;
-                                    let current = if o.bucket_clear { None } else { Some(o.bucket_blend_mode) };
-                                    if let Some(m) = tool_mode_dropdown(ui, "bucket-mode", &modes, current) {
-                                        o.bucket_clear = m.is_none();
-                                        if let Some(m) = m {
-                                            o.bucket_blend_mode = m;
-                                        }
-                                    }
-                                }
-                                opt_label(ui, tl!("Opacity"));
-                                widgets::value_field(ui, &mut app.ui.tool_options.fill_opacity, 1.0..=100.0, "%", 62.0);
-                                opt_label(ui, tl!("Tolerance"));
-                                widgets::value_field(ui, &mut app.ui.tool_options.tolerance, 0.0..=255.0, "", 58.0);
-                                widgets::checkbox(ui, &mut app.ui.tool_options.anti_alias, tl!("Anti-alias"));
-                                widgets::checkbox(ui, &mut app.ui.tool_options.contiguous, tl!("Contiguous"));
-                                widgets::checkbox(ui, &mut app.ui.tool_options.sample_all.paint_bucket, tl!("All Layers"));
-                            }
-                            Tool::Gradient => {
-                                // Live "Gradient" (a Gradient Fill layer) or "Classic gradient" (pixels).
-                                let mut classic = app.ui.tool_options.gradient_classic;
-                                if widgets::dropdown(ui, "gradient-mode", tl!("Mode"), &mut classic, &[(false, "Gradient"), (true, "Classic gradient")], 118.0)
-                                {
-                                    app.ui.tool_options.gradient_classic = classic;
-                                }
-                                // Live "Gradient" (a Gradient Fill layer) or "Classic gradient" (pixels):
-                                // both paint with the same engine-owned preset (#1651), and either swatch
-                                // click opens the Gradient Editor window, as in Photoshop.
-                                if crate::gradient_ui::preset_swatch(app, ui) {
-                                    app.ui.panels.gradient_editor = true;
-                                }
-                                widgets::vline(ui, 22.0);
-                                ui.spacing_mut().item_spacing.x = 2.0;
-                                let before = app.ui.tool_options.clone();
-                                for (style, icon, tip) in [
-                                    ("linear", "gradient", tl!("Linear Gradient")),
-                                    ("radial", "circle", tl!("Radial Gradient")),
-                                    ("angle", "rotate-cw", tl!("Angle Gradient")),
-                                    ("reflected", "arrow-left-right", tl!("Reflected Gradient")),
-                                    ("diamond", "diamond", tl!("Diamond Gradient")),
-                                ] {
-                                    if icons::button(ui, icon, 24.0, app.ui.tool_options.gradient_style == style, tip).clicked() {
-                                        app.ui.tool_options.gradient_style = style.into();
-                                    }
-                                }
-                                ui.spacing_mut().item_spacing.x = 8.0;
-                                widgets::vline(ui, 22.0);
-                                opt_label(ui, tl!("Mode"));
-                                let opts: Vec<(BlendMode, &str)> = BlendMode::LAYER_MODES.iter().map(|m| (*m, m.label())).collect();
-                                // The wheel over it steps the mode, as over the Layers panel's (#2061).
-                                widgets::dropdown_wheel_hovered(
-                                    ui,
-                                    "gradient-blend-mode",
-                                    tl!("Blend Mode"),
-                                    &mut app.ui.tool_options.gradient_blend_mode,
-                                    &opts,
-                                    96.0,
-                                );
-                                opt_label(ui, tl!("Opacity"));
-                                let r = widgets::value_field(ui, &mut app.ui.tool_options.fill_opacity, 1.0..=100.0, "%", 62.0);
-                                // Live while scrubbed, one undo step per scrub (#5012).
-                                let drag_key = r.id.with("gradient-opacity-drag");
-                                if r.drag_started() {
-                                    let n = ui.ctx().cumulative_pass_nr();
-                                    ui.data_mut(|d| d.insert_temp(drag_key, n));
-                                }
-                                if r.changed() {
-                                    let drag = if r.dragged() { ui.data(|d| d.get_temp::<u64>(drag_key)) } else { None };
-                                    crate::gradient_ui::opacity_changed(app, drag);
-                                }
-                                widgets::checkbox(ui, &mut app.ui.tool_options.gradient_reverse, tl!("Reverse"));
-                                widgets::checkbox(ui, &mut app.ui.tool_options.gradient_dither, tl!("Dither"));
-                                // Live mode: the options also change a selected gradient fill layer.
-                                crate::gradient_ui::options_changed(app, &before);
-                            }
-                            Tool::PerspectiveCrop => crate::perspective_crop_ui::options_bar(app, ui),
-                            Tool::Crop => {
-                                let before_ratio = crate::crop_ui::preset_ratio(app);
-                                let doc_size = app.session.active().map_or((0.0, 0.0), |s| (f64::from(s.doc.size.width), f64::from(s.doc.size.height)));
-                                // Ratios, sizes, saved presets, New / Delete Crop Preset… (#2443, #1919).
-                                crate::crop_presets::dropdown(app, ui);
-                                let o = &mut app.ui.tool_options;
-                                let mut ratio_base = None;
-                                if o.crop_ratio == crate::crop_size::WHR {
-                                    crate::crop_size::fields(o, ui);
-                                } else {
-                                    // Keep partial edits in ToolOptions so the first side survives a frame;
-                                    // Original Ratio shows the document's numbers, as Photoshop does.
-                                    let (mut rw, mut rh) = crate::crop_size::custom_ratio_fields(o, doc_size);
-                                    let decimals = crate::crop_size::RATIO_DECIMALS;
-                                    let fw = widgets::value_field_prec(ui, &mut rw, 0.0..=99_999.0, "", 54.0, decimals);
-                                    let swap = icons::button(ui, "arrow-left-right", 22.0, false, tl!("Swaps height and width")).clicked();
-                                    let fh = widgets::value_field_prec(ui, &mut rh, 0.0..=99_999.0, "", 54.0, decimals);
-                                    let (cw, ch) = (fw.changed(), fh.changed());
-                                    if swap {
-                                        std::mem::swap(&mut rw, &mut rh);
-                                    }
-                                    if cw || ch || swap {
-                                        crate::crop_size::set_custom_ratio_fields(o, rw, rh);
-                                    }
-                                    // Every ratio typed or scrubbed in one edit fits from the frame the edit
-                                    // started with: 1:3 on the way to 16:3 mustn't shrink it first (#7752).
-                                    let base_id = egui::Id::unique("crop-ratio-edit-base");
-                                    if cw || ch {
-                                        ratio_base = ui.data(|d| d.get_temp::<[f64; 4]>(base_id)).or(app.ui.crop_rect);
-                                    }
-                                    if ![&fw, &fh].iter().any(|f| f.has_focus() || f.dragged()) {
-                                        ui.data_mut(|d| d.remove::<[f64; 4]>(base_id));
-                                    } else if let Some(base) = ratio_base {
-                                        ui.data_mut(|d| d.insert_temp(base_id, base));
-                                    }
-                                }
-                                widgets::vline(ui, 22.0);
-                                if widgets::secondary_button(ui, tl!("Clear"), 0.0).clicked() {
-                                    crate::crop_size::clear_ratio(o);
-                                }
-                                crate::crop_straighten::options_button(&mut app.crop.straighten, ui);
-                                crate::crop_overlay::options_button(o, ui);
-                                let pick_shield_color = crate::crop_shield::options_button(&mut o.crop_shield, ui);
-                                widgets::checkbox(ui, &mut o.crop_delete, tl!("Delete Cropped Pixels"));
-                                // Fill: what a turned or extending crop puts where the image doesn't reach
-                                // (#3823). Generative Expand is not offered.
-                                ui.label(tl!("Fill:"));
-                                widgets::dropdown(
-                                    ui,
-                                    "crop-fill",
-                                    tl!("Fill:"),
-                                    &mut o.crop_content_aware,
-                                    &[(false, tl!("Background (Default)")), (true, tl!("Content-Aware Fill"))],
-                                    150.0,
-                                );
-                                if crate::crop_ui::preset_ratio(app) != before_ratio {
-                                    match ratio_base {
-                                        Some(base) => crate::crop_ui::apply_ratio_from(app, base),
-                                        None => crate::crop_ui::apply_ratio(app),
-                                    }
-                                }
-                                if pick_shield_color {
-                                    crate::crop_shield::pick_custom_color(app);
-                                }
-                                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                                    if icons::button(
-                                        ui,
-                                        "check",
-                                        26.0,
-                                        false,
-                                        &crate::i18n::fmt(tl!("Commit current crop operation  ({key})"), &[("key", &crate::shortcuts::pretty("Enter"))]),
-                                    )
-                                    .clicked()
-                                    {
-                                        crate::canvas::commit_crop(app);
-                                    }
-                                    if icons::button(ui, "ban", 26.0, false, tl!("Cancel current crop operation  (Esc)")).clicked() {
-                                        crate::crop_ui::cancel(app);
-                                    }
-                                });
-                            }
-                            // Every theme gets the font, style and size controls (#1387), as with Auto-Select (#1275).
-                            Tool::Type | Tool::VerticalType | Tool::HorizontalTypeMask | Tool::VerticalTypeMask => crate::type_tool::options_bar(app, ui),
-                            Tool::Move => {
-                                let o = &mut app.ui.tool_options;
-                                widgets::checkbox(ui, &mut o.move_auto_select, tl!("Auto-Select:"));
-                                widgets::dropdown(
-                                    ui,
-                                    "move-target",
-                                    tl!("Auto-Select:"),
-                                    &mut o.move_target,
-                                    &[("layer".to_string(), tl!("Layer")), ("group".to_string(), tl!("Group"))],
-                                    76.0,
-                                );
-                                widgets::vline(ui, 22.0);
-                                widgets::checkbox(ui, &mut o.move_show_transform, tl!("Show Transform Controls"));
-                                widgets::vline(ui, 22.0);
-                                crate::align_bar::options(app, ui);
-                            }
-                            Tool::Eyedropper => crate::eyedropper_ui::options(app, ui),
-                            Tool::Zoom => {
-                                // Resize Windows to Fit is Preferences › Zoom Resizes Windows itself, as in
-                                // Photoshop: one setting, shown in both places (zoom_window_fit.rs).
-                                let mut fit = app.session.prefs().general.zoom_resizes_windows;
-                                if widgets::checkbox(ui, &mut fit, tl!("Resize Windows to Fit")).changed() {
-                                    app.session.prefs.edit(|p| p.general.zoom_resizes_windows = fit);
-                                }
-                                widgets::checkbox(ui, &mut app.ui.tool_options.zoom_scrubby, tl!("Scrubby Zoom"));
-                                hint(
-                                    ui,
-                                    &crate::i18n::fmt(
-                                        tl!("Click to zoom in  ·  {key}-click to zoom out  ·  drag right/left to zoom in/out"),
-                                        &[("key", &crate::shortcuts::pretty("Alt"))],
-                                    ),
-                                );
-                                if widgets::secondary_button(ui, tl!("Fit Screen"), 0.0).clicked()
-                                    && let Some(i) = app.session.active_index()
-                                {
-                                    app.ui.views[i].fit_pending = true;
-                                    app.ui.views[i].request_zoom_animation(app.session.prefs().general.animated_zoom);
-                                    app.ui.views[i].zoom_anchor = None;
-                                }
-                                if widgets::secondary_button(ui, "100%", 0.0).clicked()
-                                    && let Some(i) = app.session.active_index()
-                                {
-                                    app.ui.views[i].zoom = 1.0;
-                                    app.ui.views[i].request_zoom_animation(app.session.prefs().general.animated_zoom);
-                                    app.ui.views[i].zoom_anchor = None;
-                                    app.ui.views[i].fit_pending = false;
-                                    app.ui.views[i].fill_pending = false;
-                                }
-                            }
-                            Tool::RotateView => {
-                                hint(ui, tl!("Drag around the centre to rotate the view  ·  Shift constrains to 15°"));
-                                if let Some(i) = app.session.active_index() {
-                                    ui.label(tl!("Angle"));
-                                    let mut angle = app.ui.views.get(i).map(|v| v.rotation).unwrap_or(0.0);
-                                    if widgets::value_field(ui, &mut angle, -180.0..=180.0, "°", 56.0).changed()
-                                        && let Some(v) = app.ui.views.get_mut(i)
-                                    {
-                                        v.rotation = crate::rotate_view::wrap_deg(angle);
-                                    }
-                                    if widgets::secondary_button(ui, tl!("Reset View"), 0.0).clicked()
-                                        && let Some(v) = app.ui.views.get_mut(i)
-                                    {
-                                        v.rotation = 0.0;
-                                    }
-                                }
-                            }
-                            Tool::Hand => {
-                                hint(ui, tl!("Drag to pan  ·  hold Space with any tool"));
-                                if widgets::secondary_button(ui, "100%", 0.0).clicked()
-                                    && let Some(i) = app.session.active_index()
-                                {
-                                    app.ui.views[i].zoom = 1.0;
-                                    app.ui.views[i].request_zoom_animation(app.session.prefs().general.animated_zoom);
-                                    app.ui.views[i].zoom_anchor = None;
-                                    app.ui.views[i].fit_pending = false;
-                                    app.ui.views[i].fill_pending = false;
-                                }
-                                if widgets::secondary_button(ui, tl!("Fit Screen"), 0.0).clicked()
-                                    && let Some(i) = app.session.active_index()
-                                {
-                                    app.ui.views[i].fit_pending = true;
-                                    app.ui.views[i].request_zoom_animation(app.session.prefs().general.animated_zoom);
-                                    app.ui.views[i].zoom_anchor = None;
-                                    app.ui.views[i].fill_pending = false;
-                                }
-                                if widgets::secondary_button(ui, tl!("Fill Screen"), 0.0).clicked()
-                                    && let Some(i) = app.session.active_index()
-                                {
-                                    app.ui.views[i].fill_pending = true;
-                                    app.ui.views[i].request_zoom_animation(app.session.prefs().general.animated_zoom);
-                                    app.ui.views[i].zoom_anchor = None;
-                                    app.ui.views[i].fit_pending = false;
-                                }
-                            }
-                            // Retouching and smart-selection tools draw their bar in `retouch_ui::options_bar`.
-                            _ => {}
-                        }
+                        tool_specific_options(app, ui, t, tool, b);
                         // Painting symmetry is independent of visual theme. Keep the options-bar
                         // action available for Brush, Pencil and Eraser in every palette (#2659).
                         if matches!(tool, Tool::Brush | Tool::Pencil | Tool::Eraser) {
@@ -648,6 +145,541 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         });
 }
 
+/// The per-tool options of the bar: the brush, mixer, marquee, pencil and view controls.
+/// Brush family options share the same per-tool settings model.
+fn brush_specific_options(app: &mut PhotocraftApp, ui: &mut egui::Ui, t: Tokens, b: &mut BrushSettings) {
+    match app.ui.tool {
+        Tool::Brush | Tool::Eraser if t.pro => {
+            // A Block-mode Eraser has a fixed size, opacity and flow (Photoshop, #2770).
+            let block = crate::eraser_ui::block_mode(app, app.ui.tool);
+            ui.add_enabled_ui(!block, |ui| {
+                brush_preset_chip(ui, b, &mut app.ui);
+                crate::brush_picker::settings_toggle(app, ui);
+            });
+            widgets::vline(ui, 22.0);
+            // The Eraser has no blend mode: its Mode is Brush, Pencil or Block (#2662).
+            if app.ui.tool == Tool::Eraser {
+                crate::eraser_ui::mode_dropdown(ui, &mut app.ui.tool_options.eraser_mode);
+            } else {
+                opt_label(ui, tl!("Mode"));
+                let held = app.held_erase;
+                paint_mode_dropdown(ui, "brush-mode", b, &mut app.ui.tool_options.brush_clear, held);
+            }
+            ui.add_enabled_ui(!block, |ui| {
+                percent_field(ui, tl!("Opacity"), &mut b.opacity, 0.0..=100.0, 62.0);
+                if icons::button(ui, "circle-dot", 24.0, b.pressure_opacity, tl!("Always use pressure for opacity")).clicked() {
+                    b.pressure_opacity = !b.pressure_opacity;
+                }
+            });
+            // A Pencil- or Block-mode Eraser is always full flow, without build-up (Photoshop).
+            ui.add_enabled_ui(!block && !crate::eraser_ui::pencil_mode(app, app.ui.tool), |ui| {
+                percent_field(ui, tl!("Flow"), &mut b.flow, 1.0..=100.0, 62.0);
+                let airbrush = icons::button(ui, "sparkles", 24.0, b.build_up, tl!("Enable airbrush-style build-up effects"));
+                if crate::brush_picker::named(airbrush, "Enable airbrush-style build-up effects").clicked() {
+                    b.build_up = !b.build_up;
+                }
+            });
+            opt_label(ui, tl!("Smoothing"));
+            smoothing_field(ui, b, 58.0);
+            smoothing_options(ui, b);
+            widgets::vline(ui, 22.0);
+            if icons::button(ui, "circle-dot", 24.0, b.pressure_size, tl!("Always use pressure for size")).clicked() {
+                b.pressure_size = !b.pressure_size;
+            }
+        }
+        // Pencil: Photoshop's options (no hardness or flow: the pencil is always hard).
+        Tool::Pencil => {
+            brush_preset_chip(ui, b, &mut app.ui);
+            crate::brush_picker::settings_toggle(app, ui);
+            widgets::vline(ui, 22.0);
+            if !t.pro {
+                opt_label(ui, tl!("Size"));
+                widgets::value_field(ui, &mut b.size, 1.0..=photocraft_engine::paint::MAX_BRUSH_SIZE, "px", 76.0);
+                widgets::vline(ui, 22.0);
+            }
+            opt_label(ui, tl!("Mode"));
+            let held = app.held_erase;
+            paint_mode_dropdown(ui, "pencil-mode", b, &mut app.ui.tool_options.pencil_clear, held);
+            percent_field(ui, tl!("Opacity"), &mut b.opacity, 0.0..=100.0, if t.pro { 62.0 } else { 66.0 });
+            opt_label(ui, tl!("Smoothing"));
+            smoothing_field(ui, b, if t.pro { 58.0 } else { 66.0 });
+            widgets::vline(ui, 22.0);
+            widgets::checkbox(ui, &mut app.ui.tool_options.pencil_auto_erase, tl!("Auto Erase"));
+        }
+        Tool::Brush | Tool::Eraser => {
+            brush_preset_chip(ui, b, &mut app.ui);
+            crate::brush_picker::settings_toggle(app, ui);
+            widgets::vline(ui, 22.0);
+            // A Block-mode Eraser has a fixed size, opacity and flow (Photoshop, #2770).
+            let block = crate::eraser_ui::block_mode(app, app.ui.tool);
+            ui.add_enabled_ui(!block, |ui| {
+                opt_label(ui, tl!("Size"));
+                widgets::value_field(ui, &mut b.size, 1.0..=photocraft_engine::paint::MAX_BRUSH_SIZE, "px", 76.0);
+            });
+            widgets::vline(ui, 22.0);
+            if app.ui.tool == Tool::Eraser {
+                crate::eraser_ui::mode_dropdown(ui, &mut app.ui.tool_options.eraser_mode);
+            } else {
+                opt_label(ui, tl!("Mode"));
+                let held = app.held_erase;
+                paint_mode_dropdown(ui, "brush-mode", b, &mut app.ui.tool_options.brush_clear, held);
+            }
+            // A Pencil-mode Eraser is always hard and at full flow (Photoshop).
+            let fixed = block || crate::eraser_ui::pencil_mode(app, app.ui.tool);
+            ui.add_enabled_ui(!fixed, |ui| percent_field(ui, tl!("Hardness"), &mut b.hardness, 0.0..=100.0, 66.0));
+            ui.add_enabled_ui(!block, |ui| percent_field(ui, tl!("Opacity"), &mut b.opacity, 0.0..=100.0, 66.0));
+            ui.add_enabled_ui(!fixed, |ui| percent_field(ui, tl!("Flow"), &mut b.flow, 1.0..=100.0, 66.0));
+            opt_label(ui, tl!("Smoothing"));
+            smoothing_field(ui, b, 66.0);
+            widgets::vline(ui, 22.0);
+            widgets::toggle(ui, &mut b.pressure_size, tl!("Pressure for Size"));
+            widgets::toggle(ui, &mut b.pressure_opacity, tl!("Pressure for Opacity"));
+        }
+        Tool::MixerBrush => {
+            brush_preset_chip(ui, b, &mut app.ui);
+            crate::brush_picker::settings_toggle(app, ui);
+            widgets::vline(ui, 22.0);
+            mixer_load_swatch(app, ui);
+            let m = &mut b.mixer;
+            for (icon, on, tip) in [
+                ("brush", &mut m.load_after_stroke, tl!("Load the brush after each stroke")),
+                ("brush-cleaning", &mut m.clean_after_stroke, tl!("Clean the brush after each stroke")),
+            ] {
+                if icons::button(ui, icon, 24.0, *on, tip).clicked() {
+                    *on = !*on;
+                }
+            }
+            widgets::vline(ui, 22.0);
+            for (label, value) in
+                [(tl!("Wet"), &mut b.mixer.wet), (tl!("Load"), &mut b.mixer.load), (tl!("Mix"), &mut b.mixer.mix), (tl!("Flow"), &mut b.mixer.flow)]
+            {
+                percent_field(ui, label, value, 0.0..=100.0, 62.0);
+            }
+            widgets::vline(ui, 22.0);
+            widgets::checkbox(ui, &mut b.mixer.sample_all_layers, tl!("Sample All Layers"));
+        }
+        _ => {}
+    }
+}
+
+/// Marquee tools: selection mode, feather, anti-alias, style and fixed size.
+fn marquee_options(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
+    ui.spacing_mut().item_spacing.x = 2.0;
+    for (i, (icon, tip)) in [
+        ("square", tl!("New selection").to_string()),
+        ("plus", crate::i18n::fmt(tl!("Add to selection  ({key})"), &[("key", &crate::shortcuts::pretty("Shift"))])),
+        ("minus", crate::i18n::fmt(tl!("Subtract from selection  ({key})"), &[("key", &crate::shortcuts::pretty("Alt"))])),
+        ("squares-subtract", crate::i18n::fmt(tl!("Intersect with selection  ({key})"), &[("key", &crate::shortcuts::pretty("Shift+Alt"))])),
+    ]
+    .iter()
+    .enumerate()
+    {
+        if icons::button(ui, icon, 24.0, app.ui.selection_mode == i as u8, tip).clicked() {
+            app.ui.selection_mode = i as u8;
+        }
+    }
+    ui.spacing_mut().item_spacing.x = 8.0;
+    widgets::vline(ui, 22.0);
+    let (units, size) = fixed_size_units(app);
+    let o = &mut app.ui.tool_options;
+    opt_label(ui, tl!("Feather"));
+    widgets::value_field(ui, &mut o.feather, 0.0..=1000.0, "px", 62.0);
+    // Photoshop greys Anti-alias for the Rectangular Marquee (its edges are always hard).
+    ui.add_enabled_ui(app.ui.tool == Tool::EllipseMarquee, |ui| widgets::checkbox(ui, &mut o.anti_alias, tl!("Anti-alias")));
+    widgets::vline(ui, 22.0);
+    // A single row or column has no style or size: Photoshop greys them.
+    let sized = matches!(app.ui.tool, Tool::RectMarquee | Tool::EllipseMarquee);
+    ui.add_enabled_ui(sized, |ui| opt_label(ui, tl!("Style")));
+    let styles = [("normal".to_string(), tl!("Normal")), ("fixedRatio".to_string(), tl!("Fixed Ratio")), ("fixedSize".to_string(), tl!("Fixed Size"))];
+    if ui.add_enabled_ui(sized, |ui| widgets::dropdown(ui, "marquee-style", tl!("Style"), &mut o.marquee_style, &styles, 96.0)).inner {
+        (o.marquee_width, o.marquee_height) = if o.marquee_style == "fixedSize" { (64.0, 64.0) } else { (1.0, 1.0) };
+    }
+    let fixed = sized && o.marquee_style != "normal";
+    let fixed_size = o.marquee_style == "fixedSize";
+    // Fixed Size shows its pixels in the unit picked by right-clicking Width or Height (#7910).
+    let units = widgets::FieldUnits { unit: photocraft_engine::prefs::Unit::parse(&o.marquee_unit).unwrap_or_default(), ..units };
+    ui.add_enabled_ui(fixed, |ui| {
+        let mut picked = None;
+        opt_label(ui, tl!("Width"));
+        if fixed_size {
+            picked = fixed_size_field(ui, &mut o.marquee_width, units, size[0]);
+        } else {
+            widgets::value_field(ui, &mut o.marquee_width, crate::tool_memory::style_range(&o.marquee_style), "", 62.0);
+        }
+        if icons::button(ui, "arrow-left-right", 22.0, false, tl!("Swaps height and width")).clicked() {
+            std::mem::swap(&mut o.marquee_width, &mut o.marquee_height);
+        }
+        opt_label(ui, tl!("Height"));
+        if fixed_size {
+            picked = fixed_size_field(ui, &mut o.marquee_height, units, size[1]).or(picked);
+        } else {
+            widgets::value_field(ui, &mut o.marquee_height, crate::tool_memory::style_range(&o.marquee_style), "", 62.0);
+        }
+        if let Some(name) = picked {
+            o.marquee_unit = name.into();
+        }
+    });
+    widgets::vline(ui, 22.0);
+    select_and_mask_button(app, ui);
+}
+
+/// Lasso family: selection mode, feather, anti-alias, magnetic settings and the drawing hints.
+fn lasso_options(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
+    selection_mode_buttons(app, ui);
+    widgets::vline(ui, 22.0);
+    opt_label(ui, tl!("Feather"));
+    widgets::value_field(ui, &mut app.ui.tool_options.feather, 0.0..=1000.0, "px", 62.0);
+    widgets::checkbox(ui, &mut app.ui.tool_options.anti_alias, tl!("Anti-alias"));
+    widgets::vline(ui, 22.0);
+    if app.ui.tool == Tool::MagneticLasso {
+        let o = &mut app.ui.tool_options;
+        opt_label(ui, tl!("Width"));
+        widgets::value_field(ui, &mut o.magnetic_width, 1.0..=256.0, "px", 58.0)
+            .on_hover_text(tl!("Follows only edges this close to the pointer ([ and ] change it)"));
+        opt_label(ui, tl!("Contrast"));
+        widgets::value_field(ui, &mut o.magnetic_contrast, 1.0..=100.0, "%", 58.0)
+            .on_hover_text(tl!("Higher values follow only edges that contrast sharply with their surroundings"));
+        opt_label(ui, tl!("Frequency"));
+        widgets::value_field(ui, &mut o.magnetic_frequency, 0.0..=100.0, "", 50.0).on_hover_text(tl!("How often fastening points are placed by themselves"));
+        if icons::button(ui, "circle-dot", 24.0, o.magnetic_pressure, tl!("Use tablet pressure to change pen width")).clicked() {
+            o.magnetic_pressure = !o.magnetic_pressure;
+        }
+        widgets::vline(ui, 22.0);
+    }
+    select_and_mask_button(app, ui);
+    if crate::lasso_ui::active(app) || (app.ui.tool == Tool::PolygonLasso && !app.ui.polygon.is_empty()) {
+        hint(ui, &crate::i18n::fmt(tl!("Click the first point or press {key} to close · Esc cancels"), &[("key", &crate::shortcuts::pretty("Enter"))]));
+    } else if app.ui.tool == Tool::Lasso {
+        hint(ui, tl!("Hold Alt while drawing for straight segments"));
+    }
+    if app.ui.tool == Tool::MagneticLasso && app.ui.magnetic.active() {
+        hint(
+            ui,
+            &crate::i18n::fmt(
+                tl!("Click the first point or press {key} to close · {del} removes a point · Esc cancels"),
+                &[("key", &crate::shortcuts::pretty("Enter")), ("del", &crate::shortcuts::pretty("Backspace"))],
+            ),
+        );
+    }
+}
+
+/// Selection and paint tools expose their controls as a family of options rows.
+fn selection_specific_options(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) {
+    match app.ui.tool {
+        Tool::RectMarquee | Tool::EllipseMarquee | Tool::SingleRowMarquee | Tool::SingleColumnMarquee => {
+            marquee_options(app, ui);
+        }
+        Tool::Lasso | Tool::PolygonLasso | Tool::MagneticLasso => {
+            lasso_options(app, ui);
+        }
+        Tool::MagicWand => {
+            selection_mode_buttons(app, ui);
+            widgets::vline(ui, 22.0);
+            opt_label(ui, tl!("Tolerance"));
+            widgets::value_field(ui, &mut app.ui.tool_options.tolerance, 0.0..=255.0, "", 58.0);
+            widgets::checkbox(ui, &mut app.ui.tool_options.anti_alias, tl!("Anti-alias"));
+            widgets::checkbox(ui, &mut app.ui.tool_options.contiguous, tl!("Contiguous"));
+            widgets::checkbox(ui, &mut app.ui.tool_options.sample_all.magic_wand, tl!("Sample All Layers"));
+            widgets::vline(ui, 22.0);
+            if widgets::secondary_button(ui, tl!("Select Subject"), 0.0).clicked() {
+                let r = app.run("select.subject", json!({}));
+                crate::retouch_ui::report_smart_result(app, r, tl!("No subject found — try Object Selection or the Lasso"));
+            }
+            select_and_mask_button(app, ui);
+        }
+        Tool::PaintBucket => {
+            opt_label(ui, tl!("Fill"));
+            let mut src = u8::from(app.ui.tool_options.bucket_fill_pattern);
+            if widgets::dropdown(ui, "bucket-src", tl!("Source"), &mut src, &[(0u8, tl!("Foreground")), (1, tl!("Pattern"))], 100.0) {
+                app.ui.tool_options.bucket_fill_pattern = src == 1;
+            }
+            opt_label(ui, tl!("Mode"));
+            if let Some(modes) = crate::blend_keys::tool_modes(tool) {
+                let o = &mut app.ui.tool_options;
+                let current = if o.bucket_clear { None } else { Some(o.bucket_blend_mode) };
+                if let Some(m) = tool_mode_dropdown(ui, "bucket-mode", &modes, current) {
+                    o.bucket_clear = m.is_none();
+                    if let Some(m) = m {
+                        o.bucket_blend_mode = m;
+                    }
+                }
+            }
+            opt_label(ui, tl!("Opacity"));
+            widgets::value_field(ui, &mut app.ui.tool_options.fill_opacity, 1.0..=100.0, "%", 62.0);
+            opt_label(ui, tl!("Tolerance"));
+            widgets::value_field(ui, &mut app.ui.tool_options.tolerance, 0.0..=255.0, "", 58.0);
+            widgets::checkbox(ui, &mut app.ui.tool_options.anti_alias, tl!("Anti-alias"));
+            widgets::checkbox(ui, &mut app.ui.tool_options.contiguous, tl!("Contiguous"));
+            widgets::checkbox(ui, &mut app.ui.tool_options.sample_all.paint_bucket, tl!("All Layers"));
+        }
+        Tool::Gradient => {
+            // Live "Gradient" (a Gradient Fill layer) or "Classic gradient" (pixels).
+            let mut classic = app.ui.tool_options.gradient_classic;
+            if widgets::dropdown(ui, "gradient-mode", tl!("Mode"), &mut classic, &[(false, "Gradient"), (true, "Classic gradient")], 118.0) {
+                app.ui.tool_options.gradient_classic = classic;
+            }
+            // Live "Gradient" (a Gradient Fill layer) or "Classic gradient" (pixels):
+            // both paint with the same engine-owned preset (#1651), and either swatch
+            // click opens the Gradient Editor window, as in Photoshop.
+            if crate::gradient_ui::preset_swatch(app, ui) {
+                app.ui.panels.gradient_editor = true;
+            }
+            widgets::vline(ui, 22.0);
+            ui.spacing_mut().item_spacing.x = 2.0;
+            let before = app.ui.tool_options.clone();
+            for (style, icon, tip) in [
+                ("linear", "gradient", tl!("Linear Gradient")),
+                ("radial", "circle", tl!("Radial Gradient")),
+                ("angle", "rotate-cw", tl!("Angle Gradient")),
+                ("reflected", "arrow-left-right", tl!("Reflected Gradient")),
+                ("diamond", "diamond", tl!("Diamond Gradient")),
+            ] {
+                if icons::button(ui, icon, 24.0, app.ui.tool_options.gradient_style == style, tip).clicked() {
+                    app.ui.tool_options.gradient_style = style.into();
+                }
+            }
+            ui.spacing_mut().item_spacing.x = 8.0;
+            widgets::vline(ui, 22.0);
+            opt_label(ui, tl!("Mode"));
+            let opts: Vec<(BlendMode, &str)> = BlendMode::LAYER_MODES.iter().map(|m| (*m, m.label())).collect();
+            // The wheel over it steps the mode, as over the Layers panel's (#2061).
+            widgets::dropdown_wheel_hovered(ui, "gradient-blend-mode", tl!("Blend Mode"), &mut app.ui.tool_options.gradient_blend_mode, &opts, 96.0);
+            opt_label(ui, tl!("Opacity"));
+            let r = widgets::value_field(ui, &mut app.ui.tool_options.fill_opacity, 1.0..=100.0, "%", 62.0);
+            // Live while scrubbed, one undo step per scrub (#5012).
+            let drag_key = r.id.with("gradient-opacity-drag");
+            if r.drag_started() {
+                let n = ui.ctx().cumulative_pass_nr();
+                ui.data_mut(|d| d.insert_temp(drag_key, n));
+            }
+            if r.changed() {
+                let drag = if r.dragged() { ui.data(|d| d.get_temp::<u64>(drag_key)) } else { None };
+                crate::gradient_ui::opacity_changed(app, drag);
+            }
+            widgets::checkbox(ui, &mut app.ui.tool_options.gradient_reverse, tl!("Reverse"));
+            widgets::checkbox(ui, &mut app.ui.tool_options.gradient_dither, tl!("Dither"));
+            // Live mode: the options also change a selected gradient fill layer.
+            crate::gradient_ui::options_changed(app, &before);
+        }
+        Tool::PerspectiveCrop => crate::perspective_crop_ui::options_bar(app, ui),
+        Tool::Crop => {
+            let before_ratio = crate::crop_ui::preset_ratio(app);
+            let doc_size = app.session.active().map_or((0.0, 0.0), |s| (f64::from(s.doc.size.width), f64::from(s.doc.size.height)));
+            // Ratios, sizes, saved presets, New / Delete Crop Preset… (#2443, #1919).
+            crate::crop_presets::dropdown(app, ui);
+            let o = &mut app.ui.tool_options;
+            let mut ratio_base = None;
+            if o.crop_ratio == crate::crop_size::WHR {
+                crate::crop_size::fields(o, ui);
+            } else {
+                // Keep partial edits in ToolOptions so the first side survives a frame;
+                // Original Ratio shows the document's numbers, as Photoshop does.
+                let (mut rw, mut rh) = crate::crop_size::custom_ratio_fields(o, doc_size);
+                let decimals = crate::crop_size::RATIO_DECIMALS;
+                let fw = widgets::value_field_prec(ui, &mut rw, 0.0..=99_999.0, "", 54.0, decimals);
+                let swap = icons::button(ui, "arrow-left-right", 22.0, false, tl!("Swaps height and width")).clicked();
+                let fh = widgets::value_field_prec(ui, &mut rh, 0.0..=99_999.0, "", 54.0, decimals);
+                let (cw, ch) = (fw.changed(), fh.changed());
+                if swap {
+                    std::mem::swap(&mut rw, &mut rh);
+                }
+                if cw || ch || swap {
+                    crate::crop_size::set_custom_ratio_fields(o, rw, rh);
+                }
+                // Every ratio typed or scrubbed in one edit fits from the frame the edit
+                // started with: 1:3 on the way to 16:3 mustn't shrink it first (#7752).
+                let base_id = egui::Id::unique("crop-ratio-edit-base");
+                if cw || ch {
+                    ratio_base = ui.data(|d| d.get_temp::<[f64; 4]>(base_id)).or(app.ui.crop_rect);
+                }
+                if ![&fw, &fh].iter().any(|f| f.has_focus() || f.dragged()) {
+                    ui.data_mut(|d| d.remove::<[f64; 4]>(base_id));
+                } else if let Some(base) = ratio_base {
+                    ui.data_mut(|d| d.insert_temp(base_id, base));
+                }
+            }
+            widgets::vline(ui, 22.0);
+            if widgets::secondary_button(ui, tl!("Clear"), 0.0).clicked() {
+                crate::crop_size::clear_ratio(o);
+            }
+            crate::crop_straighten::options_button(&mut app.crop.straighten, ui);
+            crate::crop_overlay::options_button(o, ui);
+            let pick_shield_color = crate::crop_shield::options_button(&mut o.crop_shield, ui);
+            widgets::checkbox(ui, &mut o.crop_delete, tl!("Delete Cropped Pixels"));
+            // Fill: what a turned or extending crop puts where the image doesn't reach
+            // (#3823). Generative Expand is not offered.
+            ui.label(tl!("Fill:"));
+            widgets::dropdown(
+                ui,
+                "crop-fill",
+                tl!("Fill:"),
+                &mut o.crop_content_aware,
+                &[(false, tl!("Background (Default)")), (true, tl!("Content-Aware Fill"))],
+                150.0,
+            );
+            if crate::crop_ui::preset_ratio(app) != before_ratio {
+                match ratio_base {
+                    Some(base) => crate::crop_ui::apply_ratio_from(app, base),
+                    None => crate::crop_ui::apply_ratio(app),
+                }
+            }
+            if pick_shield_color {
+                crate::crop_shield::pick_custom_color(app);
+            }
+            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                if icons::button(
+                    ui,
+                    "check",
+                    26.0,
+                    false,
+                    &crate::i18n::fmt(tl!("Commit current crop operation  ({key})"), &[("key", &crate::shortcuts::pretty("Enter"))]),
+                )
+                .clicked()
+                {
+                    crate::canvas::commit_crop(app);
+                }
+                if icons::button(ui, "ban", 26.0, false, tl!("Cancel current crop operation  (Esc)")).clicked() {
+                    crate::crop_ui::cancel(app);
+                }
+            });
+        }
+        // Every theme gets the font, style and size controls (#1387), as with Auto-Select (#1275).
+        Tool::Type | Tool::VerticalType | Tool::HorizontalTypeMask | Tool::VerticalTypeMask => crate::type_tool::options_bar(app, ui),
+        _ => {}
+    }
+}
+
+fn is_selection_options_tool(tool: Tool) -> bool {
+    matches!(
+        tool,
+        Tool::RectMarquee
+            | Tool::EllipseMarquee
+            | Tool::SingleRowMarquee
+            | Tool::SingleColumnMarquee
+            | Tool::Lasso
+            | Tool::PolygonLasso
+            | Tool::MagneticLasso
+            | Tool::MagicWand
+            | Tool::PaintBucket
+            | Tool::Gradient
+            | Tool::PerspectiveCrop
+            | Tool::Crop
+            | Tool::Type
+            | Tool::VerticalType
+            | Tool::HorizontalTypeMask
+            | Tool::VerticalTypeMask
+    )
+}
+
+fn tool_specific_options(app: &mut PhotocraftApp, ui: &mut egui::Ui, t: Tokens, tool: Tool, b: &mut BrushSettings) {
+    if matches!(app.ui.tool, Tool::Brush | Tool::Eraser | Tool::Pencil | Tool::MixerBrush) {
+        brush_specific_options(app, ui, t, b);
+        return;
+    }
+    if is_selection_options_tool(app.ui.tool) {
+        selection_specific_options(app, ui, tool);
+        return;
+    }
+    match app.ui.tool {
+        Tool::Move => {
+            let o = &mut app.ui.tool_options;
+            widgets::checkbox(ui, &mut o.move_auto_select, tl!("Auto-Select:"));
+            widgets::dropdown(
+                ui,
+                "move-target",
+                tl!("Auto-Select:"),
+                &mut o.move_target,
+                &[("layer".to_string(), tl!("Layer")), ("group".to_string(), tl!("Group"))],
+                76.0,
+            );
+            widgets::vline(ui, 22.0);
+            widgets::checkbox(ui, &mut o.move_show_transform, tl!("Show Transform Controls"));
+            widgets::vline(ui, 22.0);
+            crate::align_bar::options(app, ui);
+        }
+        Tool::Eyedropper => crate::eyedropper_ui::options(app, ui),
+        Tool::Zoom => {
+            // Resize Windows to Fit is Preferences › Zoom Resizes Windows itself, as in
+            // Photoshop: one setting, shown in both places (zoom_window_fit.rs).
+            let mut fit = app.session.prefs().general.zoom_resizes_windows;
+            if widgets::checkbox(ui, &mut fit, tl!("Resize Windows to Fit")).changed() {
+                app.session.prefs.edit(|p| p.general.zoom_resizes_windows = fit);
+            }
+            widgets::checkbox(ui, &mut app.ui.tool_options.zoom_scrubby, tl!("Scrubby Zoom"));
+            hint(
+                ui,
+                &crate::i18n::fmt(
+                    tl!("Click to zoom in  ·  {key}-click to zoom out  ·  drag right/left to zoom in/out"),
+                    &[("key", &crate::shortcuts::pretty("Alt"))],
+                ),
+            );
+            if widgets::secondary_button(ui, tl!("Fit Screen"), 0.0).clicked()
+                && let Some(i) = app.session.active_index()
+            {
+                app.ui.views[i].fit_pending = true;
+                app.ui.views[i].request_zoom_animation(app.session.prefs().general.animated_zoom);
+                app.ui.views[i].zoom_anchor = None;
+            }
+            if widgets::secondary_button(ui, "100%", 0.0).clicked()
+                && let Some(i) = app.session.active_index()
+            {
+                app.ui.views[i].zoom = 1.0;
+                app.ui.views[i].request_zoom_animation(app.session.prefs().general.animated_zoom);
+                app.ui.views[i].zoom_anchor = None;
+                app.ui.views[i].fit_pending = false;
+                app.ui.views[i].fill_pending = false;
+            }
+        }
+        Tool::RotateView => {
+            hint(ui, tl!("Drag around the centre to rotate the view  ·  Shift constrains to 15°"));
+            if let Some(i) = app.session.active_index() {
+                ui.label(tl!("Angle"));
+                let mut angle = app.ui.views.get(i).map(|v| v.rotation).unwrap_or(0.0);
+                if widgets::value_field(ui, &mut angle, -180.0..=180.0, "°", 56.0).changed()
+                    && let Some(v) = app.ui.views.get_mut(i)
+                {
+                    v.rotation = crate::rotate_view::wrap_deg(angle);
+                }
+                if widgets::secondary_button(ui, tl!("Reset View"), 0.0).clicked()
+                    && let Some(v) = app.ui.views.get_mut(i)
+                {
+                    v.rotation = 0.0;
+                }
+            }
+        }
+        Tool::Hand => {
+            hint(ui, tl!("Drag to pan  ·  hold Space with any tool"));
+            if widgets::secondary_button(ui, "100%", 0.0).clicked()
+                && let Some(i) = app.session.active_index()
+            {
+                app.ui.views[i].zoom = 1.0;
+                app.ui.views[i].request_zoom_animation(app.session.prefs().general.animated_zoom);
+                app.ui.views[i].zoom_anchor = None;
+                app.ui.views[i].fit_pending = false;
+                app.ui.views[i].fill_pending = false;
+            }
+            if widgets::secondary_button(ui, tl!("Fit Screen"), 0.0).clicked()
+                && let Some(i) = app.session.active_index()
+            {
+                app.ui.views[i].fit_pending = true;
+                app.ui.views[i].request_zoom_animation(app.session.prefs().general.animated_zoom);
+                app.ui.views[i].zoom_anchor = None;
+                app.ui.views[i].fill_pending = false;
+            }
+            if widgets::secondary_button(ui, tl!("Fill Screen"), 0.0).clicked()
+                && let Some(i) = app.session.active_index()
+            {
+                app.ui.views[i].fill_pending = true;
+                app.ui.views[i].request_zoom_animation(app.session.prefs().general.animated_zoom);
+                app.ui.views[i].zoom_anchor = None;
+                app.ui.views[i].fit_pending = false;
+            }
+        }
+        // Retouching and smart-selection tools draw their bar in `retouch_ui::options_bar`.
+        _ => {}
+    }
+}
+
 /// Width of the Layers panel's Opacity and Fill fields, with room for their pop-up slider's ▾.
 pub(super) const LAYER_PCT_W: f32 = 66.0 + widgets::POPUP_ARROW_W;
 
diff --git a/crates/ui-egui/src/panels/preset_panels.rs b/crates/ui-egui/src/panels/preset_panels.rs
index b06e3145f7..fcd33e89cb 100644
--- a/crates/ui-egui/src/panels/preset_panels.rs
+++ b/crates/ui-egui/src/panels/preset_panels.rs
@@ -369,6 +369,49 @@ pub(crate) struct Place<'a> {
 const GRID_GAP: f32 = 4.0;
 const GRID_INSET: f32 = 8.0;
 
+struct GroupHeaderContext<'a> {
+    panel: &'a str,
+    open: bool,
+    state: &'a mut PresetUi,
+    tokens: &'a Tokens,
+    events: &'a mut Vec<Ev>,
+}
+
+fn draw_group_header(ui: &mut egui::Ui, group: &GroupView, context: GroupHeaderContext<'_>) -> (Rect, Option<Pos2>, Option<Pos2>) {
+    let GroupHeaderContext { panel, open, state, tokens, events } = context;
+    let (rect, response) = ui.allocate_exact_size(vec2(ui.available_width(), 22.0), Sense::click_and_drag());
+    if response.hovered() || response.dragged() {
+        ui.painter().rect_filled(rect, 2.0, tokens.hover.gamma_multiply(0.5));
+    }
+    let triangle = Rect::from_center_size(pos2(rect.left() + 9.0, rect.center().y), vec2(12.0, 12.0));
+    crate::icons::paint(ui, triangle, if open { "chevron-down" } else { "chevron-right" }, 10.0, tokens.text_dim);
+    let folder = Rect::from_center_size(pos2(rect.left() + 25.0, rect.center().y), vec2(14.0, 14.0));
+    crate::icons::paint(ui, folder, if open { "folder-open" } else { "folder" }, 12.0, tokens.icon);
+    ui.painter().text(pos2(rect.left() + 37.0, rect.center().y), Align2::LEFT_CENTER, &group.name, FontId::proportional(11.5), tokens.text);
+    if response.clicked() {
+        let key = format!("{panel}/{}", group.name);
+        if !state.toggled.remove(&key) {
+            state.toggled.insert(key);
+        }
+    }
+    response.context_menu(|ui| {
+        if ui.button(tl!("Rename Group…")).clicked() {
+            state.renaming = Some((panel.to_string(), format!("group:{}", group.name), group.name.clone()));
+            ui.close();
+        }
+        if ui.button(tl!("Delete Group")).clicked() {
+            events.push(Ev::DeleteGroup(group.name.clone()));
+            ui.close();
+        }
+    });
+    let drag = if response.dragged() { ui.ctx().pointer_interact_pos() } else { None };
+    if drag.is_some() {
+        ui.ctx().set_cursor_icon(egui::CursorIcon::Grabbing);
+    }
+    let released = if response.drag_stopped() { ui.ctx().pointer_interact_pos() } else { None };
+    (rect, drag, released)
+}
+
 pub(crate) fn browser(
     ui: &mut egui::Ui,
     st: &mut PresetUi,
@@ -427,41 +470,12 @@ pub(crate) fn browser(
             for &gi in &display {
                 let Some(g) = groups.get(gi) else { continue };
                 let open = group_open(st, panel, gi, &g.name);
-                let (hr, hresp) = ui.allocate_exact_size(vec2(ui.available_width(), 22.0), Sense::click_and_drag());
-                if hresp.hovered() || hresp.dragged() {
-                    ui.painter().rect_filled(hr, 2.0, t.hover.gamma_multiply(0.5));
+                let (hr, header_drag, header_release) = draw_group_header(ui, g, GroupHeaderContext { panel, open, state: st, tokens: &t, events: &mut ev });
+                if let Some(position) = header_drag {
+                    drag = Some((gi, position));
                 }
-                let tri = Rect::from_center_size(pos2(hr.left() + 9.0, hr.center().y), vec2(12.0, 12.0));
-                crate::icons::paint(ui, tri, if open { "chevron-down" } else { "chevron-right" }, 10.0, t.text_dim);
-                let fold = Rect::from_center_size(pos2(hr.left() + 25.0, hr.center().y), vec2(14.0, 14.0));
-                crate::icons::paint(ui, fold, if open { "folder-open" } else { "folder" }, 12.0, t.icon);
-                ui.painter().text(pos2(hr.left() + 37.0, hr.center().y), Align2::LEFT_CENTER, &g.name, FontId::proportional(11.5), t.text);
-                if hresp.clicked() {
-                    let k = format!("{panel}/{}", g.name);
-                    if !st.toggled.remove(&k) {
-                        st.toggled.insert(k);
-                    }
-                }
-                hresp.context_menu(|ui| {
-                    if ui.button(tl!("Rename Group…")).clicked() {
-                        st.renaming = Some((panel.to_string(), format!("group:{}", g.name), g.name.clone()));
-                        ui.close();
-                    }
-                    if ui.button(tl!("Delete Group")).clicked() {
-                        ev.push(Ev::DeleteGroup(g.name.clone()));
-                        ui.close();
-                    }
-                });
-                if hresp.dragged()
-                    && let Some(p) = ui.ctx().pointer_interact_pos()
-                {
-                    drag = Some((gi, p));
-                    ui.ctx().set_cursor_icon(egui::CursorIcon::Grabbing);
-                }
-                if hresp.drag_stopped()
-                    && let Some(p) = ui.ctx().pointer_interact_pos()
-                {
-                    released = Some((gi, p));
+                if let Some(position) = header_release {
+                    released = Some((gi, position));
                 }
                 headers.push((gi, hr, g.name.clone()));
                 if !open {
diff --git a/crates/ui-egui/src/panels/preset_panels/panels.rs b/crates/ui-egui/src/panels/preset_panels/panels.rs
index 27a441fa5f..7aa89c5ccc 100644
--- a/crates/ui-egui/src/panels/preset_panels/panels.rs
+++ b/crates/ui-egui/src/panels/preset_panels/panels.rs
@@ -1,4 +1,7 @@
-use super::*;
+use super::{
+    Align2, Color32, CornerRadius, Ev, FontId, GroupView, ItemView, PhotocraftApp, Place, Pos2, Rect, Sense, Stroke, TextureHandle, Tokens, Tool, Value,
+    browser, canvas_drop_rect, empty, generic, json, paint_gradient, pattern_texture, pos2, run, shape_texture, style_texture, vec2,
+};
 
 // ------------------------------------------------------------------ Gradients
 
diff --git a/crates/ui-egui/src/panels/properties.rs b/crates/ui-egui/src/panels/properties.rs
index 43400674bc..0607c5ca30 100644
--- a/crates/ui-egui/src/panels/properties.rs
+++ b/crates/ui-egui/src/panels/properties.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{CornerRadius, Layer, LayerContent, LayerId, PhotocraftApp, Rect, RichText, Sense, Stroke, Tokens, empty, icons, json, pos2, theme, vec2, widgets};
 
 // ----------------------------------------------------------------------------- properties
 
diff --git a/crates/ui-egui/src/panels/props_layout/tests.rs b/crates/ui-egui/src/panels/props_layout/tests.rs
index 62e9423f44..88a61c518c 100644
--- a/crates/ui-egui/src/panels/props_layout/tests.rs
+++ b/crates/ui-egui/src/panels/props_layout/tests.rs
@@ -174,14 +174,14 @@ fn type_controls_fill_the_panel_at_every_width_and_scale() {
                 .filter(|r| r.top() >= transform.bottom() && r.bottom() <= header.top())
                 .map(|r| r.right())
                 .fold(f32::MIN, f32::max);
-            // (Both rows have a unit suffix: compare with the size/leading row.)
-            // Variable-font axes can precede the size/leading row and have no unit suffix.
-            // Compare the intended point-valued controls, retaining the same edge tolerance.
-            let lead = ["Font size", "Leading (set to the font size × auto-leading when Auto)"]
-                .into_iter()
-                .map(|label| h.get_by_role_and_label(egui::accesskit::Role::SpinButton, label).rect().right())
-                .fold(f32::MIN, f32::max);
-            assert!((t_right - lead).abs() < 0.5, "{what}: Transform fields end at {t_right}, Character at {lead}");
+            // The size/leading row ends in the leading presets chevron at the panel's right edge,
+            // where Transform's field boxes end. The leading box ends where the chevron starts:
+            // its number stops one unit suffix ("pt", like Transform's "px") short of it.
+            let chevron = h.get_by_role_and_label(egui::accesskit::Role::ComboBox, "Leading presets").rect();
+            let lead = h.get_by_role_and_label(egui::accesskit::Role::SpinButton, "Leading (set to the font size × auto-leading when Auto)").rect();
+            assert!((chevron.right() - header.right()).abs() < 0.5, "{what}: Character controls end at {}, panel {}", chevron.right(), header.right());
+            let (t_suffix, lead_suffix) = (header.right() - t_right, chevron.left() - lead.right());
+            assert!((t_suffix - lead_suffix).abs() < 0.5, "{what}: Transform's suffix slot {t_suffix}, the leading field's {lead_suffix} (overlap or gap)");
             // Quick Actions buttons span the panel too.
             let qa = h.get_by_label("Rasterize Type").rect();
             assert!(qa.right() >= header.right() - 2.0 && qa.right() <= header.right() + 1.0, "{what}: {qa:?}");
diff --git a/crates/ui-egui/src/panels/smart_ui.rs b/crates/ui-egui/src/panels/smart_ui.rs
index 0f0c87ad58..8e531b47b6 100644
--- a/crates/ui-egui/src/panels/smart_ui.rs
+++ b/crates/ui-egui/src/panels/smart_ui.rs
@@ -130,16 +130,9 @@ pub fn filter_rows(app: &mut PhotocraftApp, ui: &mut egui::Ui, doc: &Document, l
         if t.pro {
             ui.painter().line_segment([pos2(rect.left() + 30.0, rect.top()), pos2(rect.left() + 30.0, rect.bottom())], Stroke::new(1.0, t.separator));
         }
-        let (name, on) = match index {
-            None => (tl!("Smart Filters").to_string(), sm.filters_enabled),
-            Some(i) => (filter_label(&sm.smart_filters[i]), sm.smart_filters[i].visible && sm.filters_enabled),
-        };
+        let (name, on, shown) = filter_row_label(sm, index);
         let eye = Rect::from_center_size(pos2(rect.left() + indent + if index.is_none() { 9.0 } else { 41.0 }, rect.center().y), vec2(18.0, 18.0));
         let eye_resp = ui.interact(eye, ui.scope_id().with(("sf-eye", l.id.0, index)), Sense::click());
-        let shown = match index {
-            None => sm.filters_enabled,
-            Some(i) => sm.smart_filters[i].visible,
-        };
         if shown {
             icons::paint(ui, eye, "eye", 12.0, if on { t.icon } else { t.text_faint });
         }
@@ -153,11 +146,7 @@ pub fn filter_rows(app: &mut PhotocraftApp, ui: &mut egui::Ui, doc: &Document, l
         // The shared mask scales with the thumbnail setting (hidden at None); the header name
         // follows it, while filter names stay aligned past their eyes.
         let mask_left = rect.left() + indent + 28.0;
-        let x = match index {
-            None if mask_size > 0.0 => mask_left + mask_size + 8.0,
-            None => mask_left,
-            Some(_) => rect.left() + indent + 60.0,
-        };
+        let x = filter_label_x(rect.left(), indent, mask_size, index);
         if index.is_none() && mask_size > 0.0 {
             let sw = Rect::from_min_size(pos2(mask_left, rect.center().y - mask_size / 2.0), vec2(mask_size, mask_size));
             if let Some(mask) = &sm.filter_mask {
@@ -237,6 +226,24 @@ pub fn filter_rows(app: &mut PhotocraftApp, ui: &mut egui::Ui, doc: &Document, l
     }
 }
 
+fn filter_row_label(sm: &SmartObject, index: Option<usize>) -> (String, bool, bool) {
+    match index {
+        None => (tl!("Smart Filters").to_string(), sm.filters_enabled, sm.filters_enabled),
+        Some(i) => {
+            let filter = &sm.smart_filters[i];
+            (filter_label(filter), filter.visible && sm.filters_enabled, filter.visible)
+        }
+    }
+}
+
+fn filter_label_x(left: f32, indent: f32, mask_size: f32, index: Option<usize>) -> f32 {
+    match index {
+        None if mask_size > 0.0 => left + indent + 28.0 + mask_size + 8.0,
+        None => left + indent + 28.0,
+        Some(_) => left + indent + 60.0,
+    }
+}
+
 /// What a click on the filter mask thumbnail does: target it for painting (selecting the smart
 /// object), ⌥ view it alone (⇧⌥ as an overlay), ⇧ disable or enable it.
 fn filter_mask_click(l: &Layer, sm: &SmartObject, m: egui::Modifiers) -> Vec<(String, Value)> {
diff --git a/crates/ui-egui/src/panels/status_bar.rs b/crates/ui-egui/src/panels/status_bar.rs
index 007a5805a3..79ca2ef355 100644
--- a/crates/ui-egui/src/panels/status_bar.rs
+++ b/crates/ui-egui/src/panels/status_bar.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{PhotocraftApp, RichText, Tokens, label, vec2, widgets};
 
 // ----------------------------------------------------------------------------- status bar
 
@@ -23,7 +23,7 @@ pub fn status_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                     ui.with_layout(crate::direction::trailing(), |ui| {
                         crate::jobs_ui::status_progress(app, ui);
                         crate::background_redraw::status(app, ui);
-                        crate::chrome_ui::gpu_memory_status(app, ui);
+                        crate::chrome_ui::render_path_status(app, ui);
                     });
                     return;
                 }
@@ -67,7 +67,7 @@ pub fn status_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                         crate::jobs_ui::status_progress(app, ui);
                     }
                     crate::background_redraw::status(app, ui);
-                    crate::chrome_ui::gpu_memory_status(app, ui);
+                    crate::chrome_ui::render_path_status(app, ui);
                 });
             });
         });
diff --git a/crates/ui-egui/src/panels/title_bar.rs b/crates/ui-egui/src/panels/title_bar.rs
index 10c797eb20..d93315af10 100644
--- a/crates/ui-egui/src/panels/title_bar.rs
+++ b/crates/ui-egui/src/panels/title_bar.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{PhotocraftApp, Sense, Tokens, icons, theme, vec2, widgets};
 
 // ----------------------------------------------------------------------------- title bar
 
diff --git a/crates/ui-egui/src/panels/toolbar.rs b/crates/ui-egui/src/panels/toolbar.rs
index 6fb61129b9..c6c7a3567d 100644
--- a/crates/ui-egui/src/panels/toolbar.rs
+++ b/crates/ui-egui/src/panels/toolbar.rs
@@ -1,5 +1,5 @@
 use super::options_bar::reveal_focused_control;
-use super::*;
+use super::{Align2, Color32, PhotocraftApp, Pos2, Rect, Sense, Stroke, StrokeKind, Tokens, Tool, c32, icons, json, pos2, vec2};
 
 // ----------------------------------------------------------------------------- toolbar
 
diff --git a/crates/ui-egui/src/panels/type_panels_ui.rs b/crates/ui-egui/src/panels/type_panels_ui.rs
index 02c99b9dd4..d95c22addb 100644
--- a/crates/ui-egui/src/panels/type_panels_ui.rs
+++ b/crates/ui-egui/src/panels/type_panels_ui.rs
@@ -373,8 +373,8 @@ fn options_editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, paragraph: bool, s
     let defined = |attrs: &Value, k: &str| attrs.get(k).is_some();
     // Preferences ▸ Type ▸ Font Preview Size sizes the family picker's samples.
     let preview = app.session.prefs().type_.font_preview;
-    // The fonts the pickers hoist to the top (Preferences ▸ Type ▸ Recent Fonts).
-    let recents = app.ui.recent_fonts.clone();
+    // The font picker's favourites and recent fonts; a star clicked in it is applied below.
+    let mut library = crate::type_tool::FontLibrary::of(app);
     // Preferences ▸ Units & Rulers ▸ Type: the model stores points; the fields may show pixels
     // (by the document's resolution) or millimetres.
     let (type_unit, unit_label) = crate::type_tool::type_unit(app);
@@ -402,8 +402,12 @@ fn options_editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, paragraph: bool, s
             ui.add_enabled_ui(on, |ui| match kind {
                 "font" => {
                     let mut f = v.as_str().unwrap_or("").to_string();
-                    if family_picker(ui, &format!("style-font-{paragraph}-{id}"), &mut f, preview, &recents) {
-                        set = Some(json!({ panel: f }));
+                    if family_picker(ui, &format!("style-font-{paragraph}-{id}"), &mut f, preview, &mut library) {
+                        // A style picked under the family's ">" comes with it.
+                        set = Some(match library.picked_style.take() {
+                            Some(style) => json!({ panel: f, "fontStyle": style }),
+                            None => json!({ panel: f }),
+                        });
                     }
                 }
                 "pt" | "num" | "leading" => {
@@ -502,6 +506,7 @@ fn options_editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, paragraph: bool, s
             }
         }
     });
+    library.finish(app);
     if let Some(attrs) = set {
         let _ = run(app, &format!("{prefix}.set"), json!({ "id": id, "attrs": attrs }));
     }
@@ -524,13 +529,19 @@ fn options_editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, paragraph: bool, s
     }
 }
 
-/// Searchable family combo box.
-fn family_picker(ui: &mut egui::Ui, salt: &str, current: &mut String, preview: photocraft_engine::prefs::FontPreview, recents: &[String]) -> bool {
+/// Searchable family combo box, starring and listing first the fonts of `library`.
+fn family_picker(
+    ui: &mut egui::Ui,
+    salt: &str,
+    current: &mut String,
+    preview: photocraft_engine::prefs::FontPreview,
+    library: &mut crate::type_tool::FontLibrary,
+) -> bool {
     if !crate::type_tool::fonts_ready(ui, 140.0) {
         return false;
     }
     let mut shown = if current.is_empty() { photocraft_text::fonts::DEFAULT_FAMILY.to_string() } else { current.clone() };
-    let changed = crate::type_tool::family_picker_in(ui, salt, &mut shown, 140.0, &crate::type_tool::families(), preview, recents);
+    let changed = crate::type_tool::family_picker_in(ui, salt, &mut shown, 140.0, &crate::type_tool::families(), preview, library);
     if changed {
         *current = shown;
     }
@@ -624,10 +635,14 @@ pub fn glyphs_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     // Font family + style.
     ui.horizontal(|ui| {
         let mut f = family.clone();
-        if family_picker(ui, "glyph-family", &mut f, app.session.prefs().type_.font_preview, &app.ui.recent_fonts) {
+        let mut library = crate::type_tool::FontLibrary::of(app);
+        let picked = family_picker(ui, "glyph-family", &mut f, app.session.prefs().type_.font_preview, &mut library);
+        let picked_style = library.picked_style.take();
+        library.finish(app);
+        if picked {
             app.note_recent_font(&f);
             app.ui.type_panels.glyph_family = f;
-            app.ui.type_panels.glyph_style = tl!("Regular").into();
+            app.ui.type_panels.glyph_style = picked_style.unwrap_or_else(|| tl!("Regular").into());
         }
         let styles = crate::type_tool::styles(&family);
         let mut s = style.clone();
diff --git a/crates/ui-egui/src/pen_variants_tests.rs b/crates/ui-egui/src/pen_variants_tests.rs
index cee8e37bbd..330f2bc6f3 100644
--- a/crates/ui-egui/src/pen_variants_tests.rs
+++ b/crates/ui-egui/src/pen_variants_tests.rs
@@ -273,3 +273,39 @@ fn undo_in_a_resumed_draft_stops_at_the_paths_own_anchors() {
     assert!(app.ui.direct_selection.anchors.is_empty());
     assert_eq!(work_path(&app), before, "the path is as it was");
 }
+
+/// #6079 review: Make Selection hides the Work Path. A Pen press on its old endpoint then starts a
+/// new Work Path that replaces it, as Photoshop does with no path selected, instead of carrying on
+/// the hidden one. A shown Work Path and a selected saved path still carry on.
+#[test]
+fn the_pen_does_not_carry_on_a_work_path_hidden_by_make_selection() {
+    let mut app = app(Tool::Pen);
+    let anchors = |p: &Path| -> Vec<Vec<[f64; 2]>> { p.subpaths.iter().map(|s| s.knots.iter().map(|k| [k.anchor.x, k.anchor.y]).collect()).collect() };
+    click(&mut app, 20.0, 20.0);
+    click(&mut app, 80.0, 20.0);
+    crate::vector_ui::pen_commit(&mut app, false);
+    crate::vector_ui::path_to_selection(&mut app, json!({})).unwrap();
+    assert!(!crate::vector_ui::work_path_shown(&app), "Make Selection hid the Work Path");
+    click(&mut app, 80.0, 20.0);
+    click(&mut app, 80.0, 80.0);
+    crate::vector_ui::pen_commit(&mut app, false);
+    assert_eq!(anchors(&work_path(&app)), [vec![[80.0, 20.0], [80.0, 80.0]]], "a new Work Path, not the hidden one carried on");
+    // The new Work Path is shown and selected: it carries on as before.
+    click(&mut app, 80.0, 80.0);
+    click(&mut app, 140.0, 80.0);
+    crate::vector_ui::pen_commit(&mut app, false);
+    assert_eq!(anchors(&work_path(&app)), [vec![[80.0, 20.0], [80.0, 80.0], [140.0, 80.0]]]);
+    // A saved path selected in the Paths panel carries on while the Work Path is hidden.
+    let open = json!({"subpaths": [{"closed": false, "knots": [{"anchor": [150.0, 150.0]}, {"anchor": [200.0, 150.0]}]}]});
+    app.run("path.set", json!({"name": "Saved", "path": open})).unwrap();
+    crate::vector_ui::path_to_selection(&mut app, json!({})).unwrap();
+    assert!(!crate::vector_ui::work_path_shown(&app));
+    app.ui.selected_path = Some("Saved".into());
+    click(&mut app, 200.0, 150.0);
+    click(&mut app, 200.0, 190.0);
+    crate::vector_ui::pen_commit(&mut app, false);
+    let st = app.session.active().unwrap();
+    let saved = st.doc.paths.iter().find(|p| p.name == "Saved").unwrap();
+    assert_eq!(anchors(&saved.path), [vec![[150.0, 150.0], [200.0, 150.0], [200.0, 190.0]]], "the saved path carried on");
+    assert_eq!(anchors(&work_path(&app)).len(), 1, "the hidden Work Path untouched");
+}
diff --git a/crates/ui-egui/src/prefs/prefs_ui/appearance.rs b/crates/ui-egui/src/prefs/prefs_ui/appearance.rs
index bf08302397..87405f606e 100644
--- a/crates/ui-egui/src/prefs/prefs_ui/appearance.rs
+++ b/crates/ui-egui/src/prefs/prefs_ui/appearance.rs
@@ -1,6 +1,6 @@
 use super::dialogs::open_preferences;
 use super::fields::{choice_label, color_of, preference_matches};
-use super::*;
+use super::{AppearanceMode, Color32, DarkTheme, LightTheme, Map, PhotocraftApp, RichText, SavedTheme, Sense, ThemeKind, Tokens, Value, json, prefs, vec2};
 
 /// The GPU canvas colours from Preferences › Transparency & Gamut.
 pub fn canvas_style(app: &PhotocraftApp) -> crate::gpu_canvas::CanvasStyle {
diff --git a/crates/ui-egui/src/prefs/prefs_ui/dialogs.rs b/crates/ui-egui/src/prefs/prefs_ui/dialogs.rs
index 8a1b298100..c1519b48d9 100644
--- a/crates/ui-egui/src/prefs/prefs_ui/dialogs.rs
+++ b/crates/ui-egui/src/prefs/prefs_ui/dialogs.rs
@@ -1,5 +1,5 @@
 use super::shortcuts::shortcut_items;
-use super::*;
+use super::{BTreeMap, DialogKind, Map, PhotocraftApp, RichText, SECTIONS, Tokens, Value, json, prefs};
 
 // ------------------------------------------------------------------ menu routing
 
diff --git a/crates/ui-egui/src/prefs/prefs_ui/fields.rs b/crates/ui-egui/src/prefs/prefs_ui/fields.rs
index f4141464d0..2258a3f7be 100644
--- a/crates/ui-egui/src/prefs/prefs_ui/fields.rs
+++ b/crates/ui-egui/src/prefs/prefs_ui/fields.rs
@@ -2,7 +2,7 @@ use super::appearance::{AppearanceRows, appearance_rows, system_theme};
 use super::dialogs::{mismatch_body, presets_body, presets_io_body, settings_height};
 use super::graphics::{gpu_memory_lines, gpu_status_rows, memory_usage_row, read_at_launch, rendering_mode_row};
 use super::shortcuts::shortcuts_body;
-use super::*;
+use super::{Color32, Map, PhotocraftApp, RichText, SECTIONS, Sense, Tokens, Value, json, prefs, vec2};
 
 // ------------------------------------------------------------------ bodies
 
@@ -63,6 +63,10 @@ pub(super) fn humanize(key: &str) -> String {
     if key == "doNotAppendCopy" {
         return "Do not append \"copy\" to filename when saving a copy".into();
     }
+    // Plug-ins: Photoshop's wording (#9392).
+    if key == "generatorEnabled" {
+        return "Enable Generator".into();
+    }
     if key == "lowLatencyDrawing" {
         return "Low-Latency Drawing (vsync off, applies at next launch)".into();
     }
@@ -245,8 +249,16 @@ fn prefs_body(ui: &mut egui::Ui, f: &mut Map<String, Value>, system: Option<egui
                 if search.trim().is_empty()
                     && has_visible_fields(&values, &section)
                     && crate::widgets::secondary_button(ui, tl!("Reset Section"), 110.0).clicked()
-                    && let Some(def) = prefs::Preferences::default().get(&section)
+                    && let Some(mut def) = prefs::Preferences::default().get(&section)
                 {
+                    // The favourite fonts are the user's library, not a Type setting: kept, as
+                    // `prefs.reset {"path": "type"}` keeps them.
+                    if section == "type"
+                        && let Some(favorites) = values.get(&section).and_then(|v| v.get("favoriteFonts")).cloned()
+                        && let Some(def) = def.as_object_mut()
+                    {
+                        def.insert("favoriteFonts".into(), favorites);
+                    }
                     values[&section] = def;
                 }
             });
diff --git a/crates/ui-egui/src/prefs/prefs_ui/graphics.rs b/crates/ui-egui/src/prefs/prefs_ui/graphics.rs
index 63930425ea..166f5ed299 100644
--- a/crates/ui-egui/src/prefs/prefs_ui/graphics.rs
+++ b/crates/ui-egui/src/prefs/prefs_ui/graphics.rs
@@ -1,5 +1,5 @@
 use super::fields::choice_label;
-use super::*;
+use super::{Map, PhotocraftApp, RichText, Tokens, Value, json, prefs};
 
 /// Performance › Graphics: the compositor's GPU memory budget and whether the active document's
 /// layers fit it (the GPU Memory preference sets it).
diff --git a/crates/ui-egui/src/prefs/prefs_ui/save.rs b/crates/ui-egui/src/prefs/prefs_ui/save.rs
index 78408b5e1f..9dba6f78f2 100644
--- a/crates/ui-egui/src/prefs/prefs_ui/save.rs
+++ b/crates/ui-egui/src/prefs/prefs_ui/save.rs
@@ -1,6 +1,6 @@
 use super::appearance::{canvas_style, sync_animations, sync_appearance, sync_display_scale, sync_tooltips};
 use super::startup::{load, presets_store, recovery, sync_rulers};
-use super::*;
+use super::{DocId, HashMap, PhotocraftApp, Value, prefs};
 
 /// Per-frame upkeep: theme sync, persistence, autosave and the history log.
 pub fn tick(app: &mut PhotocraftApp, ctx: &egui::Context) {
diff --git a/crates/ui-egui/src/prefs/prefs_ui/shortcuts.rs b/crates/ui-egui/src/prefs/prefs_ui/shortcuts.rs
index 73b7d475d9..3c0bf1d4a4 100644
--- a/crates/ui-egui/src/prefs/prefs_ui/shortcuts.rs
+++ b/crates/ui-egui/src/prefs/prefs_ui/shortcuts.rs
@@ -1,5 +1,5 @@
 use super::dialogs::toolbar_tab;
-use super::*;
+use super::{BTreeMap, Map, PhotocraftApp, RichText, Tokens, Value, default_shortcut, json, prefs, vec2};
 
 /// Every shortcut-bearing command (engine registry plus shell commands): (id, label, menu path,
 /// default shortcut), menu items first in Photoshop order.
diff --git a/crates/ui-egui/src/prefs/prefs_ui/startup.rs b/crates/ui-egui/src/prefs/prefs_ui/startup.rs
index 30da36a2a3..1d4005f17a 100644
--- a/crates/ui-egui/src/prefs/prefs_ui/startup.rs
+++ b/crates/ui-egui/src/prefs/prefs_ui/startup.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{JobEvent, JobOutcome, PhotocraftApp, Started, Value, json, prefs};
 
 /// View › Rulers follows `unitsAndRulers.showRulers` when the preference changes (at launch, from
 /// `prefs.set` or a reset), so documents open with the rulers as last set.
diff --git a/crates/ui-egui/src/prefs/prefs_ui/tests.rs b/crates/ui-egui/src/prefs/prefs_ui/tests.rs
index 55e3c6b6e2..40fdf6ed7b 100644
--- a/crates/ui-egui/src/prefs/prefs_ui/tests.rs
+++ b/crates/ui-egui/src/prefs/prefs_ui/tests.rs
@@ -14,6 +14,24 @@ fn memory_usage_has_a_dedicated_explanation_and_keeps_its_value() {
     assert_eq!(h.state()["memoryUsageMb"], 50000);
 }
 
+#[test]
+fn the_generator_checkbox_reads_enable_generator() {
+    // #9392: the reference application's Plug-ins page says "Enable Generator", not "Generator enabled".
+    use egui_kittest::{Harness, kittest::Queryable};
+    let values = serde_json::to_value(photocraft_engine::prefs::PlugIns::default()).unwrap().as_object().unwrap().clone();
+    let keys: Vec<String> = values.keys().cloned().collect();
+    let mut h = Harness::builder()
+        .with_size(vec2(680.0, 350.0))
+        .build_ui_state(move |ui, values| section_fields(ui, "plugIns", values, &keys, crate::i18n::Lang::EN, None, ""), values);
+    h.run_steps(2);
+    assert!(h.query_by_label("Generator enabled").is_none());
+    h.get_by_label("Enable Generator").click();
+    h.run_steps(2);
+    assert_eq!(h.state()["generatorEnabled"], true);
+    let de = crate::i18n::Lang::from_code("de").unwrap();
+    assert_eq!(crate::i18n::tr(de, "Enable Generator"), "Generator aktivieren");
+}
+
 #[test]
 fn graphics_dropdowns_are_named_for_their_settings() {
     use egui::accesskit::Role;
@@ -1999,3 +2017,25 @@ fn edit_dialogs_open() {
     let d = crate::menus::invoke(&mut app, &ctx, "edit.presets.presetManager", json!({})).unwrap()["dialog"].as_u64().unwrap();
     assert!(crate::dialogs::confirm(&mut app, d).is_ok());
 }
+#[test]
+fn reset_section_on_type_keeps_the_favourite_fonts() {
+    // The favourites are the font menu's library, not a Type setting.
+    use egui_kittest::{Harness, kittest::Queryable};
+    let (mut app, store) = app_with_store();
+    app.run("prefs.set", json!({"values": {"interface.language": "en", "type.smartQuotes": false}})).unwrap();
+    app.run("type.font.favorite", json!({"family": "Bebas Neue"})).unwrap();
+    open_preferences(&mut app, "type");
+    let mut h = Harness::builder().with_size(vec2(1280.0, 800.0)).build_eframe(move |cc| {
+        PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
+        app
+    });
+    h.run_steps(4);
+    h.get_by_label("Reset Section").click();
+    h.run_steps(2);
+    h.get_by_label("OK").click();
+    h.run_steps(4);
+    let prefs = h.state().session.prefs().type_.clone();
+    assert!(prefs.smart_quotes, "the Type settings are reset");
+    assert_eq!(prefs.favorite_fonts, ["Bebas Neue"], "the favourites are kept");
+    assert_eq!(stored(&store)["type"]["favoriteFonts"], json!(["Bebas Neue"]));
+}
diff --git a/crates/ui-egui/src/render_path.rs b/crates/ui-egui/src/render_path.rs
new file mode 100644
index 0000000000..fe42e50667
--- /dev/null
+++ b/crates/ui-egui/src/render_path.rs
@@ -0,0 +1,549 @@
+//! Why a view left the GPU (#9328): one typed reason per document, recorded at **one** entry
+//! point ([`note`]) by every exit from the GPU path, logged once when it changes, kept in a short
+//! history, shown in the status bar (`chrome_ui::render_path_status`) and returned by the control
+//! channel (`perf.renderPath`). `perf.gpuFallback` mirrors the active document's reason as text
+//! ([`sync_perf`]).
+//!
+//! Four slots, each written only by its own events: the canvas's reason per document ([`note`]),
+//! a flipped or pixel-aspect-corrected view per document ([`view_cpu`] / [`view_ok`]), a reason
+//! for the whole window ([`note_app`]) and an adjustment dialog's CPU proxy preview
+//! ([`adjust_preview_cpu`] / [`adjust_preview_ok`]). [`RenderPath::current`] reads them in order
+//! of precedence: the window, then the view, then the canvas, then the preview. A software adapter
+//! is the exception: it still runs the GPU canvas, so the document's own reasons come first.
+
+use std::collections::{HashMap, HashSet, VecDeque};
+use std::fmt;
+
+use serde_json::{Value, json};
+
+use crate::PhotocraftApp;
+
+/// Changes the history keeps.
+pub const HISTORY: usize = 32;
+
+static VIEW_TRANSFORM: CpuReason = CpuReason::ViewTransform;
+
+/// Why a view is drawn by the CPU compositor or on the CPU canvas.
+#[derive(Clone, Debug, PartialEq)]
+pub enum CpuReason {
+    /// The layer pages a full (or large) refresh needs don't fit the GPU memory budget (bytes).
+    OverBudget { needed: u64, budget: u64 },
+    /// The display textures don't fit the GPU texture budget (bytes).
+    CanvasTooLarge { bytes: u64, budget: u64 },
+    /// The driver couldn't build the compositor's pipelines (such as DX12 FXC X3507, #8733).
+    CompositorBuild(String),
+    /// The device was lost (the fault's text).
+    DeviceLost(String),
+    /// An uncaptured GPU error (the fault's text).
+    GpuError(String),
+    /// What the wgpu compositor can't express (Advanced Blending, CMYK, effects…), its own text.
+    Unsupported(String),
+    /// An adjustment dialog previews through the CPU proxy (#7487).
+    AdjustPreview(&'static str),
+    /// A flipped or pixel-aspect-corrected view: the GPU canvas shader has neither.
+    ViewTransform,
+    /// The window's adapter is a software renderer.
+    SoftwareAdapter,
+    /// Startup chose CPU rendering (the preference, `--safe-gpu`, an earlier crash…).
+    CpuMode(String),
+}
+
+impl CpuReason {
+    /// The reason from a device fault.
+    pub fn from_fault(f: &photocraft_gpu::Fault) -> Self {
+        if f.is_lost() { CpuReason::DeviceLost(f.to_string()) } else { CpuReason::GpuError(f.to_string()) }
+    }
+
+    /// A stable id of the kind of reason (the control channel's `kind`): reasons compare by it,
+    /// not by their numbers or text.
+    pub fn kind(&self) -> &'static str {
+        match self {
+            CpuReason::OverBudget { .. } => "overBudget",
+            CpuReason::CanvasTooLarge { .. } => "canvasTooLarge",
+            CpuReason::CompositorBuild(_) => "compositorBuild",
+            CpuReason::DeviceLost(_) => "deviceLost",
+            CpuReason::GpuError(_) => "gpuError",
+            CpuReason::Unsupported(_) => "unsupported",
+            CpuReason::AdjustPreview(_) => "adjustPreview",
+            CpuReason::ViewTransform => "viewTransform",
+            CpuReason::SoftwareAdapter => "softwareAdapter",
+            CpuReason::CpuMode(_) => "cpuMode",
+        }
+    }
+
+    /// Reasons that apply to full refreshes only: a small GPU edit doesn't end them.
+    fn full_refresh_only(&self) -> bool {
+        matches!(self, CpuReason::OverBudget { .. } | CpuReason::CanvasTooLarge { .. })
+    }
+}
+
+impl fmt::Display for CpuReason {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        use crate::chrome_ui::fmt_bytes;
+        match self {
+            CpuReason::OverBudget { needed, budget } => {
+                write!(f, "layers need {} of GPU memory, budget {}; full refresh on the CPU", fmt_bytes(*needed), fmt_bytes(*budget))
+            }
+            CpuReason::CanvasTooLarge { bytes, budget } => {
+                write!(f, "the canvas needs {} of GPU textures, budget {}; drawing it on the CPU canvas", fmt_bytes(*bytes), fmt_bytes(*budget))
+            }
+            CpuReason::CompositorBuild(e) => write!(f, "the GPU compositor couldn't be built: {e}"),
+            CpuReason::DeviceLost(e) | CpuReason::GpuError(e) | CpuReason::Unsupported(e) => f.write_str(e),
+            CpuReason::AdjustPreview(why) => write!(f, "the adjustment preview uses the CPU proxy: {why}"),
+            CpuReason::ViewTransform => f.write_str("a flipped or pixel-aspect-corrected view is drawn on the CPU"),
+            CpuReason::SoftwareAdapter => f.write_str("the graphics adapter is a software renderer"),
+            CpuReason::CpuMode(why) => write!(f, "CPU rendering: {why}"),
+        }
+    }
+}
+
+/// What a refresh or view did.
+#[derive(Clone, Debug, PartialEq)]
+pub enum Path {
+    /// The wgpu compositor drew it (`full`: the whole document).
+    Gpu {
+        full: bool,
+    },
+    Cpu(CpuReason),
+}
+
+/// One change of a document's (or, with `doc` 0, the app's) reason.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Change {
+    pub t_ms: f64,
+    pub doc: u64,
+    pub reason: Option<CpuReason>,
+    /// A change of the adjustment preview's slot: `reason` None means the preview stopped using
+    /// the CPU proxy, not that the canvas is back on the GPU.
+    pub preview: bool,
+}
+
+/// The current reasons and their history.
+#[derive(Clone, Debug, Default)]
+pub struct RenderPath {
+    docs: HashMap<u64, CpuReason>,
+    /// Documents in a flipped or pixel-aspect-corrected view ([`CpuReason::ViewTransform`]).
+    views: HashSet<u64>,
+    /// A reason for every document: the GPU canvas was dropped, or never started.
+    app_wide: Option<CpuReason>,
+    /// The open adjustment dialog's CPU proxy preview: (doc, [`CpuReason::AdjustPreview`]). Only
+    /// one dialog is open at a time.
+    preview: Option<(u64, CpuReason)>,
+    startup_checked: bool,
+    history: VecDeque<Change>,
+    /// Tests without a GPU: act as if the window had a GPU canvas.
+    #[cfg(test)]
+    pub(crate) assume_gpu: bool,
+}
+
+impl RenderPath {
+    /// Why document `doc` is drawn on the CPU now, or None on the GPU: the window's reason, else
+    /// the view's, else the canvas's, else the adjustment preview's. A software adapter still runs
+    /// the GPU canvas, so a document that left even that names its own reason first.
+    pub fn current(&self, doc: u64) -> Option<&CpuReason> {
+        let own = || {
+            let view = self.views.contains(&doc).then_some(&VIEW_TRANSFORM);
+            view.or_else(|| self.docs.get(&doc)).or_else(|| self.preview.as_ref().filter(|(d, _)| *d == doc).map(|(_, r)| r))
+        };
+        match &self.app_wide {
+            Some(CpuReason::SoftwareAdapter) => own().or(self.app_wide.as_ref()),
+            Some(r) => Some(r),
+            None => own(),
+        }
+    }
+
+    /// The changes, oldest first.
+    pub fn history(&self) -> impl Iterator<Item = &Change> {
+        self.history.iter()
+    }
+
+    fn push(&mut self, doc: u64, reason: Option<CpuReason>, preview: bool) {
+        if self.history.len() == HISTORY {
+            self.history.pop_front();
+        }
+        self.history.push_back(Change { t_ms: crate::gpu_canvas::now_ms(), doc, reason, preview });
+    }
+}
+
+fn doc_name(app: &PhotocraftApp, doc: u64) -> String {
+    app.session.documents().iter().find(|st| st.doc.id.0 == doc).map_or_else(|| format!("document {doc}"), |st| st.doc.name.clone())
+}
+
+fn log_change(who: &str, reason: Option<&CpuReason>) {
+    match reason {
+        Some(r) => log::info!("render path: {who}: CPU ({}: {r})", r.kind()),
+        None => log::info!("render path: {who}: back on the GPU"),
+    }
+}
+
+/// Record what drew document `doc`: the one entry point of every exit from the GPU path. A new
+/// kind of reason (not new numbers) is logged once and kept in the history; a partial GPU refresh
+/// leaves a reason that applies to full refreshes only.
+pub fn note(app: &mut PhotocraftApp, doc: u64, path: Path) {
+    let rp = &mut app.render_path;
+    let prev = rp.docs.get(&doc);
+    let next = match path {
+        Path::Gpu { full: false } if prev.is_some_and(CpuReason::full_refresh_only) => return,
+        Path::Gpu { .. } => None,
+        Path::Cpu(r) => Some(r),
+    };
+    let changed = prev.map(CpuReason::kind) != next.as_ref().map(CpuReason::kind);
+    match &next {
+        Some(r) => rp.docs.insert(doc, r.clone()),
+        None => rp.docs.remove(&doc),
+    };
+    sync_perf(app);
+    if changed {
+        log_change(&doc_name(app, doc), next.as_ref());
+        app.render_path.push(doc, next, false);
+    }
+}
+
+/// Record a reason for every document (the GPU canvas was dropped or never started), or its end.
+pub fn note_app(app: &mut PhotocraftApp, reason: Option<CpuReason>) {
+    let rp = &mut app.render_path;
+    let changed = rp.app_wide.as_ref().map(CpuReason::kind) != reason.as_ref().map(CpuReason::kind);
+    rp.app_wide = reason.clone();
+    if reason.is_none() {
+        // A rebuilt GPU canvas (Retry GPU) on a software adapter still has that reason.
+        rp.startup_checked = false;
+    }
+    sync_perf(app);
+    if changed {
+        log_change("all documents", reason.as_ref());
+        app.render_path.push(0, reason, false);
+    }
+}
+
+/// A flipped or pixel-aspect-corrected view of document `doc` draws through the CPU path. It
+/// has its own slot, so the canvas's reason (Advanced Blending…) is still there once the view
+/// draws on the GPU again.
+pub fn view_cpu(app: &mut PhotocraftApp, doc: u64) {
+    if app.render_path.views.insert(doc) {
+        view_changed(app, doc, Some(CpuReason::ViewTransform));
+    }
+}
+
+/// A view that may draw on the GPU again: end its [`CpuReason::ViewTransform`] reason.
+pub fn view_ok(app: &mut PhotocraftApp, doc: u64) {
+    if app.render_path.views.remove(&doc) {
+        let reason = app.render_path.docs.get(&doc).cloned();
+        view_changed(app, doc, reason);
+    }
+}
+
+/// Log and keep the document's reason after a change of its view slot: the canvas's own reason
+/// when the view ended, so the log doesn't say "back on the GPU" while that one still applies.
+fn view_changed(app: &mut PhotocraftApp, doc: u64, reason: Option<CpuReason>) {
+    sync_perf(app);
+    log_change(&doc_name(app, doc), reason.as_ref());
+    app.render_path.push(doc, reason, false);
+}
+
+/// GPU Memory, Memory Usage or a switch of document measured whether `fit`'s layers fit the GPU
+/// memory budget. When they fit, its [`CpuReason::OverBudget`] reason ends at once: the next full
+/// refresh is on the GPU, and GPU Memory Full mustn't keep showing the old numbers until then.
+pub fn layer_fit(app: &mut PhotocraftApp, fit: crate::gpu_canvas::LayerFit) {
+    app.perf.gpu_layer_fit = Some(fit);
+    if fit.fits() && matches!(app.render_path.docs.get(&fit.doc), Some(CpuReason::OverBudget { .. })) {
+        note(app, fit.doc, Path::Gpu { full: true });
+    }
+}
+
+/// Whether the window has a GPU canvas.
+fn has_gpu_canvas(app: &PhotocraftApp) -> bool {
+    #[cfg(test)]
+    return app.gpu.is_some() || app.render_path.assume_gpu;
+    #[cfg(not(test))]
+    app.gpu.is_some()
+}
+
+/// Whether the window composites on the GPU at all: a GPU canvas, and no reason for every
+/// document other than a software adapter (which runs the GPU canvas).
+fn window_on_gpu(app: &PhotocraftApp) -> bool {
+    has_gpu_canvas(app) && matches!(app.render_path.app_wide, None | Some(CpuReason::SoftwareAdapter))
+}
+
+/// An adjustment dialog on document `doc` previews through the CPU proxy for `why`. It has its
+/// own slot, so it never replaces or ends the canvas's or the window's reason. Not recorded when
+/// the whole window is off the GPU: the proxy is then simply part of a CPU window.
+pub fn adjust_preview_cpu(app: &mut PhotocraftApp, doc: u64, why: &'static str) {
+    if !window_on_gpu(app) {
+        adjust_preview_ok(app);
+        return;
+    }
+    let reason = CpuReason::AdjustPreview(why);
+    let changed = app.render_path.preview.as_ref().is_none_or(|(d, _)| *d != doc);
+    app.render_path.preview = Some((doc, reason.clone()));
+    sync_perf(app);
+    if changed {
+        log::info!("render path: {}: adjustment preview uses the CPU proxy: {why}", doc_name(app, doc));
+        app.render_path.push(doc, Some(reason), true);
+    }
+}
+
+/// The adjustment dialog closed, or retargeted to a layer the layer path can preview: end its
+/// CPU proxy preview, if one was recorded. The canvas's and the window's reasons are untouched.
+pub fn adjust_preview_ok(app: &mut PhotocraftApp) {
+    let Some((doc, _)) = app.render_path.preview.take() else { return };
+    sync_perf(app);
+    log::info!("render path: {}: adjustment preview no longer uses the CPU proxy", doc_name(app, doc));
+    app.render_path.push(doc, None, true);
+}
+
+/// `perf.gpu_fallback`: the active document's reason as text, the same as `perf.renderPath`'s
+/// `current`, whichever document a refresh (an arranged cell, another window) just recorded.
+fn sync_perf(app: &mut PhotocraftApp) {
+    let active = app.session.active().map(|st| st.doc.id.0);
+    app.perf.gpu_fallback = active.and_then(|d| app.render_path.current(d)).map(ToString::to_string);
+}
+
+/// Each frame: the startup reason (once), and `perf.gpu_fallback` after a switch of document.
+pub fn frame(app: &mut PhotocraftApp) {
+    startup(app);
+    sync_perf(app);
+}
+
+/// Once: a software adapter (`set_wgpu` builds the GPU canvas on one, so it is checked with or
+/// without a GPU canvas) or, without a GPU canvas, CPU mode chosen at startup.
+fn startup(app: &mut PhotocraftApp) {
+    if app.render_path.startup_checked || app.gpu_fault.is_some() {
+        return;
+    }
+    let gpu = has_gpu_canvas(app);
+    let info = &app.perf.gpu_info;
+    let reason = if info.device_type == "cpu" {
+        CpuReason::SoftwareAdapter
+    } else if !gpu && info.canvas == "cpu" {
+        CpuReason::CpuMode(info.fallback.clone().unwrap_or_else(|| format!("performance.gpuBackend is {}", info.preference)))
+    } else {
+        // The adapter isn't known yet (or this host has none to report).
+        return;
+    };
+    app.render_path.startup_checked = true;
+    note_app(app, Some(reason));
+}
+
+fn reason_json(doc: u64, r: Option<&CpuReason>) -> Value {
+    json!({"doc": doc, "kind": r.map(CpuReason::kind), "detail": r.map(ToString::to_string)})
+}
+
+/// A history entry: a preview entry's `kind` is always `adjustPreview` (`detail` null when the
+/// preview stopped using the CPU proxy), so its end never reads as the canvas back on the GPU.
+fn change_json(c: &Change) -> Value {
+    let mut v = reason_json(c.doc, c.reason.as_ref());
+    if c.preview {
+        v["kind"] = json!("adjustPreview");
+    }
+    v["t"] = json!(c.t_ms);
+    v
+}
+
+/// The control channel's `perf.renderPath`: the active document's reason (`null` on the GPU) and
+/// the history, oldest first.
+pub fn inspect(app: &PhotocraftApp) -> Value {
+    let active = app.session.active().map(|st| st.doc.id.0);
+    let current = active.and_then(|d| app.render_path.current(d).map(|r| reason_json(d, Some(r))));
+    let history: Vec<Value> = app.render_path.history().map(change_json).collect();
+    json!({"current": current, "history": history})
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn app() -> PhotocraftApp {
+        PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default())
+    }
+
+    /// An app with one document, active: `perf.gpu_fallback` follows the active document.
+    fn app_with_doc() -> (PhotocraftApp, u64) {
+        let mut app = app();
+        app.run("file.new", json!({"width": 8, "height": 8})).unwrap();
+        let doc = app.session.active().unwrap().doc.id.0;
+        (app, doc)
+    }
+
+    fn over(needed: u64) -> Path {
+        Path::Cpu(CpuReason::OverBudget { needed, budget: 2 << 30 })
+    }
+
+    #[test]
+    fn reasons_compare_by_kind_not_numbers() {
+        let (mut app, d) = app_with_doc();
+        note(&mut app, d, over(3 << 30));
+        note(&mut app, d, over(4 << 30));
+        assert_eq!(app.render_path.history().count(), 1);
+        assert_eq!(app.render_path.current(d), Some(&CpuReason::OverBudget { needed: 4 << 30, budget: 2 << 30 }), "the numbers update");
+        assert!(app.perf.gpu_fallback.as_deref().is_some_and(|f| f.contains("4.0G")), "{:?}", app.perf.gpu_fallback);
+        note(&mut app, d, Path::Cpu(CpuReason::Unsupported("Advanced Blending on `A`".into())));
+        assert_eq!(app.render_path.history().count(), 2, "another kind is a change");
+    }
+
+    #[test]
+    fn a_partial_gpu_refresh_keeps_an_over_budget_reason() {
+        let (mut app, d) = app_with_doc();
+        note(&mut app, d, over(3 << 30));
+        note(&mut app, d, Path::Gpu { full: false });
+        assert!(app.render_path.current(d).is_some(), "a brush dab doesn't end it");
+        assert!(app.perf.gpu_fallback.is_some());
+        note(&mut app, d, Path::Gpu { full: true });
+        assert!(app.render_path.current(d).is_none());
+        assert!(app.perf.gpu_fallback.is_none());
+        assert_eq!(app.render_path.history().count(), 2);
+        // Other reasons end at any GPU refresh.
+        note(&mut app, d, Path::Cpu(CpuReason::ViewTransform));
+        note(&mut app, d, Path::Gpu { full: false });
+        assert!(app.render_path.current(d).is_none());
+    }
+
+    /// A refresh of a document that isn't active (an arranged cell, another window) doesn't
+    /// change `perf.gpu_fallback`, and a switch of document updates it at the next frame: it is
+    /// always `perf.renderPath`'s `current`.
+    #[test]
+    fn gpu_fallback_follows_the_active_document() {
+        let (mut app, first) = app_with_doc();
+        app.run("file.new", json!({"width": 8, "height": 8})).unwrap();
+        let second = app.session.active().unwrap().doc.id.0;
+        assert_ne!(first, second);
+        let current_detail = |app: &PhotocraftApp| inspect(app)["current"]["detail"].as_str().map(str::to_owned);
+        note(&mut app, first, Path::Cpu(CpuReason::ViewTransform));
+        assert_eq!(app.perf.gpu_fallback, None, "the inactive document's reason");
+        assert_eq!(app.perf.gpu_fallback, current_detail(&app));
+        note(&mut app, second, over(3 << 30));
+        assert!(app.perf.gpu_fallback.as_deref().is_some_and(|f| f.contains("GPU memory")), "{:?}", app.perf.gpu_fallback);
+        note(&mut app, first, Path::Gpu { full: true });
+        assert!(app.perf.gpu_fallback.is_some(), "the inactive document back on the GPU");
+        note(&mut app, first, Path::Cpu(CpuReason::ViewTransform));
+        assert!(app.session.set_active(0));
+        frame(&mut app);
+        assert_eq!(app.perf.gpu_fallback, Some(CpuReason::ViewTransform.to_string()), "after the switch");
+        assert_eq!(app.perf.gpu_fallback, current_detail(&app));
+    }
+
+    /// A flipped view has its own slot: unflipped, the document's reason (Advanced Blending) is
+    /// back, and the history doesn't say it returned to the GPU.
+    #[test]
+    fn unflipping_a_view_restores_the_documents_reason() {
+        let (mut app, d) = app_with_doc();
+        let blending = CpuReason::Unsupported("Advanced Blending on `A`".into());
+        note(&mut app, d, Path::Cpu(blending.clone()));
+        view_cpu(&mut app, d);
+        view_cpu(&mut app, d);
+        assert_eq!(app.render_path.current(d), Some(&CpuReason::ViewTransform));
+        view_ok(&mut app, d);
+        view_ok(&mut app, d);
+        assert_eq!(app.render_path.current(d), Some(&blending));
+        assert_eq!(app.perf.gpu_fallback, Some(blending.to_string()));
+        let reasons: Vec<_> = app.render_path.history().map(|c| c.reason.clone()).collect();
+        assert_eq!(reasons, [Some(blending.clone()), Some(CpuReason::ViewTransform), Some(blending)]);
+    }
+
+    #[test]
+    fn the_fallback_log_does_not_repeat_between_partial_refreshes() {
+        // Over budget, a dab, a full refresh, a dab, a full refresh: one change, not five.
+        let mut app = app();
+        note(&mut app, 1, over(3 << 30));
+        note(&mut app, 1, Path::Gpu { full: false });
+        note(&mut app, 1, over(3 << 30));
+        note(&mut app, 1, Path::Gpu { full: false });
+        note(&mut app, 1, over(3 << 30));
+        assert_eq!(app.render_path.history().count(), 1);
+    }
+
+    #[test]
+    fn history_keeps_the_last_32_changes() {
+        let mut app = app();
+        for i in 0..40 {
+            note(&mut app, i, Path::Cpu(CpuReason::ViewTransform));
+        }
+        let docs: Vec<u64> = app.render_path.history().map(|c| c.doc).collect();
+        assert_eq!(docs, (8..40).collect::<Vec<_>>());
+    }
+
+    #[test]
+    fn over_budget_reason_names_the_working_set_and_budget() {
+        let text = CpuReason::OverBudget { needed: 3600 << 20, budget: 512 << 20 }.to_string();
+        assert!(text.contains("3.5G") && text.contains("512.0M"), "{text}");
+        let text = CpuReason::CanvasTooLarge { bytes: 3 << 30, budget: 1 << 30 }.to_string();
+        assert!(text.contains("3.0G") && text.contains("1.0G"), "{text}");
+    }
+
+    #[test]
+    fn a_software_adapter_is_the_reason_at_startup() {
+        let mut app = app();
+        assert!(app.gpu.is_none());
+        frame(&mut app);
+        assert!(app.render_path.current(1).is_none(), "no adapter known yet");
+        app.perf.gpu_info.adapter = "llvmpipe".into();
+        app.perf.gpu_info.device_type = "cpu".into();
+        frame(&mut app);
+        assert_eq!(app.render_path.current(1), Some(&CpuReason::SoftwareAdapter));
+        frame(&mut app);
+        assert_eq!(app.render_path.history().count(), 1, "once");
+
+        let mut app = self::app();
+        app.perf.gpu_info.device_type = "integratedGpu".into();
+        app.perf.gpu_info.canvas = "cpu".into();
+        app.perf.gpu_info.fallback = Some("--safe-gpu".into());
+        frame(&mut app);
+        assert_eq!(app.render_path.current(7), Some(&CpuReason::CpuMode("--safe-gpu".into())));
+        assert_eq!(inspect(&app)["history"][0]["kind"], "cpuMode");
+    }
+
+    /// `set_wgpu` builds the GPU canvas on a software adapter: it is still the window's reason,
+    /// and still after Retry GPU rebuilds the canvas. A hardware adapter records none.
+    #[test]
+    fn a_software_adapter_records_its_startup_reason() {
+        let mut app = app();
+        app.render_path.assume_gpu = true;
+        app.perf.gpu_info.device_type = "discreteGpu".into();
+        app.perf.gpu_info.canvas = "gpu".into();
+        frame(&mut app);
+        assert!(app.render_path.current(1).is_none(), "a hardware GPU");
+        assert_eq!(app.render_path.history().count(), 0);
+
+        let mut app = self::app();
+        app.render_path.assume_gpu = true;
+        app.perf.gpu_info.adapter = "Microsoft Basic Render Driver".into();
+        app.perf.gpu_info.device_type = "cpu".into();
+        app.perf.gpu_info.canvas = "gpu".into();
+        frame(&mut app);
+        assert_eq!(app.render_path.current(1), Some(&CpuReason::SoftwareAdapter));
+        frame(&mut app);
+        assert_eq!(app.render_path.history().count(), 1, "once");
+        // The canvas dropped after an error, then rebuilt by Retry GPU on the same adapter.
+        note_app(&mut app, Some(CpuReason::Unsupported("out of memory".into())));
+        note_app(&mut app, None);
+        frame(&mut app);
+        assert_eq!(app.render_path.current(1), Some(&CpuReason::SoftwareAdapter), "after Retry GPU");
+    }
+
+    /// A software adapter still runs the GPU canvas, so a document that left even that names its
+    /// own reason; the others keep the adapter's. CI's runners have software adapters.
+    #[test]
+    fn a_document_reason_comes_before_a_software_adapter() {
+        let mut app = app();
+        app.render_path.assume_gpu = true;
+        app.perf.gpu_info.device_type = "cpu".into();
+        app.perf.gpu_info.canvas = "gpu".into();
+        frame(&mut app);
+        let too_large = CpuReason::CanvasTooLarge { bytes: 2 << 30, budget: 1 << 30 };
+        note(&mut app, 7, Path::Cpu(too_large.clone()));
+        assert_eq!(app.render_path.current(7), Some(&too_large));
+        assert_eq!(app.render_path.current(8), Some(&CpuReason::SoftwareAdapter));
+        note(&mut app, 7, Path::Gpu { full: true });
+        assert_eq!(app.render_path.current(7), Some(&CpuReason::SoftwareAdapter), "back on the GPU canvas");
+
+        // An adjustment preview through the CPU proxy names its own reason too, until it ends.
+        adjust_preview_cpu(&mut app, 8, "a filter with no GPU kernel");
+        assert_eq!(app.render_path.current(8), Some(&CpuReason::AdjustPreview("a filter with no GPU kernel")));
+        adjust_preview_ok(&mut app);
+        assert_eq!(app.render_path.current(8), Some(&CpuReason::SoftwareAdapter), "the preview ended");
+
+        // No GPU canvas at all: the app-wide reason is the cause for every document.
+        note_app(&mut app, Some(CpuReason::Unsupported("out of memory".into())));
+        note(&mut app, 7, Path::Cpu(too_large));
+        assert_eq!(app.render_path.current(7), Some(&CpuReason::Unsupported("out of memory".into())));
+    }
+}
diff --git a/crates/ui-egui/src/screenshot_tests.rs b/crates/ui-egui/src/screenshot_tests.rs
index 4d23b0607b..9771548b59 100644
--- a/crates/ui-egui/src/screenshot_tests.rs
+++ b/crates/ui-egui/src/screenshot_tests.rs
@@ -509,114 +509,151 @@ fn actual_callback(output: &egui::FullOutput) -> Option<egui::ScreenshotCallback
     })
 }
 
-#[test]
-fn completed_callback_revalidates_next_raw_input_before_actual_app_writes() {
+type ScreenshotWrites = std::rc::Rc<std::cell::RefCell<Vec<(String, Vec<u8>)>>>;
+type ScreenshotEncodes = std::rc::Rc<std::cell::RefCell<Vec<(u32, u32, Vec<u8>)>>>;
+
+struct ActualCallbackFixture {
+    app: crate::PhotocraftApp,
+    ctx: Context,
+    writes: ScreenshotWrites,
+    encodes: ScreenshotEncodes,
+    reply: std::sync::mpsc::Receiver<serde_json::Value>,
+    document: Option<DocumentId>,
+    old_geometry: CaptureGeometry,
+    old_pixels: std::sync::Weak<ColorImage>,
+}
+
+fn actual_callback_fixture() -> ActualCallbackFixture {
     use std::cell::RefCell;
     use std::rc::Rc;
-    // Unchanged success, resize, DPI change, and minimized are separate real app instances.
+
+    let writes = Rc::new(RefCell::new(Vec::new()));
+    let encodes = Rc::new(RefCell::new(Vec::new()));
+    let (written, encoded) = (writes.clone(), encodes.clone());
+    let services = crate::Services {
+        automation_write: Some(Box::new(move |path, bytes| {
+            written.borrow_mut().push((path.to_owned(), bytes.to_vec()));
+            Ok(())
+        })),
+        encode_png: Some(Box::new(move |w, h, rgba| {
+            encoded.borrow_mut().push((w, h, rgba.get(..4).unwrap_or_default().to_vec()));
+            let image = photocraft_codecs::Image::from_u8(w, h, photocraft_codecs::ChannelLayout::Rgba, rgba.to_vec()).map_err(|error| error.to_string())?;
+            photocraft_codecs::encode(&image, photocraft_codecs::Format::Png, &photocraft_codecs::EncodeOptions::default()).map_err(|error| error.to_string())
+        })),
+        ..Default::default()
+    };
+    let mut app = crate::PhotocraftApp::new(photocraft_engine::Session::new(), services);
+    app.run("file.new", serde_json::json!({"width": 32, "height": 32})).unwrap();
+    let ctx = Context::default();
+    for _ in 0..4 {
+        actual_capture_frame(&mut app, &ctx, vec2(600.0, 400.0), 1.0, false);
+    }
+    let old_geometry = app.captures.last_geometry().expect("the old real UI geometry");
+    let document = app.document_identity();
+    let (tx, reply) = std::sync::mpsc::channel();
+    app.captures.admit(91, Some("fixture/current.png".into()), tx, document, 0.0, super::screenshot::now()).unwrap();
+    let mut callback = None;
+    for _ in 0..8 {
+        let output = actual_capture_frame(&mut app, &ctx, vec2(600.0, 400.0), 1.0, false);
+        if let Some(found) = actual_callback(&output) {
+            callback = Some(found);
+            break;
+        }
+    }
+    let old_image = Arc::new(ColorImage::filled(old_geometry.expected_pixels().unwrap(), Color32::RED));
+    let old_pixels = Arc::downgrade(&old_image);
+    callback.expect("actual app issued one screenshot callback").complete(old_image);
+    assert!(writes.borrow().is_empty() && encodes.borrow().is_empty(), "the real callback only stores pixels");
+    ActualCallbackFixture { app, ctx, writes, encodes, reply, document, old_geometry, old_pixels }
+}
+
+#[test]
+fn completed_callback_revalidates_next_raw_input_before_actual_app_writes() {
     for (size, scale, minimized) in
         [(vec2(600.0, 400.0), 1.0, false), (vec2(640.0, 400.0), 1.0, false), (vec2(600.0, 400.0), 2.0, false), (vec2(600.0, 400.0), 1.0, true)]
     {
-        let changed = size != vec2(600.0, 400.0) || scale != 1.0 || minimized;
-        let writes = Rc::new(RefCell::new(Vec::new()));
-        let encodes = Rc::new(RefCell::new(Vec::new()));
-        let (written, encoded) = (writes.clone(), encodes.clone());
-        let services = crate::Services {
-            automation_write: Some(Box::new(move |path, bytes| {
-                written.borrow_mut().push((path.to_owned(), bytes.to_vec()));
-                Ok(())
-            })),
-            encode_png: Some(Box::new(move |w, h, rgba| {
-                encoded.borrow_mut().push((w, h, rgba.get(..4).unwrap_or_default().to_vec()));
-                let image =
-                    photocraft_codecs::Image::from_u8(w, h, photocraft_codecs::ChannelLayout::Rgba, rgba.to_vec()).map_err(|error| error.to_string())?;
-                photocraft_codecs::encode(&image, photocraft_codecs::Format::Png, &photocraft_codecs::EncodeOptions::default())
-                    .map_err(|error| error.to_string())
-            })),
-            ..Default::default()
-        };
-        let mut app = crate::PhotocraftApp::new(photocraft_engine::Session::new(), services);
-        app.run("file.new", serde_json::json!({"width": 32, "height": 32})).unwrap();
-        let ctx = Context::default();
-        for _ in 0..4 {
-            actual_capture_frame(&mut app, &ctx, vec2(600.0, 400.0), 1.0, false);
+        let mut fixture = actual_callback_fixture();
+        if size == vec2(600.0, 400.0) && scale == 1.0 && !minimized {
+            verify_unchanged_capture(&mut fixture);
+        } else {
+            verify_changed_capture(&mut fixture, size, scale, minimized);
         }
-        let old = app.captures.last_geometry().expect("the old real UI geometry");
-        let document = app.document_identity();
-        let (tx, rx) = std::sync::mpsc::channel();
-        app.captures.admit(91, Some("fixture/current.png".into()), tx, document, 0.0, super::screenshot::now()).unwrap();
-        let mut callback = None;
-        for _ in 0..8 {
-            let output = actual_capture_frame(&mut app, &ctx, vec2(600.0, 400.0), 1.0, false);
-            if let Some(found) = actual_callback(&output) {
-                callback = Some(found);
-                break;
-            }
-        }
-        let old_image = Arc::new(ColorImage::filled(old.expected_pixels().unwrap(), Color32::RED));
-        let old_pixels = Arc::downgrade(&old_image);
-        callback.expect("actual app issued one screenshot callback").complete(old_image);
-        assert!(writes.borrow().is_empty() && encodes.borrow().is_empty(), "the real callback only stores pixels");
-        let output = actual_capture_frame(&mut app, &ctx, size, scale, minimized);
-        if changed {
-            assert!(writes.borrow().is_empty() && encodes.borrow().is_empty(), "no stale encode/write on the first changed input");
-            assert!(old_pixels.upgrade().is_none(), "old pixels are released on geometry rejection");
-            let current = app.captures.last_geometry().unwrap();
-            assert!(current.logical_size != old.logical_size || current.pixels_per_point != old.pixels_per_point || current.minimized != old.minimized);
-            if minimized {
-                // A minimized surface cannot be retried. It fails once, then an independent
-                // request after restoration proves that cancellation releases its budget.
-                let reply = rx.try_recv().expect("one minimized error");
-                assert_eq!(reply["ok"], false, "{reply}");
-                assert!(reply["error"].as_str().unwrap().contains("minimized"));
-                assert_eq!(app.captures.pending(), 0);
-                assert_eq!(app.captures.reserved_bytes(), 0);
-                assert!(actual_callback(&output).is_none());
-                actual_capture_frame(&mut app, &ctx, size, scale, false);
-                let (tx, restored_rx) = std::sync::mpsc::channel();
-                app.captures.admit(92, Some("fixture/restored.png".into()), tx, document, 0.0, super::screenshot::now()).unwrap();
-                for _ in 0..8 {
-                    let output = actual_capture_frame(&mut app, &ctx, size, scale, false);
-                    if let Some(callback) = actual_callback(&output) {
-                        callback.complete(Arc::new(ColorImage::filled(app.captures.last_geometry().unwrap().expected_pixels().unwrap(), Color32::BLUE)));
-                        break;
-                    }
-                }
-                actual_capture_frame(&mut app, &ctx, size, scale, false);
-                let reply = restored_rx.try_recv().expect("the restored window accepts a new request");
-                assert_eq!(reply["ok"], true, "{reply}");
-                assert_eq!(writes.borrow().len(), 1);
-                assert!(writes.borrow()[0].1.starts_with(b"\x89PNG\r\n\x1a\n"));
-                assert_eq!(encodes.borrow().len(), 1);
-                assert_eq!(encodes.borrow()[0].2, [0, 0, 255, 255]);
-                assert_eq!(app.captures.pending(), 0);
-                assert_eq!(app.captures.reserved_bytes(), 0);
-                assert!(rx.try_recv().is_err() && restored_rx.try_recv().is_err());
-                continue;
-            }
-            assert!(rx.try_recv().is_err(), "bounded retry has not delivered a stale success");
-            let mut retry = actual_callback(&output);
-            for _ in 0..8 {
-                if retry.is_some() {
-                    break;
-                }
-                retry = actual_callback(&actual_capture_frame(&mut app, &ctx, size, scale, minimized));
-            }
-            retry
-                .expect("the actual app reissues at bounded current geometry")
-                .complete(Arc::new(ColorImage::filled(current.expected_pixels().unwrap(), Color32::BLUE)));
-            actual_capture_frame(&mut app, &ctx, size, scale, minimized);
-            assert_eq!(encodes.borrow().first().map(|entry| entry.2.as_slice()), Some([0, 0, 255, 255].as_slice()), "only the new callback image is encoded");
-        }
-        let reply = rx.try_recv().expect("one response after the valid callback");
-        assert_eq!(reply["ok"], true, "{reply}");
-        assert_eq!(writes.borrow().len(), 1);
-        assert!(writes.borrow()[0].1.starts_with(b"\x89PNG\r\n\x1a\n"), "real PNG encoding and automation_write ran");
-        assert_eq!(encodes.borrow().len(), 1);
-        assert_eq!(app.captures.pending(), 0);
-        assert_eq!(app.captures.reserved_bytes(), 0);
-        actual_capture_frame(&mut app, &ctx, size, scale, minimized);
-        assert_eq!(writes.borrow().len(), 1, "no duplicate output");
-        assert!(rx.try_recv().is_err());
     }
 }
+
+fn verify_unchanged_capture(fixture: &mut ActualCallbackFixture) {
+    actual_capture_frame(&mut fixture.app, &fixture.ctx, vec2(600.0, 400.0), 1.0, false);
+    assert_successful_capture(fixture, vec2(600.0, 400.0), 1.0, false);
+}
+
+fn verify_changed_capture(fixture: &mut ActualCallbackFixture, size: egui::Vec2, scale: f32, minimized: bool) {
+    let output = actual_capture_frame(&mut fixture.app, &fixture.ctx, size, scale, minimized);
+    assert!(fixture.writes.borrow().is_empty() && fixture.encodes.borrow().is_empty(), "no stale encode/write on the first changed input");
+    assert!(fixture.old_pixels.upgrade().is_none(), "old pixels are released on geometry rejection");
+    let current = fixture.app.captures.last_geometry().unwrap();
+    assert!(
+        current.logical_size != fixture.old_geometry.logical_size
+            || current.pixels_per_point != fixture.old_geometry.pixels_per_point
+            || current.minimized != fixture.old_geometry.minimized
+    );
+    if minimized {
+        verify_minimized_capture(fixture, size, scale, &output);
+        return;
+    }
+    assert!(fixture.reply.try_recv().is_err(), "bounded retry has not delivered a stale success");
+    let mut retry = actual_callback(&output);
+    for _ in 0..8 {
+        if retry.is_some() {
+            break;
+        }
+        retry = actual_callback(&actual_capture_frame(&mut fixture.app, &fixture.ctx, size, scale, minimized));
+    }
+    retry
+        .expect("the actual app reissues at bounded current geometry")
+        .complete(Arc::new(ColorImage::filled(current.expected_pixels().unwrap(), Color32::BLUE)));
+    actual_capture_frame(&mut fixture.app, &fixture.ctx, size, scale, minimized);
+    assert_eq!(fixture.encodes.borrow().first().map(|entry| entry.2.as_slice()), Some([0, 0, 255, 255].as_slice()), "only the new callback image is encoded");
+    assert_successful_capture(fixture, size, scale, minimized);
+}
+
+fn verify_minimized_capture(fixture: &mut ActualCallbackFixture, size: egui::Vec2, scale: f32, output: &egui::FullOutput) {
+    let reply = fixture.reply.try_recv().expect("one minimized error");
+    assert_eq!(reply["ok"], false, "{reply}");
+    assert!(reply["error"].as_str().unwrap().contains("minimized"));
+    assert_eq!(fixture.app.captures.pending(), 0);
+    assert_eq!(fixture.app.captures.reserved_bytes(), 0);
+    assert!(actual_callback(output).is_none());
+    actual_capture_frame(&mut fixture.app, &fixture.ctx, size, scale, false);
+    let (tx, restored_rx) = std::sync::mpsc::channel();
+    fixture.app.captures.admit(92, Some("fixture/restored.png".into()), tx, fixture.document, 0.0, super::screenshot::now()).unwrap();
+    for _ in 0..8 {
+        let output = actual_capture_frame(&mut fixture.app, &fixture.ctx, size, scale, false);
+        if let Some(callback) = actual_callback(&output) {
+            callback.complete(Arc::new(ColorImage::filled(fixture.app.captures.last_geometry().unwrap().expected_pixels().unwrap(), Color32::BLUE)));
+            break;
+        }
+    }
+    actual_capture_frame(&mut fixture.app, &fixture.ctx, size, scale, false);
+    let reply = restored_rx.try_recv().expect("the restored window accepts a new request");
+    assert_eq!(reply["ok"], true, "{reply}");
+    assert_eq!(fixture.writes.borrow().len(), 1);
+    assert!(fixture.writes.borrow()[0].1.starts_with(b"\x89PNG\r\n\x1a\n"));
+    assert_eq!(fixture.encodes.borrow().len(), 1);
+    assert_eq!(fixture.encodes.borrow()[0].2, [0, 0, 255, 255]);
+    assert_eq!(fixture.app.captures.pending(), 0);
+    assert_eq!(fixture.app.captures.reserved_bytes(), 0);
+    assert!(fixture.reply.try_recv().is_err() && restored_rx.try_recv().is_err());
+}
+
+fn assert_successful_capture(fixture: &mut ActualCallbackFixture, size: egui::Vec2, scale: f32, minimized: bool) {
+    let reply = fixture.reply.try_recv().expect("one response after the valid callback");
+    assert_eq!(reply["ok"], true, "{reply}");
+    assert_eq!(fixture.writes.borrow().len(), 1);
+    assert!(fixture.writes.borrow()[0].1.starts_with(b"\x89PNG\r\n\x1a\n"), "real PNG encoding and automation_write ran");
+    assert_eq!(fixture.encodes.borrow().len(), 1);
+    assert_eq!(fixture.app.captures.pending(), 0);
+    assert_eq!(fixture.app.captures.reserved_bytes(), 0);
+    actual_capture_frame(&mut fixture.app, &fixture.ctx, size, scale, minimized);
+    assert_eq!(fixture.writes.borrow().len(), 1, "no duplicate output");
+    assert!(fixture.reply.try_recv().is_err());
+}
diff --git a/crates/ui-egui/src/services.rs b/crates/ui-egui/src/services.rs
index d330884a0a..53d3c2e7f0 100644
--- a/crates/ui-egui/src/services.rs
+++ b/crates/ui-egui/src/services.rs
@@ -1,4 +1,7 @@
-use super::*;
+use super::{
+    CaptionStyle, Document, FileDialogFn, OsEvent, Value, dds_options_ui, jobs_ui, jpeg_options_ui, monitor_status, native_menu, screen_picker,
+    targa_options_ui,
+};
 
 /// The error a save gets while another save waits on its format prompt.
 pub(crate) const SAVE_OPTIONS_OPEN: &str = "Answer the TIFF, Targa, DDS or JPEG Options before starting another save";
diff --git a/crates/ui-egui/src/state.rs b/crates/ui-egui/src/state.rs
index ef587063cb..eac69a2263 100644
--- a/crates/ui-egui/src/state.rs
+++ b/crates/ui-egui/src/state.rs
@@ -314,6 +314,11 @@ pub struct UiState {
     /// Selected row in the Paths panel ("work" or a saved path name).
     #[serde(default)]
     pub selected_path: Option<String>,
+    /// The document and Work Path deselected by making a selection from it with the Pen or Path
+    /// Selection tool (#6079): the canvas hides that path until a path is selected again or the
+    /// Work Path changes.
+    #[serde(default)]
+    pub hidden_work_path: Option<(u64, photocraft_doc::Path)>,
     /// Layers panel kind filter ("pixel", "adjustment", "type", "shape", "smart"); empty = all.
     #[serde(default)]
     pub layer_filter: Vec<String>,
@@ -540,6 +545,7 @@ impl Default for UiState {
             direct_selection: Default::default(),
             corner_radius: None,
             selected_path: None,
+            hidden_work_path: None,
             panels: Panels::default(),
             views: Vec::new(),
             dialogs: Vec::new(),
@@ -651,6 +657,11 @@ mod tests {
 
     #[test]
     fn tool_names_parse() {
+        basic_and_retouch_tool_names_parse();
+        vector_tool_names_parse();
+    }
+
+    fn basic_and_retouch_tool_names_parse() {
         assert_eq!(Tool::from_name("brush"), Some(Tool::Brush));
         assert_eq!(Tool::from_name("Rect"), Some(Tool::RectMarquee));
         assert_eq!(Tool::from_name("RectMarquee"), Some(Tool::RectMarquee));
@@ -669,6 +680,9 @@ mod tests {
         assert_eq!(Tool::from_name("patternStamp"), Some(Tool::PatternStamp));
         assert_eq!(Tool::from_name("Pattern Stamp Tool"), Some(Tool::PatternStamp));
         assert_eq!(Tool::ALL.len(), 68);
+    }
+
+    fn vector_tool_names_parse() {
         assert_eq!(Tool::from_name("Vertical Type Mask Tool"), Some(Tool::VerticalTypeMask));
         assert_eq!(Tool::from_name("addAnchorPoint"), Some(Tool::AddAnchorPoint));
         assert_eq!(Tool::from_name("Delete Anchor Point Tool"), Some(Tool::DeleteAnchorPoint));
diff --git a/crates/ui-egui/src/state/color_panel.rs b/crates/ui-egui/src/state/color_panel.rs
index 4b1ac89ee8..29dfebc471 100644
--- a/crates/ui-egui/src/state/color_panel.rs
+++ b/crates/ui-egui/src/state/color_panel.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Deserialize, Serialize};
 
 /// Selected tab per dock card.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
diff --git a/crates/ui-egui/src/state/panel_state.rs b/crates/ui-egui/src/state/panel_state.rs
index 4cc2d67184..387f6ce915 100644
--- a/crates/ui-egui/src/state/panel_state.rs
+++ b/crates/ui-egui/src/state/panel_state.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Deserialize, Serialize};
 
 /// Photoshop-style Layers panel display preferences; part of serialized UI state.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, Default)]
diff --git a/crates/ui-egui/src/state/tool.rs b/crates/ui-egui/src/state/tool.rs
index 2b6702f317..cd96f525a1 100644
--- a/crates/ui-egui/src/state/tool.rs
+++ b/crates/ui-egui/src/state/tool.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Deserialize, Serialize};
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
 pub enum Tool {
diff --git a/crates/ui-egui/src/state/tool_options.rs b/crates/ui-egui/src/state/tool_options.rs
index 6855ddeb12..8b8bad1630 100644
--- a/crates/ui-egui/src/state/tool_options.rs
+++ b/crates/ui-egui/src/state/tool_options.rs
@@ -1,5 +1,5 @@
 use super::tool::Tool;
-use super::*;
+use super::{Deserialize, Serialize};
 
 /// Options-bar state for tools (Photoshop keeps these per tool).
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
diff --git a/crates/ui-egui/src/state/transform.rs b/crates/ui-egui/src/state/transform.rs
index ed14318721..5eb2064f0d 100644
--- a/crates/ui-egui/src/state/transform.rs
+++ b/crates/ui-egui/src/state/transform.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Deserialize, Serialize};
 
 /// Edit › Transform's mode: what a handle drag does with no modifier keys held.
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
diff --git a/crates/ui-egui/src/text.rs b/crates/ui-egui/src/text.rs
index ddfc651ef9..3a703275bd 100644
--- a/crates/ui-egui/src/text.rs
+++ b/crates/ui-egui/src/text.rs
@@ -2,5 +2,6 @@ pub mod bidi_text;
 pub mod cjk_fonts;
 pub mod direction;
 pub mod egui_fonts;
+pub(super) mod font_filters;
 pub(super) mod font_preview;
 pub mod served_fonts;
diff --git a/crates/ui-egui/src/text/font_filters.rs b/crates/ui-egui/src/text/font_filters.rs
new file mode 100644
index 0000000000..5883860f16
--- /dev/null
+++ b/crates/ui-egui/src/text/font_filters.rs
@@ -0,0 +1,277 @@
+//! The font menu's filters, as in Photoshop's font menu (except its Adobe Fonts parts): a class
+//! list (Serif, Sans Serif, Script…), Show Variable Fonts, Show Favorite Fonts and Show Similar
+//! Fonts, and Clear All. Each family's class, format and shape come from its own tables
+//! ([`photocraft_text::font_class`]), read once per font list and cached here.
+
+use std::collections::HashMap;
+use std::sync::{Arc, PoisonError};
+
+use photocraft_text::{FamilyTraits, FontClass, FontFormat};
+
+/// How many fonts Show Similar Fonts lists (the current one first).
+pub(crate) const SIMILAR_COUNT: usize = 30;
+
+/// The filter bar's state, per font menu (kept for the session).
+#[derive(Clone, Debug, Default, PartialEq)]
+pub(crate) struct FontFilters {
+    /// Only fonts of this class (`None`: All Classes).
+    pub class: Option<FontClass>,
+    pub favorites: bool,
+    pub variable: bool,
+    /// Fonts like the current one, most alike first.
+    pub similar: bool,
+    /// The class list is collapsed (the « button).
+    pub hide_classes: bool,
+}
+
+impl FontFilters {
+    /// Whether any filter narrows the list (Clear All is enabled).
+    pub fn any(&self) -> bool {
+        self.class.is_some() || self.favorites || self.variable || self.similar
+    }
+
+    /// Clear All: every filter off; the class list stays as it was.
+    pub fn clear(&mut self) {
+        *self = FontFilters { hide_classes: self.hide_classes, ..Default::default() };
+    }
+}
+
+/// Family traits by family name; `None` for a family that can't be read (or a served font not
+/// fetched yet).
+pub(crate) type TraitsMap = HashMap<String, Option<FamilyTraits>>;
+
+/// The traits of `family` from the shared font database, cached until fonts are registered.
+pub(crate) fn traits(family: &str) -> Option<FamilyTraits> {
+    type Cached = Option<(u64, TraitsMap)>;
+    static CACHE: std::sync::Mutex<Cached> = std::sync::Mutex::new(None);
+    let generation = photocraft_text::fonts::shared_generation();
+    let mut cache = CACHE.lock().unwrap_or_else(PoisonError::into_inner);
+    if cache.as_ref().is_none_or(|(g, _)| *g != generation) {
+        *cache = Some((generation, HashMap::new()));
+    }
+    let (_, map) = cache.as_mut()?;
+    if let Some(t) = map.get(family) {
+        return t.clone();
+    }
+    // Only once the background font scan is done: never block the UI on it.
+    let t = photocraft_text::try_shared()?.lock().unwrap_or_else(PoisonError::into_inner).fonts.family_traits(family);
+    map.insert(family.to_string(), t.clone());
+    t
+}
+
+/// Narrow and order the menu's `rows` by `filters`. `current` is the font Show Similar Fonts
+/// compares with; `lookup` gives a family's traits. Returns false when Show Similar Fonts is on
+/// but the current font has nothing to compare (its rows are then left as they were).
+pub(crate) fn apply<'a>(
+    rows: &mut Vec<(&'a String, &'a str)>,
+    filters: &FontFilters,
+    favorites: &[String],
+    current: &str,
+    lookup: &dyn Fn(&str) -> Option<FamilyTraits>,
+) -> bool {
+    if filters.favorites {
+        rows.retain(|(f, _)| favorites.contains(f));
+    }
+    if filters.variable {
+        rows.retain(|(f, _)| lookup(f).is_some_and(|t| t.variable()));
+    }
+    if let Some(class) = filters.class {
+        rows.retain(|(f, _)| lookup(f).is_some_and(|t| t.class == Some(class)));
+    }
+    if !filters.similar {
+        return true;
+    }
+    let Some(reference) = lookup(current).filter(|t| t.class.is_some() || t.panose.iter().any(|d| *d > 1)) else {
+        return false;
+    };
+    let mut scored: Vec<(f32, (&String, &str))> = rows
+        .drain(..)
+        .filter_map(|row| lookup(row.0).map(|t| (if row.0 == current { -1.0 } else { photocraft_text::font_class::difference(&reference, &t) }, row)))
+        .collect();
+    scored.sort_by(|a, b| a.0.total_cmp(&b.0));
+    rows.extend(scored.into_iter().take(SIMILAR_COUNT).map(|(_, row)| row));
+    true
+}
+
+/// The translated class name.
+pub(crate) fn class_label(class: FontClass) -> &'static str {
+    match class {
+        FontClass::Serif => tl!("Serif"),
+        FontClass::SlabSerif => tl!("Slab Serif"),
+        FontClass::SansSerif => tl!("Sans Serif"),
+        FontClass::Script => tl!("Script"),
+        FontClass::Monospace => tl!("Monospace"),
+        FontClass::Handwritten => tl!("Handwritten"),
+        FontClass::Blackletter => tl!("Blackletter"),
+        FontClass::Decorative => tl!("Decorative"),
+    }
+}
+
+/// The format badge's tooltip.
+pub(crate) fn format_tip(format: FontFormat) -> &'static str {
+    match format {
+        FontFormat::OpenType => tl!("OpenType font"),
+        FontFormat::TrueType => tl!("TrueType font"),
+        FontFormat::Variable => tl!("Variable font"),
+    }
+}
+
+/// The class list's width; the filter buttons sit above it.
+pub(crate) const CLASS_COLUMN_WIDTH: f32 = 118.0;
+
+/// The filter buttons: the class-list toggle and the three filters. Returns true when a filter
+/// changed.
+pub(crate) fn filter_buttons(ui: &mut egui::Ui, filters: &mut FontFilters) -> bool {
+    let before = filters.clone();
+    let (icon, tip) = if filters.hide_classes { ("chevrons-right", tl!("Show Font Classes")) } else { ("chevrons-left", tl!("Hide Font Classes")) };
+    if crate::icons::button(ui, icon, 22.0, false, tip).clicked() {
+        filters.hide_classes = !filters.hide_classes;
+    }
+    if crate::icons::button(ui, "font-variable", 22.0, filters.variable, tl!("Show Variable Fonts")).clicked() {
+        filters.variable = !filters.variable;
+    }
+    let tip = if filters.favorites { tl!("Show All Fonts") } else { tl!("Show Favorite Fonts") };
+    if crate::icons::button(ui, if filters.favorites { "star-filled" } else { "star" }, 22.0, filters.favorites, tip).clicked() {
+        filters.favorites = !filters.favorites;
+    }
+    if crate::icons::button(ui, "font-similar", 22.0, filters.similar, tl!("Show Similar Fonts")).clicked() {
+        filters.similar = !filters.similar;
+    }
+    *filters != before
+}
+
+/// Clear All: turns every filter off. Returns true when it did.
+pub(crate) fn clear_all(ui: &mut egui::Ui, filters: &mut FontFilters) -> bool {
+    let clicked = ui.add_enabled(filters.any(), egui::Button::new(tl!("Clear All")).small()).clicked();
+    if clicked {
+        filters.clear();
+    }
+    clicked
+}
+
+/// The preview banner's height.
+pub(crate) const PREVIEW_HEIGHT: f32 = 64.0;
+
+/// The preview at the top of the font menu: `family` (the font under the pointer, else the
+/// current one) named and set large, `width` wide. It sets `text`, the user's own type, when
+/// there is some, else a sample.
+pub(crate) fn preview_banner(ui: &mut egui::Ui, family: &str, label: &str, text: Option<&str>, width: f32) {
+    let (rect, response) = ui.allocate_exact_size(egui::vec2(width, PREVIEW_HEIGHT), egui::Sense::hover());
+    response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Label, true, format!("{} {label}", tl!("Font preview:"))));
+    if !ui.is_rect_visible(rect) {
+        return;
+    }
+    let t = crate::theme::Tokens::get(ui.ctx());
+    ui.painter().rect_filled(rect, t.radius_sm, t.canvas);
+    ui.painter().text(rect.left_top() + egui::vec2(10.0, 8.0), egui::Align2::LEFT_TOP, label, egui::FontId::proportional(11.0), t.text_dim);
+    if let Some(text) = text {
+        let line = egui::Rect::from_min_max(rect.left_top() + egui::vec2(10.0, 20.0), rect.right_bottom() - egui::vec2(10.0, 2.0));
+        crate::font_preview::paint_text(ui, family, text, line, 30.0);
+        return;
+    }
+    let Some((size, _)) = crate::font_preview::sample(photocraft_engine::prefs::FontPreview::Huge) else { return };
+    crate::font_preview::paint(ui, family, rect.translate(egui::vec2(0.0, 6.0)), size);
+}
+
+/// The class list beside the fonts. Returns true when the class changed.
+pub(crate) fn class_list(ui: &mut egui::Ui, filters: &mut FontFilters) -> bool {
+    let before = filters.class;
+    ui.vertical(|ui| {
+        ui.set_width(CLASS_COLUMN_WIDTH);
+        if ui.add(egui::Button::selectable(filters.class.is_none(), tl!("All Classes")).truncate()).clicked() {
+            filters.class = None;
+        }
+        for class in FontClass::ALL {
+            if ui.add(egui::Button::selectable(filters.class == Some(class), class_label(class)).truncate()).clicked() {
+                filters.class = Some(class);
+            }
+        }
+    });
+    filters.class != before
+}
+
+/// Traits a test hands the menu instead of reading installed fonts.
+pub(crate) fn lookup_in(map: Option<Arc<TraitsMap>>) -> impl Fn(&str) -> Option<FamilyTraits> {
+    move |family| match &map {
+        Some(map) => map.get(family).cloned().flatten(),
+        None => traits(family),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn t(class: FontClass, format: FontFormat, panose: [u8; 10], weight: u16) -> Option<FamilyTraits> {
+        Some(FamilyTraits { class: Some(class), format, panose, weight })
+    }
+
+    fn fixture() -> (Vec<String>, TraitsMap) {
+        let sans = [2, 11, 6, 4, 2, 2, 2, 2, 2, 4];
+        let serif = [2, 2, 6, 3, 5, 4, 5, 2, 3, 4];
+        let map: TraitsMap = [
+            ("Arial", t(FontClass::SansSerif, FontFormat::TrueType, sans, 400)),
+            ("Arial Black", t(FontClass::SansSerif, FontFormat::TrueType, [2, 11, 10, 4, 2, 1, 2, 2, 2, 4], 900)),
+            ("Bahnschrift", t(FontClass::SansSerif, FontFormat::Variable, sans, 400)),
+            ("Consolas", t(FontClass::Monospace, FontFormat::TrueType, [2, 11, 6, 9, 2, 2, 4, 3, 2, 4], 400)),
+            ("Georgia", t(FontClass::Serif, FontFormat::TrueType, serif, 400)),
+            ("Minion", t(FontClass::Serif, FontFormat::OpenType, serif, 400)),
+            ("Mystery", None),
+        ]
+        .into_iter()
+        .map(|(k, v)| (k.to_string(), v))
+        .collect();
+        let mut families: Vec<String> = map.keys().cloned().collect();
+        families.sort();
+        (families, map)
+    }
+
+    fn run(filters: &FontFilters, favorites: &[&str], current: &str) -> (Vec<String>, bool) {
+        let (families, map) = fixture();
+        let mut rows: Vec<(&String, &str)> = families.iter().map(|f| (f, f.as_str())).collect();
+        let favorites: Vec<String> = favorites.iter().map(|s| s.to_string()).collect();
+        let lookup = lookup_in(Some(Arc::new(map)));
+        let ok = apply(&mut rows, filters, &favorites, current, &lookup);
+        (rows.into_iter().map(|(f, _)| f.clone()).collect(), ok)
+    }
+
+    #[test]
+    fn class_variable_and_favorite_filters_narrow_and_combine() {
+        let class = |c| FontFilters { class: Some(c), ..Default::default() };
+        assert_eq!(run(&class(FontClass::Serif), &[], "Arial").0, ["Georgia", "Minion"]);
+        assert_eq!(run(&class(FontClass::Monospace), &[], "Arial").0, ["Consolas"]);
+        assert!(run(&class(FontClass::Blackletter), &[], "Arial").0.is_empty());
+        let variable = FontFilters { variable: true, ..Default::default() };
+        assert_eq!(run(&variable, &[], "Arial").0, ["Bahnschrift"]);
+        let both = FontFilters { favorites: true, class: Some(FontClass::SansSerif), ..Default::default() };
+        assert_eq!(run(&both, &["Georgia", "Arial Black"], "Arial").0, ["Arial Black"]);
+        // Nothing on: every font, unknown ones too.
+        assert_eq!(run(&FontFilters::default(), &[], "Arial").0.len(), 7);
+    }
+
+    #[test]
+    fn similar_fonts_start_with_the_current_one_most_alike_first() {
+        let similar = FontFilters { similar: true, ..Default::default() };
+        let (rows, ok) = run(&similar, &[], "Arial");
+        assert!(ok);
+        assert_eq!(rows[0], "Arial", "the current font first");
+        assert_eq!(rows[1], "Bahnschrift", "same class and shape");
+        let georgia = rows.iter().position(|f| f == "Georgia").unwrap();
+        let black = rows.iter().position(|f| f == "Arial Black").unwrap();
+        assert!(black < georgia, "another weight of the class is nearer than another class");
+        assert!(!rows.contains(&"Mystery".to_string()), "unreadable fonts can't be compared");
+        // A current font with nothing to compare leaves the list alone and says so.
+        let (rows, ok) = run(&similar, &[], "Mystery");
+        assert!(!ok);
+        assert_eq!(rows.len(), 7);
+    }
+
+    #[test]
+    fn clear_all_keeps_the_class_list_state() {
+        let mut f = FontFilters { class: Some(FontClass::Script), favorites: true, variable: true, similar: true, hide_classes: true };
+        assert!(f.any());
+        f.clear();
+        assert_eq!(f, FontFilters { hide_classes: true, ..Default::default() });
+        assert!(!f.any());
+    }
+}
diff --git a/crates/ui-egui/src/text/font_preview.rs b/crates/ui-egui/src/text/font_preview.rs
index 58b1b20b15..8e9a5639a3 100644
--- a/crates/ui-egui/src/text/font_preview.rs
+++ b/crates/ui-egui/src/text/font_preview.rs
@@ -174,6 +174,44 @@ pub(crate) fn paint(ui: &egui::Ui, family: &str, row: Rect, size: f32) {
     }
 }
 
+/// The few lines of the user's own text the font menu's preview keeps rendered: family, text,
+/// display scale, font generation, point size and width.
+type TextKey = (String, String, u32, u64, u32, u32);
+#[derive(Clone, Default)]
+struct TextCache(VecDeque<(TextKey, Option<TextureHandle>)>);
+const TEXT_CACHE_LIMIT: usize = 16;
+
+/// `text` set in `family` at `size`, from the left of `rect` and vertically centred; what doesn't
+/// fit is cut at the right. The font menu's preview of the user's own text.
+pub(crate) fn paint_text(ui: &egui::Ui, family: &str, text: &str, rect: Rect, size: f32) {
+    let ctx = ui.ctx();
+    let scale = ctx.pixels_per_point().ceil().clamp(1.0, 4.0) as u32;
+    let slot = rect.width().clamp(1.0, 4096.0);
+    let key: TextKey = (family.to_owned(), text.to_owned(), scale, photocraft_text::fonts::shared_generation(), size as u32, slot as u32);
+    let id = egui::Id::unique("font-menu-text-previews");
+    let cached = ctx.data_mut(|d| d.get_temp_mut_or_default::<TextCache>(id).0.iter().find(|(k, _)| *k == key).map(|(_, t)| t.clone()));
+    let texture = cached.unwrap_or_else(|| {
+        let mut engine = photocraft_text::shared().lock().unwrap_or_else(PoisonError::into_inner);
+        let image = engine.fonts.has_family(family).then(|| render(&mut engine, family, text, slot, scale, size)).flatten();
+        drop(engine);
+        let texture = image.map(|image| ctx.load_texture(format!("font-text-{family}"), image, TextureOptions::LINEAR));
+        ctx.data_mut(|d| {
+            let cache = d.get_temp_mut_or_default::<TextCache>(id);
+            if cache.0.len() >= TEXT_CACHE_LIMIT {
+                cache.0.pop_front();
+            }
+            cache.0.push_back((key, texture.clone()));
+        });
+        texture
+    });
+    if let Some(texture) = texture {
+        let h = scaled(HEIGHT, size);
+        let at = Rect::from_min_size(pos2(rect.left(), rect.center().y - h / 2.0), vec2(slot, h));
+        let uv = Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0));
+        ui.painter().image(texture.id(), at, uv, crate::theme::Tokens::get(ctx).text);
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/ui-egui/src/theme.rs b/crates/ui-egui/src/theme.rs
index 822d79e148..88672fe75c 100644
--- a/crates/ui-egui/src/theme.rs
+++ b/crates/ui-egui/src/theme.rs
@@ -1180,52 +1180,197 @@ pub mod live {
         let mut unknown = Vec::new();
         let Some(obj) = v.as_object() else { return unknown };
         for (k, val) in obj {
-            macro_rules! c {
-                ($($f:ident),*) => {
-                    match k.as_str() {
-                        $(stringify!($f) => { if let Some(c) = color(val) { t.$f = c; } })*
-                        "radius_sm" => { if let Some(x) = val.as_f64() { t.radius_sm = x as f32; } }
-                        "radius" => { if let Some(x) = val.as_f64() { t.radius = x as f32; } }
-                        "radius_lg" => { if let Some(x) = val.as_f64() { t.radius_lg = x as f32; } }
-                        _ => unknown.push(k.clone()),
-                    }
-                };
+            if override_chrome_color(t, k, val) || override_text_color(t, k, val) || override_accent_color(t, k, val) {
+                continue;
+            }
+            match k.as_str() {
+                "radius_sm" => {
+                    if let Some(x) = val.as_f64() {
+                        t.radius_sm = x as f32;
+                    }
+                }
+                "radius" => {
+                    if let Some(x) = val.as_f64() {
+                        t.radius = x as f32;
+                    }
+                }
+                "radius_lg" => {
+                    if let Some(x) = val.as_f64() {
+                        t.radius_lg = x as f32;
+                    }
+                }
+                _ => unknown.push(k.clone()),
             }
-            c!(
-                caption_close,
-                caption_close_text,
-                chrome,
-                canvas,
-                canvas_dot,
-                dock,
-                card,
-                card_border,
-                field,
-                field_border,
-                hover,
-                pressed,
-                text,
-                text_dim,
-                text_faint,
-                icon,
-                accent,
-                accent_soft,
-                accent_border,
-                accent_text,
-                separator,
-                shadow,
-                primary_bg,
-                primary_text,
-                danger,
-                warning,
-                tab_strip,
-                row_selected,
-                scrim
-            );
         }
         unknown
     }
 
+    fn override_chrome_color(t: &mut Tokens, key: &str, value: &serde_json::Value) -> bool {
+        match key {
+            "caption_close" => {
+                if let Some(c) = color(value) {
+                    t.caption_close = c;
+                }
+            }
+            "caption_close_text" => {
+                if let Some(c) = color(value) {
+                    t.caption_close_text = c;
+                }
+            }
+            "chrome" => {
+                if let Some(c) = color(value) {
+                    t.chrome = c;
+                }
+            }
+            "canvas" => {
+                if let Some(c) = color(value) {
+                    t.canvas = c;
+                }
+            }
+            "canvas_dot" => {
+                if let Some(c) = color(value) {
+                    t.canvas_dot = c;
+                }
+            }
+            "dock" => {
+                if let Some(c) = color(value) {
+                    t.dock = c;
+                }
+            }
+            "card" => {
+                if let Some(c) = color(value) {
+                    t.card = c;
+                }
+            }
+            "card_border" => {
+                if let Some(c) = color(value) {
+                    t.card_border = c;
+                }
+            }
+            "field" => {
+                if let Some(c) = color(value) {
+                    t.field = c;
+                }
+            }
+            "field_border" => {
+                if let Some(c) = color(value) {
+                    t.field_border = c;
+                }
+            }
+            _ => return false,
+        }
+        true
+    }
+
+    fn override_text_color(t: &mut Tokens, key: &str, value: &serde_json::Value) -> bool {
+        match key {
+            "hover" => {
+                if let Some(c) = color(value) {
+                    t.hover = c;
+                }
+            }
+            "pressed" => {
+                if let Some(c) = color(value) {
+                    t.pressed = c;
+                }
+            }
+            "text" => {
+                if let Some(c) = color(value) {
+                    t.text = c;
+                }
+            }
+            "text_dim" => {
+                if let Some(c) = color(value) {
+                    t.text_dim = c;
+                }
+            }
+            "text_faint" => {
+                if let Some(c) = color(value) {
+                    t.text_faint = c;
+                }
+            }
+            "icon" => {
+                if let Some(c) = color(value) {
+                    t.icon = c;
+                }
+            }
+            "separator" => {
+                if let Some(c) = color(value) {
+                    t.separator = c;
+                }
+            }
+            "shadow" => {
+                if let Some(c) = color(value) {
+                    t.shadow = c;
+                }
+            }
+            "primary_bg" => {
+                if let Some(c) = color(value) {
+                    t.primary_bg = c;
+                }
+            }
+            "primary_text" => {
+                if let Some(c) = color(value) {
+                    t.primary_text = c;
+                }
+            }
+            _ => return false,
+        }
+        true
+    }
+
+    fn override_accent_color(t: &mut Tokens, key: &str, value: &serde_json::Value) -> bool {
+        match key {
+            "accent" => {
+                if let Some(c) = color(value) {
+                    t.accent = c;
+                }
+            }
+            "accent_soft" => {
+                if let Some(c) = color(value) {
+                    t.accent_soft = c;
+                }
+            }
+            "accent_border" => {
+                if let Some(c) = color(value) {
+                    t.accent_border = c;
+                }
+            }
+            "accent_text" => {
+                if let Some(c) = color(value) {
+                    t.accent_text = c;
+                }
+            }
+            "danger" => {
+                if let Some(c) = color(value) {
+                    t.danger = c;
+                }
+            }
+            "warning" => {
+                if let Some(c) = color(value) {
+                    t.warning = c;
+                }
+            }
+            "tab_strip" => {
+                if let Some(c) = color(value) {
+                    t.tab_strip = c;
+                }
+            }
+            "row_selected" => {
+                if let Some(c) = color(value) {
+                    t.row_selected = c;
+                }
+            }
+            "scrim" => {
+                if let Some(c) = color(value) {
+                    t.scrim = c;
+                }
+            }
+            _ => return false,
+        }
+        true
+    }
+
     #[cfg(test)]
     mod tests {
         use super::*;
diff --git a/crates/ui-egui/src/tools/crop_presets.rs b/crates/ui-egui/src/tools/crop_presets.rs
index 992fff05a7..85077aea88 100644
--- a/crates/ui-egui/src/tools/crop_presets.rs
+++ b/crates/ui-egui/src/tools/crop_presets.rs
@@ -144,7 +144,7 @@ pub fn dropdown(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let mut chosen: Option<Choice> = None;
     let parent_layer = ui.layer_id();
     let combo =
-        egui::ComboBox::from_id_salt("crop-ratio").selected_text(label).width(140.0).height(420.0).icon(crate::widgets::chevron_icon).show_ui(ui, |ui| {
+        craft_ui::ComboBox::from_id_salt("crop-ratio").selected_text(label).width(140.0).height(420.0).icon(crate::widgets::chevron_icon).show_ui(ui, |ui| {
             crate::press_menu::above_parent_ui(parent_layer, ui);
             let (before, after): (Vec<_>, Vec<_>) = builtin.iter().partition(|(k, _)| k != crop_size::FRONT);
             for (k, l) in &before {
diff --git a/crates/ui-egui/src/tools/crop_ui.rs b/crates/ui-egui/src/tools/crop_ui.rs
index dc852d47c1..3a05ba2cc7 100644
--- a/crates/ui-egui/src/tools/crop_ui.rs
+++ b/crates/ui-egui/src/tools/crop_ui.rs
@@ -727,10 +727,11 @@ pub fn swap_orientation(app: &mut PhotocraftApp) -> bool {
     {
         app.ui.tool_options.crop_ratio = k;
     }
+    // The frame turns first: fitting the swapped ratio inside the old frame would shrink it.
+    keyed(app, swapped(r));
     if preset_ratio(app).is_some() {
         apply_ratio(app);
     } else {
-        keyed(app, swapped(r));
         crate::crop_mode::sync_frame(app);
         crate::crop_mode::auto_center(app);
     }
@@ -766,96 +767,114 @@ pub fn pointer(app: &mut PhotocraftApp, ev: ToolEvent, mods: Modifiers) -> bool
     let p = match ev {
         ToolEvent::Down { x, y, .. } | ToolEvent::Move { x, y, .. } | ToolEvent::Up { x, y } => [x, y],
     };
-    if app.session.active().is_none() || !p[0].is_finite() || !p[1].is_finite() {
+    if app.session.active().is_none() || !p.iter().all(|v| v.is_finite()) || straighten(app, ev, mods, p) {
         return true;
     }
-    // The Straighten button, or ⌘ held: the drag draws a line to level the frame on.
-    if crate::crop_straighten::pointer(app, ev, mods) {
-        claim(app);
-        // Default mode: the image turns so the line ends up level (the press keeps its point).
-        // The turn is one box Undo step, like any other frame gesture.
-        match ev {
-            ToolEvent::Down { .. } => {
-                app.crop.press_step = Some(step_of(app));
-                crate::crop_mode::sync(app, Some(p));
-            }
-            ToolEvent::Move { .. } => crate::crop_mode::sync_frame(app),
-            ToolEvent::Up { .. } => {
-                crate::crop_mode::sync_frame(app);
-                push_press_step(app);
-            }
-        }
-        return true;
+    if track(app, ev, p, mods) {
+        crate::crop_mode::sync_frame(app);
     }
+    true
+}
+
+/// Press, drag and release of the frame. Returns true when the frame needs syncing to the view.
+fn track(app: &mut PhotocraftApp, ev: ToolEvent, p: [f64; 2], mods: Modifiers) -> bool {
     match ev {
-        ToolEvent::Down { .. } => {
-            claim(app);
-            app.crop.editing = true;
-            app.crop.press_step = Some(step_of(app));
-            // Default mode: the view is upright for the frame (picking the tool already made it so;
-            // this catches a frame set over the control channel), about the pressed point.
-            crate::crop_mode::sync(app, Some(p));
-            let frame = app.ui.crop_rect.filter(|r| r.iter().all(|v| v.is_finite()));
-            let deg = angle(app);
-            let image = crate::crop_mode::moves_image(app);
-            app.crop.drag = Some(match frame.map(|r| (r, hit_turned(r, deg, p, tolerance(app)))) {
-                Some((rect, Hit::Handle(hx, hy))) => {
-                    let view = if crate::crop_mode::live_center(app) { crate::crop_mode::press_view(app) } else { None };
-                    CropDrag::Resize { hx, hy, start: p, rect, view }
-                }
-                // Default mode: inside the box the image moves, the box staying where it is on
-                // screen (Photoshop doesn't re-centre it). Inside the untouched frame a drag still
-                // draws a new box.
-                Some((rect, Hit::Inside)) if !app.crop.default_frame && image => {
-                    CropDrag::MoveImage { start: p, rect, view: crate::crop_mode::press_view(app) }
-                }
-                Some((rect, Hit::Inside)) if !app.crop.default_frame => CropDrag::Move { start: p, rect },
-                Some((rect, Hit::Outside)) if image => {
-                    let c = center(rect);
-                    CropDrag::TurnImage { center: c, grab: (p[1] - c[1]).atan2(p[0] - c[0]), from: deg, view: crate::crop_mode::press_view(app) }
-                }
-                // Outside the frame a drag turns it, as in Photoshop (#1792).
-                Some((rect, Hit::Outside)) => {
-                    let c = center(rect);
-                    CropDrag::Rotate { center: c, grab: (p[1] - c[1]).atan2(p[0] - c[0]), from: deg }
-                }
-                _ => {
-                    app.ui.crop_angle = 0.0;
-                    CropDrag::Draw { anchor: p, cur: p, last: p, prev: app.ui.crop_rect }
-                }
-            });
-        }
+        ToolEvent::Down { .. } => begin_drag(app, p),
         ToolEvent::Move { .. } => update(app, p, mods),
         ToolEvent::Up { .. } => {
             update(app, p, mods);
-            let Some(drag) = app.crop.drag.take() else { return true };
-            let ok = app.ui.crop_rect.is_some_and(size_ok);
-            // A click outside the untouched default frame (no turn) leaves it the default.
-            let changed = !matches!(drag, CropDrag::Rotate { from, .. } | CropDrag::TurnImage { from, .. } if from == angle(app))
-                && !matches!(drag, CropDrag::MoveImage { rect, .. } if app.ui.crop_rect == Some(rect));
-            if ok && changed {
-                app.crop.default_frame = false;
-            }
-            match drag {
-                CropDrag::Draw { prev, .. } if !ok => app.ui.crop_rect = prev,
-                CropDrag::Move { rect, .. } | CropDrag::Resize { rect, view: None, .. } if !ok => app.ui.crop_rect = Some(rect),
-                // A live-centred resize collapsed: the frame and the view it moved go back.
-                CropDrag::Resize { rect, view: Some(view), .. } if !ok => crate::crop_mode::offset_image(app, rect, Some(view), [0.0, 0.0]),
-                // Auto Center Preview: a box drawn in default mode moves to the middle. (A resized
-                // one stays where its centre was: `crop_mode::live_resize`.)
-                CropDrag::Draw { .. } if ok => {
-                    crate::crop_mode::sync_frame(app);
-                    crate::crop_mode::auto_center(app);
-                }
-                _ => {}
-            }
+            let Some(drag) = app.crop.drag.take() else { return false };
+            release(app, drag);
+        }
+    }
+    true
+}
+
+/// The Straighten line drag. Returns true when it took the event.
+fn straighten(app: &mut PhotocraftApp, ev: ToolEvent, mods: Modifiers, p: [f64; 2]) -> bool {
+    // Straighten button or ⌘: the drag draws a line to level the frame on.
+    if !crate::crop_straighten::pointer(app, ev, mods) {
+        return false;
+    }
+    claim(app);
+    // Default mode: the image turns so the line ends up level.
+    // The turn is one box Undo step, like any other frame gesture.
+    match ev {
+        ToolEvent::Down { .. } => {
+            app.crop.press_step = Some(step_of(app));
+            crate::crop_mode::sync(app, Some(p));
+        }
+        ToolEvent::Move { .. } => crate::crop_mode::sync_frame(app),
+        ToolEvent::Up { .. } => {
+            crate::crop_mode::sync_frame(app);
             push_press_step(app);
         }
     }
-    crate::crop_mode::sync_frame(app);
     true
 }
 
+/// Starts the drag a press at `p` selects: resize, move, turn or draw.
+fn begin_drag(app: &mut PhotocraftApp, p: [f64; 2]) {
+    claim(app);
+    app.crop.editing = true;
+    app.crop.press_step = Some(step_of(app));
+    // Default mode: the view stays upright for the frame, about the pressed point.
+    crate::crop_mode::sync(app, Some(p));
+    let frame = app.ui.crop_rect.filter(|r| r.iter().all(|v| v.is_finite()));
+    let deg = angle(app);
+    app.crop.drag = Some(match frame.map(|r| (r, hit_turned(r, deg, p, tolerance(app)))) {
+        Some((rect, Hit::Handle(hx, hy))) => {
+            let view = if crate::crop_mode::live_center(app) { crate::crop_mode::press_view(app) } else { None };
+            CropDrag::Resize { hx, hy, start: p, rect, view }
+        }
+        Some((rect, Hit::Inside)) if !app.crop.default_frame => inside_drag(app, p, rect),
+        Some((rect, Hit::Outside)) => outside_drag(app, p, rect, deg),
+        _ => {
+            app.ui.crop_angle = 0.0;
+            CropDrag::Draw { anchor: p, cur: p, last: p, prev: app.ui.crop_rect }
+        }
+    });
+}
+
+/// A press inside the frame: moves the image in default mode, else the frame.
+fn inside_drag(app: &PhotocraftApp, p: [f64; 2], rect: [f64; 4]) -> CropDrag {
+    // Default mode moves the image and keeps the box in place on screen, as in Photoshop.
+    if crate::crop_mode::moves_image(app) {
+        CropDrag::MoveImage { start: p, rect, view: crate::crop_mode::press_view(app) }
+    } else {
+        CropDrag::Move { start: p, rect }
+    }
+}
+
+/// A press outside the frame: turns the image in default mode, else the frame.
+fn outside_drag(app: &PhotocraftApp, p: [f64; 2], rect: [f64; 4], deg: f64) -> CropDrag {
+    let c = center(rect);
+    let grab = (p[1] - c[1]).atan2(p[0] - c[0]);
+    if crate::crop_mode::moves_image(app) {
+        CropDrag::TurnImage { center: c, grab, from: deg, view: crate::crop_mode::press_view(app) }
+    } else {
+        // Outside the frame a drag turns it, as in Photoshop (#1792).
+        CropDrag::Rotate { center: c, grab, from: deg }
+    }
+}
+
+/// Ends `drag`: keeps a valid frame or restores the previous one, and records an undo step when it changed.
+fn release(app: &mut PhotocraftApp, drag: CropDrag) {
+    let ok = app.ui.crop_rect.is_some_and(size_ok);
+    // A click outside the untouched default frame (no turn) leaves it the default.
+    let changed = !matches!(drag, CropDrag::Rotate { from, .. } | CropDrag::TurnImage { from, .. } if from == angle(app))
+        && !matches!(drag, CropDrag::MoveImage { rect, .. } if app.ui.crop_rect == Some(rect));
+    if ok && changed {
+        app.crop.default_frame = false;
+    }
+    if ok {
+        finish_frame(app, drag);
+    } else {
+        restore_frame(app, drag);
+    }
+    push_press_step(app);
+}
+
 /// On release: the frame state at the press becomes a box Undo step when the gesture changed it.
 fn push_press_step(app: &mut PhotocraftApp) {
     if let Some(before) = app.crop.press_step.take()
@@ -866,45 +885,72 @@ fn push_press_step(app: &mut PhotocraftApp) {
     }
 }
 
+/// Puts back the frame a too-small drag started from.
+fn restore_frame(app: &mut PhotocraftApp, drag: CropDrag) {
+    match drag {
+        CropDrag::Draw { prev, .. } => app.ui.crop_rect = prev,
+        CropDrag::Move { rect, .. } | CropDrag::Resize { rect, view: None, .. } => app.ui.crop_rect = Some(rect),
+        // A collapsed live-centred resize restores the frame and the view.
+        CropDrag::Resize { rect, view: Some(view), .. } => crate::crop_mode::offset_image(app, rect, Some(view), [0.0, 0.0]),
+        _ => {}
+    }
+}
+
+/// Centres a newly drawn frame in default mode.
+fn finish_frame(app: &mut PhotocraftApp, drag: CropDrag) {
+    // Auto Center Preview moves a box drawn in default mode to the middle.
+    if let CropDrag::Draw { .. } = drag {
+        crate::crop_mode::sync_frame(app);
+        crate::crop_mode::auto_center(app);
+    }
+}
+
 /// The frame follows the pointer at `p`.
 fn update(app: &mut PhotocraftApp, p: [f64; 2], mods: Modifiers) {
+    if follow_view_drag(app, p, mods) {
+        return;
+    }
+    if let Some(rect) = dragged_frame(app, p, mods) {
+        app.ui.crop_rect = Some(rect);
+    }
+}
+
+/// Follows rotate, turn, move-image and live-centred resize drags. Returns false for the other drags.
+fn follow_view_drag(app: &mut PhotocraftApp, p: [f64; 2], mods: Modifiers) -> bool {
+    match app.crop.drag {
+        Some(CropDrag::Rotate { center, grab, from }) => app.ui.crop_angle = turned_angle(center, grab, from, p, mods.shift),
+        Some(CropDrag::TurnImage { center, grab, from, view }) => {
+            // The image turns with the pointer's sweep on screen, so the frame turns against it.
+            let at = crate::crop_mode::to_press(app, view, p);
+            let turned = from - ((at[1] - center[1]).atan2(at[0] - center[0]) - grab).to_degrees();
+            if turned.is_finite() {
+                app.ui.crop_angle = normalized_angle(if mods.shift { (turned / 15.0).round() * 15.0 } else { turned });
+                crate::crop_mode::sync_frame(app);
+            }
+        }
+        Some(CropDrag::MoveImage { start, rect, view }) => {
+            // The image follows the pointer, so the frame and view move the other way.
+            let at = crate::crop_mode::to_press(app, view, p);
+            crate::crop_mode::offset_image(app, rect, view, [at[0] - start[0], at[1] - start[1]]);
+        }
+        Some(CropDrag::Resize { hx, hy, start, rect, view: Some(view) }) => {
+            // Auto Center Preview keeps the box centred while the handle follows the pointer.
+            let at = crate::crop_mode::to_press(app, Some(view), p);
+            let ratio = resize_ratio(app, rect, mods);
+            let deg = angle(app);
+            crate::crop_mode::live_resize(app, crate::crop_mode::LiveResize { rect, deg, hx, hy, start, q: at, ratio, alt: mods.alt }, view);
+        }
+        _ => return false,
+    }
+    true
+}
+
+/// The frame a draw, move or resize drag gives at `p`, or None for the other drags.
+fn dragged_frame(app: &mut PhotocraftApp, p: [f64; 2], mods: Modifiers) -> Option<[f64; 4]> {
     let ratio = preset_ratio(app);
     let space = app.crop.space;
     let deg = angle(app);
-    match app.crop.drag {
-        Some(CropDrag::Rotate { center, grab, from }) => {
-            app.ui.crop_angle = turned_angle(center, grab, from, p, mods.shift);
-            return;
-        }
-        Some(CropDrag::TurnImage { center, grab, from, view }) => {
-            // The image turns with the pointer's sweep on screen, so the frame turns against it.
-            let q = crate::crop_mode::to_press(app, view, p);
-            let a = from - ((q[1] - center[1]).atan2(q[0] - center[0]) - grab).to_degrees();
-            if a.is_finite() {
-                app.ui.crop_angle = normalized_angle(if mods.shift { (a / 15.0).round() * 15.0 } else { a });
-                crate::crop_mode::sync_frame(app);
-            }
-            return;
-        }
-        Some(CropDrag::MoveImage { start, rect, view }) => {
-            // The image follows the pointer: the frame moves the other way on it, and the view
-            // with the frame, so the box stays put.
-            let q = crate::crop_mode::to_press(app, view, p);
-            crate::crop_mode::offset_image(app, rect, view, [q[0] - start[0], q[1] - start[1]]);
-            return;
-        }
-        Some(CropDrag::Resize { hx, hy, start, rect, view: Some(view) }) => {
-            // Auto Center Preview: the box stays centred where it was while the handle follows
-            // the pointer.
-            let q = crate::crop_mode::to_press(app, Some(view), p);
-            let ratio = resize_ratio(app, rect, mods);
-            crate::crop_mode::live_resize(app, crate::crop_mode::LiveResize { rect, deg, hx, hy, start, q, ratio, alt: mods.alt }, view);
-            return;
-        }
-        _ => {}
-    }
-    let Some(drag) = app.crop.drag.as_mut() else { return };
-    let rect = match drag {
+    match app.crop.drag.as_mut()? {
         CropDrag::Draw { anchor, cur, last, .. } => {
             if space {
                 // Space: the frame being drawn follows the pointer, keeping its size.
@@ -915,14 +961,11 @@ fn update(app: &mut PhotocraftApp, p: [f64; 2], mods: Modifiers) {
                 *cur = p;
             }
             *last = p;
-            if *anchor == *cur {
-                return;
-            }
-            drawn(*anchor, *cur, ratio, mods)
+            (*anchor != *cur).then(|| drawn(*anchor, *cur, ratio, mods))
         }
         CropDrag::Move { start, rect } => {
             let (dx, dy) = (p[0] - start[0], p[1] - start[1]);
-            [rect[0] + dx, rect[1] + dy, rect[2] + dx, rect[3] + dy]
+            Some([rect[0] + dx, rect[1] + dy, rect[2] + dx, rect[3] + dy])
         }
         CropDrag::Resize { hx, hy, start, rect, .. } => {
             let keep = || {
@@ -930,11 +973,10 @@ fn update(app: &mut PhotocraftApp, p: [f64; 2], mods: Modifiers) {
                 (w > 0.0 && h > 0.0).then(|| w / h)
             };
             let ratio = ratio.or_else(|| if mods.shift { keep() } else { None });
-            resized_turned(*rect, deg, *hx, *hy, [p[0] - start[0], p[1] - start[1]], ratio, mods.alt)
+            Some(resized_turned(*rect, deg, *hx, *hy, [p[0] - start[0], p[1] - start[1]], ratio, mods.alt))
         }
-        CropDrag::Rotate { .. } | CropDrag::TurnImage { .. } | CropDrag::MoveImage { .. } => return,
-    };
-    app.ui.crop_rect = Some(rect);
+        CropDrag::Rotate { .. } | CropDrag::TurnImage { .. } | CropDrag::MoveImage { .. } => None,
+    }
 }
 
 /// Geometry and snapping must use the same ratio so constrained handles stay aligned.
diff --git a/crates/ui-egui/src/tools/crop_ui/tests.rs b/crates/ui-egui/src/tools/crop_ui/tests.rs
index ffe9914527..6fba4e57d4 100644
--- a/crates/ui-egui/src/tools/crop_ui/tests.rs
+++ b/crates/ui-egui/src/tools/crop_ui/tests.rs
@@ -1080,6 +1080,17 @@ fn x_swaps_the_frame_orientation_not_the_colours() {
     app.ui.tool_options.crop_ratio = String::new();
     assert!(swap_orientation(&mut app));
     assert_eq!(app.ui.tool_options.crop_ratio, "", "no ratio stays none");
+    // With a ratio preset X turns the frame too, keeping its size, and X again brings it back.
+    let near = |a: Option<[f64; 4]>, b: [f64; 4]| a.is_some_and(|a| a.iter().zip(b).all(|(x, y)| (x - y).abs() < 1e-9));
+    app.ui.tool_options.crop_ratio = "16:9".into();
+    app.ui.crop_rect = Some([60.0, 27.5, 140.0, 72.5]);
+    key(&mut app, Key::X, NONE);
+    assert_eq!(app.ui.tool_options.crop_ratio, "9:16");
+    assert!(near(app.ui.crop_rect, [77.5, 10.0, 122.5, 90.0]), "45 x 80, not shrunk: {:?}", app.ui.crop_rect);
+    key(&mut app, Key::X, NONE);
+    assert_eq!(app.ui.tool_options.crop_ratio, "16:9");
+    assert!(near(app.ui.crop_rect, [60.0, 27.5, 140.0, 72.5]), "and back: {:?}", app.ui.crop_rect);
+    app.ui.tool_options.crop_ratio = String::new();
     assert_eq!(swapped_ratio("1.414:1", 1.0, 1.0).as_deref(), Some("1:1.414"), "decimals survive the swap (#6487)");
     assert_eq!(swapped_ratio("0:5", 1.0, 1.0), None);
     assert_eq!(swapped_ratio("nonsense", 1.0, 1.0), None);
diff --git a/crates/ui-egui/src/tools/direct_select.rs b/crates/ui-egui/src/tools/direct_select.rs
index 6f8ede6a1b..577ecda468 100644
--- a/crates/ui-egui/src/tools/direct_select.rs
+++ b/crates/ui-egui/src/tools/direct_select.rs
@@ -1,7 +1,7 @@
 //! Direct Selection tool (A, #790), the Convert Point tool (#3204), the Pens' ⌘/Ctrl (Direct
 //! Selection: the Pen, Freeform Pen and Curvature Pen) and the Pen's ⌥/Alt (Convert Point)
-//! modifiers, as in Photoshop. It edits the paths the canvas shows: the targeted vector mask or
-//! the active shape layer's path, and the work path.
+//! modifiers, as in Photoshop. It edits the paths the canvas shows: the targeted vector mask, the
+//! active shape layer's path or the active type layer's Type Path, and the work path.
 //!
 //! * Click an anchor to select it (⇧ adds or removes, ⌥ selects its whole subpath), drag on empty
 //!   canvas to marquee-select anchors, click empty canvas to deselect.
@@ -39,6 +39,8 @@ pub enum PathRef {
     Work,
     /// A layer's shape path, or its vector mask.
     Layer(u64),
+    /// A type layer's Type Path (#9114), apart from a vector mask the layer may have.
+    TypePath(u64),
     /// The Pen path being drawn (`ui.pen`): edited in place, not through the engine.
     Pen,
 }
@@ -49,6 +51,7 @@ impl PathRef {
         match self {
             PathRef::Work => json!({"name": "work"}),
             PathRef::Layer(id) => json!({"name": "layer", "layer": id}),
+            PathRef::TypePath(id) => json!({"name": "layer", "layer": id, "typePath": true}),
             // Never sent: edits to the Pen path being drawn don't go through the engine.
             PathRef::Pen => json!({}),
         }
@@ -163,12 +166,16 @@ pub fn shows(app: &PhotocraftApp, mods: Modifiers) -> bool {
         || matches!(app.ui.tool, Tool::AddAnchorPoint | Tool::DeleteAnchorPoint | Tool::ConvertPoint)
 }
 
-/// The active paths, front first: the targeted vector mask or the active shape layer's path, then
-/// the work path. The Pen's Auto Add/Delete edits these (`anchor_tools::pen_auto`).
+/// The active paths, front first: the targeted vector mask, the active shape layer's path or the
+/// active type layer's Type Path (#9114), then the work path. The Pen's Auto Add/Delete edits these
+/// (`anchor_tools::pen_auto`).
 pub(crate) fn active_paths(app: &PhotocraftApp) -> Vec<(PathRef, Path)> {
-    let layer = crate::vector_ui::targeted_vector_mask(app).or_else(|| crate::vector_ui::active_shape_path(app));
-    let work = app.session.active().and_then(|st| st.doc.work_path.clone());
-    layer.map(|(id, p)| (PathRef::Layer(id), p)).into_iter().chain(work.map(|p| (PathRef::Work, p))).collect()
+    let layer = crate::vector_ui::targeted_vector_mask(app)
+        .or_else(|| crate::vector_ui::active_shape_path(app))
+        .map(|(id, p)| (PathRef::Layer(id), p))
+        .or_else(|| crate::vector_ui::active_type_path(app).map(|(id, p)| (PathRef::TypePath(id), p)));
+    let work = app.session.active().and_then(|st| st.doc.work_path.clone()).filter(|_| crate::vector_ui::work_path_shown(app));
+    layer.into_iter().chain(work.map(|p| (PathRef::Work, p))).collect()
 }
 
 /// The paths Direct Selection edits, front first: the Pen path being drawn, the active paths, then
@@ -301,7 +308,7 @@ fn press(app: &mut PhotocraftApp, p: [f64; 2], mods: Modifiers, convert: bool) -
         app.ui.direct_selection.drag = Some(Drag::Marquee { start: p, end: p, add: mods.shift });
         return true;
     };
-    if let PathRef::Layer(id) = target
+    if let PathRef::Layer(id) | PathRef::TypePath(id) = target
         && app.session.active().and_then(|st| st.active_layer).map(|l| l.0) != Some(id)
     {
         let _ = app.run("layer.select", json!({"layer": id}));
diff --git a/crates/ui-egui/src/tools/direct_select/tests.rs b/crates/ui-egui/src/tools/direct_select/tests.rs
index 31a16bfcda..27a9fc59d8 100644
--- a/crates/ui-egui/src/tools/direct_select/tests.rs
+++ b/crates/ui-egui/src/tools/direct_select/tests.rs
@@ -517,3 +517,55 @@ fn a_curvature_pen_double_click_through_the_canvas_rounds_a_corner() {
     assert!(k.smooth && k.in_ctrl != k.anchor, "the double-clicked corner is smooth: {k:?}");
     assert!(h.state().ui.pen.is_none(), "and no path was started");
 }
+
+/// #9114: with type on a path selected, Direct Selection reshapes the type's own path (in front of
+/// the work path it was made from) and the type follows, in one undoable step.
+#[test]
+fn dragging_an_anchor_of_type_on_a_path_moves_the_type() {
+    let mut app = app(Tool::DirectSelection);
+    app.run("path.set", json!({"name": "work", "path": {"subpaths": [{"closed": false, "knots": [[100, 20], [100, 180]]}]}})).unwrap();
+    let id = app.run("type.create", json!({"x": 20, "y": 70, "text": "On a path", "size": 24})).unwrap()["layer"].as_u64().unwrap();
+    app.run("type.attachToPath", json!({})).unwrap();
+    let type_path = |app: &PhotocraftApp| match &app.session.active().unwrap().doc.layer(photocraft_doc::LayerId(id)).unwrap().content {
+        photocraft_doc::LayerContent::Text(t) => photocraft_engine::type_extra_cmds::type_path(t).unwrap(),
+        _ => panic!("not a type layer"),
+    };
+    let n = steps(&app);
+    drag(&mut app, [100.2, 180.2], [160.2, 180.2], Modifiers::NONE);
+    assert_eq!(app.ui.direct_selection.target, Some(PathRef::TypePath(id)), "the type path, in front of the work path");
+    let end = type_path(&app).subpaths[0].knots[1].anchor;
+    assert!((end.x - 160.0).abs() < 1e-6 && (end.y - 180.0).abs() < 1e-6, "{end:?}");
+    assert_eq!(work(&app).subpaths[0].knots[1].anchor, Point::new(100.0, 180.0), "the work path stays");
+    assert_eq!(steps(&app), n + 1);
+    assert!(app.session.undo());
+    assert_eq!(type_path(&app).subpaths[0].knots[1].anchor.x.round(), 100.0);
+}
+
+/// #9114: with a type-on-a-path layer's vector mask targeted, Direct Selection edits the mask, not
+/// the Type Path; untargeted, it edits the Type Path and the mask stays.
+#[test]
+fn a_targeted_vector_mask_on_type_on_a_path_is_edited_not_the_type_path() {
+    let mut app = app(Tool::DirectSelection);
+    app.run("path.set", json!({"name": "work", "path": {"subpaths": [{"closed": false, "knots": [[100, 20], [100, 180]]}]}})).unwrap();
+    let id = app.run("type.create", json!({"x": 20, "y": 70, "text": "On a path", "size": 24})).unwrap()["layer"].as_u64().unwrap();
+    app.run("type.attachToPath", json!({})).unwrap();
+    let rect = json!({"subpaths": [{"closed": true, "knots": [[20, 20], [180, 20], [180, 160], [20, 160]]}]});
+    app.run("layer.vectorMask.add", json!({"layer": id, "path": rect})).unwrap();
+    app.ui.vector_mask_target = true;
+    let layer = |app: &PhotocraftApp| app.session.active().unwrap().doc.layer(photocraft_doc::LayerId(id)).unwrap().clone();
+    let type_path = |app: &PhotocraftApp| match &layer(app).content {
+        photocraft_doc::LayerContent::Text(t) => photocraft_engine::type_extra_cmds::type_path(t).unwrap(),
+        _ => panic!("not a type layer"),
+    };
+    let before = type_path(&app);
+    drag(&mut app, [20.2, 20.2], [40.2, 30.2], Modifiers::NONE);
+    assert_eq!(app.ui.direct_selection.target, Some(PathRef::Layer(id)));
+    assert_eq!(layer(&app).vector_mask.unwrap().path.subpaths[0].knots[0].anchor, Point::new(40.0, 30.0), "the mask's corner moved");
+    assert_eq!(type_path(&app), before, "the Type Path stays");
+    // With the mask no longer targeted, the Type Path is in front again and the mask stays.
+    app.ui.vector_mask_target = false;
+    drag(&mut app, [100.2, 180.2], [160.2, 180.2], Modifiers::NONE);
+    assert_eq!(app.ui.direct_selection.target, Some(PathRef::TypePath(id)));
+    assert!((type_path(&app).subpaths[0].knots[1].anchor.x - 160.0).abs() < 1e-6);
+    assert_eq!(layer(&app).vector_mask.unwrap().path.subpaths[0].knots[0].anchor, Point::new(40.0, 30.0));
+}
diff --git a/crates/ui-egui/src/tools/gradient_ui.rs b/crates/ui-egui/src/tools/gradient_ui.rs
index 729a24dc67..4ea5da8a72 100644
--- a/crates/ui-egui/src/tools/gradient_ui.rs
+++ b/crates/ui-egui/src/tools/gradient_ui.rs
@@ -394,8 +394,9 @@ pub fn display_doc(app: &mut PhotocraftApp, idx: usize) -> Option<(Arc<Document>
     if cmd == cmds::CREATE {
         let mut l = cmds::new_layer(&app.session, &doc, &p).ok()?;
         l.id = PREVIEW_LAYER;
-        let above = app.session.active().and_then(|s| s.active_layer);
-        shown.insert_above(above, l);
+        // Where the committed layer will go, so the preview doesn't jump on release.
+        let active = app.session.active().and_then(|s| s.active_layer);
+        photocraft_engine::layer_place::insert_new(&mut shown, active, l, photocraft_engine::layer_place::Place::AutoEditable);
     } else {
         let l = doc.layer(layer)?;
         let f = edited_fill(app, l, doc.bounds(), cmd, &p)?;
diff --git a/crates/ui-egui/src/tools/gradient_ui/properties_panel.rs b/crates/ui-egui/src/tools/gradient_ui/properties_panel.rs
index 271118de40..b5a16773f1 100644
--- a/crates/ui-egui/src/tools/gradient_ui/properties_panel.rs
+++ b/crates/ui-egui/src/tools/gradient_ui/properties_panel.rs
@@ -1,6 +1,9 @@
 //! Compact live-gradient Properties controls, sharing the editor's stop interaction.
 
-use super::*;
+use super::{
+    Color32, Fill, GradientStyle, Layer, LayerId, Marker, PhotocraftApp, Rect, Sense, Sink, Stroke, StrokeKind, Tokens, c32, cmds, edit_stop_color, fill_of,
+    json, preset_stop_color, selection_after_edit, stops_editor_for, strip_key, vec2, widgets,
+};
 use crate::{icons, props_layout, theme};
 
 const STYLES: [(GradientStyle, &str); 5] = [
@@ -215,6 +218,7 @@ pub(super) fn stop_fields(app: &mut PhotocraftApp, ui: &mut egui::Ui, sink: Sink
 #[cfg(test)]
 mod tests {
     use super::*;
+    use egui::pos2;
     use egui_kittest::{
         Harness,
         kittest::{NodeT, Queryable},
diff --git a/crates/ui-egui/src/tools/move_mods.rs b/crates/ui-egui/src/tools/move_mods.rs
index ffd302add0..84bf2c085f 100644
--- a/crates/ui-egui/src/tools/move_mods.rs
+++ b/crates/ui-egui/src/tools/move_mods.rs
@@ -90,7 +90,9 @@ fn duplicate(app: &mut PhotocraftApp) -> Option<usize> {
     let before = past_len(app)?;
     // In place: the copy follows the pointer from the original, artboards too (#1531).
     match app.run("layer.duplicate", json!({"inPlace": true})) {
-        Ok(_) => Some(before),
+        // The state just before the copy's: in non-linear history the copy's step also moved
+        // the later states in front of it (`History::record`), and those must stay.
+        Ok(_) => Some(past_len(app).and_then(|n| n.checked_sub(1)).unwrap_or(before).max(before)),
         Err(e) => {
             app.ui.status = e;
             None
@@ -186,7 +188,8 @@ pub fn finish(app: &mut PhotocraftApp) {
 /// ⌥-drag's copy is taken back.
 pub fn abandon(app: &mut PhotocraftApp) {
     if std::mem::take(&mut app.move_mods).dup_from.is_some() {
-        app.session.undo();
+        // Exactly, also in non-linear history (where an undo would land on a later state).
+        app.session.rollback();
     }
 }
 
diff --git a/crates/ui-egui/src/tools/move_mods/tests.rs b/crates/ui-egui/src/tools/move_mods/tests.rs
index 27118357fe..bb8b39f0d8 100644
--- a/crates/ui-egui/src/tools/move_mods/tests.rs
+++ b/crates/ui-egui/src/tools/move_mods/tests.rs
@@ -104,6 +104,22 @@ fn alt_drag_duplicates_and_moves_the_copy_in_one_step() {
     assert_eq!(bounds(&app, st.active_layer.unwrap()), photocraft_geom::Rect::new(22, 8, 38, 24));
 }
 
+/// Allow Non-Linear History: the copy's step moves the later states in front of it, and
+/// folding the copy and the move into one step must keep them.
+#[test]
+fn alt_drag_keeps_the_later_states_in_non_linear_history() {
+    let mut app = app_with_layer();
+    app.session.execute("history.options", json!({"allowNonLinearHistory": true})).unwrap();
+    let id = app.session.active().unwrap().active_layer.unwrap();
+    app.session.execute("layer.setProps", json!({"layer": id.0, "opacity": 0.5})).unwrap();
+    assert!(app.session.undo());
+    let mut expected = app.session.active().unwrap().history.entries();
+    expected.extend(app.session.active().unwrap().history.redo_labels().map(str::to_string));
+    expected.push(DUPLICATE_MOVE_LABEL.into());
+    drag(&mut app, &[[16.0, 16.0], [20.0, 16.0], [26.0, 21.0]], egui::Modifiers::ALT);
+    assert_eq!(app.session.active().unwrap().history.entries(), expected, "the later state stays");
+}
+
 #[test]
 fn alt_drag_duplicates_every_selected_layer() {
     let mut app = app_with_layer();
diff --git a/crates/ui-egui/src/tools/shape_stroke_ui/editor.rs b/crates/ui-egui/src/tools/shape_stroke_ui/editor.rs
index 4d0e44678b..318468d910 100644
--- a/crates/ui-egui/src/tools/shape_stroke_ui/editor.rs
+++ b/crates/ui-egui/src/tools/shape_stroke_ui/editor.rs
@@ -262,7 +262,7 @@ pub fn button(
 fn choice<T: Copy + PartialEq>(ui: &mut egui::Ui, label: &str, value: &mut T, choices: &[(T, &str)], children: &mut Children) {
     let parent_layer = ui.layer_id();
     let (press, close) = crate::press_menu::PressCombo::before(ui, label);
-    let response = egui::ComboBox::from_id_salt(label)
+    let response = craft_ui::ComboBox::from_id_salt(label)
         .width(152.0)
         .selected_text(choices.iter().find(|(v, _)| v == value).map_or("", |(_, n)| tl!(*n)))
         .close_behavior(close)
diff --git a/crates/ui-egui/src/tools/stroke_trail.rs b/crates/ui-egui/src/tools/stroke_trail.rs
index 0ea62c6a97..4a087be890 100644
--- a/crates/ui-egui/src/tools/stroke_trail.rs
+++ b/crates/ui-egui/src/tools/stroke_trail.rs
@@ -126,13 +126,19 @@ impl Trail {
         let tail = tail.map(|(_, t)| t);
         let renderer = &dabs.renderer;
         let full = |c: f32| if dabs.reach && c > 0.0 { 1.0 } else { c };
-        self.restamp(changed, |x, y| full(renderer.coverage_at(x, y).max(tail.as_ref().map_or(0.0, |t| t.coverage_at(x, y)))));
+        let reach = dabs.reach;
+        let touches = |r| renderer.touches(r) || tail.as_ref().is_some_and(|t| t.touches(r));
+        self.restamp(changed, reach, touches, |x, y| full(renderer.coverage_at(x, y).max(tail.as_ref().map_or(0.0, |t| t.coverage_at(x, y)))));
         self.dabs = Some(dabs);
     }
 
     /// Recompute the mask pixels over the document rectangle `r` from `cov` (document pixel →
-    /// coverage 0..=1), sampled at each mask pixel's centre.
-    fn restamp(&mut self, r: photocraft_geom::Rect, cov: impl Fn(i32, i32) -> f32) {
+    /// coverage 0..=1), sampled at each mask pixel's centre. With `block`, a mask pixel takes the
+    /// largest coverage of all the document pixels it stands for instead: on a big document (one
+    /// mask pixel per k x k) a thin Remove stroke can fall between the centres, and every pixel it
+    /// touches is removed. `touches` says whether `cov` can be above 0 anywhere in a document
+    /// rectangle, so blocks the stroke never reached aren't scanned pixel by pixel.
+    fn restamp(&mut self, r: photocraft_geom::Rect, block: bool, touches: impl Fn(photocraft_geom::Rect) -> bool, cov: impl Fn(i32, i32) -> f32) {
         if r.is_empty() {
             return;
         }
@@ -144,14 +150,39 @@ impl Trail {
         if x1 <= x0 || y1 <= y0 {
             return;
         }
+        // Document pixels of mask pixel `i` along a side `n` long: its centre, or its whole span
+        // clipped to the document (at least one pixel).
+        let span = |i: usize, n: u32| -> (i32, i32) {
+            if block {
+                let lo = (i as f64 * k) as i64;
+                let hi = (((i + 1) as f64 * k) as i64).min(i64::from(n)).max(lo + 1);
+                (i32::try_from(lo).unwrap_or(i32::MAX), i32::try_from(hi).unwrap_or(i32::MAX))
+            } else {
+                let c = ((i as f64 + 0.5) * k).floor() as i32;
+                (c, c.saturating_add(1))
+            }
+        };
         for y in y0..y1 {
-            let dy = ((y as f64 + 0.5) * k).floor() as i32;
+            let (dy0, dy1) = span(y, self.doc[1]);
             for x in x0..x1 {
-                let dx = ((x as f64 + 0.5) * k).floor() as i32;
-                let c = cov(dx, dy);
-                let c = if c.is_finite() { (c.clamp(0.0, 1.0) * 255.0).round() as u8 } else { 0 };
+                let (dx0, dx1) = span(x, self.doc[0]);
                 let i = y * self.w + x;
-                let c = c.max(self.base.get(i).copied().unwrap_or(0));
+                let base = self.base.get(i).copied().unwrap_or(0);
+                let mut c = 0.0f32;
+                let skip = base == u8::MAX || !touches(photocraft_geom::Rect::new(dx0, dy0, dx1, dy1));
+                'block: for dy in if skip { 0..0 } else { dy0..dy1 } {
+                    for dx in dx0..dx1 {
+                        let v = cov(dx, dy);
+                        if v > c {
+                            c = v;
+                            if c >= 1.0 {
+                                break 'block;
+                            }
+                        }
+                    }
+                }
+                let c = if c.is_finite() { (c.clamp(0.0, 1.0) * 255.0).round() as u8 } else { 0 };
+                let c = c.max(base);
                 if let Some(v) = self.cov.get_mut(i) {
                     *v = c;
                 }
@@ -312,6 +343,41 @@ mod tests {
         assert_eq!(t.coverage(40, 40), 0);
     }
 
+    /// On a big document one mask pixel stands for k x k document pixels. A thin Remove stroke
+    /// that falls between the mask pixels' centres still removes what it touches, so it still
+    /// shows.
+    #[test]
+    fn a_thin_reach_stroke_on_a_big_document_still_shows() {
+        // A 2 px brush reaches document rows 10-14, a 4 px one rows 9-16; the mask's centres
+        // sample rows 9 and 15 at k = 6, rows 6 and 18 at k = 12.
+        for (doc, size) in [([6000, 4000], 2.0), ([12000, 8000], 4.0)] {
+            let brush = BrushSettings { size, hardness: 1.0, ..Default::default() };
+            let pts = [[300.0, 12.5, 1.0], [3000.0, 12.5, 1.0]];
+            let mut t = Trail::new(doc);
+            t.feed_reach(&pts, || brush.clone());
+            let x = (1500.0 / t.scale()) as usize;
+            assert!((0..3).any(|y| t.coverage(x, y) == 255), "{size} px on {doc:?}: the stroke shows");
+            assert_eq!(t.coverage(x, 3), 0, "{size} px on {doc:?}: nothing below it");
+            let mut s = Trail::new(doc);
+            s.feed_stroke_reach(&pts, || brush.clone());
+            assert!((0..3).any(|y| s.coverage(x, y) == 255), "{size} px on {doc:?}: a waiting stroke too");
+        }
+    }
+
+    /// A later stroke restamps its whole dirty rectangle, earlier strokes' tint included, also
+    /// off its own path.
+    #[test]
+    fn a_crossing_reach_stroke_keeps_the_earlier_tint_inside_its_rect() {
+        let mut t = Trail::new([200, 200]);
+        let brush = BrushSettings { size: 20.0, ..Default::default() };
+        t.feed_stroke_reach(&[[20.0, 100.0, 1.0], [180.0, 100.0, 1.0]], || brush.clone());
+        t.feed_stroke_reach(&[[20.0, 20.0, 1.0], [180.0, 180.0, 1.0]], || brush.clone());
+        assert_eq!(t.coverage(150, 100), 255, "the first stroke, off the second, inside its rect");
+        assert_eq!(t.coverage(50, 100), 255);
+        assert_eq!(t.coverage(150, 150), 255, "the second stroke");
+        assert_eq!(t.coverage(150, 40), 0);
+    }
+
     #[test]
     fn hostile_points_and_huge_documents_are_safe() {
         let mut t = Trail::new([300_000, 2]);
diff --git a/crates/ui-egui/src/tools/transform_tool.rs b/crates/ui-egui/src/tools/transform_tool.rs
index 1aac4e1854..672bd82868 100644
--- a/crates/ui-egui/src/tools/transform_tool.rs
+++ b/crates/ui-egui/src/tools/transform_tool.rs
@@ -35,11 +35,14 @@ pub(crate) use begin::begin_content_aware;
 pub use begin::{begin, begin_copy, begin_placed, begin_selection, begin_warp, enter_warp, leave_warp, warps_type};
 pub(crate) use commit::{SAVE_FOR_WEB, committing, nudge};
 pub use commit::{cancel, commit, end_if_left, follow_edits, intercept, is_enabled, on_job_event, track_steps};
+#[cfg(test)]
+use drag_modes::{HandleIndicator, handle_indicator, keep_convex, turns};
 pub(crate) use drag_modes::{apply_drag, corner_distorts, legacy_mods};
 #[cfg(test)]
 pub(crate) use drag_modes::{apply_mode_drag, unlinked_mods};
+pub(crate) use draw::draw_handle_cursor;
 #[cfg(test)]
-use drag_modes::{keep_convex, turns};
+use draw::scale_values;
 #[cfg(test)]
 pub(crate) use draw::{Readout, live_readout, styled_frame};
 pub(crate) use draw::{carries_selection_of, draw_selection};
diff --git a/crates/ui-egui/src/tools/transform_tool/begin.rs b/crates/ui-egui/src/tools/transform_tool/begin.rs
index e4ec2b8691..44bea250aa 100644
--- a/crates/ui-egui/src/tools/transform_tool/begin.rs
+++ b/crates/ui-egui/src/tools/transform_tool/begin.rs
@@ -1,6 +1,9 @@
 use super::commit::{commit, start_steps};
 use super::preview::{Above, preview_image};
-use super::*;
+use super::{
+    Arc, BezierMesh, CAS_ONLY_SCALES, Color32, DocId, Document, Follow, Homography, LOCKED, LayerContent, LayerId, MadeLayer, PhotocraftApp, Steps,
+    TransformPreview, TransformSession, Warp, WarpStyle, corners, json,
+};
 
 /// Start Free Transform on the active layer (or its selected pixels), or on the targeted unlinked
 /// layer mask, alpha channel or Quick Mask.
@@ -208,17 +211,18 @@ pub(super) fn take_back_made(app: &mut PhotocraftApp, document: DocId, layer: La
     let Some(index) = app.session.documents().iter().position(|st| {
         st.doc.id == document
             && st.doc.layer(layer).is_some()
-            && st.history.past_len().checked_sub(1).and_then(|i| st.history.state(i)).is_some_and(|before| before.layer(layer).is_none())
+            && st
+                .history
+                .recorded_before()
+                .or_else(|| st.history.past_len().checked_sub(1).and_then(|i| st.history.state(i)))
+                .is_some_and(|before| before.layer(layer).is_none())
     }) else {
         return;
     };
     let active = app.session.active_index();
     app.session.set_active(index);
-    if app.session.undo()
-        && let Some(st) = app.session.active_mut()
-    {
-        st.history.clear_redo();
-    }
+    // Exactly, also in non-linear history (where an undo would land on a later state).
+    app.session.rollback();
     if let Some(active) = active {
         app.session.set_active(active);
     }
diff --git a/crates/ui-egui/src/tools/transform_tool/commit.rs b/crates/ui-egui/src/tools/transform_tool/commit.rs
index 23ab10e429..eebc7120ce 100644
--- a/crates/ui-egui/src/tools/transform_tool/commit.rs
+++ b/crates/ui-egui/src/tools/transform_tool/commit.rs
@@ -1,6 +1,8 @@
 use super::begin::{fold_made, rect_to_quad_affine, take_back_made, warps_type};
 use super::options_bar::{rotate_about_pivot, scale_about_pivot};
-use super::*;
+use super::{
+    Arc, DocId, JobEvent, JobId, JobOutcome, LayerContent, LayerId, MadeLayer, PhotocraftApp, Step, Steps, TransformPreview, TransformSession, corners, json,
+};
 
 /// Undo and Redo while the commit runs in the background (Free Transform, or Warp).
 const STILL_APPLYING: &str = "Free Transform is still being applied";
diff --git a/crates/ui-egui/src/tools/transform_tool/drag_modes.rs b/crates/ui-egui/src/tools/transform_tool/drag_modes.rs
index 8800df7e04..0114e57754 100644
--- a/crates/ui-egui/src/tools/transform_tool/drag_modes.rs
+++ b/crates/ui-egui/src/tools/transform_tool/drag_modes.rs
@@ -1,5 +1,5 @@
 use super::pointer::{Gesture, Hit, carry_pivot};
-use super::*;
+use super::{Homography, LayerContent, LayerId, PhotocraftApp, TransformMode, TransformSession};
 
 /// The same effective modifiers drive the geometry and decide whether Ctrl is a distortion
 /// gesture rather than the ordinary snap override. Keep type and Content-Aware Scale refusals.
@@ -21,6 +21,33 @@ pub(crate) fn corner_distorts(app: &PhotocraftApp, index: usize, mods: egui::Mod
     mods.command && !(mods.alt && mods.shift)
 }
 
+/// The pointer a handle shows for a drag that distorts or skews the box rather than scaling or
+/// rotating it (#5405).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) enum HandleIndicator {
+    Distort,
+    Skew,
+}
+
+/// What dragging handle `h` with `mods` does, worked out by the same rules as the drag itself
+/// ([`drag_mods`], [`mode_mods`], [`apply_mode_drag`]): ⌘ on a corner distorts (⌘⌥⇧ adds
+/// perspective) and on an edge skews, Distort and Perspective modes distort from the corners,
+/// Skew mode skews from the edges. Rotate mode turns the box whatever the keys, a Skew-mode corner
+/// slides along an edge, editable type refuses Distort and Content-Aware Scale only scales: `None`.
+pub(super) fn handle_indicator(app: &PhotocraftApp, t: &TransformSession, h: Hit, mods: egui::Modifiers) -> Option<HandleIndicator> {
+    if t.warp.is_some() || t.content_aware.is_some() || !mode_allows(t.mode, h) {
+        return None;
+    }
+    let (mode, mods) = drag_mods(app, t, h, mods);
+    match (mode, h) {
+        (TransformMode::Rotate, _) | (TransformMode::Skew, Hit::Corner(_)) => None,
+        (TransformMode::Skew, Hit::Edge(_)) => Some(HandleIndicator::Skew),
+        (_, Hit::Corner(_)) if mode_mods(mode, h, mods).command => Some(HandleIndicator::Distort),
+        (_, Hit::Edge(_)) if mods.command => Some(HandleIndicator::Skew),
+        _ => None,
+    }
+}
+
 /// Editable type can be scaled, rotated and skewed but not distorted (#2630): the rule that greys
 /// Distort and Perspective in `enable_rules::disabled`, for the box's own layer. A box on a path,
 /// on the selection outline or on a lone mask or channel moves no type.
diff --git a/crates/ui-egui/src/tools/transform_tool/draw.rs b/crates/ui-egui/src/tools/transform_tool/draw.rs
index 2dce211108..fc1babfbdb 100644
--- a/crates/ui-egui/src/tools/transform_tool/draw.rs
+++ b/crates/ui-egui/src/tools/transform_tool/draw.rs
@@ -1,8 +1,80 @@
 use super::begin::warps_type;
+use super::drag_modes::{HandleIndicator, handle_indicator};
 use super::options_bar::{quad_scale, readout};
-use super::pointer::{Hit, rotate_dir, rotation_degrees};
+use super::pointer::{Hit, handle_at, rotate_dir, rotation_degrees};
 use super::warp::{on_section_edge, quick_split_kind, single_patch};
-use super::*;
+use super::{
+    BezierMesh, Color32, DocId, HANDLE_PX, Homography, LayerId, PhotocraftApp, Pos2, SplitTool, Stroke, TransformPreview, TransformSession, ViewXform, Warp,
+    WarpDrag, WarpStyle, corners, pos2, vec2,
+};
+
+/// The distort or skew pointer at screen point `at`, where [`super::cursor`] hid the system
+/// pointer over a handle. The canvas calls it from its cursor branch, so nothing is drawn where a
+/// guide, a pan or a zoom set the cursor instead.
+pub(crate) fn draw_handle_cursor(app: &PhotocraftApp, ctx: &egui::Context, xf: &ViewXform, at: Pos2, mods: egui::Modifiers) {
+    let Some(t) = &app.ui.transform else { return };
+    let h = handle_at(app, t, xf.to_doc(at), super::handle_tolerance(app));
+    let scr = |q: [f64; 2]| xf.to_screen(q[0] as f32, q[1] as f32);
+    match (h, handle_indicator(app, t, h, mods)) {
+        (Hit::Corner(i), Some(HandleIndicator::Distort)) => {
+            if let Some(q) = t.quad.get(i) {
+                draw_distort_cursor(ctx, at, scr(*q) - scr(t.pivot));
+            }
+        }
+        (Hit::Edge(i), Some(HandleIndicator::Skew)) => {
+            if let (Some(a), Some(b)) = (t.quad.get(i), t.quad.get((i + 1) % 4)) {
+                draw_skew_cursor(ctx, at, scr(*b) - scr(*a));
+            }
+        }
+        _ => {}
+    }
+}
+
+/// Draws the Free Distort cursor at `at`: a high-contrast vector pointer pointing toward
+/// or outward through the corner, with shadow outline for contrast on any canvas background.
+fn draw_distort_cursor(ctx: &egui::Context, at: Pos2, toward: egui::Vec2) {
+    let len = toward.length();
+    let u = if len.is_finite() && len > 1e-6 { toward / len } else { vec2(-1.0, -1.0).normalized() };
+    let perp = vec2(-u.y, u.x);
+    let tokens = crate::theme::Tokens::get(ctx);
+    let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("transform-distort-cursor")));
+
+    // An arrowhead dart pointing along `u` with tip at `at`.
+    let tip = at;
+    const LENGTH: f32 = 16.0;
+    const HALF_WIDTH: f32 = 7.0;
+    let base = tip - u * LENGTH;
+    let left = base + perp * HALF_WIDTH;
+    let right = base - perp * HALF_WIDTH;
+    let notch = tip - u * (LENGTH * 0.65);
+
+    // Convex decomposition: two triangles meeting along [tip, notch].
+    painter.add(egui::Shape::convex_polygon(vec![tip, left, notch], tokens.accent_text, Stroke::NONE));
+    painter.add(egui::Shape::convex_polygon(vec![tip, notch, right], tokens.accent_text, Stroke::NONE));
+    painter.add(egui::Shape::closed_line(vec![tip, left, notch, right], Stroke::new(1.5, tokens.shadow)));
+}
+
+/// Draws the Skew cursor at `at`: opposing parallel arrows aligned with the edge tangent `tangent`.
+fn draw_skew_cursor(ctx: &egui::Context, at: Pos2, tangent: egui::Vec2) {
+    let len = tangent.length();
+    let u = if len.is_finite() && len > 1e-6 { tangent / len } else { vec2(1.0, 0.0) };
+    let perp = vec2(-u.y, u.x);
+    let tokens = crate::theme::Tokens::get(ctx);
+    let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("transform-skew-cursor")));
+
+    for (offset, dir) in [(4.0f32, 1.0f32), (-4.0f32, -1.0f32)] {
+        let center = at + perp * offset;
+        let p_start = center - u * (dir * 9.0);
+        let p_end = center + u * (dir * 9.0);
+        painter.line_segment([p_start, p_end], Stroke::new(3.5, tokens.shadow));
+        painter.line_segment([p_start, p_end], Stroke::new(1.5, tokens.accent_text));
+
+        let tip = p_end + u * (dir * 3.5);
+        let wing1 = p_end - u * (dir * 2.5) + perp * 3.5;
+        let wing2 = p_end - u * (dir * 2.5) - perp * 3.5;
+        painter.add(egui::Shape::convex_polygon(vec![tip, wing1, wing2], tokens.accent_text, Stroke::new(1.0, tokens.shadow)));
+    }
+}
 
 /// For each vertex of the preview's `n` × `n` grid over the unit square (row by row), whether it
 /// maps to the front side of `h`'s horizon. A Distort dragged past the horizon sends the rest of
@@ -83,7 +155,9 @@ pub fn draw_overlay(app: &PhotocraftApp, painter: &egui::Painter, xf: &ViewXform
     if let Some(w) = &t.warp {
         let over_canvas = painter.ctx().input(|i| i.pointer.hover_pos()).filter(|p| xf.rect.contains(*p)).map(|p| xf.to_doc(p));
         let at = pv.split_pointer.or(over_canvas);
-        let alt = painter.ctx().input(|i| i.modifiers.alt || i.modifiers.command);
+        // The same keys as `cursor`, sticky ones included, so the guide matches the pointer.
+        let mods = crate::workspace_ui::sticky_mods(app, painter.ctx().input(|i| i.modifiers));
+        let alt = mods.alt || mods.command;
         let guide = at.filter(|_| !warps_type(app)).and_then(|p| {
             let tool = pv.split_tool.or_else(|| {
                 (alt || pv.split_quick).then(|| {
@@ -136,7 +210,7 @@ pub fn draw_overlay(app: &PhotocraftApp, painter: &egui::Painter, xf: &ViewXform
         }
         // Preferences › Tools › Show Transformation Values off hides it, as in Photoshop (#204).
         if let Some(r) = live_readout(app).filter(|_| app.session.prefs().tools.show_transformation_values) {
-            draw_live_readout(painter.ctx(), at, r);
+            draw_live_readout(app, painter.ctx(), at, r);
         }
     }
 }
@@ -237,8 +311,11 @@ pub(crate) fn styled_frame(app: &PhotocraftApp, zoom: f32, dragging: bool) -> Op
 pub(crate) enum Readout {
     /// Clockwise degrees in document space (`rotation_degrees`), whatever the view's turn or flip.
     Angle(f64),
-    /// Width and height in percent of the original box.
-    Scale([f64; 2]),
+    /// Width and height in percent of the original box, and the box's size in document pixels.
+    /// The size is the scaled width and height (what W and H 100 % mean in the options bar),
+    /// not the edge lengths: a skew leans the sides, which lengthens them but not the height
+    /// between the top and bottom edges.
+    Scale { percent: [f64; 2], px: [f64; 2] },
     /// Document pixels moved since the press.
     Offset([f64; 2]),
 }
@@ -253,7 +330,8 @@ pub(crate) fn live_readout(app: &PhotocraftApp) -> Option<Readout> {
         Hit::Inside => Some(Readout::Offset([t.quad[0][0] - g.quad0[0][0], t.quad[0][1] - g.quad0[0][1]])),
         Hit::Corner(_) | Hit::Edge(_) if parallelogram(&t.quad) => {
             let (w, h, _, _) = readout(t);
-            (w.is_finite() && h.is_finite()).then_some(Readout::Scale([w, h]))
+            let px = [w / 100.0 * (t.rect[2] - t.rect[0]), h / 100.0 * (t.rect[3] - t.rect[1])];
+            (w.is_finite() && h.is_finite()).then_some(Readout::Scale { percent: [w, h], px })
         }
         Hit::Corner(_) | Hit::Edge(_) | Hit::Pivot => None,
     }
@@ -267,21 +345,32 @@ fn parallelogram(q: &[[f64; 2]; 4]) -> bool {
 }
 
 /// [`live_readout`] as the rounded label beside the pointer (the marquee's and Crop's readout).
-fn draw_live_readout(ctx: &egui::Context, at: Pos2, r: Readout) {
-    // Round first so a hair below zero never reads "-0".
-    let fixed = |v: f64, places: i32| {
-        let k = 10f64.powi(places);
-        let v = (v * k).round() / k;
-        if v == 0.0 { 0.0 } else { v }
-    };
+fn draw_live_readout(app: &PhotocraftApp, ctx: &egui::Context, at: Pos2, r: Readout) {
     let id = "transform-readout";
     match r {
         Readout::Angle(a) => crate::canvas::draw_readout(ctx, id, at, ["Angle:"], [format!("{:.1}°", fixed(a, 1))]),
-        Readout::Scale([w, h]) => crate::canvas::draw_readout(ctx, id, at, ["W:", "H:"], [w, h].map(|v| format!("{:.1}%", fixed(v, 1)))),
+        Readout::Scale { percent, px } => crate::canvas::draw_readout(ctx, id, at, ["W:", "H:"], scale_values(app, percent, px)),
         Readout::Offset([dx, dy]) => crate::canvas::draw_readout(ctx, id, at, ["ΔX:", "ΔY:"], [dx, dy].map(|v| format!("{:.0} px", fixed(v, 0)))),
     }
 }
 
+/// `v` rounded to `places` decimals, so a hair below zero never reads "-0".
+fn fixed(v: f64, places: i32) -> f64 {
+    let k = 10f64.powi(places);
+    let v = (v * k).round() / k;
+    if v == 0.0 { 0.0 } else { v }
+}
+
+/// The W and H rows of the scale readout: the box's size in the Units & Rulers unit at the
+/// document's resolution, as Photoshop shows it (cm when the rulers are in centimeters, #9400);
+/// the scale of the original box when the rulers are in percent.
+pub(crate) fn scale_values(app: &PhotocraftApp, percent: [f64; 2], px: [f64; 2]) -> [String; 2] {
+    if app.session.prefs().units_and_rulers.rulers == photocraft_engine::prefs::Unit::Percent {
+        return percent.map(|v| format!("{:.1}%", fixed(v, 1)));
+    }
+    crate::canvas::size_readout(app, [0.0, 0.0, px[0], px[1]])
+}
+
 /// Width and height of the document being transformed, in document pixels.
 fn canvas_size(pv: &TransformPreview) -> [f32; 2] {
     [pv.doc.size.width as f32, pv.doc.size.height as f32]
diff --git a/crates/ui-egui/src/tools/transform_tool/options_bar.rs b/crates/ui-egui/src/tools/transform_tool/options_bar.rs
index e2f1ad20ac..c9393810b5 100644
--- a/crates/ui-egui/src/tools/transform_tool/options_bar.rs
+++ b/crates/ui-egui/src/tools/transform_tool/options_bar.rs
@@ -2,7 +2,7 @@ use super::begin::{enter_warp, leave_warp, warps_type};
 use super::commit::{cancel, commit};
 use super::pointer::point_on_quad;
 use super::warp::edit_session_warp;
-use super::*;
+use super::{BezierMesh, Homography, PhotocraftApp, SplitTool, Stroke, TransformSession, Warp, WarpStyle, json, vec2};
 
 /// How much the box enlarges its pixels: the longest edge relative to the original (picks the
 /// preview's texture level and filter).
diff --git a/crates/ui-egui/src/tools/transform_tool/pointer.rs b/crates/ui-egui/src/tools/transform_tool/pointer.rs
index 7df9bfa6f1..87ccfe2f49 100644
--- a/crates/ui-egui/src/tools/transform_tool/pointer.rs
+++ b/crates/ui-egui/src/tools/transform_tool/pointer.rs
@@ -1,8 +1,11 @@
 use super::begin::warps_type;
 use super::commit::{commit, committing, moves_type};
-use super::drag_modes::{apply_drag, apply_mode_drag, drag_mods, mode_allows, mode_mods};
+use super::drag_modes::{apply_drag, apply_mode_drag, drag_mods, handle_indicator, mode_allows, mode_mods};
 use super::warp::{quick_split_kind, split_cursor, surface_at, warp_hit, warp_pointer};
-use super::*;
+use super::{
+    CursorIcon, HANDLE_PX, Homography, LayerContent, LayerId, PhotocraftApp, ToolEvent, TransformMode, TransformPreview, TransformSession, ViewXform,
+    WarpStyle, handle_tolerance,
+};
 
 /// Which part of the box a document point hits.
 #[derive(Clone, Copy, Debug, PartialEq, serde::Serialize, serde::Deserialize)]
@@ -239,9 +242,13 @@ pub(super) fn rotate_dir(t: &TransformSession, pv: Option<&TransformPreview>, p:
     {
         return None;
     }
-    let rotating = pv.is_some_and(|pv| pv.gesture.is_some_and(|g| g.hit == Hit::Outside));
-    if !rotating && !near_rotate_corner(t, p, tol) {
-        return None;
+    // During a drag the arrow shows only while it rotates: not when a handle that scales, skews
+    // or distorts strays past a corner (#5405).
+    match pv.and_then(|pv| pv.gesture) {
+        Some(g) if g.hit == Hit::Outside || (t.mode == TransformMode::Rotate && matches!(g.hit, Hit::Corner(_) | Hit::Edge(_))) => {}
+        Some(_) => return None,
+        None if !near_rotate_corner(t, p, tol) => return None,
+        None => {}
     }
     let dist = |q: [f64; 2]| (p[0] - q[0]).hypot(p[1] - q[1]);
     let i = (0..4).min_by(|&a, &b| dist(t.quad[a]).total_cmp(&dist(t.quad[b])))?;
@@ -256,9 +263,14 @@ pub(super) fn rotate_dir(t: &TransformSession, pv: Option<&TransformPreview>, p:
     (l.is_finite() && l > 1e-9).then(|| [s[0] / l, s[1] / l])
 }
 
+/// The handle a drag in progress holds, else the one under document point `p`.
+pub(super) fn handle_at(app: &PhotocraftApp, t: &TransformSession, p: [f64; 2], tol: f64) -> Hit {
+    app.transform_preview.as_ref().and_then(|pv| pv.gesture.map(|g| g.hit)).unwrap_or_else(|| hit(t, p, tol))
+}
+
 /// Cursor for hovering a document point while transforming. `xf` is the canvas's view;
-/// `quick_split` is Ctrl or Option, which arms a quick split while a warp is active.
-pub fn cursor(app: &PhotocraftApp, xf: &ViewXform, p: [f64; 2], quick_split: bool) -> Option<CursorIcon> {
+/// `mods` provides modifier keys (Command for Distort on corners / Skew on edges; Alt/Command for quick split in warp).
+pub fn cursor(app: &PhotocraftApp, xf: &ViewXform, p: [f64; 2], mods: egui::Modifiers) -> Option<CursorIcon> {
     let t = app.ui.transform.as_ref()?;
     let tol = handle_tolerance(app);
     if let Some(w) = &t.warp {
@@ -266,6 +278,7 @@ pub fn cursor(app: &PhotocraftApp, xf: &ViewXform, p: [f64; 2], quick_split: boo
             return Some(CursorIcon::Default);
         }
         let armed = app.transform_preview.as_ref().and_then(|pv| pv.split_tool);
+        let quick_split = mods.alt || mods.command;
         if armed.is_some() || quick_split {
             // One search for the grid position under the pointer, for both the kind and the arrow.
             let m = w.to_mesh(1, 1);
@@ -278,14 +291,18 @@ pub fn cursor(app: &PhotocraftApp, xf: &ViewXform, p: [f64; 2], quick_split: boo
         }
         return Some(if w.mesh.as_ref().and_then(|m| surface_at(m, p)).is_some() { CursorIcon::Grab } else { CursorIcon::Default });
     }
-    let h = hit(t, p, tol);
+    let h = handle_at(app, t, p, tol);
     if !mode_allows(t.mode, h) || (t.content_aware.is_some() && h == Hit::Outside) {
         return Some(CursorIcon::Default);
     }
+    // A ⌘-drag outside the box still rotates, so ⌘ keeps the curved arrow there.
     if rotate_cursor_dir(app, p).is_some() {
-        // The overlay draws the curved rotate arrow (`rotate_cursor_dir`), also during the drag.
+        // The canvas draws the curved rotate arrow (`rotate_cursor_dir`), also during the drag.
         return Some(CursorIcon::None);
     }
+    // The canvas draws the distort or skew pointer in place of the hidden one
+    // (`draw_handle_cursor`); not while the box is being applied, when it draws no handles.
+    let indicator = handle_indicator(app, t, h, mods).filter(|_| committing(app).is_none());
     // The box's corners run clockwise from the top-left; edge k joins corners k and k + 1.
     let corner = |k: usize| t.quad[k % 4];
     let edge_mid = |k: usize| {
@@ -295,6 +312,7 @@ pub fn cursor(app: &PhotocraftApp, xf: &ViewXform, p: [f64; 2], quick_split: boo
     // A handle resizes the box away from the opposite handle.
     let resize = |from: [f64; 2], to: [f64; 2]| crate::tool_cursor::resize([to[0] - from[0], to[1] - from[1]], xf);
     Some(match h {
+        Hit::Corner(_) | Hit::Edge(_) if indicator.is_some() => CursorIcon::None,
         Hit::Corner(i) => crate::tool_cursor::corner_resize(&t.quad, i, xf),
         Hit::Edge(i) => resize(edge_mid(i + 2), edge_mid(i)),
         Hit::Pivot => CursorIcon::Crosshair,
diff --git a/crates/ui-egui/src/tools/transform_tool/preview.rs b/crates/ui-egui/src/tools/transform_tool/preview.rs
index d39d6575f3..b9edbc67e8 100644
--- a/crates/ui-egui/src/tools/transform_tool/preview.rs
+++ b/crates/ui-egui/src/tools/transform_tool/preview.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Color32, Document, LayerContent, LayerId, ViewXform, pos2};
 
 /// Texels of the moving pixels over `b`: full resolution unless the long side exceeds the GPU's
 /// `max_side` (#91: this used to be capped at 2048 px, so big layers previewed blurry), plus the
diff --git a/crates/ui-egui/src/tools/transform_tool/tests.rs b/crates/ui-egui/src/tools/transform_tool/tests.rs
index 57d323b84a..1646fa0775 100644
--- a/crates/ui-egui/src/tools/transform_tool/tests.rs
+++ b/crates/ui-egui/src/tools/transform_tool/tests.rs
@@ -1571,10 +1571,10 @@ fn hovering_just_outside_a_corner_asks_for_the_rotate_cursor() {
     let h = std::f64::consts::FRAC_1_SQRT_2;
     let (tl, br) = ([32.0 - tol * 1.5, 32.0 - tol * 1.5], [160.0 + tol * 1.5, 160.0 + tol * 1.5]);
     let xf = ViewXform::active(&app).unwrap();
-    assert_eq!(cursor(&app, &xf, tl, false), Some(CursorIcon::None), "the arrow is drawn instead");
+    assert_eq!(cursor(&app, &xf, tl, egui::Modifiers::NONE), Some(CursorIcon::None), "the arrow is drawn instead");
     assert!(near2(rotate_cursor_dir(&app, tl), [h, h]), "{:?}", rotate_cursor_dir(&app, tl));
     assert!(near2(rotate_cursor_dir(&app, br), [-h, -h]), "bends round the bottom-right corner");
-    assert_eq!(cursor(&app, &xf, [60.0, 60.0], false), Some(CursorIcon::Move));
+    assert_eq!(cursor(&app, &xf, [60.0, 60.0], egui::Modifiers::NONE), Some(CursorIcon::Move));
     assert_eq!(rotate_cursor_dir(&app, [60.0, 60.0]), None, "inside moves");
     assert_eq!(rotate_cursor_dir(&app, [32.0, 32.0]), None, "the corner handle scales");
     assert_eq!(rotate_cursor_dir(&app, [f64::NAN, 32.0]), None);
@@ -1657,7 +1657,10 @@ fn resize_cursors_turn_with_the_box_and_the_view() {
         let t = app.ui.transform.clone().unwrap();
         let xf = ViewXform::active(&app).unwrap();
         let mid = |i: usize| [(t.quad[i][0] + t.quad[(i + 1) % 4][0]) / 2.0, (t.quad[i][1] + t.quad[(i + 1) % 4][1]) / 2.0];
-        let got: Vec<_> = (0..4).map(|i| cursor(&app, &xf, t.quad[i], false)).chain((0..4).map(|i| cursor(&app, &xf, mid(i), false))).collect();
+        let got: Vec<_> = (0..4)
+            .map(|i| cursor(&app, &xf, t.quad[i], egui::Modifiers::NONE))
+            .chain((0..4).map(|i| cursor(&app, &xf, mid(i), egui::Modifiers::NONE)))
+            .collect();
         let want = [want[0], want[1], want[0], want[1], want[2], want[3], want[2], want[3]].map(Some);
         assert_eq!(got, want, "box {deg}°, view {view}°, flip {flip}");
     }
@@ -1673,7 +1676,7 @@ fn corner_cursors_stay_diagonal_on_a_long_box() {
         crate::menus::invoke(&mut app, &egui::Context::default(), "edit.freeTransform", json!({})).unwrap();
         let t = app.ui.transform.clone().unwrap();
         let xf = ViewXform::active(&app).unwrap();
-        let got: Vec<_> = (0..4).map(|i| cursor(&app, &xf, t.quad[i], false)).collect();
+        let got: Vec<_> = (0..4).map(|i| cursor(&app, &xf, t.quad[i], egui::Modifiers::NONE)).collect();
         assert_eq!(got, [NwSe, NeSw, NwSe, NeSw].map(Some), "{rect:?}");
     }
 }
@@ -1724,8 +1727,39 @@ fn the_live_readout_follows_the_drag() {
     // The right edge doubles the width (proportional by default: the height too).
     ev(&mut app, ToolEvent::Down { x: 165.0, y: 93.0, pressure: 1.0 });
     ev(&mut app, ToolEvent::Move { x: 293.0, y: 93.0, pressure: 1.0 });
-    let Some(Readout::Scale([w, h])) = live_readout(&app) else { panic!("{:?}", live_readout(&app)) };
+    let Some(Readout::Scale { percent: [w, h], px }) = live_readout(&app) else { panic!("{:?}", live_readout(&app)) };
     assert!((w - 200.0).abs() < 1e-6 && (h - 200.0).abs() < 1e-6, "{w} {h}");
+    assert!((px[0] - 256.0).abs() < 1e-6 && (px[1] - 256.0).abs() < 1e-6, "{px:?}");
+}
+
+/// #9400: the W/H readout shows the box's size in the ruler unit, as Photoshop does, and
+/// the scale of the original box when the rulers are in percent.
+#[test]
+fn the_scale_readout_follows_the_ruler_unit() {
+    use photocraft_engine::prefs::Unit;
+    let mut app = app_with_square(256, photocraft_geom::Rect::new(32, 32, 160, 160));
+    app.ui.extras.snap = false;
+    crate::menus::invoke(&mut app, &egui::Context::default(), "edit.freeTransform", json!({})).unwrap();
+    let ev = |app: &mut PhotocraftApp, e| crate::canvas::tool_event(app, e, egui::Modifiers::NONE);
+    // The right edge from 160 to 288: the 128 px box doubles (proportionally).
+    ev(&mut app, ToolEvent::Down { x: 160.0, y: 96.0, pressure: 1.0 });
+    ev(&mut app, ToolEvent::Move { x: 288.0, y: 96.0, pressure: 1.0 });
+    let Some(Readout::Scale { percent, px }) = live_readout(&app) else { panic!("{:?}", live_readout(&app)) };
+    let shown = |app: &mut PhotocraftApp, unit: Unit| {
+        app.session.prefs.edit(|p| p.units_and_rulers.rulers = unit);
+        scale_values(app, percent, px)
+    };
+    let dpi = app.session.active().unwrap().doc.resolution_dpi;
+    assert_eq!(dpi, 72.0, "the expected values below are at 72 ppi");
+    assert_eq!(shown(&mut app, Unit::Pixels), ["256 px".to_string(), "256 px".to_string()]);
+    assert_eq!(shown(&mut app, Unit::Inches), ["3.556 in".to_string(), "3.556 in".to_string()]);
+    assert_eq!(shown(&mut app, Unit::Centimeters), ["9.03 cm".to_string(), "9.03 cm".to_string()]);
+    assert_eq!(shown(&mut app, Unit::Millimeters), ["90.31 mm".to_string(), "90.31 mm".to_string()]);
+    assert_eq!(shown(&mut app, Unit::Percent), ["200.0%".to_string(), "200.0%".to_string()]);
+    // A flipped box reads as a negative width, as in the options bar.
+    assert_eq!(scale_values(&app, [-50.0, 50.0], [-64.0, 64.0]), ["-50.0%".to_string(), "50.0%".to_string()]);
+    app.session.prefs.edit(|p| p.units_and_rulers.rulers = Unit::Pixels);
+    assert_eq!(scale_values(&app, [-50.0, 50.0], [-64.0, 64.0]), ["-64 px".to_string(), "64 px".to_string()]);
 }
 
 #[test]
@@ -2988,3 +3022,180 @@ fn anchor_grid_point_on_quad_and_carry_pivot() {
     assert_eq!(matching_anchor(quad, [12.3, 45.6]), None);
     assert_eq!(matching_anchor(quad, [50.0, 30.0]), None);
 }
+
+#[test]
+fn hovering_corner_with_ctrl_shows_distort_cursor() {
+    let mut app = app_with_square(256, photocraft_geom::Rect::new(32, 32, 160, 160));
+    crate::menus::invoke(&mut app, &egui::Context::default(), "edit.freeTransform", json!({})).unwrap();
+    let tol = handle_tolerance(&app);
+    let corner = [32.0, 32.0];
+    let mut command = egui::Modifiers::NONE;
+    command.command = true;
+    let xf = ViewXform::active(&app).unwrap();
+
+    // Without Ctrl: corner handle gives standard diagonal scale cursor.
+    assert_eq!(cursor(&app, &xf, corner, egui::Modifiers::NONE), Some(CursorIcon::ResizeNwSe));
+
+    // With Ctrl: corner handle arms free distort, hiding OS cursor so custom pointer is drawn.
+    assert_eq!(cursor(&app, &xf, corner, command), Some(CursorIcon::None));
+
+    // A Cmd-drag just outside a corner still rotates, so the curved arrow stays.
+    let near_corner = [32.0 - tol * 1.5, 32.0 - tol * 1.5];
+    assert_eq!(cursor(&app, &xf, near_corner, command), Some(CursorIcon::None));
+    assert!(rotate_cursor_dir(&app, near_corner).is_some());
+    assert_eq!(cursor(&app, &xf, near_corner, egui::Modifiers::NONE), Some(CursorIcon::None));
+}
+
+#[test]
+fn hovering_edge_with_ctrl_shows_skew_cursor() {
+    let mut app = app_with_square(256, photocraft_geom::Rect::new(32, 32, 160, 160));
+    crate::menus::invoke(&mut app, &egui::Context::default(), "edit.freeTransform", json!({})).unwrap();
+    let edge = [96.0, 32.0]; // top edge midpoint
+    let mut command = egui::Modifiers::NONE;
+    command.command = true;
+    let xf = ViewXform::active(&app).unwrap();
+
+    // Without Ctrl: edge handle gives axis resize cursor.
+    assert_eq!(cursor(&app, &xf, edge, egui::Modifiers::NONE), Some(CursorIcon::ResizeVertical));
+
+    // With Ctrl: edge handle arms skew, hiding OS cursor so custom skew indicator is drawn.
+    assert_eq!(cursor(&app, &xf, edge, command), Some(CursorIcon::None));
+}
+
+#[test]
+fn hovering_corner_on_text_layer_with_ctrl_retains_resize_cursor() {
+    let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+    app.session.execute("file.new", json!({"width": 200, "height": 100})).unwrap();
+    app.sync_views();
+    app.run("type.create", json!({"x": 10, "y": 60, "text": "Hello"})).unwrap();
+    let ctx = egui::Context::default();
+    crate::menus::invoke(&mut app, &ctx, "edit.freeTransform", json!({})).unwrap();
+
+    let t = app.ui.transform.as_ref().unwrap();
+    let corner = t.quad[0];
+    let mut command = egui::Modifiers::NONE;
+    command.command = true;
+    let xf = ViewXform::active(&app).unwrap();
+
+    // Editable type refuses distort, so holding Ctrl retains standard resize cursor on corners.
+    let without_ctrl = cursor(&app, &xf, corner, egui::Modifiers::NONE);
+    let with_ctrl = cursor(&app, &xf, corner, command);
+    assert_ne!(with_ctrl, Some(CursorIcon::None));
+    assert_eq!(with_ctrl, without_ctrl, "text layer must retain resize cursor");
+}
+
+#[test]
+fn cursor_during_drag_stays_stable() {
+    let mut app = app_with_square(256, photocraft_geom::Rect::new(32, 32, 160, 160));
+    app.ui.extras.snap = false;
+    crate::menus::invoke(&mut app, &egui::Context::default(), "edit.freeTransform", json!({})).unwrap();
+    let mut command = egui::Modifiers::NONE;
+    command.command = true;
+    let xf = ViewXform::active(&app).unwrap();
+
+    // Start dragging corner [32.0, 32.0] with Command held.
+    crate::canvas::tool_event(&mut app, ToolEvent::Down { x: 32.0, y: 32.0, pressure: 1.0 }, command);
+    crate::canvas::tool_event(&mut app, ToolEvent::Move { x: 50.0, y: 60.0, pressure: 1.0 }, command);
+
+    // While dragging, cursor anywhere stays CursorIcon::None (distort custom cursor).
+    assert_eq!(cursor(&app, &xf, [50.0, 60.0], command), Some(CursorIcon::None));
+    assert_eq!(cursor(&app, &xf, [200.0, 200.0], command), Some(CursorIcon::None));
+
+    // Release drag
+    crate::canvas::tool_event(&mut app, ToolEvent::Up { x: 50.0, y: 60.0 }, command);
+
+    // Once released, dragging has ended: far outside returns the commit-on-click cursor,
+    // and hovering the corner without Command restores normal resize cursor.
+    assert_eq!(cursor(&app, &xf, [200.0, 200.0], command), Some(CursorIcon::Alias));
+    assert_ne!(cursor(&app, &xf, [50.0, 60.0], egui::Modifiers::NONE), Some(CursorIcon::None));
+}
+
+fn cmd() -> egui::Modifiers {
+    egui::Modifiers { command: true, ..Default::default() }
+}
+
+/// The indicator each handle shows in `mode` with `mods`: corner 0 and edge 0 (top) of a square.
+fn indicators(mode: &str, mods: egui::Modifiers) -> (Option<HandleIndicator>, Option<HandleIndicator>) {
+    let mut app = app_with_square(256, photocraft_geom::Rect::new(32, 32, 160, 160));
+    crate::menus::invoke(&mut app, &egui::Context::default(), mode, json!({})).unwrap();
+    let t = app.ui.transform.clone().unwrap();
+    (handle_indicator(&app, &t, Hit::Corner(0), mods), handle_indicator(&app, &t, Hit::Edge(0), mods))
+}
+
+#[test]
+fn handle_pointers_follow_what_the_drag_does() {
+    use HandleIndicator::{Distort, Skew};
+    let none = egui::Modifiers::NONE;
+    let persp = egui::Modifiers { command: true, alt: true, shift: true, ..Default::default() };
+    assert_eq!(indicators("edit.freeTransform", none), (None, None), "plain drags scale");
+    assert_eq!(indicators("edit.freeTransform", cmd()), (Some(Distort), Some(Skew)));
+    assert_eq!(indicators("edit.freeTransform", persp), (Some(Distort), Some(Skew)));
+    // Rotate mode turns the box from every handle, whatever the keys.
+    assert_eq!(indicators("edit.transform.rotate", cmd()), (None, None));
+    // A Skew-mode corner slides along one edge, with or without Cmd; its edges skew.
+    assert_eq!(indicators("edit.transform.skew", cmd()), (None, Some(Skew)));
+    assert_eq!(indicators("edit.transform.skew", none), (None, Some(Skew)));
+    // Distort mode leaves the edges alone, Cmd or not.
+    assert_eq!(indicators("edit.transform.distort", none), (Some(Distort), None));
+    assert_eq!(indicators("edit.transform.distort", cmd()), (Some(Distort), None));
+    // Perspective mode: corners move in pairs; Cmd on an edge skews (`apply_drag`).
+    assert_eq!(indicators("edit.transform.perspective", none), (Some(Distort), None));
+    assert_eq!(indicators("edit.transform.perspective", cmd()), (Some(Distort), Some(Skew)));
+    assert_eq!(indicators("edit.transform.scale", cmd()), (Some(Distort), Some(Skew)));
+}
+
+#[test]
+fn ctrl_in_rotate_mode_keeps_the_rotate_pointer() {
+    let mut app = app_with_square(256, photocraft_geom::Rect::new(32, 32, 160, 160));
+    crate::menus::invoke(&mut app, &egui::Context::default(), "edit.transform.rotate", json!({})).unwrap();
+    let xf = ViewXform::active(&app).unwrap();
+    let corner = [32.0, 32.0];
+    assert_eq!(cursor(&app, &xf, corner, cmd()), Some(CursorIcon::None));
+    assert!(rotate_cursor_dir(&app, corner).is_some(), "a Rotate-mode corner drag rotates: the turn arrow stays");
+    // An edge drag rotates too: Cmd draws no skew pointer there.
+    let edge = [96.0, 32.0];
+    assert_eq!(cursor(&app, &xf, edge, cmd()), cursor(&app, &xf, edge, egui::Modifiers::NONE));
+}
+
+#[test]
+fn rotate_mode_handle_drag_keeps_the_arrow_away_from_the_corners() {
+    let mut app = app_with_square(256, photocraft_geom::Rect::new(32, 32, 160, 160));
+    app.ui.extras.snap = false;
+    crate::menus::invoke(&mut app, &egui::Context::default(), "edit.transform.rotate", json!({})).unwrap();
+    let xf = ViewXform::active(&app).unwrap();
+    let none = egui::Modifiers::NONE;
+    crate::canvas::tool_event(&mut app, ToolEvent::Down { x: 32.0, y: 32.0, pressure: 1.0 }, none);
+    // Far from every corner of the turned box, past the hover zone.
+    crate::canvas::tool_event(&mut app, ToolEvent::Move { x: 250.0, y: 96.0, pressure: 1.0 }, none);
+    let t = app.ui.transform.clone().unwrap();
+    let tol = handle_tolerance(&app);
+    assert!(t.quad.iter().all(|q| (250.0 - q[0]).hypot(96.0 - q[1]) > tol * 4.0), "{:?}", t.quad);
+    assert!(rotate_cursor_dir(&app, [250.0, 96.0]).is_some(), "the corner drag rotates");
+    assert_eq!(cursor(&app, &xf, [250.0, 96.0], none), Some(CursorIcon::None));
+}
+
+#[test]
+fn scale_drag_past_a_corner_shows_no_rotate_arrow() {
+    let mut app = app_with_square(256, photocraft_geom::Rect::new(32, 32, 160, 160));
+    app.ui.extras.snap = false;
+    crate::menus::invoke(&mut app, &egui::Context::default(), "edit.freeTransform", json!({})).unwrap();
+    let none = egui::Modifiers::NONE;
+    crate::canvas::tool_event(&mut app, ToolEvent::Down { x: 160.0, y: 160.0, pressure: 1.0 }, none);
+    crate::canvas::tool_event(&mut app, ToolEvent::Move { x: 150.0, y: 150.0, pressure: 1.0 }, none);
+    let t = app.ui.transform.clone().unwrap();
+    let tol = handle_tolerance(&app);
+    // Just outside another corner, where a hover would show the turn arrow.
+    let past = [t.quad[0][0] - tol * 1.5, t.quad[0][1] - tol * 1.5];
+    assert_eq!(rotate_cursor_dir(&app, past), None, "the drag scales");
+}
+
+#[test]
+fn applying_the_box_hides_no_pointer() {
+    let mut app = app_with_square(256, photocraft_geom::Rect::new(32, 32, 160, 160));
+    crate::menus::invoke(&mut app, &egui::Context::default(), "edit.freeTransform", json!({})).unwrap();
+    let xf = ViewXform::active(&app).unwrap();
+    app.transform_preview.as_mut().unwrap().committing = Some(JobId(1));
+    // The overlay draws no handles while the box is applied, so no drawn pointer either.
+    assert_eq!(cursor(&app, &xf, [32.0, 32.0], cmd()), Some(CursorIcon::ResizeNwSe));
+    assert_eq!(cursor(&app, &xf, [96.0, 32.0], cmd()), Some(CursorIcon::ResizeVertical));
+}
diff --git a/crates/ui-egui/src/tools/transform_tool/warp.rs b/crates/ui-egui/src/tools/transform_tool/warp.rs
index 90b372a36f..ca918d5d06 100644
--- a/crates/ui-egui/src/tools/transform_tool/warp.rs
+++ b/crates/ui-egui/src/tools/transform_tool/warp.rs
@@ -1,5 +1,5 @@
 use super::begin::warps_type;
-use super::*;
+use super::{BezierMesh, CursorIcon, PhotocraftApp, SplitTool, ToolEvent, ViewXform, Warp, WarpDrag, WarpStyle, json};
 
 /// An anchor or a handle on a section line. The inner control points of a patch are not shown.
 pub(super) fn on_section_edge(i: usize, j: usize) -> bool {
diff --git a/crates/ui-egui/src/tools/type_tool.rs b/crates/ui-egui/src/tools/type_tool.rs
index 2789a2b48f..bd1de4cf2d 100644
--- a/crates/ui-egui/src/tools/type_tool.rs
+++ b/crates/ui-egui/src/tools/type_tool.rs
@@ -34,7 +34,7 @@ mod pointer;
 #[cfg(test)]
 use defaults::{apply, default_style_params, default_styles, shown_scale};
 pub use defaults::{foreground_changed, open_color_picker};
-pub(crate) use defaults::{formatting_params, target, target_text, type_unit, with_target};
+pub(crate) use defaults::{formatting_params, target, target_text, type_unit};
 #[cfg(test)]
 pub(crate) use editing::{CharToggle, step_char_metric, toggle_char_style, toggle_hyphenate};
 pub use editing::{cancel, commit, commit_with, edit_active, edit_at, end_if_left};
@@ -44,9 +44,9 @@ use editing::{insert, insert_typed, smart_quotes};
 #[cfg(test)]
 pub(crate) use fonts::{Axis, axis_value, slider_axes};
 #[cfg(test)]
-use fonts::{FONT_MENU_HEIGHT, font_labels_id, font_menu_rows, font_picker_in, style_names, wheel_family_index};
+use fonts::{FONT_MENU_HEIGHT, font_labels_id, font_menu_rows, font_picker_in, preview_text, style_names, wheel_family_index};
+pub(crate) use fonts::{FontLibrary, family_picker_in, fonts_ready, selected_style};
 pub use fonts::{families, style_label, styles, sync_font_names, warm_fonts};
-pub(crate) use fonts::{family_picker_in, fonts_ready, selected_style};
 pub(crate) use ime::{ImeState, controls_only, finish_reset_logic, finish_reset_pass, in_ui_pass, install_reset_hooks};
 #[cfg(test)]
 use ime::{IncomingComposition, ResetPhase};
diff --git a/crates/ui-egui/src/tools/type_tool/canvas_tests.rs b/crates/ui-egui/src/tools/type_tool/canvas_tests.rs
index cf0aeb4970..a6dd09e44a 100644
--- a/crates/ui-egui/src/tools/type_tool/canvas_tests.rs
+++ b/crates/ui-egui/src/tools/type_tool/canvas_tests.rs
@@ -127,6 +127,28 @@ mod panel_defaults {
         h
     }
 
+    /// Without a type target the preset chevrons set the next layer's defaults, with no
+    /// document edit.
+    #[test]
+    fn presets_without_a_type_layer_set_the_defaults() {
+        let app = new_app();
+        let steps = app.session.active().unwrap().history.entries().len();
+        let mut h = panels(app);
+        h.get_by_role_and_label(Role::ComboBox, "Font size presets").click();
+        h.run();
+        h.get_by_label("72 pt").scroll_to_me();
+        h.run();
+        h.get_by_label("72 pt").click();
+        h.run();
+        assert_eq!(h.state().ui.tool_options.type_size, 72.0);
+        h.get_by_role_and_label(Role::ComboBox, "Leading presets").click();
+        h.run();
+        h.get_by_label("Auto").click();
+        h.run();
+        assert_eq!(h.state().ui.tool_options.type_style_defaults.get("leading"), Some(&json!("auto")));
+        assert_eq!(h.state().session.active().unwrap().history.entries().len(), steps, "defaults are not a document edit");
+    }
+
     fn number(h: &mut Harness<'static, PhotocraftApp>, label: &str, value: &str) {
         h.get_by_role_and_label(Role::SpinButton, label).click();
         h.run();
@@ -1952,6 +1974,44 @@ mod multi_layer_formatting {
         h.run();
     }
 
+    fn preset(h: &mut Harness<'static, PhotocraftApp>, label: &str) {
+        // Presets near the end of the popup can be below its scroll viewport.
+        h.get_by_label(label).scroll_to_me();
+        h.run();
+        h.get_by_label(label).click();
+        h.run();
+    }
+
+    /// Opens a preset chevron by its accessible name and picks `label`.
+    fn pick(h: &mut Harness<'static, PhotocraftApp>, menu: &str, label: &str) {
+        h.get_by_role_and_label(Role::ComboBox, menu).click();
+        h.run();
+        preset(h, label);
+    }
+
+    /// The open preset popup's item labels, top to bottom, with "|" where a separator splits
+    /// them (a gap clearly larger than the row pitch). `any` is one item's label.
+    fn menu_items(h: &Harness<'static, PhotocraftApp>, any: &str) -> Vec<String> {
+        use egui_kittest::kittest::NodeT;
+        let role = h.get_by_label(any).accesskit_node().role();
+        let left = h.get_by_label(any).rect().left();
+        let mut items: Vec<(f32, String)> = h
+            .query_all_by_role(role)
+            .filter(|n| (n.rect().left() - left).abs() < 1.0)
+            .filter_map(|n| Some((n.rect().top(), n.accesskit_node().label()?)))
+            .collect();
+        items.sort_by(|a, b| a.0.total_cmp(&b.0));
+        let pitch = items.windows(2).map(|w| w[1].0 - w[0].0).fold(f32::MAX, f32::min);
+        let mut out = Vec::new();
+        for (i, (top, label)) in items.iter().enumerate() {
+            if i > 0 && top - items[i - 1].0 > pitch + 2.0 {
+                out.push("|".to_owned());
+            }
+            out.push(label.clone());
+        }
+        out
+    }
+
     fn editing(app: &mut PhotocraftApp, id: LayerId) {
         app.ui.text_edit = Some(crate::state::TextEdit {
             layer: id.0,
@@ -2023,6 +2083,97 @@ mod multi_layer_formatting {
         assert_eq!(text(h.state(), id).paragraph_runs()[0].style.direction, TextDirection::Rtl, "new type starts right to left");
     }
 
+    /// The size, leading and tracking chevrons offer the reference application's lists: Leading
+    /// starts with Auto, Tracking splits tightening, 0 and loosening with separators.
+    #[test]
+    fn character_panel_preset_menus_list_the_reference_values() {
+        let (app, _) = fixture();
+        let mut h = controls(app, true);
+        let sizes = [
+            "6 pt", "8 pt", "9 pt", "10 pt", "11 pt", "12 pt", "14 pt", "16 pt", "18 pt", "24 pt", "30 pt", "36 pt", "48 pt", "60 pt", "72 pt", "150 pt",
+            "300 pt",
+        ];
+        h.get_by_role_and_label(Role::ComboBox, "Font size presets").click();
+        h.run();
+        assert_eq!(menu_items(&h, "72 pt"), sizes);
+        h.key_press(egui::Key::Escape);
+        h.run();
+        h.get_by_role_and_label(Role::ComboBox, "Leading presets").click();
+        h.run();
+        let leading: Vec<&str> = std::iter::once("Auto").chain(sizes).collect();
+        assert_eq!(menu_items(&h, "72 pt"), leading);
+        h.key_press(egui::Key::Escape);
+        h.run();
+        h.get_by_role_and_label(Role::ComboBox, "Tracking presets").click();
+        h.run();
+        let tracking = ["-100", "-75", "-50", "-25", "-10", "-5", "|", "0", "|", "5", "10", "25", "50", "75", "100", "200"];
+        assert_eq!(menu_items(&h, "200"), tracking);
+    }
+
+    #[test]
+    fn character_panel_preset_menus_edit_size_leading_and_tracking() {
+        let (app, ids) = fixture();
+        let untouched = style(&app, ids[2], 0);
+        let steps = app.session.active().unwrap().history.entries().len();
+        let mut h = controls(app, true);
+
+        // The chevrons use the same setStyle path as the editable fields beside them.
+        pick(&mut h, "Font size presets", "72 pt");
+        pick(&mut h, "Leading presets", "Auto");
+        pick(&mut h, "Tracking presets", "-5");
+
+        for id in &ids[..2] {
+            let c = style(h.state(), *id, 0);
+            assert_eq!(c.size_pt, 72.0);
+            assert_eq!(c.leading_pt, None, "Auto restores font-relative line spacing");
+            assert_eq!(c.tracking, -5.0);
+        }
+        assert_eq!(style(h.state(), ids[2], 0), untouched, "unselected type layers are unchanged");
+        assert_eq!(h.state().session.active().unwrap().history.entries().len(), steps + 3, "one step per pick");
+
+        // The numeric spin boxes must remain usable beside their preset chevrons.
+        number(&mut h, "Font size", "40");
+        assert_eq!(style(h.state(), ids[0], 0).size_pt, 40.0);
+        assert_eq!(style(h.state(), ids[1], 0).size_pt, 40.0);
+    }
+
+    /// While typing, a preset changes only the selected characters, like a typed value.
+    #[test]
+    fn character_panel_presets_edit_only_the_selected_span() {
+        let (app, ids) = fixture();
+        let mut h = controls(app, true);
+        let peer = text(h.state(), ids[1]).char_runs();
+        editing(h.state_mut(), ids[0]);
+        h.run();
+        pick(&mut h, "Font size presets", "150 pt");
+        assert_eq!((size_at(h.state(), ids[0], 0), size_at(h.state(), ids[0], 1), size_at(h.state(), ids[0], 3)), (12.0, 150.0, 12.0));
+        assert_eq!(text(h.state(), ids[1]).char_runs(), peer);
+    }
+
+    /// Type units in millimetres: the lists show converted values with at most two decimals,
+    /// and a picked preset stores its exact point value (not 12.000001 from a unit round trip).
+    #[test]
+    fn character_panel_presets_in_millimetres_round_labels_and_store_exact_points() {
+        let mut app = new_app();
+        app.run("prefs.set", json!({"path": "unitsAndRulers.typeUnits", "value": "mm"})).unwrap();
+        let id = LayerId(app.run("type.create", json!({"text": "AéBCD", "font": "Inter", "size": 30, "color": "#000000"})).unwrap()["layer"].as_u64().unwrap());
+        selected(&mut app, &[id]);
+        let mut h = controls(app, true);
+        h.get_by_role_and_label(Role::ComboBox, "Font size presets").click();
+        h.run();
+        let items = menu_items(&h, "25.4 mm");
+        assert_eq!(items.len(), 17, "{items:?}");
+        for item in &items {
+            let n = item.strip_suffix(" mm").unwrap_or_else(|| panic!("{item}"));
+            assert!(n.split('.').nth(1).is_none_or(|d| d.len() <= 2 && !d.ends_with('0')), "{item}");
+        }
+        assert_eq!(items[0], "2.12 mm", "6 pt");
+        preset(&mut h, "4.23 mm");
+        assert_eq!(style(h.state(), id, 0).size_pt, 12.0, "12 pt exactly");
+        pick(&mut h, "Leading presets", "105.83 mm");
+        assert_eq!(style(h.state(), id, 0).leading_pt, Some(300.0));
+    }
+
     #[test]
     fn options_font_family_preserves_peer_faces_and_batches_layer_flags() {
         let (app, ids) = fixture();
@@ -2094,6 +2245,29 @@ mod multi_layer_formatting {
         h.run_steps(2);
     }
 
+    /// A style picked under a family's ">" in the Character section's font menu, with type
+    /// layers selected, sets them and is kept for new type, as the options bar's menu does.
+    #[test]
+    fn a_style_picked_in_the_character_sections_font_menu_is_kept_for_new_type() {
+        let (app, ids) = fixture();
+        // The first style row under the family (so it is in view), other than the defaults'.
+        let pick = super::super::styles("Inter").into_iter().find(|s| s != "Regular" && s != "Bold Italic").expect("Inter has several styles");
+        assert_ne!(app.ui.tool_options.type_style, pick);
+        let mut h = controls(app, true);
+        h.get_all_by_role(Role::ComboBox).next().unwrap().click();
+        h.run();
+        h.get_all_by_role(Role::TextInput).find(|n| n.is_focused()).expect("the search field has the focus").type_text("Inter");
+        h.run();
+        h.get_all_by_label("Show Styles").next().unwrap().click();
+        h.run();
+        h.get_by_label(&super::super::style_label(&pick)).click();
+        h.run();
+        assert_eq!(h.state().ui.tool_options.type_style, pick, "new type takes the picked style");
+        for id in &ids[..2] {
+            assert_eq!(style(h.state(), *id, 0).font_style, pick, "the selected layers are set in it");
+        }
+    }
+
     #[test]
     fn hyphenate_is_not_shown_while_layout_does_not_hyphenate() {
         // #6710: layout never hyphenates; the control must stay hidden until it does.
@@ -2163,6 +2337,11 @@ mod multi_layer_formatting {
         let c = style(h.state(), ids[0], 0);
         assert_eq!((c.size_pt, c.leading_pt, c.baseline_shift_pt), (30.0, Some(42.0), 5.0));
         assert_eq!(text(h.state(), ids[0]).paragraph_runs()[0].style.start_indent_pt, 4.5);
+
+        pick(&mut h, "Font size presets", "144 px");
+        pick(&mut h, "Leading presets", "300 px");
+        let c = style(h.state(), ids[0], 0);
+        assert_eq!((c.size_pt, c.leading_pt), (72.0, Some(150.0)), "presets preserve point values in pixel display units");
     }
 
     /// #5717: a layer scaled so its shown size or leading is past a field's range (2400 pt, or
diff --git a/crates/ui-egui/src/tools/type_tool/defaults.rs b/crates/ui-egui/src/tools/type_tool/defaults.rs
index 05fea9244c..203c3e9e93 100644
--- a/crates/ui-egui/src/tools/type_tool/defaults.rs
+++ b/crates/ui-egui/src/tools/type_tool/defaults.rs
@@ -1,5 +1,5 @@
 use super::editing::edit_home;
-use super::*;
+use super::{LayerId, PhotocraftApp, TextLayer, hex, json, text_layer};
 
 /// Representative for the displayed properties: the edit layer, else a selected type layer.
 pub(crate) fn target(app: &PhotocraftApp) -> Option<(u64, Option<[usize; 2]>)> {
@@ -219,20 +219,6 @@ pub(super) fn apply(app: &mut PhotocraftApp, ctx: &egui::Context, props: serde_j
     let _ = app.run("type.setStyle", p);
 }
 
-/// `props` aimed at the type target: its layer, the selected characters while typing, and the
-/// typing session's undo step. `None` without a type target.
-pub(crate) fn with_target(app: &PhotocraftApp, mut props: serde_json::Value) -> Option<serde_json::Value> {
-    let (layer, range) = target(app)?;
-    props["layer"] = json!(layer);
-    if let Some(r) = range {
-        props["range"] = json!(r);
-    }
-    if let Some(key) = app.ui.text_edit.as_ref().map(|ed| ed.session.clone()) {
-        props["coalesce"] = json!(key);
-    }
-    Some(props)
-}
-
 /// Open the shared Color Picker with a snapshot of the text target. Sampling or cancelling
 /// the dialog never changes the text selection, tool colours, or document history.
 pub fn open_color_picker(app: &mut PhotocraftApp, rgb: [f32; 3]) -> u64 {
diff --git a/crates/ui-egui/src/tools/type_tool/editing.rs b/crates/ui-egui/src/tools/type_tool/editing.rs
index 33d49ccf4c..57c3a3177f 100644
--- a/crates/ui-egui/src/tools/type_tool/editing.rs
+++ b/crates/ui-egui/src/tools/type_tool/editing.rs
@@ -1,7 +1,7 @@
 use super::ime::interrupt_incoming;
 use super::ime_edit::note_ime_application_change;
 use super::layout::{hit_layer, hit_offset, shows_own_layout};
-use super::*;
+use super::{LayerId, PhotocraftApp, TextEdit, TextLayer, active_doc_id, byte_range, current_text, json, selected_range, session_key, text_layer};
 
 /// Start editing an existing type layer. Like Photoshop, editing shows the text as the type
 /// engine lays it out, so a PSD layer is re-rendered first (inside the edit session's history
diff --git a/crates/ui-egui/src/tools/type_tool/font_picker_tests.rs b/crates/ui-egui/src/tools/type_tool/font_picker_tests.rs
index 48d03c18fc..7d24fbef42 100644
--- a/crates/ui-egui/src/tools/type_tool/font_picker_tests.rs
+++ b/crates/ui-egui/src/tools/type_tool/font_picker_tests.rs
@@ -1,4 +1,6 @@
-//! The Type tool's searchable font menu (#1369): it keeps its height and focuses its search field.
+//! The Type tool's searchable font menu (#1369): it grows back after a search and focuses its search field.
+
+use std::collections::HashMap;
 
 use super::font_picker_in;
 use egui::accesskit::Role;
@@ -31,11 +33,15 @@ fn harness_with(preview: FontPreview) -> Harness<'static, State> {
 }
 
 fn harness_with_recents(preview: FontPreview, recents: Vec<String>) -> Harness<'static, State> {
+    harness_sized(preview, recents, vec2(600.0, 900.0))
+}
+
+fn harness_sized(preview: FontPreview, recents: Vec<String>, size: egui::Vec2) -> Harness<'static, State> {
     // Enough families that the unfiltered menu hits its maximum height and scrolls.
     let mut families: Vec<String> = (0..60).map(|i| format!("Family {i:02}")).collect();
     families.push("Zeta Sans".into());
     let state = State { current: "Family 00".into(), families, button: egui::Id::NULL, popup: egui::Id::NULL, preview, recents };
-    let mut h = Harness::builder().with_size(vec2(600.0, 900.0)).with_max_steps(SETTLE_STEPS).build_ui_state(
+    let mut h = Harness::builder().with_size(size).with_max_steps(SETTLE_STEPS).build_ui_state(
         |ui, s: &mut State| {
             s.button = ui.make_persistent_id(egui::IdSalt::new("type-font"));
             s.popup = s.button.with("popup");
@@ -155,6 +161,33 @@ fn the_search_field_stays_put_while_the_list_scrolls() {
     assert!(popup.contains(after.center()), "the search field left the menu");
 }
 
+/// The wheel past the end of the list, or over the class list, leaves the preview, filters and
+/// search field in place, also in a window too short for the menu's full height: the lists stay
+/// within the room the menu leaves them, so the menu itself has nothing to scroll.
+#[test]
+fn the_wheel_past_the_end_of_the_list_leaves_the_header_in_place() {
+    // Over the font list, and over the class list beside it, which has no scroll area of its own.
+    for (size, over) in
+        [(vec2(600.0, 900.0), "Family 02"), (vec2(600.0, 900.0), "All Classes"), (vec2(600.0, 420.0), "Family 02"), (vec2(600.0, 420.0), "All Classes")]
+    {
+        let mut h = harness_sized(FontPreview::Medium, Vec::new(), size);
+        open(&mut h);
+        let search = h.get_by_role(Role::TextInput).rect();
+        h.hover_at(h.get_by_label(over).rect().center());
+        for _ in 0..40 {
+            h.event(egui::Event::MouseWheel {
+                source: egui::MouseWheelSource::Unknown,
+                unit: egui::MouseWheelUnit::Line,
+                delta: vec2(0.0, -10.0),
+                phase: egui::TouchPhase::Move,
+                modifiers: Modifiers::NONE,
+            });
+            h.run();
+        }
+        assert_eq!(search, h.get_by_role(Role::TextInput).rect(), "{size:?} over {over}: the search field moved under the wheel");
+    }
+}
+
 /// #7792: the arrow keys scroll the list to the selected family without moving the search
 /// field: they scroll the list, not the whole menu.
 #[test]
@@ -173,23 +206,31 @@ fn the_search_field_stays_put_while_the_arrows_scroll_the_list() {
     assert_eq!(search, h.get_by_role(Role::TextInput).rect(), "the search field scrolled away with the list");
 }
 
+/// A query matching no family shrinks the menu to its header and the class list beside the
+/// list; clearing it grows the menu back to its full height (egui#5225), and the search field
+/// stays where it was throughout.
 #[test]
-fn clearing_the_query_restores_the_menu_height() {
+fn clearing_a_query_that_matches_nothing_grows_the_menu_back() {
     let mut h = harness();
     open(&mut h);
     let full = popup_rect(&h).expect("menu open").height();
-    h.get_by_role(Role::TextInput).type_text("zeta");
+    let search = h.get_by_role(Role::TextInput).rect();
+    h.get_by_role(Role::TextInput).type_text("xxxx");
     h.run();
-    assert!(h.query_by_label("Family 01").is_none(), "the query filters the list");
-    let searching = popup_rect(&h).expect("still open").height();
-    for _ in 0.."zeta".len() {
+    assert!(h.query_by_label("Family 00").is_none(), "the query matches no family");
+    let none = popup_rect(&h).expect("still open").height();
+    let classes = h.get_by_label("Decorative").rect();
+    let menu = popup_rect(&h).expect("still open");
+    assert!(none < full - 100.0 && menu.bottom() < classes.bottom() + 20.0, "no matches shrink the menu to the class list: {menu:?}, {classes:?}, full {full}");
+    assert_eq!(search, h.get_by_role(Role::TextInput).rect(), "the search field moved when the list emptied");
+    for _ in 0.."xxxx".len() {
         h.key_press(Key::Backspace);
     }
     h.run();
     assert!(h.query_by_label("Family 01").is_some(), "the cleared query lists every family");
     let cleared = popup_rect(&h).expect("still open").height();
     assert!((cleared - full).abs() < 0.5, "height after clearing {cleared} != original {full}");
-    assert!((searching - full).abs() < 0.5, "the menu keeps its height while searching: {searching} vs {full}");
+    assert_eq!(search, h.get_by_role(Role::TextInput).rect(), "the search field moved when the list grew back");
 }
 
 #[test]
@@ -876,7 +917,7 @@ fn open_menu_shows_the_recent_group_when_the_marked_row_fits_below_it() {
     let row = h.query_all_by_label("Family 12").find(|n| n.accesskit_node().toggled() == Some(egui::accesskit::Toggled::True)).expect("its marked row").rect();
     assert!(popup.contains_rect(row) && row.top() >= search.bottom(), "recent #3 is in view: {row:?} in {popup:?}");
     assert!(
-        popup.contains_rect(first) && (0.0..=12.0).contains(&(first.top() - search.bottom())),
+        popup.contains_rect(first) && (0.0..=16.0).contains(&(first.top() - search.bottom())),
         "the group's first row sits just below the search field: {first:?} under {search:?}"
     );
 }
@@ -1037,6 +1078,370 @@ fn wheel_family_index_clamps_to_the_ends() {
     assert_eq!(super::wheel_family_index(0, 0, -1.0), None);
 }
 
+/// A picker over the test families with a recent/favourite library; the library is kept in the
+/// state so a test can read the star that was clicked.
+struct LibState {
+    current: String,
+    families: Vec<String>,
+    library: super::FontLibrary,
+    popup: egui::Id,
+}
+
+fn library_harness(recent: &[&str], favorites: &[&str]) -> Harness<'static, LibState> {
+    library_harness_with(recent, favorites, None, None)
+}
+
+fn library_harness_with(
+    recent: &[&str],
+    favorites: &[&str],
+    traits: Option<crate::font_filters::TraitsMap>,
+    styles: Option<HashMap<String, Vec<String>>>,
+) -> Harness<'static, LibState> {
+    let mut families: Vec<String> = (0..20).map(|i| format!("Family {i:02}")).collect();
+    families.push("Zeta Sans".into());
+    let library = super::FontLibrary {
+        recent: recent.iter().map(|s| s.to_string()).collect(),
+        favorites: favorites.iter().map(|s| s.to_string()).collect(),
+        traits: traits.map(std::sync::Arc::new),
+        styles: styles.map(std::sync::Arc::new),
+        ..Default::default()
+    };
+    let state = LibState { current: "Family 00".into(), families, library, popup: egui::Id::NULL };
+    let mut h = Harness::builder().with_size(vec2(600.0, 900.0)).build_ui_state(
+        |ui, s: &mut LibState| {
+            let fams = s.families.clone();
+            s.popup = ui.make_persistent_id(egui::IdSalt::new("type-font")).with("popup");
+            super::family_picker_in(ui, "type-font", &mut s.current, 170.0, &fams, FontPreview::Medium, &mut s.library);
+        },
+        state,
+    );
+    h.run();
+    h.query_all_by_role(Role::ComboBox).next().unwrap().click();
+    h.run();
+    h
+}
+
+/// The tops of every row labelled `label`, top to bottom.
+fn row_tops(h: &Harness<'static, LibState>, label: &str) -> Vec<f32> {
+    let mut tops: Vec<f32> = h.query_all_by_label(label).map(|n| n.rect().top()).collect();
+    tops.sort_by(f32::total_cmp);
+    tops
+}
+
+#[test]
+fn recent_fonts_come_first_and_stay_in_the_alphabetical_list() {
+    let h = library_harness(&["Zeta Sans", "Family 05", "Not Installed"], &[]);
+    let zeta = row_tops(&h, "Zeta Sans");
+    let five = row_tops(&h, "Family 05");
+    let first = row_tops(&h, "Family 00");
+    assert_eq!(zeta.len(), 2, "Zeta Sans is listed as recent and in its alphabetical place");
+    assert_eq!(five.len(), 2);
+    assert!(zeta[0] < five[0] && five[0] < first[0], "recent first, most recent on top: {zeta:?} {five:?} {first:?}");
+    assert!(h.query_by_label("Not Installed").is_none(), "a recent font that is no longer installed isn't listed");
+}
+
+#[test]
+fn a_search_hides_the_recent_section() {
+    let mut h = library_harness(&["Zeta Sans"], &[]);
+    h.get_by_role(Role::TextInput).type_text("zeta");
+    h.run();
+    assert_eq!(row_tops(&h, "Zeta Sans").len(), 1);
+}
+
+#[test]
+fn clicking_a_star_marks_the_font_without_picking_it_or_closing_the_menu() {
+    let mut h = library_harness(&[], &[]);
+    let row = h.get_by_label("Family 03").rect();
+    // The star sits left of the style expander's slot, which is left of the row's button.
+    let star = egui::pos2(row.left() - 2.0 - 16.0 - 2.0 - 11.0, row.center().y);
+    h.hover_at(star);
+    h.run();
+    for pressed in [true, false] {
+        h.event(egui::Event::PointerButton { pos: star, button: egui::PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+        h.run();
+    }
+    assert_eq!(h.state().library.toggled.as_deref(), Some("Family 03"));
+    assert_eq!(h.state().current, "Family 00", "the star doesn't pick the font");
+    assert!(h.query_by_label("Family 10").is_some(), "the menu stays open");
+}
+
+#[test]
+fn the_favorites_filter_lists_only_starred_fonts() {
+    let mut h = library_harness(&["Family 01"], &["Zeta Sans", "Family 07"]);
+    assert_eq!(h.query_all_by_label("Remove from Favorites").count(), 2, "starred rows show a filled star");
+    h.get_by_label("Show Favorite Fonts").click();
+    h.run();
+    assert!(h.query_by_label("Zeta Sans").is_some() && h.query_by_label("Family 07").is_some());
+    assert!(h.query_by_label("Family 01").is_none(), "neither other fonts nor the recent section show");
+    assert!(h.query_by_label("Family 02").is_none());
+}
+
+#[test]
+fn the_favorites_filter_explains_an_empty_library() {
+    let mut h = library_harness(&[], &[]);
+    h.get_by_label("Show Favorite Fonts").click();
+    h.run();
+    assert!(h.query_by_label_contains("No favorite fonts yet").is_some());
+}
+
+#[test]
+fn a_clicked_star_is_saved_to_the_preferences_library() {
+    let mut app = crate::PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+    let mut library = super::FontLibrary::of(&app);
+    library.toggled = Some("Bebas Neue".into());
+    library.finish(&mut app);
+    assert_eq!(app.session.prefs().type_.favorite_fonts, ["Bebas Neue"]);
+    assert_eq!(super::FontLibrary::of(&app).favorites, ["Bebas Neue"]);
+    app.note_recent_font("Arial");
+    assert_eq!(super::FontLibrary::of(&app).recent, ["Arial"]);
+}
+
+fn traits(class: photocraft_text::FontClass, format: photocraft_text::FontFormat, panose: [u8; 10]) -> Option<photocraft_text::FamilyTraits> {
+    Some(photocraft_text::FamilyTraits { class: Some(class), format, panose, weight: 400 })
+}
+
+/// Family 00-02 serif, 03 a variable sans, 04 monospace, Zeta Sans a sans like 03; the rest
+/// unknown. Family 01 has three styles.
+fn filter_harness() -> Harness<'static, LibState> {
+    use photocraft_text::{FontClass, FontFormat};
+    let serif = [2, 2, 6, 3, 5, 4, 5, 2, 3, 4];
+    let sans = [2, 11, 6, 4, 2, 2, 2, 2, 2, 4];
+    let map: crate::font_filters::TraitsMap = [
+        ("Family 00", traits(FontClass::Serif, FontFormat::TrueType, serif)),
+        ("Family 01", traits(FontClass::Serif, FontFormat::OpenType, serif)),
+        ("Family 02", traits(FontClass::Serif, FontFormat::TrueType, serif)),
+        ("Family 03", traits(FontClass::SansSerif, FontFormat::Variable, sans)),
+        ("Family 04", traits(FontClass::Monospace, FontFormat::TrueType, [2, 11, 6, 9, 2, 2, 2, 2, 2, 4])),
+        ("Zeta Sans", traits(FontClass::SansSerif, FontFormat::TrueType, sans)),
+    ]
+    .into_iter()
+    .map(|(k, v)| (k.to_string(), v))
+    .collect();
+    let styles: HashMap<String, Vec<String>> =
+        [("Family 01".to_string(), vec!["Regular".to_string(), "Bold".to_string(), "Italic".to_string()])].into_iter().collect();
+    library_harness_with(&[], &[], Some(map), Some(styles))
+}
+
+#[test]
+fn the_class_list_narrows_the_fonts_and_all_classes_brings_them_back() {
+    let mut h = filter_harness();
+    h.get_by_label("Serif").click();
+    h.run();
+    for f in ["Family 00", "Family 01", "Family 02"] {
+        assert!(h.query_by_label(f).is_some(), "{f} is a serif");
+    }
+    assert!(h.query_by_label("Family 03").is_none() && h.query_by_label("Zeta Sans").is_none());
+    h.get_by_label("Monospace").click();
+    h.run();
+    assert!(h.query_by_label("Family 04").is_some() && h.query_by_label("Family 00").is_none());
+    h.get_by_label("All Classes").click();
+    h.run();
+    assert!(h.query_by_label("Family 10").is_some(), "unclassified fonts are back");
+}
+
+#[test]
+fn variable_and_similar_filters_and_clear_all() {
+    let mut h = filter_harness();
+    h.get_by_label("Show Variable Fonts").click();
+    h.run();
+    assert!(h.query_by_label("Family 03").is_some());
+    assert!(h.query_by_label("Family 00").is_none() && h.query_by_label("Zeta Sans").is_none());
+    h.get_by_label("Clear All").click();
+    h.run();
+    assert!(h.query_by_label("Family 10").is_some(), "Clear All turns every filter off");
+    // Similar to the current Family 00 (a serif): the serifs first, sans after, unknown never.
+    h.get_by_label("Show Similar Fonts").click();
+    h.run();
+    let top = |label: &str| h.query_by_label(label).map(|n| n.rect().top());
+    let (current, serif, sans) = (top("Family 00").unwrap(), top("Family 02").unwrap(), top("Zeta Sans").unwrap());
+    assert!(current < serif && serif < sans, "{current} {serif} {sans}");
+    assert!(h.query_by_label("Family 10").is_none(), "fonts that can't be compared aren't listed");
+}
+
+/// With Show Similar Fonts on, the arrows step down the list made for the font current when it
+/// was turned on: re-sorting around each font stepped to sent the next step back.
+#[test]
+fn the_arrows_walk_down_the_similar_fonts_list() {
+    let mut h = filter_harness();
+    h.get_by_label("Show Similar Fonts").click();
+    h.run();
+    let order: Vec<String> = {
+        let mut rows: Vec<(f32, String)> = ["Family 00", "Family 01", "Family 02", "Family 03", "Family 04", "Zeta Sans"]
+            .iter()
+            .filter_map(|f| h.query_by_label(f).map(|n| (n.rect().top(), f.to_string())))
+            .collect();
+        rows.sort_by(|a, b| a.0.total_cmp(&b.0));
+        rows.into_iter().map(|(_, f)| f).collect()
+    };
+    assert_eq!(order[0], "Family 00", "the current font first");
+    for step in 1..4 {
+        h.key_press(egui::Key::ArrowDown);
+        h.run();
+        assert_eq!(h.state().current, order[step], "step {step} through {order:?}");
+    }
+}
+
+#[test]
+fn a_style_picked_under_the_expander_picks_the_family_in_that_style() {
+    let mut h = filter_harness();
+    assert_eq!(h.query_all_by_label("Show Styles").count(), 1, "only a family with several styles expands");
+    h.get_by_label("Show Styles").click();
+    h.run();
+    h.get_by_label("Bold").click();
+    h.run();
+    assert_eq!(h.state().current, "Family 01");
+    assert_eq!(h.state().library.picked_style.as_deref(), Some("Bold"));
+    assert!(h.query_by_label("Family 10").is_none(), "picking a style closes the menu");
+}
+
+/// An expanded family's style rows stay listed while the list scrolls its own row out of view:
+/// they used to vanish then, so the rows below jumped up.
+#[test]
+fn an_expanded_familys_styles_stay_listed_when_its_row_scrolls_away() {
+    let mut h = filter_harness();
+    let top = h.get_by_label("Family 00").rect().top();
+    h.get_by_label("Show Styles").click();
+    h.run();
+    assert!(h.query_by_label("Italic").is_some(), "Family 01 lists its styles");
+    let over = h.get_by_label("Family 05").rect().center();
+    h.hover_at(over);
+    h.run();
+    let mut styles_without_family_row = false;
+    for _ in 0..40 {
+        h.event(egui::Event::MouseWheel {
+            unit: egui::MouseWheelUnit::Point,
+            delta: vec2(0.0, -6.0),
+            phase: egui::TouchPhase::Move,
+            modifiers: Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
+        });
+        h.run_steps(3);
+        let family_gone = h.query_by_label("Family 01").is_none_or(|n| n.rect().bottom() <= top);
+        let italic = h.query_by_label("Italic").map(|n| n.rect());
+        styles_without_family_row |= family_gone && italic.is_some_and(|r| r.bottom() > top);
+    }
+    assert!(styles_without_family_row, "the style rows show below the family row scrolled out of view");
+}
+
+#[test]
+fn the_search_field_stays_in_place_while_the_list_scrolls() {
+    let mut h = library_harness(&[], &[]);
+    let search = h.get_by_role(Role::TextInput).rect();
+    let row = h.get_by_label("Family 01").rect();
+    h.hover_at(row.center());
+    h.run();
+    h.event(egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(0.0, -300.0),
+        phase: egui::TouchPhase::Move,
+        modifiers: Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
+    });
+    h.run_steps(4);
+    assert_eq!(h.get_by_role(Role::TextInput).rect(), search, "the field doesn't scroll away");
+    assert!(h.query_by_label("Family 01").is_none_or(|n| n.rect().top() < row.top()), "the list scrolled");
+}
+
+#[test]
+fn the_preview_follows_the_font_under_the_pointer_and_the_menu_keeps_its_width() {
+    let mut h = library_harness(&[], &[]);
+    assert!(h.query_by_label("Font preview: Family 00").is_some(), "the current font first");
+    let width = popup_width(&h);
+    h.hover_at(h.get_by_label("Family 03").rect().center());
+    h.run_steps(3);
+    assert!(h.query_by_label("Font preview: Family 03").is_some());
+    // Filtering never widens the menu past its list (no empty strip).
+    h.get_by_label("Show Favorite Fonts").click();
+    h.run_steps(3);
+    assert!((popup_width(&h) - width).abs() < 1.0, "{} vs {width}", popup_width(&h));
+}
+
+fn popup_width(h: &Harness<'static, LibState>) -> f32 {
+    let preview = h.query_all_by_label_contains("Font preview:").next().unwrap().rect();
+    preview.width()
+}
+
+#[test]
+fn the_preview_sets_the_type_layers_text_or_the_selection_being_typed() {
+    let mut app = crate::PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+    assert_eq!(super::preview_text(&app), None, "no document");
+    app.run("file.new", serde_json::json!({"width": 64, "height": 64})).unwrap();
+    let id = app.run("type.create", serde_json::json!({"text": "Hello\rworld  ", "size": 24})).unwrap()["layer"].as_u64().unwrap();
+    app.run("layer.select", serde_json::json!({"id": id})).ok();
+    app.ui.text_edit = Some(crate::state::TextEdit {
+        layer: id,
+        document: None,
+        caret: 0,
+        anchor: 0,
+        session: "s".into(),
+        created: false,
+        mask: false,
+        dragging: false,
+        resize: None,
+        preedit: None,
+    });
+    assert_eq!(super::preview_text(&app).as_deref(), Some("Hello world"), "the whole text, on one line");
+    if let Some(ed) = app.ui.text_edit.as_mut() {
+        ed.anchor = 6;
+        ed.caret = 11;
+    }
+    assert_eq!(super::preview_text(&app).as_deref(), Some("world"), "only the selection while typing");
+    if let Some(ed) = app.ui.text_edit.as_mut() {
+        ed.anchor = 50;
+        ed.caret = 400;
+    }
+    assert_eq!(super::preview_text(&app), None, "an out-of-range selection is blank, not a panic");
+}
+
+/// Minimizing the window (a zero-size screen for a few frames) and restoring it must not leave
+/// the menu wider than its lists: an empty strip appeared beside the list after a minimize.
+#[test]
+fn minimizing_and_restoring_the_window_keeps_the_menu_as_wide_as_its_lists() {
+    let mut h = library_harness(&[], &[]);
+    h.set_size(vec2(1286.0, 900.0));
+    h.run_steps(3);
+    let width = |h: &Harness<'static, LibState>| h.ctx.memory(|m| m.area_rect(h.state().popup)).map(|r| r.width());
+    let before = width(&h).expect("menu open");
+    for size in [vec2(1.0, 1.0), vec2(0.0, 0.0), vec2(1286.0, 900.0)] {
+        h.set_size(size);
+        h.run_steps(3);
+    }
+    let after = width(&h).expect("menu still open");
+    assert!((after - before).abs() < 1.0, "menu width {after} after a minimize, {before} before");
+}
+
+/// The same with the font button near the right edge, as in the Character panel, where the
+/// popup is pushed left against the window's edge.
+#[test]
+fn a_menu_opened_from_the_right_edge_stays_narrow_after_a_minimize() {
+    let mut families: Vec<String> = (0..20).map(|i| format!("Family {i:02}")).collect();
+    families.push("Zeta Sans".into());
+    let state = LibState { current: "Family 00".into(), families, library: Default::default(), popup: egui::Id::NULL };
+    let mut h = Harness::builder().with_size(vec2(1286.0, 900.0)).build_ui_state(
+        |ui, s: &mut LibState| {
+            ui.horizontal(|ui| {
+                ui.add_space(940.0);
+                s.popup = ui.make_persistent_id(egui::IdSalt::new("type-font")).with("popup");
+                let fams = s.families.clone();
+                super::family_picker_in(ui, "type-font", &mut s.current, 300.0, &fams, FontPreview::Medium, &mut s.library);
+            });
+        },
+        state,
+    );
+    h.run();
+    h.query_all_by_role(Role::ComboBox).next().unwrap().click();
+    h.run_steps(4);
+    let width = |h: &Harness<'static, LibState>| h.ctx.memory(|m| m.area_rect(h.state().popup)).map(|r| r.width());
+    let before = width(&h).expect("menu open");
+    for size in [vec2(0.0, 0.0), vec2(300.0, 200.0), vec2(1286.0, 900.0)] {
+        h.set_size(size);
+        h.run_steps(4);
+    }
+    h.run_steps(4);
+    let after = width(&h).expect("menu open again");
+    assert!(after <= before + 1.0, "menu width {after} after a minimize, {before} before");
+}
+
 /// #5152: in the full app the Properties panel's Character section draws a second font picker
 /// after the options bar; hovering a font in the options bar still previews it on the canvas.
 #[test]
diff --git a/crates/ui-egui/src/tools/type_tool/fonts.rs b/crates/ui-egui/src/tools/type_tool/fonts.rs
index 4bb5bf1970..266bdb6f02 100644
--- a/crates/ui-egui/src/tools/type_tool/fonts.rs
+++ b/crates/ui-egui/src/tools/type_tool/fonts.rs
@@ -1,5 +1,5 @@
 use super::defaults::apply;
-use super::*;
+use super::{Arc, HashMap, PhotocraftApp, PoisonError, json};
 
 /// Font families: bundled, system, and those the host serves (`photocraft_text::served`, fetched
 /// when picked). Cached until the shared engine registers fonts or the served catalog changes.
@@ -260,13 +260,98 @@ pub(crate) fn fonts_ready(ui: &mut egui::Ui, width: f32) -> bool {
     false
 }
 
-/// Searchable font-family combo box.
-pub(super) fn font_picker(ui: &mut egui::Ui, current: &mut String, width: f32, preview: photocraft_engine::prefs::FontPreview, recents: &[String]) -> bool {
-    family_picker_in(ui, "type-font", current, width, &families(), preview, recents)
+/// The font menu's local library (`photocraft_engine::font_library_cmds`): the recent fonts it
+/// lists first and the favourites it stars, read before the menu is drawn, plus the font whose
+/// star was clicked, starred or un-starred by [`FontLibrary::finish`] afterwards, and the style
+/// picked from a family's expanded styles.
+#[derive(Clone, Debug, Default)]
+pub(crate) struct FontLibrary {
+    pub recent: Vec<String>,
+    pub favorites: Vec<String>,
+    pub toggled: Option<String>,
+    /// The style picked under a family's ">" (with the family), for the caller to apply.
+    pub picked_style: Option<String>,
+    /// Family traits to filter by instead of the installed fonts' (tests).
+    pub traits: Option<Arc<crate::font_filters::TraitsMap>>,
+    /// Each family's style names instead of the installed fonts' (tests).
+    pub styles: Option<Arc<HashMap<String, Vec<String>>>>,
+    /// The user's own text for the preview at the top of the menu (else it shows a sample).
+    pub preview_text: Option<String>,
 }
 
-/// Maximum height of the font menu.
-pub(super) const FONT_MENU_HEIGHT: f32 = 460.0;
+/// The text the font menu's preview sets: the selected characters while typing, else the type
+/// target's whole text, on one line and at most 60 characters. `None` without a type target or
+/// with blank text (the preview then shows its sample).
+pub(super) fn preview_text(app: &PhotocraftApp) -> Option<String> {
+    let (layer, range) = defaults::target(app)?;
+    let text = &crate::type_tool::text_layer(&app.session.active()?.doc, crate::type_tool::LayerId(layer))?.text;
+    use crate::type_tool::defaults;
+
+    let chosen: String = match range {
+        Some([a, b]) => text.chars().skip(a).take(b.saturating_sub(a)).collect(),
+        None => text.clone(),
+    };
+    let line = chosen.split(['\n', '\r', '\u{2028}', '\u{2029}']).map(str::trim).filter(|s| !s.is_empty()).collect::<Vec<_>>().join(" ");
+    let line: String = line.chars().take(60).collect();
+    (!line.is_empty()).then_some(line)
+}
+
+impl FontLibrary {
+    pub(crate) fn of(app: &PhotocraftApp) -> Self {
+        use photocraft_engine::font_library_cmds as lib;
+        // The recent fonts are the shell's (`PhotocraftApp::note_recent_font`), the favourites the engine's.
+        Self { recent: app.ui.recent_fonts.clone(), favorites: lib::favorite_fonts(&app.session), ..Default::default() }
+    }
+
+    /// The style names a family's ">" expands to.
+    fn styles_of(&self, family: &str) -> Vec<String> {
+        match &self.styles {
+            Some(map) => map.get(family).cloned().unwrap_or_else(|| vec!["Regular".into()]),
+            None => styles(family),
+        }
+    }
+
+    /// Star or un-star the clicked font, through the engine command.
+    pub(crate) fn finish(self, app: &mut PhotocraftApp) {
+        if let Some(family) = self.toggled
+            && let Err(e) = app.run("type.font.favorite", json!({"family": family}))
+        {
+            app.ui.status = e;
+            app.ui.status_error = true;
+        }
+    }
+}
+
+/// Searchable font-family combo box, with the recent and favourite fonts of `app`. `Some` when a
+/// family was picked, holding the style when it was picked from the family's expanded styles.
+pub(super) fn font_picker(app: &mut PhotocraftApp, ui: &mut egui::Ui, current: &mut String, width: f32) -> Option<Option<String>> {
+    let preview = app.session.prefs().type_.font_preview;
+    let mut library = FontLibrary { preview_text: preview_text(app), ..FontLibrary::of(app) };
+    let changed = family_picker_in(ui, "type-font", current, width, &families(), preview, &mut library);
+    let style = library.picked_style.take();
+    library.finish(app);
+    if !changed {
+        return None;
+    }
+    // Each family applied is recorded, an arrow step too, as `PhotocraftApp::note_recent_font` says.
+    app.note_recent_font(current);
+    Some(style)
+}
+
+/// Maximum height of the font menu: room for the search/filter bar over the font list, so only
+/// the list scrolls.
+pub(super) const FONT_MENU_HEIGHT: f32 = 520.0;
+/// The font list's height (it scrolls inside the menu, under the fixed search field).
+const FONT_LIST_HEIGHT: f32 = 440.0;
+/// The font list's width: star, style expander, name, format badge and sample.
+const FONT_LIST_WIDTH: f32 = 420.0;
+/// Room the search row keeps for Clear All, and for the filter buttons when they follow the field.
+const FONT_CLEAR_WIDTH: f32 = 84.0;
+const FONT_BUTTONS_WIDTH: f32 = 112.0;
+/// Room right of the font list's viewport for its scroll bar.
+const FONT_SCROLL_BAR_WIDTH: f32 = 14.0;
+/// Room for the format badge (O, TT, VAR) left of the sample.
+const FONT_BADGE_WIDTH: f32 = 28.0;
 
 /// [`font_picker`] over a given family list (tests pass their own).
 #[cfg(test)]
@@ -278,7 +363,7 @@ pub(super) fn font_picker_in(
     preview: photocraft_engine::prefs::FontPreview,
     recents: &[String],
 ) -> bool {
-    family_picker_in(ui, "type-font", current, width, families, preview, recents)
+    family_picker_in(ui, "type-font", current, width, families, preview, &mut FontLibrary { recent: recents.to_vec(), ..FontLibrary::default() })
 }
 
 /// Shared by the Type options, Character, style and Glyphs panels. Selection changes still
@@ -290,7 +375,7 @@ pub(crate) fn family_picker_in(
     width: f32,
     families: &[String],
     preview: photocraft_engine::prefs::FontPreview,
-    recents: &[String],
+    library: &mut FontLibrary,
 ) -> bool {
     let mut changed = false;
     // A font picked from the open menu (click or Enter): the field keeps the focus afterwards.
@@ -304,7 +389,7 @@ pub(crate) fn family_picker_in(
     let labels: Option<Arc<HashMap<String, String>>> = ui.ctx().data(|d| d.get_temp(font_labels_id()));
     let labels = labels.as_deref();
     let shown = labels.and_then(|l| l.get(current.as_str())).unwrap_or(current).clone();
-    let combo = egui::ComboBox::from_id_salt(salt)
+    let combo = craft_ui::ComboBox::from_id_salt(salt)
         .selected_text(shown)
         .width(width)
         .height(FONT_MENU_HEIGHT)
@@ -314,7 +399,15 @@ pub(crate) fn family_picker_in(
         .close_behavior(if matches!(close, egui::PopupCloseBehavior::IgnoreClicks) { close } else { egui::PopupCloseBehavior::CloseOnClickOutside });
 
     let mut response = combo.show_ui(ui, |ui| {
-        let height_id = search_id.with("height");
+        // Positions kept between frames are relative to the menu's left edge: the menu moves
+        // (the window's edge pushes it after a resize), and screen positions from an earlier
+        // frame would pad the search row out and widen the menu, an empty strip beside the list.
+        let origin = ui.cursor().min.x;
+        // Freshly opened (not drawn last pass): the preview starts on the current font.
+        let pass_id = search_id.with("pass");
+        let pass = ui.ctx().cumulative_pass_nr();
+        let opened = ui.data(|d| d.get_temp::<u64>(pass_id)).is_none_or(|p| p.saturating_add(1) < pass);
+        ui.data_mut(|d| d.insert_temp(pass_id, pass));
         // Each opening focuses the search, including a reopen on the very next pass. Keep
         // asking through the invisible sizing pass, until the field receives focus.
         let mut focus = ui.data(|d| d.get_temp(focus_id)).unwrap_or(true);
@@ -323,10 +416,61 @@ pub(crate) fn family_picker_in(
         let down = ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::ArrowDown));
         let up = ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::ArrowUp));
         let enter = ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Enter));
-        if focus {
-            ui.memory_mut(|m| m.request_focus(search_id.with("input")));
+        // The filter bar beside the search field, as in Photoshop: the class list toggle, Show
+        // Variable / Favorite / Similar Fonts and Clear All (`font_filters`).
+        let filters_id = search_id.with("filters");
+        let mut filters: crate::font_filters::FontFilters = ui.data(|d| d.get_temp(filters_id)).unwrap_or_default();
+        // The preview on top: the font last under the pointer, else the current one.
+        let preview_id = search_id.with("preview-font");
+        if opened {
+            ui.data_mut(|d| d.remove::<String>(preview_id));
         }
-        let r = ui.add(egui::TextEdit::singleline(&mut q).id(search_id.with("input")).hint_text(tl!("Search fonts")).desired_width(200.0));
+        let previewed: String = ui.data(|d| d.get_temp(preview_id)).unwrap_or_else(|| current.clone());
+        let previewed_label = labels.and_then(|l| l.get(previewed.as_str())).map_or(previewed.as_str(), String::as_str).to_string();
+        // Everything above the list is as wide as the class and font lists below, measured last
+        // frame: never wider, so the menu has no empty strip beside the list.
+        let (list_left_id, body_id) = (search_id.with("list-left"), search_id.with("body"));
+        let class_w = crate::font_filters::CLASS_COLUMN_WIDTH;
+        let estimate = FONT_LIST_WIDTH + 16.0 + if filters.hide_classes { 0.0 } else { class_w + 14.0 };
+        let body: Option<egui::Rect> = ui.data(|d| d.get_temp(body_id));
+        let menu_width = body.map_or(estimate, |b| b.width());
+        // Divider lines span the space they are given: cap it, or they stretch the menu.
+        if body.is_some() {
+            ui.set_max_width(menu_width);
+        }
+        crate::font_filters::preview_banner(ui, &previewed, &previewed_label, library.preview_text.as_deref(), menu_width);
+        // The filter buttons over the class list, and the search field over the fonts, starting
+        // where the list does.
+        let list_left: Option<f32> = ui.data(|d| d.get_temp::<f32>(list_left_id)).map(|x| origin + x);
+        let menu_right = body.map(|b| origin + b.right());
+        let r = ui
+            .horizontal(|ui| {
+                if !filters.hide_classes {
+                    ui.allocate_ui_with_layout(egui::vec2(class_w, 24.0), egui::Layout::left_to_right(egui::Align::Center), |ui| {
+                        crate::font_filters::filter_buttons(ui, &mut filters);
+                    });
+                }
+                if let Some(x) = list_left.filter(|_| !filters.hide_classes) {
+                    let pad = x - ui.cursor().min.x;
+                    if pad > 0.0 {
+                        ui.add_space(pad);
+                    }
+                }
+                // The field fills the row up to Clear All (and the buttons, which follow it when
+                // the class list is hidden).
+                let trailing = FONT_CLEAR_WIDTH + if filters.hide_classes { FONT_BUTTONS_WIDTH } else { 0.0 };
+                let search_w = menu_right.map_or(FONT_LIST_WIDTH - trailing, |right| right - ui.cursor().min.x - trailing).clamp(120.0, FONT_LIST_WIDTH);
+                if focus {
+                    ui.memory_mut(|m| m.request_focus(search_id.with("input")));
+                }
+                let r = ui.add(egui::TextEdit::singleline(&mut q).id(search_id.with("input")).hint_text(tl!("Search fonts")).desired_width(search_w));
+                if filters.hide_classes {
+                    crate::font_filters::filter_buttons(ui, &mut filters);
+                }
+                crate::font_filters::clear_all(ui, &mut filters);
+                r
+            })
+            .inner;
         if focus {
             // The opening click can release after several focused frames. Keep the request
             // pending through that release, which can hand focus back to the combo button.
@@ -337,11 +481,24 @@ pub(crate) fn family_picker_in(
             d.insert_temp(search_id, q.clone());
         });
         let ql = q.to_lowercase();
+        let lookup = crate::font_filters::lookup_in(library.traits.clone());
         // The recent group stays as it was when the menu opened: each arrow step applies (and so
         // records) a family, and moving it to the top would send the next step back up.
         let opening = ui.data(|d| d.get_temp::<Vec<String>>(recents_id).is_none());
-        let open_recents: Vec<String> = ui.data_mut(|d| d.get_temp_mut_or_insert_with(recents_id, || recents.to_vec()).clone());
-        let (rows, n_recent) = font_menu_rows(families, labels, &ql, &open_recents);
+        let open_recents: Vec<String> = ui.data_mut(|d| d.get_temp_mut_or_insert_with(recents_id, || library.recent.clone()).clone());
+        // No recent group while a filter is on: the filters narrow the alphabetical list alone.
+        let (mut rows, n_recent) = font_menu_rows(families, labels, &ql, if filters.any() { &[] } else { &open_recents });
+        // Show Similar Fonts compares with the font current when it was turned on (or the menu
+        // opened), as the recent group stays put: each arrow step applies a font, and sorting
+        // around that one sent the next step back to the font before.
+        let similar_id = search_id.with("similar-to");
+        let reference: String = if filters.similar {
+            ui.data_mut(|d| d.get_temp_mut_or_insert_with(similar_id, || current.clone()).clone())
+        } else {
+            ui.data_mut(|d| d.remove::<String>(similar_id));
+            current.clone()
+        };
+        let comparable = crate::font_filters::apply(&mut rows, &filters, &library.favorites, &reference, &lookup);
         // A recent family is listed twice. The current family's row is the one the last arrow
         // selected while it still shows that family, else its first copy: as in Photoshop, the
         // one in the recent group when it has one (#9160), and the arrows walk on from there.
@@ -390,89 +547,193 @@ pub(crate) fn family_picker_in(
         }
         let preview = crate::font_preview::sample(preview);
         let row_h = preview.map_or(28.0, |(_, [_, h])| (h + 4.0).max(28.0));
-
-        // Wrap the font rows in a ScrollArea so only the list scrolls: the search field above
-        // stays fixed at the top of the popup.
+        let expanded_id = search_id.with("expanded");
+        let mut expanded: Vec<String> = ui.data(|d| d.get_temp(expanded_id)).unwrap_or_default();
         let mut hovered: Option<String> = None;
         let reveal = if stepped.is_some() { None } else { reveal };
         let mut reveal_top: Option<egui::Rect> = None;
-        egui::ScrollArea::vertical().show(ui, |ui| {
-            for (i, (f, label)) in rows.into_iter().enumerate() {
-                if i == n_recent && n_recent > 0 {
-                    ui.separator();
-                }
-                // Highlighted by its fill alone, as Photoshop's font menu is. A selectable button lays
-                // out its frame's stroke only once hovered or selected, so with the theme's stroke the
-                // row under the pointer (and the selected one) grew and pushed the rows below down:
-                // the list jumped as the pointer moved (#7406). One row only, though a recent
-                // family is listed twice.
-                let mut button = egui::Button::selectable(selected == Some(i), label).truncate().stroke(egui::Stroke::NONE);
-                if let Some((size, [_, h])) = preview {
-                    button = button.right_text(egui::Atom::custom(
-                        egui::IdSalt::new(("font-sample", f)),
-                        egui::vec2(crate::font_preview::slot_width(ui.ctx(), f, size), h),
-                    ));
-                }
-                let response = ui.add_sized([330.0, row_h], button);
-                if stepped == Some(i) {
-                    response.scroll_to_me(Some(egui::Align::Center));
-                } else if reveal.is_some() {
-                    if reveal_from == Some(i) {
-                        reveal_top = Some(response.rect);
+        ui.separator();
+        // The line between the class list and the font list. A separator in the row would take
+        // the row's whole available height and hold the menu at its full height under a short
+        // search result, so the row keeps its room and the line is drawn once the row is laid out.
+        let mut divider: Option<f32> = None;
+        let body = ui.horizontal_top(|ui| {
+            if !filters.hide_classes {
+                crate::font_filters::class_list(ui, &mut filters);
+                divider = Some(ui.cursor().min.x + 3.0);
+                ui.add_space(6.0 + ui.spacing().item_spacing.x);
+            }
+            // The list scrolls under the fixed search field and filters, and shrinks to a short
+            // search result: the menu grows back with it (craft_ui::ComboBox, #9849).
+            let list = egui::ScrollArea::vertical().id_salt(search_id.with("list")).max_height(FONT_LIST_HEIGHT).auto_shrink([true, true]);
+            // Top to bottom, though the list sits beside the class list.
+            let shown = list.show(ui, |ui| {
+                ui.vertical(|ui| {
+                    ui.set_width(FONT_LIST_WIDTH);
+                    let weak = |ui: &mut egui::Ui, text: &str| {
+                        ui.label(egui::RichText::new(text).weak());
+                    };
+                    if filters.similar && !comparable {
+                        weak(ui, tl!("No similar fonts: the current font doesn't say what it looks like."));
                     }
-                    if reveal == Some(i) {
-                        // Jump, not glide: the menu opens with its current family in view. Arrow
-                        // steps above keep the animation. A recent row too far below the top of
-                        // the group (large previews, many recents) is brought up to the bottom.
-                        let top = reveal_top.unwrap_or(response.rect);
-                        let (rect, align) = if response.rect.bottom() - top.top() <= ui.clip_rect().height() {
-                            (top, egui::Align::Min)
-                        } else {
-                            (response.rect, egui::Align::Max)
-                        };
-                        ui.scroll_to_rect_animation(rect, Some(align), egui::style::ScrollAnimation::none());
+                    if rows.is_empty() {
+                        weak(
+                            ui,
+                            if filters.favorites && library.favorites.is_empty() {
+                                tl!("No favorite fonts yet: click the star beside a font to add it.")
+                            } else {
+                                tl!("No fonts match these filters.")
+                            },
+                        );
                     }
-                }
-                if let Some((size, _)) = preview
-                    && ui.is_rect_visible(response.rect)
-                {
-                    crate::font_preview::paint(ui, f, response.rect, size);
-                }
-                if response.hovered() {
-                    hovered = Some(f.clone());
-                }
-                if press.chosen(ui, &response) {
-                    *current = f.clone();
-                    // A served family not fetched yet: start now, before any text needs it.
-                    photocraft_text::served::request(f);
-                    changed = true;
-                    picked = true;
-                    ui.data_mut(|d| d.remove::<String>(search_id));
-                    hovered = None;
-                    ui.close();
-                }
+                    // The first `n_recent` rows are the recent group, above a line (`font_menu_rows`).
+                    for (i, &(f, label)) in rows.iter().enumerate() {
+                        let recent_row = i < n_recent;
+                        if i == n_recent && n_recent > 0 {
+                            ui.separator();
+                        }
+                        // Only rows on screen read their font's format and styles, and an expanded
+                        // family: its style rows stay listed when its own row scrolls out of view.
+                        let visible = ui.is_rect_visible(egui::Rect::from_min_size(ui.cursor().min, egui::vec2(FONT_LIST_WIDTH, row_h)));
+                        let format = if visible { lookup(f).map(|t| t.format) } else { None };
+                        let open = !recent_row && expanded.contains(f);
+                        let styles = if visible || open { library.styles_of(f) } else { Vec::new() };
+                        let favorite = library.favorites.contains(f);
+                        // Highlighted by its fill alone, as Photoshop's font menu is: a hovered or selected
+                        // row's stroke grew it and pushed the rows below down (#7406).
+                        let slot = preview.map_or(0.0, |(size, _)| crate::font_preview::slot_width(ui.ctx(), f, size));
+                        // One row lit, though a recent family is listed twice.
+                        let mut button = egui::Button::selectable(selected == Some(i), label).truncate().stroke(egui::Stroke::NONE);
+                        let [_, h] = preview.map_or([0.0, 16.0], |(_, b)| b);
+                        button =
+                            button.right_text(egui::Atom::custom(egui::IdSalt::new(("font-sample", f, recent_row)), egui::vec2(slot + FONT_BADGE_WIDTH, h)));
+                        let response = ui
+                            .allocate_ui_with_layout(egui::vec2(FONT_LIST_WIDTH, row_h), egui::Layout::left_to_right(egui::Align::Center), |ui| {
+                                ui.spacing_mut().item_spacing.x = 2.0;
+                                // The star adds the font to (or removes it from) the favourites; it never picks it.
+                                let tip = if favorite { tl!("Remove from Favorites") } else { tl!("Add to Favorites") };
+                                if crate::icons::button(ui, if favorite { "star-filled" } else { "star" }, 22.0, false, tip).clicked() {
+                                    library.toggled = Some(f.clone());
+                                }
+                                // A family with several styles expands to list them (">").
+                                if styles.len() > 1 && !recent_row {
+                                    let (icon, tip) = if open { ("chevron-down", tl!("Hide Styles")) } else { ("chevron-right", tl!("Show Styles")) };
+                                    if crate::icons::button(ui, icon, 16.0, false, tip).clicked() {
+                                        if open {
+                                            expanded.retain(|e| e != f);
+                                        } else {
+                                            expanded.push(f.clone());
+                                        }
+                                    }
+                                } else {
+                                    ui.add_space(16.0);
+                                }
+                                ui.add_sized([ui.available_width(), row_h], button)
+                            })
+                            .inner;
+                        if stepped == Some(i) {
+                            response.scroll_to_me(Some(egui::Align::Center));
+                        } else if reveal.is_some() {
+                            if reveal_from == Some(i) {
+                                reveal_top = Some(response.rect);
+                            }
+                            if reveal == Some(i) {
+                                // Jump, not glide: the menu opens with its current family in view. Arrow
+                                // steps above keep the animation. A recent row too far below the top of
+                                // the group (large previews, many recents) is brought up to the bottom.
+                                let top = reveal_top.unwrap_or(response.rect);
+                                let (rect, align) = if response.rect.bottom() - top.top() <= ui.clip_rect().height() {
+                                    (top, egui::Align::Min)
+                                } else {
+                                    (response.rect, egui::Align::Max)
+                                };
+                                ui.scroll_to_rect_animation(rect, Some(align), egui::style::ScrollAnimation::none());
+                            }
+                        }
+                        if let Some((size, _)) = preview
+                            && ui.is_rect_visible(response.rect)
+                        {
+                            crate::font_preview::paint(ui, f, response.rect, size);
+                        }
+                        // The format badge (O, TT, VAR) just left of the sample.
+                        if let Some(format) = format {
+                            let center = egui::pos2(response.rect.right() - 8.0 - slot - FONT_BADGE_WIDTH / 2.0, response.rect.center().y);
+                            let t = crate::theme::Tokens::get(ui.ctx());
+                            ui.painter().text(center, egui::Align2::CENTER_CENTER, format.badge(), egui::FontId::proportional(10.0), t.text_dim);
+                            let tip = egui::Rect::from_center_size(center, egui::vec2(FONT_BADGE_WIDTH, 14.0));
+                            ui.interact(tip, ui.scope_id().with(("font-format", f, recent_row)), egui::Sense::hover())
+                                .on_hover_text(crate::font_filters::format_tip(format));
+                        }
+                        if response.hovered() {
+                            hovered = Some(f.clone());
+                        }
+                        if press.chosen(ui, &response) {
+                            *current = f.clone();
+                            // A served family not fetched yet: start now, before any text needs it.
+                            photocraft_text::served::request(f);
+                            changed = true;
+                            picked = true;
+                            ui.data_mut(|d| d.remove::<String>(search_id));
+                            hovered = None;
+                            ui.close();
+                        }
+                        if !open {
+                            continue;
+                        }
+                        // The family's styles, each picking the family in that style.
+                        for style in &styles {
+                            let style_row = ui
+                                .horizontal(|ui| {
+                                    ui.add_space(46.0);
+                                    ui.add_sized(
+                                        [ui.available_width(), 22.0],
+                                        egui::Button::selectable(false, style_label(style)).truncate().stroke(egui::Stroke::NONE),
+                                    )
+                                })
+                                .inner;
+                            if style_row.clicked() {
+                                *current = f.clone();
+                                photocraft_text::served::request(f);
+                                library.picked_style = Some(style.clone());
+                                changed = true;
+                                picked = true;
+                                ui.data_mut(|d| d.remove::<String>(search_id));
+                                hovered = None;
+                                ui.close();
+                            }
+                        }
+                    }
+                })
+            });
+            ui.data_mut(|d| d.insert_temp(list_left_id, shown.inner_rect.left() - origin));
+            shown.inner_rect.right()
+        });
+        if let Some(x) = divider {
+            ui.painter().vline(x, body.response.rect.y_range(), ui.visuals().widgets.noninteractive.bg_stroke);
+        }
+        // The lists' own extent, from the class list to the font list's scroll bar: the row
+        // itself stretches with the popup, so it can't tell when the popup is too wide.
+        let list_right = body.inner + FONT_SCROLL_BAR_WIDTH;
+        let body = egui::Rect::from_min_max(body.response.rect.min, egui::pos2(list_right.min(body.response.rect.right()), body.response.rect.bottom()));
+        ui.data_mut(|d| {
+            d.insert_temp(filters_id, filters);
+            d.insert_temp(expanded_id, expanded);
+            d.insert_temp(body_id, body.translate(egui::vec2(-origin, 0.0)));
+            if let Some(f) = &hovered {
+                d.insert_temp(preview_id, f.clone());
             }
         });
-        // egui measures a popup only when it opens and never lets it grow back, so a filtered
-        // list would leave the menu short after the query is cleared (#1369). Keep the unfiltered
-        // height while searching. Measured after the rows: before them `min_rect` only holds the
-        // search field, and the cache would shrink the menu to it.
-        if ql.is_empty() {
-            let h = ui.min_rect().height();
-            ui.data_mut(|d| d.insert_temp(height_id, h));
-        } else if let Some(h) = ui.data(|d| d.get_temp::<f32>(height_id)) {
-            ui.set_min_height(h.min(FONT_MENU_HEIGHT));
-        }
         if accept { None } else { hovered }
     });
     response.response = response.response.accessible_name(tl!("Font"));
     press.after(&response.response);
-    if !egui::ComboBox::is_open(ui.ctx(), response.response.id) {
+    if !craft_ui::ComboBox::is_open(ui.ctx(), response.response.id) {
         ui.data_mut(|d| {
             d.remove::<bool>(focus_id);
             d.remove::<Vec<String>>(recents_id);
             d.remove::<usize>(row_id);
             d.remove::<bool>(search_id.with("reveal"));
+            d.remove::<String>(search_id.with("similar-to"));
         });
     }
     let hovered_font = response.inner.unwrap_or_default();
@@ -484,7 +745,7 @@ pub(crate) fn family_picker_in(
     if picked {
         ui.memory_mut(|m| m.request_focus(field));
     }
-    let open = egui::ComboBox::is_open(ui.ctx(), field);
+    let open = craft_ui::ComboBox::is_open(ui.ctx(), field);
     if !open && ui.is_enabled() && ui.memory(|m| m.has_focus(field)) {
         ui.memory_mut(|m| m.set_focus_lock_filter(field, egui::EventFilter { vertical_arrows: true, ..Default::default() }));
         let down = ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::ArrowDown));
@@ -512,7 +773,7 @@ pub(crate) fn family_picker_in(
 
     // The wheel over the closed button steps through the families, a notch each, like Photoshop's
     // options-bar font menu: no need to open the list (#3350).
-    if !egui::ComboBox::is_open(ui.ctx(), response.response.id) && ui.is_enabled() {
+    if !craft_ui::ComboBox::is_open(ui.ctx(), response.response.id) && ui.is_enabled() {
         let hovered = response.response.hovered();
         if hovered {
             ui.input_mut(|i| i.smooth_scroll_delta = egui::Vec2::ZERO);
@@ -537,7 +798,7 @@ pub(crate) fn family_picker_in(
         let hover_id = egui::Id::unique("type-font-hover");
         if let Some(f) = hovered_font {
             ui.ctx().data_mut(|d| d.insert_temp(hover_id, f));
-        } else if egui::ComboBox::is_open(ui.ctx(), response.response.id) {
+        } else if craft_ui::ComboBox::is_open(ui.ctx(), response.response.id) {
             // Only the open menu clears it: the options bar and the Character section both draw
             // this picker, and the closed one must not wipe the other's hover (#5152).
             ui.ctx().data_mut(|d| d.remove::<String>(hover_id));
diff --git a/crates/ui-egui/src/tools/type_tool/ime.rs b/crates/ui-egui/src/tools/type_tool/ime.rs
index 09994a338d..4f9f606bed 100644
--- a/crates/ui-egui/src/tools/type_tool/ime.rs
+++ b/crates/ui-egui/src/tools/type_tool/ime.rs
@@ -1,6 +1,6 @@
 use super::editing::edit_home;
 use super::ime_edit::{ime_geometry, reconcile_preedit};
-use super::*;
+use super::{Arc, HashMap, ImeContextTracker, ImeMutationStamp, ImeTarget, LayerId, PhotocraftApp, TextEdit, ViewXform, active_doc_id, current_text};
 
 /// Per-editor IME owner/generation bookkeeping for the custom Type tool.
 ///
diff --git a/crates/ui-egui/src/tools/type_tool/ime_edit.rs b/crates/ui-egui/src/tools/type_tool/ime_edit.rs
index c13abf716e..33296343d3 100644
--- a/crates/ui-egui/src/tools/type_tool/ime_edit.rs
+++ b/crates/ui-egui/src/tools/type_tool/ime_edit.rs
@@ -3,7 +3,9 @@ use super::ime::{
     ImeCommitted, ImeEmitted, ResetContext, bind_reset_context, ime_target, interrupt_incoming, remember_incoming, reset_route_eligible, sync_incoming,
 };
 use super::layout::layout;
-use super::*;
+use super::{
+    CommittedText, ImeObservation, LayerId, PhotocraftApp, Point, Pos2, Range, TextEdit, ViewXform, byte_of, current_text, json, text_char_count, text_layer,
+};
 
 /// UTF-8 byte offsets of the caret, anchor and pre-edit, found in one traversal.
 ///
diff --git a/crates/ui-egui/src/tools/type_tool/ime_tests.rs b/crates/ui-egui/src/tools/type_tool/ime_tests.rs
index d76938c87a..5617eebe5b 100644
--- a/crates/ui-egui/src/tools/type_tool/ime_tests.rs
+++ b/crates/ui-egui/src/tools/type_tool/ime_tests.rs
@@ -172,118 +172,129 @@ fn external_edit_invalidates_the_preedit_and_rejects_its_late_commit() {
     for bytes in [false, true] {
         for split in [false, true] {
             for discard in [false, true] {
-                let ctx = context();
-                let mut app = app();
-                run(&mut app, &ctx, Vec::new());
-                // Compose in the middle of committed text, so an application edit before it
-                // moves a still-in-range (but wrong) character range.
-                insert(&mut app, "def");
-                if let Some(ed) = app.ui.text_edit.as_mut() {
-                    ed.caret = 3;
-                    ed.anchor = 3;
-                }
-                let composing = run(&mut app, &ctx, vec![preedit("に")]).expect("composing descriptor");
-                assert_eq!(layer_text(&app), "abcにdef");
-                assert_eq!(payload(&composing).text, "abcdef", "the preview is not committed text");
-                let layer = app.ui.text_edit.as_ref().unwrap().layer;
-                let session = app.ui.text_edit.as_ref().unwrap().session.clone();
-                // The control channel edits the same layer without passing through `insert`.
-                app.run("type.edit", json!({"layer": layer, "replace": {"start": 0, "end": 1, "text": ""}, "coalesce": session})).unwrap();
-                assert_eq!(layer_text(&app), "bcにdef");
-                let revision = app.session.active().unwrap().revision;
-                let history = app.session.active().unwrap().history.entries();
-                let selection = app.ui.text_edit.as_ref().map(|ed| (ed.anchor, ed.caret));
-                let unchanged = |app: &PhotocraftApp| {
-                    assert_eq!(layer_text(app), "bcにdef");
-                    assert_eq!(app.session.active().unwrap().revision, revision);
-                    assert_eq!(app.session.active().unwrap().history.entries(), history);
-                    assert_eq!(app.ui.text_edit.as_ref().map(|ed| (ed.anchor, ed.caret)), selection);
-                };
-
-                // The old range (3,1) now covers `d`: report unavailable, cancel the
-                // composition and do not present `d` as the composition. A discarded pass
-                // must retain both latches until a descriptor is actually delivered.
-                let invalidated = if discard {
-                    ctx.options_mut(|o| o.max_passes = std::num::NonZeroUsize::new(4).expect("four passes"));
-                    let mut passes = Vec::new();
-                    let mut out = ctx.run_ui(egui::RawInput { focused: true, ..Default::default() }, |ui| {
-                        handle_keys(&mut app, ui.ctx());
-                        let rect = egui::Rect::from_min_size(Pos2::ZERO, egui::vec2(400.0, 300.0));
-                        let xf = ViewXform { rect, zoom: 1.0, center: [100.0, 100.0], flip: false, rotation: 0.0, aspect: 1.0 };
-                        draw_overlay(&mut app, ui.painter(), &xf);
-                        if passes.is_empty() {
-                            ui.ctx().request_discard("invalidated preedit descriptor regression");
-                        }
-                        let discarded = ui.ctx().will_discard();
-                        let before = (app.type_ime.stale, app.type_ime.interrupt);
-                        sync_ime(&mut app, ui.ctx());
-                        finish_reset_pass(&mut app, ui.ctx());
-                        let unavailable = ui.ctx().output(|out| out.ime.as_ref().expect("pass descriptor").surrounding_text.available().is_none());
-                        passes.push((discarded, before, (app.type_ime.stale, app.type_ime.interrupt), unavailable));
-                    });
-                    out.textures_delta.clear();
-                    assert_eq!(passes.first(), Some(&(true, (true, true), (true, true), true)), "discard cannot consume invalidation");
-                    assert_eq!(passes.last(), Some(&(false, (true, true), (false, false), true)), "the accepted pass delivers it once");
-                    out.platform_output.ime.expect("descriptor")
-                } else {
-                    run(&mut app, &ctx, Vec::new()).expect("descriptor")
-                };
-                assert!(invalidated.surrounding_text.available().is_none());
-                assert!(invalidated.should_interrupt_composition);
-                assert_eq!(
-                    (invalidated.owner, invalidated.context_generation, invalidated.purpose),
-                    (composing.owner, composing.context_generation, composing.purpose)
-                );
-                assert_eq!(invalidated.change_cause, ImeChangeCause::Other);
-                assert_eq!(app.ui.text_edit.as_ref().unwrap().preedit, None);
-                assert!(app.type_ime.preedit.is_none());
-                unchanged(&app);
-
-                let recovered = run(&mut app, &ctx, Vec::new()).expect("idle descriptor");
-                assert_eq!(payload(&recovered).text, "bcにdef");
-                assert_eq!((payload(&recovered).cursor, payload(&recovered).anchor), (6, 6));
-                assert!(!recovered.should_interrupt_composition, "a delivered reset is not replayed");
-                assert!(matches!(app.type_ime.incoming, Some(IncomingComposition::Stale)), "idle availability does not accept an old terminal");
-                unchanged(&app);
-
-                // The pending deletion and commit belonged to the cancelled composition:
-                // neither combined nor split delivery may replace `d` or grow undo history.
-                let mut events = vec![terminal_delete(bytes)];
-                if split {
-                    run(&mut app, &ctx, events).expect("rejected deletion descriptor");
-                    unchanged(&app);
-                    for _ in 0..3 {
-                        run(&mut app, &ctx, Vec::new());
-                    }
-                    assert!(matches!(app.type_ime.incoming, Some(IncomingComposition::Stale)));
-                    events = Vec::new();
-                }
-                events.push(egui::Event::Ime(egui::ImeEvent::Commit("に".into())));
-                let late = run(&mut app, &ctx, events).expect("descriptor");
-                assert_eq!(layer_text(&app), "bcにdef");
-                assert_eq!(late.change_cause, ImeChangeCause::Other);
-                assert_eq!(payload(&late).text, "bcにdef");
-                unchanged(&app);
-                assert!(matches!(app.type_ime.incoming, Some(IncomingComposition::Stale)), "terminal input cannot acknowledge cancellation");
-
-                let fresh =
-                    run(&mut app, &ctx, vec![completed(invalidated.reset_request.expect("reset request")), preedit("Q")]).expect("fresh preview descriptor");
-                assert_eq!(layer_text(&app), "bcにdQef");
-                assert_eq!(payload(&fresh).text, "bcにdef", "fresh preview is excluded from committed text");
-                assert!(!fresh.should_interrupt_composition);
-                let committed = run(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::Commit("Q".into()))]).expect("fresh commit descriptor");
-                assert_eq!(layer_text(&app), "bcにdQef");
-                assert_eq!(payload(&committed).text, "bcにdQef");
-                assert_eq!(committed.change_cause, ImeChangeCause::InputMethod);
-                let direct = run(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::Commit("R".into()))]).expect("direct commit descriptor");
-                assert_eq!(layer_text(&app), "bcにdQRef");
-                assert_eq!(payload(&direct).text, "bcにdQRef");
-                assert_eq!(direct.change_cause, ImeChangeCause::InputMethod);
+                external_edit_case(bytes, split, discard);
             }
         }
     }
 }
 
+fn external_edit_case(bytes: bool, split: bool, discard: bool) {
+    let ctx = context();
+    let mut app = app();
+    run(&mut app, &ctx, Vec::new());
+    // Compose in the middle of committed text, so an application edit before it
+    // moves a still-in-range (but wrong) character range.
+    insert(&mut app, "def");
+    if let Some(ed) = app.ui.text_edit.as_mut() {
+        ed.caret = 3;
+        ed.anchor = 3;
+    }
+    let composing = run(&mut app, &ctx, vec![preedit("に")]).expect("composing descriptor");
+    assert_eq!(layer_text(&app), "abcにdef");
+    assert_eq!(payload(&composing).text, "abcdef", "the preview is not committed text");
+    let layer = app.ui.text_edit.as_ref().unwrap().layer;
+    let session = app.ui.text_edit.as_ref().unwrap().session.clone();
+    // The control channel edits the same layer without passing through `insert`.
+    app.run("type.edit", json!({"layer": layer, "replace": {"start": 0, "end": 1, "text": ""}, "coalesce": session})).unwrap();
+    assert_eq!(layer_text(&app), "bcにdef");
+    let revision = app.session.active().unwrap().revision;
+    let history = app.session.active().unwrap().history.entries();
+    let selection = app.ui.text_edit.as_ref().map(|ed| (ed.anchor, ed.caret));
+    let unchanged = |app: &PhotocraftApp| {
+        assert_eq!(layer_text(app), "bcにdef");
+        assert_eq!(app.session.active().unwrap().revision, revision);
+        assert_eq!(app.session.active().unwrap().history.entries(), history);
+        assert_eq!(app.ui.text_edit.as_ref().map(|ed| (ed.anchor, ed.caret)), selection);
+    };
+
+    // The old range (3,1) now covers `d`: report unavailable, cancel the
+    // composition and do not present `d` as the composition. A discarded pass
+    // must retain both latches until a descriptor is actually delivered.
+    let invalidated = invalidated_descriptor(&mut app, &ctx, discard);
+    assert!(invalidated.surrounding_text.available().is_none());
+    assert!(invalidated.should_interrupt_composition);
+    assert_eq!((invalidated.owner, invalidated.context_generation, invalidated.purpose), (composing.owner, composing.context_generation, composing.purpose));
+    assert_eq!(invalidated.change_cause, ImeChangeCause::Other);
+    assert_eq!(app.ui.text_edit.as_ref().unwrap().preedit, None);
+    assert!(app.type_ime.preedit.is_none());
+    unchanged(&app);
+
+    let recovered = run(&mut app, &ctx, Vec::new()).expect("idle descriptor");
+    assert_eq!(payload(&recovered).text, "bcにdef");
+    assert_eq!((payload(&recovered).cursor, payload(&recovered).anchor), (6, 6));
+    assert!(!recovered.should_interrupt_composition, "a delivered reset is not replayed");
+    assert!(matches!(app.type_ime.incoming, Some(IncomingComposition::Stale)), "idle availability does not accept an old terminal");
+    unchanged(&app);
+
+    // The pending deletion and commit belonged to the cancelled composition:
+    // neither combined nor split delivery may replace `d` or grow undo history.
+    let mut events = reject_cancelled_deletion(&mut app, &ctx, bytes, split, &unchanged);
+    events.push(egui::Event::Ime(egui::ImeEvent::Commit("に".into())));
+    let late = run(&mut app, &ctx, events).expect("descriptor");
+    assert_eq!(layer_text(&app), "bcにdef");
+    assert_eq!(late.change_cause, ImeChangeCause::Other);
+    assert_eq!(payload(&late).text, "bcにdef");
+    unchanged(&app);
+    assert!(matches!(app.type_ime.incoming, Some(IncomingComposition::Stale)), "terminal input cannot acknowledge cancellation");
+
+    let fresh = run(&mut app, &ctx, vec![completed(invalidated.reset_request.expect("reset request")), preedit("Q")]).expect("fresh preview descriptor");
+    assert_eq!(layer_text(&app), "bcにdQef");
+    assert_eq!(payload(&fresh).text, "bcにdef", "fresh preview is excluded from committed text");
+    assert!(!fresh.should_interrupt_composition);
+    let committed = run(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::Commit("Q".into()))]).expect("fresh commit descriptor");
+    assert_eq!(layer_text(&app), "bcにdQef");
+    assert_eq!(payload(&committed).text, "bcにdQef");
+    assert_eq!(committed.change_cause, ImeChangeCause::InputMethod);
+    let direct = run(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::Commit("R".into()))]).expect("direct commit descriptor");
+    assert_eq!(layer_text(&app), "bcにdQRef");
+    assert_eq!(payload(&direct).text, "bcにdQRef");
+    assert_eq!(direct.change_cause, ImeChangeCause::InputMethod);
+}
+
+/// Delivers the deletion of the cancelled composition. With `split`, it is rejected on its own
+/// first. Returns the events that the caller still has to deliver.
+fn reject_cancelled_deletion(app: &mut PhotocraftApp, ctx: &egui::Context, bytes: bool, split: bool, unchanged: &dyn Fn(&PhotocraftApp)) -> Vec<egui::Event> {
+    let mut events = vec![terminal_delete(bytes)];
+    if split {
+        run(app, ctx, events).expect("rejected deletion descriptor");
+        unchanged(app);
+        for _ in 0..3 {
+            run(app, ctx, Vec::new());
+        }
+        assert!(matches!(app.type_ime.incoming, Some(IncomingComposition::Stale)));
+        events = Vec::new();
+    }
+    events
+}
+
+fn invalidated_descriptor(app: &mut PhotocraftApp, ctx: &egui::Context, discard: bool) -> egui::output::IMEOutput {
+    if discard {
+        ctx.options_mut(|o| o.max_passes = std::num::NonZeroUsize::new(4).expect("four passes"));
+        let mut passes = Vec::new();
+        let mut out = ctx.run_ui(egui::RawInput { focused: true, ..Default::default() }, |ui| {
+            handle_keys(app, ui.ctx());
+            let rect = egui::Rect::from_min_size(Pos2::ZERO, egui::vec2(400.0, 300.0));
+            let xf = ViewXform { rect, zoom: 1.0, center: [100.0, 100.0], flip: false, rotation: 0.0, aspect: 1.0 };
+            draw_overlay(app, ui.painter(), &xf);
+            if passes.is_empty() {
+                ui.ctx().request_discard("invalidated preedit descriptor regression");
+            }
+            let discarded = ui.ctx().will_discard();
+            let before = (app.type_ime.stale, app.type_ime.interrupt);
+            sync_ime(app, ui.ctx());
+            finish_reset_pass(app, ui.ctx());
+            let unavailable = ui.ctx().output(|out| out.ime.as_ref().expect("pass descriptor").surrounding_text.available().is_none());
+            passes.push((discarded, before, (app.type_ime.stale, app.type_ime.interrupt), unavailable));
+        });
+        out.textures_delta.clear();
+        assert_eq!(passes.first(), Some(&(true, (true, true), (true, true), true)), "discard cannot consume invalidation");
+        assert_eq!(passes.last(), Some(&(false, (true, true), (false, false), true)), "the accepted pass delivers it once");
+        out.platform_output.ime.expect("descriptor")
+    } else {
+        run(app, ctx, Vec::new()).expect("descriptor")
+    }
+}
+
 #[test]
 fn target_change_interrupts_and_rejects_the_late_commit() {
     let ctx = context();
@@ -1038,14 +1049,14 @@ fn reset_harness(app: PhotocraftApp) -> egui_kittest::Harness<'static, ResetHarn
                             170.0,
                             &["Family 00".into(), "Family 01".into()],
                             photocraft_engine::prefs::FontPreview::Medium,
-                            &[],
+                            &mut FontLibrary::default(),
                         );
                         let search = ui.scope_id().with(("font-search", "reset-font"));
                         state.search = ui.data(|d| d.get_temp::<String>(search)).unwrap_or_default();
                         let input = search.with("input");
                         state.search_input = Some(input);
                         state.search_focused = ui.memory(|m| m.has_focus(input));
-                        state.search_height = ui.data(|d| d.get_temp::<f32>(search.with("height")));
+                        state.search_height = ui.data(|d| d.get_temp::<egui::Rect>(search.with("body"))).map(|r| r.height());
                     });
                 }
                 if state.picker_button {
diff --git a/crates/ui-egui/src/tools/type_tool/keys.rs b/crates/ui-egui/src/tools/type_tool/keys.rs
index 98820ab0a5..deb10f77a1 100644
--- a/crates/ui-egui/src/tools/type_tool/keys.rs
+++ b/crates/ui-egui/src/tools/type_tool/keys.rs
@@ -9,7 +9,7 @@ use super::ime::{
 use super::ime_edit::{ime_delete_bytes, ime_delete_chars, ime_update};
 use super::layout::layout;
 use super::pointer::word_boundary;
-use super::*;
+use super::{LayerId, PhotocraftApp, byte_of, current_text, json, text_char_count, text_layer};
 
 /// Caret on the neighbouring line (±1; a column in vertical type), keeping the position
 /// along the line. Works in line space, so it serves both orientations.
@@ -138,14 +138,6 @@ pub fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
         let is_key = matches!(ev, egui::Event::Key { .. });
         let text = if is_key { current_text(app, id).unwrap_or_default() } else { String::new() };
         let n = if is_key { text.chars().count() } else { 0 };
-        let set = |app: &mut PhotocraftApp, caret: usize, extend: bool| {
-            if let Some(e) = app.ui.text_edit.as_mut() {
-                e.caret = caret.min(n);
-                if !extend {
-                    e.anchor = e.caret;
-                }
-            }
-        };
         handled[k] = true;
         match ev {
             egui::Event::Text(s) => insert_typed(app, s),
@@ -199,133 +191,9 @@ pub fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
             }
             egui::Event::Cut => cut_selection(app, ctx),
             egui::Event::Key { key, pressed: true, modifiers: m, .. } => {
-                use egui::Key;
-                let key = &flow_key(*key, vertical_flow);
-                match key {
-                    // Photoshop's type formatting keys act on the selected characters and win
-                    // over the global ⇧⌘K/U/B/I (Color Settings, Desaturate, Auto Color, Inverse)
-                    // while typing. Each press is one history step.
-                    Key::K | Key::U | Key::B | Key::I | Key::Slash | Key::Questionmark if m.command && m.shift && !m.alt => {
-                        let which = match key {
-                            Key::K => CharToggle::AllCaps,
-                            Key::U => CharToggle::Underline,
-                            Key::B => CharToggle::FauxBold,
-                            Key::I => CharToggle::FauxItalic,
-                            _ => CharToggle::Strikethrough,
-                        };
-                        toggle_char_style(app, which);
-                    }
-                    Key::H if m.command && m.shift && m.alt => toggle_hyphenate(app),
-                    // ⌥↑/↓ leading -/+2 pt, ⇧⌥↑/↓ baseline shift +/-2 pt (10 with ⌘/Ctrl).
-                    Key::ArrowUp | Key::ArrowDown if m.alt => {
-                        let step = if m.command { 10.0 } else { 2.0 };
-                        let up = *key == Key::ArrowUp;
-                        if m.shift {
-                            step_char_metric(app, "baselineShiftBy", if up { step } else { -step });
-                        } else {
-                            step_char_metric(app, "leadingBy", if up { -step } else { step });
-                        }
-                    }
-                    // ⌥←/→ over a selection tracks it by -/+20 (100 with ⌘/Ctrl).
-                    Key::ArrowLeft | Key::ArrowRight if m.alt && !m.shift && a != b => {
-                        let step = if m.command { 100.0 } else { 20.0 };
-                        step_char_metric(app, "trackingBy", if *key == Key::ArrowRight { step } else { -step });
-                    }
-                    Key::Backspace | Key::Delete => {
-                        if a == b {
-                            let fwd = *key == Key::Delete;
-                            let to = match (fwd, m.alt, m.command) {
-                                (false, _, true) => line_edge(app, id, a, false),
-                                (false, true, _) => word_boundary(&text, a, false),
-                                (false, _, _) => a.saturating_sub(1),
-                                (true, true, _) => word_boundary(&text, a, true),
-                                (true, _, _) => (a + 1).min(n),
-                            };
-                            if to != a {
-                                if let Some(e) = app.ui.text_edit.as_mut() {
-                                    e.anchor = to;
-                                }
-                                insert(app, "");
-                            }
-                        } else {
-                            insert(app, "");
-                        }
-                    }
-                    // Photoshop: Alt/Option+←/→ at a collapsed caret kerns the pair before it by
-                    // 20/1000 em (100 with ⌘/Ctrl), one history step per press.
-                    Key::ArrowLeft | Key::ArrowRight if m.alt && !m.shift && a == b => {
-                        let step = if m.command { 100.0 } else { 20.0 };
-                        kern_pair(app, id, ed.caret, if *key == Key::ArrowRight { step } else { -step });
-                    }
-                    Key::ArrowLeft | Key::ArrowRight => {
-                        let fwd = *key == Key::ArrowRight;
-                        // Word movement: ⌘/Ctrl (Photoshop's; Alt is kerning), and Alt+Shift
-                        // extends the selection by words; Home/End go to the line edges.
-                        let to = if m.command || m.alt {
-                            word_boundary(&text, ed.caret, fwd)
-                        } else if a != b && !m.shift {
-                            if fwd { b } else { a }
-                        } else if fwd {
-                            ed.caret + 1
-                        } else {
-                            ed.caret.saturating_sub(1)
-                        };
-                        set(app, to, m.shift);
-                    }
-                    Key::ArrowUp | Key::ArrowDown => {
-                        let to = if m.command {
-                            if *key == Key::ArrowUp { 0 } else { n }
-                        } else {
-                            line_step(app, id, ed.caret, if *key == Key::ArrowUp { -1 } else { 1 })
-                        };
-                        set(app, to, m.shift);
-                    }
-                    Key::Home | Key::End => {
-                        let to = line_edge(app, id, ed.caret, *key == Key::End);
-                        set(app, to, m.shift);
-                    }
-                    Key::Enter if m.command => commit_with(app, *m),
-                    Key::Enter => insert(app, "\n"),
-                    // Photoshop types a tab character; layout advances it to the next tab stop.
-                    Key::Tab if !m.command && !m.alt && !m.shift => {
-                        // egui queues focus navigation before this handler runs; consuming the
-                        // key alone would let the menu bar take focus after the first tab (#8889).
-                        ctx.memory_mut(|m| m.move_focus(egui::FocusDirection::None));
-                        insert(app, "\t");
-                    }
-                    Key::Escape if crate::type_transform::active(app) => crate::type_transform::cancel_drag(app),
-                    // The Type Mask tools: Escape always cancels, leaving the selection as it was.
-                    Key::Escape if ed.mask => cancel(app),
-                    // Preferences ▸ Type: with "Use Escape to Commit" off, Escape cancels the
-                    // session (undoes it, removing a just-created layer) like the Cancel button.
-                    Key::Escape if app.session.prefs().type_.use_esc_to_commit => commit(app),
-                    Key::Escape => cancel(app),
-                    Key::A if m.command => {
-                        if let Some(e) = app.ui.text_edit.as_mut() {
-                            e.anchor = 0;
-                            e.caret = n;
-                        }
-                    }
-                    // Photoshop: while editing type, ⌘/Ctrl+T shows or hides the Character panel
-                    // (Free Transform of the layer being typed into is not what it means here).
-                    Key::T if m.command && !m.shift && !m.alt => {
-                        let _ = crate::menus::invoke(app, ctx, "window.panel.character", json!({}));
-                    }
-                    // Other command shortcuts (⌘Z, ⌘S, …) pass through to the menus.
-                    _ if m.command => {
-                        if *key == Key::Z {
-                            crate::type_transform::cancel_drag(app);
-                        }
-                        if reset_guarded(app, ctx.viewport_id()) || app.type_ime.incoming.is_some() {
-                            interrupt_action(app, ctx.viewport_id());
-                            custom_mutations = false;
-                            deferred_custom = true;
-                            suspend_reset(app, ctx);
-                        }
-                        handled[k] = false;
-                    }
-                    _ => {}
-                }
+                let edit = KeyEditContext { id, vertical_flow, edit: &ed, selection: (a, b), text: &text, char_count: n };
+                let mut flow = EventFlow { handled: &mut handled, index: k, custom_mutations: &mut custom_mutations, deferred_custom: &mut deferred_custom };
+                handle_pressed_key(app, ctx, key, m, &edit, &mut flow);
             }
             egui::Event::Key { pressed: false, modifiers: m, .. } => handled[k] = !m.command,
             _ => handled[k] = false,
@@ -345,3 +213,182 @@ pub fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
     }
     app.ui.text_edit.is_some()
 }
+
+struct KeyEditContext<'a> {
+    id: LayerId,
+    vertical_flow: bool,
+    edit: &'a crate::state::TextEdit,
+    selection: (usize, usize),
+    text: &'a str,
+    char_count: usize,
+}
+
+struct EventFlow<'a> {
+    handled: &'a mut [bool],
+    index: usize,
+    custom_mutations: &'a mut bool,
+    deferred_custom: &'a mut bool,
+}
+
+fn handle_pressed_key(
+    app: &mut PhotocraftApp,
+    ctx: &egui::Context,
+    raw_key: &egui::Key,
+    modifiers: &egui::Modifiers,
+    edit: &KeyEditContext<'_>,
+    flow: &mut EventFlow<'_>,
+) {
+    let key = flow_key(*raw_key, edit.vertical_flow);
+    if handle_style_key(app, key, modifiers, edit) || handle_delete_key(app, key, modifiers, edit) || handle_move_key(app, key, modifiers, edit) {
+        return;
+    }
+
+    use egui::Key;
+    match key {
+        Key::Enter if modifiers.command => commit_with(app, *modifiers),
+        Key::Enter => insert(app, "\n"),
+        Key::Tab if !modifiers.command && !modifiers.alt && !modifiers.shift => {
+            // egui queues focus navigation before this handler runs; consuming the
+            // key alone would let the menu bar take focus after the first tab (#8889).
+            ctx.memory_mut(|memory| memory.move_focus(egui::FocusDirection::None));
+            insert(app, "\t");
+        }
+        Key::Escape if crate::type_transform::active(app) => crate::type_transform::cancel_drag(app),
+        Key::Escape if edit.edit.mask => cancel(app),
+        Key::Escape if app.session.prefs().type_.use_esc_to_commit => commit(app),
+        Key::Escape => cancel(app),
+        Key::A if modifiers.command => {
+            if let Some(state) = app.ui.text_edit.as_mut() {
+                state.anchor = 0;
+                state.caret = edit.char_count;
+            }
+        }
+        Key::T if modifiers.command && !modifiers.shift && !modifiers.alt => {
+            let _ = crate::menus::invoke(app, ctx, "window.panel.character", json!({}));
+        }
+        _ if modifiers.command => {
+            if key == Key::Z {
+                crate::type_transform::cancel_drag(app);
+            }
+            if reset_guarded(app, ctx.viewport_id()) || app.type_ime.incoming.is_some() {
+                interrupt_action(app, ctx.viewport_id());
+                *flow.custom_mutations = false;
+                *flow.deferred_custom = true;
+                suspend_reset(app, ctx);
+            }
+            flow.handled[flow.index] = false;
+        }
+        _ => {}
+    }
+}
+
+fn handle_style_key(app: &mut PhotocraftApp, key: egui::Key, modifiers: &egui::Modifiers, edit: &KeyEditContext<'_>) -> bool {
+    use egui::Key;
+    match key {
+        Key::K | Key::U | Key::B | Key::I | Key::Slash | Key::Questionmark if modifiers.command && modifiers.shift && !modifiers.alt => {
+            let style = match key {
+                Key::K => CharToggle::AllCaps,
+                Key::U => CharToggle::Underline,
+                Key::B => CharToggle::FauxBold,
+                Key::I => CharToggle::FauxItalic,
+                _ => CharToggle::Strikethrough,
+            };
+            toggle_char_style(app, style);
+            true
+        }
+        Key::H if modifiers.command && modifiers.shift && modifiers.alt => {
+            toggle_hyphenate(app);
+            true
+        }
+        Key::ArrowUp | Key::ArrowDown if modifiers.alt => {
+            let amount = if modifiers.command { 10.0 } else { 2.0 };
+            let up = key == Key::ArrowUp;
+            let (property, delta) =
+                if modifiers.shift { ("baselineShiftBy", if up { amount } else { -amount }) } else { ("leadingBy", if up { -amount } else { amount }) };
+            step_char_metric(app, property, delta);
+            true
+        }
+        Key::ArrowLeft | Key::ArrowRight if modifiers.alt && !modifiers.shift && edit.selection.0 != edit.selection.1 => {
+            let amount = if modifiers.command { 100.0 } else { 20.0 };
+            let delta = if key == Key::ArrowRight { amount } else { -amount };
+            step_char_metric(app, "trackingBy", delta);
+            true
+        }
+        Key::ArrowLeft | Key::ArrowRight if modifiers.alt && !modifiers.shift && edit.selection.0 == edit.selection.1 => {
+            let amount = if modifiers.command { 100.0 } else { 20.0 };
+            let delta = if key == Key::ArrowRight { amount } else { -amount };
+            kern_pair(app, edit.id, edit.edit.caret, delta);
+            true
+        }
+        _ => false,
+    }
+}
+
+fn handle_delete_key(app: &mut PhotocraftApp, key: egui::Key, modifiers: &egui::Modifiers, edit: &KeyEditContext<'_>) -> bool {
+    use egui::Key;
+    if !matches!(key, Key::Backspace | Key::Delete) {
+        return false;
+    }
+    let (start, end) = edit.selection;
+    if start == end {
+        let forward = key == Key::Delete;
+        let to = match (forward, modifiers.alt, modifiers.command) {
+            (false, _, true) => line_edge(app, edit.id, start, false),
+            (false, true, _) => word_boundary(edit.text, start, false),
+            (false, _, _) => start.saturating_sub(1),
+            (true, true, _) => word_boundary(edit.text, start, true),
+            (true, _, _) => (start + 1).min(edit.char_count),
+        };
+        if to != start {
+            if let Some(state) = app.ui.text_edit.as_mut() {
+                state.anchor = to;
+            }
+            insert(app, "");
+        }
+    } else {
+        insert(app, "");
+    }
+    true
+}
+
+fn handle_move_key(app: &mut PhotocraftApp, key: egui::Key, modifiers: &egui::Modifiers, edit: &KeyEditContext<'_>) -> bool {
+    use egui::Key;
+    let caret = edit.edit.caret;
+    let (start, end) = edit.selection;
+    let destination = match key {
+        Key::ArrowLeft | Key::ArrowRight => {
+            let forward = key == Key::ArrowRight;
+            Some(if modifiers.command || modifiers.alt {
+                word_boundary(edit.text, caret, forward)
+            } else if start != end && !modifiers.shift {
+                if forward { end } else { start }
+            } else if forward {
+                caret + 1
+            } else {
+                caret.saturating_sub(1)
+            })
+        }
+        Key::ArrowUp | Key::ArrowDown => Some(if modifiers.command {
+            if key == Key::ArrowUp { 0 } else { edit.char_count }
+        } else {
+            line_step(app, edit.id, caret, if key == Key::ArrowUp { -1 } else { 1 })
+        }),
+        Key::Home | Key::End => Some(line_edge(app, edit.id, caret, key == Key::End)),
+        _ => None,
+    };
+    if let Some(destination) = destination {
+        set_caret(app, edit.char_count, destination, modifiers.shift);
+        true
+    } else {
+        false
+    }
+}
+
+fn set_caret(app: &mut PhotocraftApp, char_count: usize, caret: usize, extend: bool) {
+    if let Some(state) = app.ui.text_edit.as_mut() {
+        state.caret = caret.min(char_count);
+        if !extend {
+            state.anchor = state.caret;
+        }
+    }
+}
diff --git a/crates/ui-egui/src/tools/type_tool/layout.rs b/crates/ui-egui/src/tools/type_tool/layout.rs
index adfb3e910d..45e7cafa3a 100644
--- a/crates/ui-egui/src/tools/type_tool/layout.rs
+++ b/crates/ui-egui/src/tools/type_tool/layout.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Affine, Arc, Document, LayerContent, LayerId, PhotocraftApp, Point, PoisonError, TextLayer, TextLayout, text_layer};
 
 /// Layout of a type layer (cached per document revision) and its text → document transform.
 pub fn layout(app: &mut PhotocraftApp, id: LayerId) -> Option<(Arc<TextLayout>, Affine, String)> {
diff --git a/crates/ui-egui/src/tools/type_tool/options_bar.rs b/crates/ui-egui/src/tools/type_tool/options_bar.rs
index 413cf58455..e2616982ff 100644
--- a/crates/ui-egui/src/tools/type_tool/options_bar.rs
+++ b/crates/ui-egui/src/tools/type_tool/options_bar.rs
@@ -2,7 +2,7 @@ use super::defaults::{apply, formatting_params, open_color_picker, shown_scale,
 use super::editing::{cancel, commit_with};
 use super::fonts::{font_picker, fonts_ready, selected_style, style_label, styles};
 use super::keys::is_vertical;
-use super::*;
+use super::{Color32, LayerId, PhotocraftApp, Stroke, byte_of, json, text_layer};
 
 /// Photoshop's Type options bar.
 pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
@@ -33,13 +33,22 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     }
     // Font family and style menus (one placeholder in their place while the fonts load).
     if fonts_ready(ui, 170.0 + ui.spacing().item_spacing.x + 110.0) {
-        if font_picker(ui, &mut fam, 170.0, app.session.prefs().type_.font_preview, &app.ui.recent_fonts) {
-            app.note_recent_font(&fam);
+        if let Some(picked) = font_picker(app, ui, &mut fam, 170.0) {
             app.ui.tool_options.type_font = fam.clone();
             let st = styles(&fam);
-            style = if st.contains(&style) { style } else { st.first().cloned().unwrap_or_else(|| "Regular".into()) };
+            let picked = picked.filter(|s| st.contains(s));
+            style = match &picked {
+                Some(s) => s.clone(),
+                None if st.contains(&style) => style,
+                None => st.first().cloned().unwrap_or_else(|| "Regular".into()),
+            };
             app.ui.tool_options.type_style = style.clone();
-            apply(app, ui.ctx(), json!({"font": fam}));
+            // Only a style picked under the family's ">" is set: otherwise each selected layer
+            // keeps its own face in the new family (#3556).
+            match picked {
+                Some(s) => apply(app, ui.ctx(), json!({"font": fam, "fontStyle": s})),
+                None => apply(app, ui.ctx(), json!({"font": fam})),
+            }
         }
         let opts: Vec<(String, String)> = styles(&fam).into_iter().map(|s| (s.clone(), style_label(&s))).collect();
         let opts_ref: Vec<(String, &str)> = opts.iter().map(|(a, b)| (a.clone(), b.as_str())).collect();
@@ -244,7 +253,7 @@ pub(super) fn kerning_field(ui: &mut egui::Ui, shown: &str, width: f32) -> Optio
         }
         let presets = ["Metrics", "Optical", "0", "-100", "-75", "-50", "-25", "-10", "-5", "5", "10", "25", "50", "75", "100", "200"];
         let (press, close) = crate::press_menu::PressCombo::before(ui, "props-kern-presets");
-        let combo = egui::ComboBox::from_id_salt("props-kern-presets")
+        let combo = craft_ui::ComboBox::from_id_salt("props-kern-presets")
             .selected_text("")
             .width(16.0)
             .height(420.0)
diff --git a/crates/ui-egui/src/tools/type_tool/overlay.rs b/crates/ui-egui/src/tools/type_tool/overlay.rs
index 31a6022df3..fbac016e3d 100644
--- a/crates/ui-egui/src/tools/type_tool/overlay.rs
+++ b/crates/ui-egui/src/tools/type_tool/overlay.rs
@@ -1,7 +1,7 @@
 use super::editing::edit_home;
 use super::ime_edit::{ime_offsets, ime_preedit_is_current};
 use super::layout::layout;
-use super::*;
+use super::{Color32, LayerId, PhotocraftApp, Point, Pos2, Stroke, ViewXform, byte_of, text_layer};
 
 /// Selection highlight, caret and text frame over the canvas.
 pub fn draw_overlay(app: &mut PhotocraftApp, painter: &egui::Painter, xf: &ViewXform) {
diff --git a/crates/ui-egui/src/tools/type_tool/panel.rs b/crates/ui-egui/src/tools/type_tool/panel.rs
index 53e1ed31d1..09ebeb70c9 100644
--- a/crates/ui-egui/src/tools/type_tool/panel.rs
+++ b/crates/ui-egui/src/tools/type_tool/panel.rs
@@ -3,7 +3,7 @@ use super::fonts::{axis_sliders, font_picker, fonts_ready, selected_style, style
 use super::options_bar::{
     align_glyph, apply_kerning, direction_glyph, direction_items, icon_label, kerning_at, kerning_field, kerning_label, num_field, styles_at, toggle_cell,
 };
-use super::*;
+use super::{Color32, LayerId, PhotocraftApp, Stroke, json, text_layer};
 
 /// The Character panel's OpenType buttons, in Photoshop's order: (feature tag, command id,
 /// tooltip). The tooltips are the Type › OpenType menu labels.
@@ -117,6 +117,86 @@ fn cell_width(avail: f32, n: usize) -> f32 {
     ((avail - (n - 1.0) * 2.0) / n).floor().max(20.0)
 }
 
+/// The reference application's Character panel size list (points); Leading offers Auto, then
+/// the same values. The reference app's options bar offers the same size list.
+pub(crate) const SIZE_PRESETS: [f32; 17] = [6.0, 8.0, 9.0, 10.0, 11.0, 12.0, 14.0, 16.0, 18.0, 24.0, 30.0, 36.0, 48.0, 60.0, 72.0, 150.0, 300.0];
+/// Tracking presets (1/1000 em), in groups split by separators: tightening, none, loosening.
+const TRACKING_PRESETS: [&[f32]; 3] = [&[-100.0, -75.0, -50.0, -25.0, -10.0, -5.0], &[0.0], &[5.0, 10.0, 25.0, 50.0, 75.0, 100.0, 200.0]];
+
+/// What a [`metric_field`] produced: a typed value in the display unit, a preset in the model's
+/// unit (points; converting it through the display unit and back would store 12.000001), or Auto.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum MetricChoice {
+    Typed(f32),
+    Preset(f32),
+    Auto,
+}
+
+/// A preset as the list shows it: the value in the display unit, at most two decimals.
+fn preset_label(v: f32, unit: &str) -> String {
+    let n = format!("{v:.2}");
+    let n = n.trim_end_matches('0').trim_end_matches('.');
+    let n = if n == "-0" { "0" } else { n };
+    if unit.is_empty() { n.to_owned() } else { format!("{n} {unit}") }
+}
+
+/// A Character panel [`num_field`] with a preset chevron in the same cell, which still ends at
+/// the column's right edge. The value stays editable: presets are shortcuts, not limits.
+/// `presets` are groups of model values (split by separators), shown multiplied by `u`; `auto`
+/// adds an Auto item first (`Some(true)` when Auto is current).
+#[allow(clippy::too_many_arguments)]
+fn metric_field(
+    ui: &mut egui::Ui,
+    (label, tip, menu): (&str, &str, &str),
+    value: f32,
+    range: std::ops::RangeInclusive<f32>,
+    (u, unit): (f32, &str),
+    width: f32,
+    presets: &[&[f32]],
+    auto: Option<bool>,
+) -> Option<MetricChoice> {
+    let sp = ui.spacing().clone();
+    let pad = sp.button_padding.x;
+    let combo_w = (sp.icon_spacing + sp.icon_width).max(16.0 - 2.0 * pad) + 2.0 * pad;
+    let mut chosen = None;
+    ui.horizontal(|ui| {
+        ui.spacing_mut().item_spacing.x = 0.0;
+        if let Some(v) = num_field(ui, label, tip, value, range, unit, (width - combo_w).max(24.0)) {
+            chosen = Some(MetricChoice::Typed(v));
+        }
+        let near = |p: f32| (p * u - value).abs() <= 1e-4 * value.abs().max(1.0);
+        let (press, close) = crate::press_menu::PressCombo::before(ui, menu);
+        let combo = craft_ui::ComboBox::from_id_salt(menu)
+            .selected_text("")
+            .width(combo_w)
+            .height(420.0)
+            .icon(crate::widgets::chevron_icon)
+            .close_behavior(close)
+            .show_ui(ui, |ui| {
+                if let Some(on) = auto {
+                    let item = ui.selectable_label(on, tl!("Auto"));
+                    if press.chosen(ui, &item) {
+                        chosen = Some(MetricChoice::Auto);
+                    }
+                }
+                for (i, group) in presets.iter().enumerate() {
+                    if i > 0 {
+                        ui.separator();
+                    }
+                    for &p in *group {
+                        let item = ui.selectable_label(auto != Some(true) && near(p), preset_label(p * u, unit));
+                        if press.chosen(ui, &item) {
+                            chosen = Some(MetricChoice::Preset(p));
+                        }
+                    }
+                }
+            });
+        press.after(&combo.response);
+        combo.response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::ComboBox, ui.is_enabled(), tl!(menu)));
+    });
+    chosen
+}
+
 /// Properties panel sections for a type layer: Character, Paragraph and Type Options (#155).
 pub fn type_properties(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     type_sections(app, ui, true, true, false);
@@ -153,10 +233,16 @@ fn type_sections(app: &mut PhotocraftApp, ui: &mut egui::Ui, character: bool, pa
         let mut ready = true;
         row(ui, &mut |ui| {
             ready = fonts_ready(ui, full);
-            if ready && font_picker(ui, &mut fam, full, app.session.prefs().type_.font_preview, &app.ui.recent_fonts) {
-                app.note_recent_font(&fam);
+            if ready && let Some(picked) = font_picker(app, ui, &mut fam, full) {
                 app.ui.tool_options.type_font = fam.clone();
-                apply(app, ui.ctx(), json!({"font": fam}));
+                match picked {
+                    Some(style) => {
+                        // New type takes the style too, as from the options bar's menu.
+                        app.ui.tool_options.type_style = style.clone();
+                        apply(app, ui.ctx(), json!({"font": fam, "fontStyle": style}));
+                    }
+                    None => apply(app, ui.ctx(), json!({"font": fam})),
+                }
             }
         });
         row(ui, &mut |ui| {
@@ -175,13 +261,24 @@ fn type_sections(app: &mut PhotocraftApp, ui: &mut egui::Ui, character: bool, pa
             let k = shown_scale(app);
             // Hover tips stay English until wired through `tl!` in a multi-locale change
             // (`every_tl_literal_is_translated` requires every complete catalog).
-            if let Some(v) = num_field(ui, "tT", "Font size", c.size_pt * k * u, 0.1 * u..=1296.0 * u, unit, w) {
-                app.ui.tool_options.type_size = v / u;
-                apply(app, ui.ctx(), json!({"size": v / u, "metricsAsShown": true}));
+            let size =
+                metric_field(ui, ("tT", "Font size", "Font size presets"), c.size_pt * k * u, 0.1 * u..=1296.0 * u, (u, unit), w, &[&SIZE_PRESETS], None);
+            if let Some(pt) = match size {
+                Some(MetricChoice::Typed(v)) => Some(v / u),
+                Some(MetricChoice::Preset(pt)) => Some(pt),
+                _ => None,
+            } {
+                app.ui.tool_options.type_size = pt;
+                apply(app, ui.ctx(), json!({"size": pt, "metricsAsShown": true}));
             }
             let lead = c.leading_pt.unwrap_or(c.size_pt * para.auto_leading.max(0.01)) * k;
-            if let Some(v) = num_field(ui, "A↕", "Leading (set to the font size × auto-leading when Auto)", lead * u, 0.1 * u..=5000.0 * u, unit, w) {
-                apply(app, ui.ctx(), json!({"leading": v / u, "metricsAsShown": true}));
+            let tip = "Leading (set to the font size × auto-leading when Auto)";
+            match metric_field(ui, ("A↕", tip, "Leading presets"), lead * u, 0.1 * u..=5000.0 * u, (u, unit), w, &[&SIZE_PRESETS], Some(c.leading_pt.is_none()))
+            {
+                Some(MetricChoice::Typed(v)) => apply(app, ui.ctx(), json!({"leading": v / u, "metricsAsShown": true})),
+                Some(MetricChoice::Preset(pt)) => apply(app, ui.ctx(), json!({"leading": pt, "metricsAsShown": true})),
+                Some(MetricChoice::Auto) => apply(app, ui.ctx(), json!({"leading": "auto"})),
+                None => {}
             }
         });
         row(ui, &mut |ui| {
@@ -193,7 +290,9 @@ fn type_sections(app: &mut PhotocraftApp, ui: &mut egui::Ui, character: bool, pa
                     apply_kerning(app, ui.ctx(), v);
                 }
             });
-            if let Some(v) = num_field(ui, "VA", "Tracking (1/1000 em)", c.tracking, -1000.0..=10000.0, "", w) {
+            if let Some(MetricChoice::Typed(v) | MetricChoice::Preset(v)) =
+                metric_field(ui, ("VA", "Tracking (1/1000 em)", "Tracking presets"), c.tracking, -1000.0..=10000.0, (1.0, ""), w, &TRACKING_PRESETS, None)
+            {
                 apply(app, ui.ctx(), json!({"tracking": v}));
             }
         });
diff --git a/crates/ui-egui/src/tools/type_tool/pointer.rs b/crates/ui-egui/src/tools/type_tool/pointer.rs
index 2249907954..39cce1c91c 100644
--- a/crates/ui-egui/src/tools/type_tool/pointer.rs
+++ b/crates/ui-egui/src/tools/type_tool/pointer.rs
@@ -1,7 +1,7 @@
 use super::defaults::default_style_params;
 use super::editing::{begin_edit, commit_with};
 use super::layout::{hit_layer, hit_offset, layout, to_text};
-use super::*;
+use super::{BoxResize, LayerId, PLACEHOLDER, PhotocraftApp, Point, TextEdit, TextLayout, active_doc_id, byte_of, current_text, json, session_key, text_layer};
 
 /// Smallest paragraph box a handle drag leaves, in text-space px.
 pub(super) const MIN_BOX: f32 = 4.0;
diff --git a/crates/ui-egui/src/tools/vector_ui.rs b/crates/ui-egui/src/tools/vector_ui.rs
index 60ee51c676..c86ad3a1cd 100644
--- a/crates/ui-egui/src/tools/vector_ui.rs
+++ b/crates/ui-egui/src/tools/vector_ui.rs
@@ -2,7 +2,9 @@
 //! Direct Selection (A) lives in `direct_select`.
 //! All edits go through the engine's `shape.*` / `path.*` commands.
 
-use egui::{Color32, Pos2, Rect, Sense, Stroke, pos2, vec2};
+#[cfg(test)]
+use egui::Pos2;
+use egui::{Color32, Rect, Sense, Stroke, pos2, vec2};
 use photocraft_doc::vector::Path;
 use photocraft_doc::{Document, LayerContent};
 use photocraft_geom::Affine;
@@ -36,8 +38,12 @@ use overlay::{MAX_CURVE_PIECES, bezier};
 #[cfg(test)]
 pub(crate) use overlay::{curve_points, path_lines, selected_saved_path, shows_anchors};
 pub(crate) use overlay::{draw_anchor, draw_handle, draw_outline};
+#[cfg(test)]
+use path_ops::target_path;
 pub use path_ops::{active_path_name, path_selection_finish, path_to_selection, pick_shape_at, selected_document_path, takes_path_mask, with_active_path};
-pub(crate) use path_ops::{active_shape_path, delete_key_deletes_work_path, free_transform_path, targeted_vector_mask};
+pub(crate) use path_ops::{
+    active_shape_path, active_type_path, delete_key_deletes_work_path, deselect_loaded_path, free_transform_path, targeted_vector_mask, work_path_shown,
+};
 #[cfg(test)]
 use paths_panel::path_context_actions;
 pub use paths_panel::{PathEntry, PathRow, path_rows, paths_footer, paths_panel};
diff --git a/crates/ui-egui/src/tools/vector_ui/curvature.rs b/crates/ui-egui/src/tools/vector_ui/curvature.rs
index 097ad9d207..5506beb8f7 100644
--- a/crates/ui-egui/src/tools/vector_ui/curvature.rs
+++ b/crates/ui-egui/src/tools/vector_ui/curvature.rs
@@ -1,5 +1,5 @@
 use super::pen::{cancel_stale, pen_commit};
-use super::*;
+use super::{PenPath, PhotocraftApp};
 
 /// Recompute a Curvature Pen path's handles from its anchors and corner points.
 pub(super) fn curvature_refresh(pen: &mut PenPath, closed: bool) {
diff --git a/crates/ui-egui/src/tools/vector_ui/options.rs b/crates/ui-egui/src/tools/vector_ui/options.rs
index 1147810733..e87dd825d9 100644
--- a/crates/ui-egui/src/tools/vector_ui/options.rs
+++ b/crates/ui-egui/src/tools/vector_ui/options.rs
@@ -1,6 +1,6 @@
 use super::path_ops::active_path_name;
 use super::shapes::is_shape_tool;
-use super::*;
+use super::{GradientChoices, LayerContent, PaintChange, PhotocraftApp, Tokens, Tool, Value, json, paint_param, swatch};
 
 // ---------------------------------------------------------------------------------------------
 // Options bars
diff --git a/crates/ui-egui/src/tools/vector_ui/overlay.rs b/crates/ui-egui/src/tools/vector_ui/overlay.rs
index b0bdbe3221..7e2b6ab4e6 100644
--- a/crates/ui-egui/src/tools/vector_ui/overlay.rs
+++ b/crates/ui-egui/src/tools/vector_ui/overlay.rs
@@ -1,7 +1,14 @@
 use super::curvature::curvature_refresh;
-use super::path_ops::targeted_vector_mask;
+use super::path_ops::{active_type_path, targeted_vector_mask, work_path_shown_in};
 use super::pen::{closing, over_first_anchor, shift_45};
-use super::*;
+use egui::{Color32, Pos2, Rect, Stroke, pos2, vec2};
+use photocraft_doc::vector::Path;
+use photocraft_doc::{Document, LayerContent};
+
+use crate::PhotocraftApp;
+use crate::canvas::ViewXform;
+use crate::state::Tool;
+use crate::theme::Tokens;
 
 // ---------------------------------------------------------------------------------------------
 // Drawing
@@ -147,7 +154,7 @@ pub fn draw_overlay(app: &PhotocraftApp, painter: &egui::Painter, xf: &ViewXform
         // a path tool is active, as in Photoshop: a Work Path left unselected (one a PSD arrived
         // with, or after Ctrl-click Load as Selection) would otherwise cover the marching ants (#6551).
         let anchors = shows_anchors(tool);
-        if let Some(wp) = &doc.work_path
+        if let Some(wp) = doc.work_path.as_ref().filter(|_| work_path_shown_in(app, doc))
             && (anchors || app.ui.selected_path.as_deref() == Some("work"))
         {
             draw_path(wp, anchors);
@@ -166,6 +173,10 @@ pub fn draw_overlay(app: &PhotocraftApp, painter: &egui::Painter, xf: &ViewXform
         if let Some((_, p)) = targeted_vector_mask(app) {
             draw_path(&p, anchors);
         }
+        // So does type on a path's Type Path, which the Pen's Auto Add/Delete edits (#9114).
+        if let Some((_, p)) = active_type_path(app) {
+            draw_path(&p, anchors);
+        }
         crate::corner_radius::draw(app, painter, &to_scr, accent);
     }
     // Pen path in progress, with handles of the last knot and a rubber band to the pointer. While
diff --git a/crates/ui-egui/src/tools/vector_ui/path_ops.rs b/crates/ui-egui/src/tools/vector_ui/path_ops.rs
index db9847aeca..a0f3ca4e6d 100644
--- a/crates/ui-egui/src/tools/vector_ui/path_ops.rs
+++ b/crates/ui-egui/src/tools/vector_ui/path_ops.rs
@@ -1,9 +1,10 @@
 use super::paths_panel::{PathEntry, PathRow, path_rows};
 use super::pen::pen_commit;
-use super::*;
+use super::{Affine, Document, LayerContent, Path, PhotocraftApp, Tool, Value, json};
 
 /// The path that path commands act on without a name: the one selected in the Paths panel, else
-/// the work path, else the selected layer's shape path or vector mask; `None` when there's none.
+/// the work path while it is shown (not after Make Selection hid it, #6079), else the selected
+/// layer's shape path or vector mask; `None` when there's none.
 pub fn active_path_name(app: &PhotocraftApp) -> Option<String> {
     let st = app.session.active()?;
     let rows = path_rows(&st.doc, st.active_layer);
@@ -13,7 +14,8 @@ pub fn active_path_name(app: &PhotocraftApp) -> Option<String> {
         PathRow::Saved => r.name.clone(),
     };
     let selected = app.ui.selected_path.as_deref().filter(|s| rows.iter().any(|r| key(r) == *s)).map(str::to_string);
-    selected.or_else(|| rows.iter().find(|r| r.kind == PathRow::Work).map(key)).or_else(|| rows.iter().find(|r| r.kind == PathRow::Layer).map(key))
+    let work = rows.iter().find(|r| r.kind == PathRow::Work).filter(|_| work_path_shown(app)).map(key);
+    selected.or(work).or_else(|| rows.iter().find(|r| r.kind == PathRow::Layer).map(key))
 }
 
 /// The commands that create a fill or adjustment layer and take a `"path"` as its vector mask.
@@ -65,14 +67,51 @@ pub fn path_to_selection(app: &mut PhotocraftApp, params: Value) -> Result<Value
         .ok_or_else(|| tl!("No path to make a selection from: draw one with the Pen tool or select one in the Paths panel.").to_string())?;
     let mut p = params.as_object().cloned().unwrap_or_default();
     p.insert("name".into(), json!(name));
-    app.run("path.toSelection", Value::Object(p))
+    let r = app.run("path.toSelection", Value::Object(p))?;
+    deselect_loaded_path(app, &name);
+    Ok(r)
+}
+
+/// After the Pen or Path Selection tool made a selection from the path `name` (⌘↩, the canvas
+/// menu's Make Selection…), Photoshop deselects it in the Paths panel and stops drawing it; the
+/// path itself stays (#6079). The Work Path is hidden too when a saved path was loaded, so no
+/// path is the target path afterwards. A shape layer's path or vector mask (`"layer"`) stays the active
+/// path, so layer targeting is unchanged.
+pub(crate) fn deselect_loaded_path(app: &mut PhotocraftApp, name: &str) {
+    if name == "layer" {
+        return;
+    }
+    app.ui.selected_path = None;
+    // Whichever path was loaded, nothing is the target path afterwards: a shown Work Path would
+    // otherwise become the active path (a second ⌘↩ or the canvas menu's Delete Path acting on it).
+    app.ui.hidden_work_path = app.session.active().and_then(|st| st.doc.work_path.clone().map(|p| (st.doc.id.0, p)));
+}
+
+/// Is the active document's Work Path drawn and edited on the canvas? Not after
+/// [`deselect_loaded_path`] hid it, until the Work Path is selected again in the Paths panel (which
+/// ends the hide; a saved path or a layer's path doesn't show it) or it changes (a new one drawn, Make Work Path,
+/// `path.set`…) (#6079).
+pub(crate) fn work_path_shown(app: &PhotocraftApp) -> bool {
+    app.session.active().is_none_or(|st| work_path_shown_in(app, &st.doc))
+}
+
+/// [`work_path_shown`] for `doc`, which the canvas may draw while another document is already
+/// active (the frame a click into another arranged tile activates it). The Paths panel's
+/// selection belongs to the active document only.
+pub(crate) fn work_path_shown_in(app: &PhotocraftApp, doc: &Document) -> bool {
+    let active = app.session.active().is_some_and(|st| st.doc.id == doc.id);
+    if active && app.ui.selected_path.as_deref() == Some("work") {
+        return true;
+    }
+    let Some((id, hidden)) = &app.ui.hidden_work_path else { return true };
+    doc.id.0 != *id || doc.work_path.as_ref() != Some(hidden)
 }
 
 // ---------------------------------------------------------------------------------------------
 // Path Selection
 
 /// What Path Selection edits.
-enum PathTarget {
+pub(super) enum PathTarget {
     Shape(u64),
     /// The active layer's vector mask, when its Layers thumbnail is targeted (#196).
     VectorMask(u64),
@@ -88,6 +127,16 @@ pub(crate) fn targeted_vector_mask(app: &PhotocraftApp) -> Option<(u64, Path)> {
     l.vector_mask.as_ref().map(|m| (l.id.0, m.path.clone()))
 }
 
+/// The active type layer's path in document space, if it is type on a path (#9114).
+pub(crate) fn active_type_path(app: &PhotocraftApp) -> Option<(u64, Path)> {
+    let st = app.session.active()?;
+    let l = st.active_layer.and_then(|id| st.doc.layer(id))?;
+    match &l.content {
+        LayerContent::Text(t) => photocraft_engine::type_extra_cmds::type_path(t).map(|p| (l.id.0, p)),
+        _ => None,
+    }
+}
+
 /// The active shape layer's path, if the active layer is a shape layer.
 pub(crate) fn active_shape_path(app: &PhotocraftApp) -> Option<(u64, Path)> {
     let st = app.session.active()?;
@@ -113,13 +162,16 @@ pub(crate) fn delete_key_deletes_work_path(app: &PhotocraftApp) -> bool {
 
 /// The path Path Selection edits: the targeted vector mask, the active shape layer's path, else
 /// the work path.
-fn target_path(app: &PhotocraftApp) -> Option<(PathTarget, Path)> {
+pub(super) fn target_path(app: &PhotocraftApp) -> Option<(PathTarget, Path)> {
     if let Some((id, p)) = targeted_vector_mask(app) {
         return Some((PathTarget::VectorMask(id), p));
     }
     if let Some((id, p)) = active_shape_path(app) {
         return Some((PathTarget::Shape(id), p));
     }
+    if !work_path_shown(app) {
+        return None;
+    }
     app.session.active()?.doc.work_path.clone().map(|p| (PathTarget::Work, p))
 }
 
diff --git a/crates/ui-egui/src/tools/vector_ui/path_selection_tests.rs b/crates/ui-egui/src/tools/vector_ui/path_selection_tests.rs
index a5d4ee035a..8cab12747a 100644
--- a/crates/ui-egui/src/tools/vector_ui/path_selection_tests.rs
+++ b/crates/ui-egui/src/tools/vector_ui/path_selection_tests.rs
@@ -74,6 +74,9 @@ fn cmd_enter_while_drawing_finishes_the_path_and_loads_it() {
     assert!(app.ui.pen.is_none(), "the pen path was finished");
     assert!(app.session.active().unwrap().doc.work_path.is_some(), "into the work path");
     assert!(app.session.active().unwrap().doc.selection.is_some(), "and loaded as a selection: {}", app.ui.status);
+    // Then deselected and no longer drawn, as in Photoshop; the work path stays (#6079).
+    assert_eq!(app.ui.selected_path, None);
+    assert!(!crate::vector_ui::work_path_shown(app));
     // Plain ↩ still only finishes a path.
     let mut h = harness();
     h.state_mut().ui.tool = Tool::Pen;
@@ -84,6 +87,60 @@ fn cmd_enter_while_drawing_finishes_the_path_and_loads_it() {
     assert!(h.state().session.active().unwrap().doc.selection.is_none());
 }
 
+#[test]
+fn selecting_a_saved_path_keeps_the_hidden_work_path_hidden() {
+    // #6079 review: only selecting the Work Path in the Paths panel shows it again.
+    let mut h = harness();
+    h.state_mut().run("path.set", json!({"name": "Saved", "path": rect_path(100.0, 40.0, 60.0, 50.0)})).unwrap();
+    h.state_mut().ui.tool = Tool::Pen;
+    let p = |x: f64, y: f64| [[x, y], [x, y], [x, y]];
+    h.state_mut().ui.pen = Some(PenPath { knots: vec![p(20.0, 20.0), p(120.0, 20.0), p(120.0, 80.0)], ..Default::default() });
+    h.run_steps(2);
+    press(&mut h, Key::Enter, command());
+    assert!(!crate::vector_ui::work_path_shown(h.state()), "⌘↩ hid the work path");
+    panel(&mut h, 2);
+    let saved = h.get_by_label("Saved").rect();
+    click(&mut h, egui::pos2(saved.left() + 70.0, saved.center().y), Modifiers::NONE);
+    assert_eq!(h.state().ui.selected_path.as_deref(), Some("Saved"));
+    assert!(!crate::vector_ui::work_path_shown(h.state()), "a saved path doesn't show the Work Path");
+    // So Delete with the Pen doesn't delete the invisible work path either.
+    press(&mut h, Key::Delete, Modifiers::NONE);
+    assert!(h.state().session.active().unwrap().doc.work_path.is_some(), "the hidden work path survives Delete");
+    // Selecting the Work Path shows it; now Delete deletes it.
+    let work = h.get_by_label("Work Path").rect();
+    click(&mut h, egui::pos2(work.left() + 70.0, work.center().y), Modifiers::NONE);
+    assert_eq!(h.state().ui.selected_path.as_deref(), Some("work"));
+    assert!(crate::vector_ui::work_path_shown(h.state()), "selecting the Work Path shows it");
+    press(&mut h, Key::Delete, Modifiers::NONE);
+    assert!(h.state().session.active().unwrap().doc.work_path.is_none(), "{}", h.state().ui.status);
+}
+
+#[test]
+fn reselecting_the_hidden_work_path_ends_the_hide() {
+    // #6079 review: once the Work Path is selected again in the Paths panel, deselecting it there
+    // leaves an ordinary unselected Work Path (drawn and edited with a path tool, #6551), not the
+    // hidden one from before.
+    let mut h = harness();
+    h.state_mut().ui.tool = Tool::Pen;
+    let p = |x: f64, y: f64| [[x, y], [x, y], [x, y]];
+    h.state_mut().ui.pen = Some(PenPath { knots: vec![p(20.0, 20.0), p(120.0, 20.0), p(120.0, 80.0)], ..Default::default() });
+    h.run_steps(2);
+    press(&mut h, Key::Enter, command());
+    assert!(!crate::vector_ui::work_path_shown(h.state()), "⌘↩ hid the work path");
+    panel(&mut h, 2);
+    let work = h.get_by_label("Work Path").rect();
+    click(&mut h, egui::pos2(work.left() + 70.0, work.center().y), Modifiers::NONE);
+    assert_eq!(h.state().ui.selected_path.as_deref(), Some("work"));
+    // Clicking the panel's empty area deselects it.
+    click(&mut h, egui::pos2(work.left() + 70.0, work.bottom() + 40.0), Modifiers::NONE);
+    assert_eq!(h.state().ui.selected_path, None);
+    assert!(crate::vector_ui::work_path_shown(h.state()), "the unchanged Work Path didn't go back into hiding");
+    assert_eq!(crate::vector_ui::active_path_name(h.state()).as_deref(), Some("work"));
+    // So Delete with the Pen deletes it, like any unselected Work Path.
+    press(&mut h, Key::Delete, Modifiers::NONE);
+    assert!(h.state().session.active().unwrap().doc.work_path.is_none(), "{}", h.state().ui.status);
+}
+
 #[test]
 fn cmd_enter_loads_the_path_selected_in_the_paths_panel() {
     let mut h = harness();
@@ -95,13 +152,36 @@ fn cmd_enter_loads_the_path_selected_in_the_paths_panel() {
     h.run_steps(2);
     press(&mut h, Key::Enter, command());
     assert_eq!(selection(&h), Some([100, 40, 60, 50]), "{}", h.state().ui.status);
-    // A selected path that went away falls back to the work path.
+    // A selected path that went away falls back to the work path once that is selected again.
     h.state_mut().run("path.delete", json!({"name": "Path 1"})).unwrap();
     h.state_mut().run("select.deselect", json!({})).unwrap();
+    h.state_mut().ui.selected_path = Some("work".into());
     press(&mut h, Key::Enter, command());
     assert_eq!(selection(&h), Some([0, 0, 30, 30]));
 }
 
+#[test]
+fn cmd_enter_on_a_saved_path_leaves_no_target_path() {
+    // #6079: after loading a saved path nothing is the target path; the shown Work Path must not
+    // take over (a second ⌘↩ or the canvas menu's Delete Path would act on it).
+    let mut h = harness();
+    h.state_mut().run("path.set", json!({"name": "work", "path": rect_path(0.0, 0.0, 30.0, 30.0)})).unwrap();
+    h.state_mut().run("path.set", json!({"name": "Path 1", "path": rect_path(100.0, 40.0, 60.0, 50.0)})).unwrap();
+    h.state_mut().ui.tool = Tool::Pen;
+    h.state_mut().ui.selected_path = Some("Path 1".into());
+    h.run_steps(2);
+    press(&mut h, Key::Enter, command());
+    assert_eq!(selection(&h), Some([100, 40, 60, 50]), "{}", h.state().ui.status);
+    assert_eq!(h.state().ui.selected_path, None);
+    assert_eq!(crate::vector_ui::active_path_name(h.state()), None, "the Work Path didn't become the target path");
+    assert!(!crate::vector_ui::work_path_shown(h.state()), "the Work Path isn't drawn");
+    // A second ⌘↩ has no path to load.
+    h.state_mut().run("select.deselect", json!({})).unwrap();
+    press(&mut h, Key::Enter, command());
+    assert_eq!(selection(&h), None, "the unselected Work Path wasn't loaded");
+    assert!(h.state().session.active().unwrap().doc.work_path.is_some(), "the Work Path stays");
+}
+
 #[test]
 fn without_a_path_it_says_why_and_the_key_can_be_rebound() {
     let mut h = harness();
@@ -367,3 +447,51 @@ fn loading_a_path_after_hiding_extras_restores_outline() {
     assert_eq!(selection(&h), Some([10, 10, 50, 40]));
     assert!(h.state().ui.view.shows(h.state().ui.view.show.selection_edges));
 }
+
+/// #6079 review: in an arranged view, the frame a click into another tile activates its document
+/// still draws the old active document's overlays. The Work Path Make Selection hid there must not
+/// flash up in that frame.
+#[test]
+fn a_hidden_work_path_stays_hidden_when_another_tile_is_clicked() {
+    // Path outlines (accent lines) in the right tile in the frame a click into the left tile makes.
+    let right_outlines_on_switch = |hide: bool| {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        for _ in 0..2 {
+            app.run("file.new", json!({"width": 200, "height": 150})).unwrap();
+        }
+        app.sync_views();
+        app.ui.view.arrange = "tileAllVertically".into();
+        app.ui.tool = Tool::Pen;
+        app.run("path.set", json!({"name": "work", "path": rect_path(40.0, 30.0, 100.0, 80.0)})).unwrap();
+        crate::vector_ui::path_to_selection(&mut app, json!({})).unwrap();
+        app.run("select.deselect", json!({})).unwrap();
+        assert!(!crate::vector_ui::work_path_shown(&app), "Make Selection hid the second document's Work Path");
+        if !hide {
+            app.ui.hidden_work_path = None;
+        }
+        let mut h = Harness::builder().with_size(vec2(1000.0, 600.0)).build_ui_state(
+            |ui, app: &mut PhotocraftApp| {
+                if !ui.ctx().fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
+                    return;
+                }
+                egui::CentralPanel::default().show(ui, |ui| crate::canvas::document_area(app, ui));
+            },
+            app,
+        );
+        PhotocraftApp::setup_context(&h.ctx, crate::theme::ThemeKind::ALL[0]);
+        h.run_steps(4);
+        let area = h.state().last_canvas_rect;
+        let at = egui::pos2(area.left() + area.width() / 4.0, area.center().y);
+        h.event(Event::PointerMoved(at));
+        h.event(Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+        h.run_steps(1);
+        assert_eq!(h.state().session.active_index(), Some(0), "the click activated the left document");
+        let accent = crate::theme::Tokens::get(&h.ctx).accent;
+        let outlines = h.output().shapes.iter().filter(|s| {
+            matches!(&s.shape, egui::Shape::Path(p) if p.stroke.color == egui::epaint::ColorMode::Solid(accent) && p.visual_bounding_rect().min.x > area.center().x)
+        });
+        outlines.count()
+    };
+    assert!(right_outlines_on_switch(false) > 0, "a shown Work Path is drawn in that frame");
+    assert_eq!(right_outlines_on_switch(true), 0, "the hidden one isn't");
+}
diff --git a/crates/ui-egui/src/tools/vector_ui/paths_panel.rs b/crates/ui-egui/src/tools/vector_ui/paths_panel.rs
index 09daf57dba..1d02f3fdd7 100644
--- a/crates/ui-egui/src/tools/vector_ui/paths_panel.rs
+++ b/crates/ui-egui/src/tools/vector_ui/paths_panel.rs
@@ -1,6 +1,6 @@
 use super::overlay::path_lines;
 use super::shapes::hex;
-use super::*;
+use super::{Color32, Document, LayerContent, Path, PhotocraftApp, Rect, Sense, Stroke, Tokens, Value, json, pos2, vec2};
 
 // ---------------------------------------------------------------------------------------------
 // Paths panel
@@ -265,6 +265,11 @@ pub fn paths_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                     };
                     action = Some(("path.toSelection", json!({"name": key, "mode": mode})));
                 } else if resp.clicked() {
+                    // Selecting the Work Path ends the hide from Make Selection (#6079): deselected
+                    // again, it is an ordinary unselected Work Path (#6551).
+                    if *kind == PathRow::Work {
+                        app.ui.hidden_work_path = None;
+                    }
                     app.ui.selected_path = Some(key.clone());
                 }
                 // As in Photoshop, double-clicking a saved path's name renames it, and double-clicking
diff --git a/crates/ui-egui/src/tools/vector_ui/pen.rs b/crates/ui-egui/src/tools/vector_ui/pen.rs
index dfecf1330a..56b6d79449 100644
--- a/crates/ui-egui/src/tools/vector_ui/pen.rs
+++ b/crates/ui-egui/src/tools/vector_ui/pen.rs
@@ -1,7 +1,7 @@
 use super::curvature::{curvature_hit, curvature_refresh};
-use super::path_ops::targeted_vector_mask;
+use super::path_ops::{targeted_vector_mask, work_path_shown};
 use super::shapes::{fill_param, stroke_param};
-use super::*;
+use super::{Document, Path, PenPath, PhotocraftApp, Resumed, Tool, Value, json};
 
 // ---------------------------------------------------------------------------------------------
 // Pen
@@ -408,6 +408,10 @@ fn resume_at(app: &PhotocraftApp, x: f64, y: f64, tol: f64) -> Option<PenPath> {
     let st = app.session.active()?;
     let doc = st.doc.id.0;
     let name = app.ui.selected_path.clone().filter(|n| path_exists(&st.doc, n)).unwrap_or_else(|| "work".into());
+    // A Work Path hidden by Make Selection isn't carried on: a new path replaces it (#6079).
+    if name == "work" && !work_path_shown(app) {
+        return None;
+    }
     let near = |k: &photocraft_doc::Knot| (k.anchor.x - x).hypot(k.anchor.y - y) < tol;
     doc_path(&st.doc, &name)?.subpaths.iter().enumerate().filter(|(_, s)| !s.closed).find_map(|(i, s)| {
         let reversed = if s.knots.last().is_some_and(near) {
diff --git a/crates/ui-egui/src/tools/vector_ui/shapes.rs b/crates/ui-egui/src/tools/vector_ui/shapes.rs
index d931d1ca5b..dc72a120f0 100644
--- a/crates/ui-egui/src/tools/vector_ui/shapes.rs
+++ b/crates/ui-egui/src/tools/vector_ui/shapes.rs
@@ -1,6 +1,6 @@
 use super::options::solid_paint;
 use super::overlay::path_lines;
-use super::*;
+use super::{Affine, Color32, PhotocraftApp, Tokens, Tool, ToolOptions, Value, ViewXform, json, paint_param};
 
 pub fn is_shape_tool(t: Tool) -> bool {
     matches!(t, Tool::Rectangle | Tool::EllipseShape | Tool::Triangle | Tool::Polygon | Tool::Line | Tool::CustomShape)
diff --git a/crates/ui-egui/src/tools/vector_ui/tests.rs b/crates/ui-egui/src/tools/vector_ui/tests.rs
index 06ff83f348..31de3650e9 100644
--- a/crates/ui-egui/src/tools/vector_ui/tests.rs
+++ b/crates/ui-egui/src/tools/vector_ui/tests.rs
@@ -285,6 +285,19 @@ fn an_unselected_work_path_is_not_drawn_over_the_canvas() {
     }
 }
 
+/// #9114: the active type layer's Type Path shows with the Pen, whose Auto Add/Delete edits it.
+#[test]
+fn the_type_path_of_type_on_a_path_is_drawn_with_the_pen() {
+    let ctx = egui::Context::default();
+    let mut app = app();
+    app.run("path.set", json!({"name": "work", "path": {"subpaths": [{"closed": false, "knots": [[100, 20], [100, 180]]}]}})).unwrap();
+    app.run("type.create", json!({"x": 20, "y": 70, "text": "On a path", "size": 24})).unwrap();
+    app.run("type.attachToPath", json!({})).unwrap();
+    app.run("path.delete", json!({"name": "work"})).unwrap();
+    app.ui.tool = Tool::Pen;
+    assert!(overlay_shapes(&app, &ctx) > 0, "the Type Path is drawn");
+}
+
 #[test]
 fn show_target_path_and_extras_hide_the_path_outlines() {
     // #1119: View › Show › Target Path only flipped its checkmark; the canvas kept drawing the
@@ -321,6 +334,61 @@ fn show_target_path_and_extras_hide_the_path_outlines() {
     assert!(overlay_shapes(&app, &ctx) > 0, "the pen path in progress is still drawn");
 }
 
+#[test]
+fn making_a_selection_from_the_pen_path_deselects_and_hides_it() {
+    // #6079: after ⌘↩ the work path's outline stayed on the canvas; Photoshop deselects it.
+    let ctx = egui::Context::default();
+    let mut app = app();
+    app.ui.tool = Tool::Pen;
+    app.ui.pen = Some(PenPath { knots: vec![[[20.0, 20.0]; 3], [[120.0, 20.0]; 3], [[120.0, 80.0]; 3]], ..Default::default() });
+    path_to_selection(&mut app, json!({})).unwrap();
+    let st = app.session.active().unwrap();
+    assert!(st.doc.selection.is_some(), "the selection is made");
+    assert!(st.doc.work_path.is_some(), "the work path is kept");
+    assert_eq!(app.ui.selected_path, None, "and deselected in the Paths panel");
+    assert_eq!(overlay_shapes(&app, &ctx), 0, "so the canvas no longer draws it");
+    assert!(target_path(&app).is_none() && !delete_key_deletes_work_path(&app), "nor edits or deletes it");
+    // Undo removes the selection; the path stays.
+    app.run("edit.undo", json!({})).unwrap();
+    assert!(app.session.active().unwrap().doc.work_path.is_some());
+    assert!(app.session.active().unwrap().doc.selection.is_none());
+    assert_eq!(overlay_shapes(&app, &ctx), 0, "still hidden");
+    // Selecting a saved path in the Paths panel doesn't show it; only the Work Path does.
+    let saved = json!({"subpaths": [{"closed": true, "knots": [{"anchor": [60, 60]}, {"anchor": [90, 60]}, {"anchor": [90, 90]}]}]});
+    app.run("path.set", json!({"name": "Saved", "path": saved})).unwrap();
+    app.ui.selected_path = Some("Saved".into());
+    // The selected saved path is drawn (#6550), the hidden Work Path isn't.
+    let saved_only = overlay_shapes(&app, &ctx);
+    assert!(!work_path_shown(&app) && saved_only > 0, "a saved path keeps the Work Path hidden");
+    let hidden = app.ui.hidden_work_path.take();
+    assert!(overlay_shapes(&app, &ctx) > saved_only, "the Work Path adds its own outline when shown");
+    app.ui.hidden_work_path = hidden;
+    app.ui.selected_path = None;
+    // Another Work Path made any other way (Make Work Path, `path.set` over the control
+    // channel…) is a different path: it shows without being selected.
+    let other = json!({"subpaths": [{"closed": true, "knots": [{"anchor": [5, 5]}, {"anchor": [50, 5]}, {"anchor": [50, 50]}]}]});
+    app.run("path.set", json!({"name": "work", "path": other})).unwrap();
+    assert_eq!(app.ui.selected_path, None);
+    assert!(work_path_shown(&app) && overlay_shapes(&app, &ctx) > 0, "a changed Work Path is shown");
+    // Selecting it in the Paths panel shows it again.
+    app.ui.selected_path = Some("work".into());
+    assert!(overlay_shapes(&app, &ctx) > 0);
+    // A new path drawn after the deselect replaces the work path and is shown.
+    path_to_selection(&mut app, json!({})).unwrap();
+    assert_eq!(overlay_shapes(&app, &ctx), 0);
+    app.ui.pen = Some(PenPath { knots: vec![[[10.0, 10.0]; 3], [[40.0, 10.0]; 3]], ..Default::default() });
+    pen_commit(&mut app, false);
+    assert_eq!(app.ui.selected_path.as_deref(), Some("work"));
+    assert_eq!(app.session.active().unwrap().doc.work_path.as_ref().unwrap().subpaths.len(), 1, "replaced, not combined");
+    assert!(overlay_shapes(&app, &ctx) > 0);
+    // A shape layer's path stays the active path: layer targeting is unchanged.
+    app.ui.tool_options.vector_mode = "shape".into();
+    app.ui.pen = Some(PenPath { knots: vec![[[20.0, 20.0]; 3], [[120.0, 20.0]; 3], [[120.0, 80.0]; 3]], ..Default::default() });
+    path_to_selection(&mut app, json!({})).unwrap();
+    assert_eq!(app.ui.selected_path.as_deref(), Some("layer"));
+    assert!(active_shape_path(&app).is_some());
+}
+
 #[test]
 fn the_saved_path_selected_in_the_paths_panel_is_drawn() {
     // #6550: selecting a saved path in the Paths panel drew nothing on the canvas.
diff --git a/crates/ui-egui/src/widgets/angle_dial.rs b/crates/ui-egui/src/widgets/angle_dial.rs
index 7a6c82f6b1..a21b453ded 100644
--- a/crates/ui-egui/src/widgets/angle_dial.rs
+++ b/crates/ui-egui/src/widgets/angle_dial.rs
@@ -2,7 +2,7 @@
 //! Drop Shadow's light (#882), Motion Blur and the other direction angles of the filter
 //! dialogs (#3152) share it, as Photoshop's dialogs do.
 
-use super::*;
+use super::{Response, Sense, Stroke, Tokens, Ui, value_field, vec2};
 
 /// `Label (dial) [field°]` for a direction in document angles: counter-clockwise from three
 /// o'clock, y up. The dial points anywhere in -180..=180; the result is clamped to `range`, and
@@ -61,6 +61,7 @@ pub fn angle_dial_row(ui: &mut Ui, label: &str, angle: &mut f32, range: std::ops
 #[cfg(test)]
 mod tests {
     use super::*;
+    use egui::Vec2;
     use egui_kittest::kittest::Queryable;
 
     fn click(h: &mut egui_kittest::Harness<'_, f32>, delta: Vec2) {
diff --git a/crates/ui-egui/src/widgets/buttons.rs b/crates/ui-egui/src/widgets/buttons.rs
index c6ac810d23..41ad5509bc 100644
--- a/crates/ui-egui/src/widgets/buttons.rs
+++ b/crates/ui-egui/src/widgets/buttons.rs
@@ -1,5 +1,5 @@
 use super::panel::surface;
-use super::*;
+use super::{Color32, Rect, Response, Sense, Stroke, StrokeKind, Tokens, Ui, Vec2, pos2, theme, vec2};
 
 /// iOS-style toggle switch.
 pub fn toggle(ui: &mut Ui, on: &mut bool, label: &str) -> Response {
diff --git a/crates/ui-egui/src/widgets/color.rs b/crates/ui-egui/src/widgets/color.rs
index 0c71e0746a..e246afcded 100644
--- a/crates/ui-egui/src/widgets/color.rs
+++ b/crates/ui-egui/src/widgets/color.rs
@@ -1,5 +1,5 @@
 use super::dropdown::swatch_popup;
-use super::*;
+use super::{Color32, CornerRadius, Pos2, Rect, Response, Sense, Stroke, StrokeKind, Tokens, Ui, Vec2, pos2};
 
 /// Cached RGB data; drawing work is bounded by the 256 display bins, never the image size.
 pub fn rgb_histogram(ui: &mut Ui, histogram: &photocraft_algo::histogram::RgbHistogram, height: f32) -> egui::Response {
diff --git a/crates/ui-egui/src/widgets/color_count.rs b/crates/ui-egui/src/widgets/color_count.rs
index da65928ad7..03da8cf31f 100644
--- a/crates/ui-egui/src/widgets/color_count.rs
+++ b/crates/ui-egui/src/widgets/color_count.rs
@@ -1,6 +1,6 @@
 //! Integer-only Indexed Color field and a linear slider with common palette sizes.
 
-use super::*;
+use super::{Align2, Color32, Rect, Response, Sense, Stroke, StrokeKind, Tokens, Ui, pos2, surface, theme, vec2};
 
 const STOPS: [u32; 6] = [8, 16, 32, 64, 128, 256];
 
@@ -102,6 +102,7 @@ pub fn color_count_row(ui: &mut Ui, label: &str, count: &mut u32) -> Response {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use egui::Pos2;
     use egui_kittest::{Harness, kittest::Queryable};
 
     #[test]
diff --git a/crates/ui-egui/src/widgets/dropdown.rs b/crates/ui-egui/src/widgets/dropdown.rs
index 877e5f7c61..6f83b0edd2 100644
--- a/crates/ui-egui/src/widgets/dropdown.rs
+++ b/crates/ui-egui/src/widgets/dropdown.rs
@@ -1,7 +1,7 @@
 use super::panel::chevron_icon;
 use super::scrub::take_label_scrub_name;
 use super::slider::wheel_notches_of;
-use super::*;
+use super::{Pos2, Rect, Response, Ui, Vec2, type_ahead};
 
 /// A compact labelled dropdown in the studio style.
 pub fn dropdown<T: PartialEq + Clone>(ui: &mut Ui, id: &str, name: &str, current: &mut T, options: &[(T, &str)], width: f32) -> bool {
@@ -64,7 +64,7 @@ fn dropdown_with<T: PartialEq + Clone>(
     let (press, close) = crate::press_menu::PressCombo::before(ui, id);
     let texts: Vec<String> = options.iter().map(|(_, l)| shown(l)).collect();
     let response =
-        egui::ComboBox::from_id_salt(id).selected_text(label).width(width).height(420.0).icon(chevron_icon).close_behavior(close).show_ui(ui, |ui| {
+        craft_ui::ComboBox::from_id_salt(id).selected_text(label).width(width).height(420.0).icon(chevron_icon).close_behavior(close).show_ui(ui, |ui| {
             fit_widest_option(ui, texts.iter().map(|l| l.as_str()));
             // A typed letter jumps to the next option starting with it, ↩ closes the list (#1481).
             let labels: Vec<&str> = texts.iter().map(|l| l.as_str()).collect();
@@ -123,7 +123,7 @@ fn dropdown_with<T: PartialEq + Clone>(
     if wheel && !over_list {
         let stepped = wheel_steps(ui, wheel_id, response.hovered(), current, options);
         wheeled = !stepped.is_empty();
-        if wheeled && egui::ComboBox::is_open(ui.ctx(), response.id) {
+        if wheeled && craft_ui::ComboBox::is_open(ui.ctx(), response.id) {
             ui.data_mut(|d| d.insert_temp(reveal_id, true));
         }
         chosen.extend(stepped);
@@ -184,7 +184,7 @@ fn wheel_steps<T: PartialEq + Clone>(ui: &mut Ui, id: egui::Id, hovered: bool, c
 }
 
 /// Give a dropdown keyboard focus when it opens, then use the arrow keys to move through its
-/// choices. `egui::ComboBox` opens a popup but leaves focus on the canvas by default, which makes
+/// choices. `craft_ui::ComboBox` opens a popup but leaves focus on the canvas by default, which makes
 /// controls such as the Layers panel's Blend Mode dropdown unreachable from the keyboard.
 fn combo_box_arrow_keys<T: PartialEq + Clone>(ui: &mut Ui, response: &Response, current: &mut T, options: &[(T, &str)]) -> bool {
     if response.clicked() {
@@ -192,7 +192,7 @@ fn combo_box_arrow_keys<T: PartialEq + Clone>(ui: &mut Ui, response: &Response,
     }
     // The popup, rather than its button, becomes the focused egui layer after it opens. While it
     // is open it owns its navigation keys, even though `response.has_focus()` is then false.
-    if !egui::ComboBox::is_open(ui.ctx(), response.id) || options.is_empty() {
+    if !craft_ui::ComboBox::is_open(ui.ctx(), response.id) || options.is_empty() {
         return false;
     }
     let step = if ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::ArrowDown)) {
@@ -268,7 +268,7 @@ pub fn dropdown_with_tooltips<T: PartialEq + Clone>(ui: &mut Ui, id: &str, name:
     let mut changed = false;
     let (press, close) = crate::press_menu::PressCombo::before(ui, id);
     let response =
-        egui::ComboBox::from_id_salt(id).selected_text(label).width(width).height(420.0).icon(chevron_icon).close_behavior(close).show_ui(ui, |ui| {
+        craft_ui::ComboBox::from_id_salt(id).selected_text(label).width(width).height(420.0).icon(chevron_icon).close_behavior(close).show_ui(ui, |ui| {
             fit_widest_option(ui, options.iter().map(|(_, l, _)| tl!(l)));
             let labels: Vec<&str> = options.iter().map(|(_, l, _)| tl!(l)).collect();
             let shown = options.iter().position(|(v, _, _)| v == current);
diff --git a/crates/ui-egui/src/widgets/fields.rs b/crates/ui-egui/src/widgets/fields.rs
index 143320e330..439662724e 100644
--- a/crates/ui-egui/src/widgets/fields.rs
+++ b/crates/ui-egui/src/widgets/fields.rs
@@ -3,7 +3,7 @@ use super::scrub::{label_scrub_response, take_label_scrub};
 use super::slider::slider;
 use super::text_field::first_field_id;
 use super::units::{FieldUnits, field_resolution_id, fmt_num, fmt_num_prec, fmt_num2, parse_num_in, plain, unit_of_suffix};
-use super::*;
+use super::{Align2, Color32, Rect, Response, Sense, Stroke, StrokeKind, Tokens, Ui, Vec2, pos2, theme, vec2};
 
 /// Monospace numeric field with a dimmed unit suffix, Photoshop style. Drag to scrub. Typed
 /// arithmetic (`1920/2`) applies on Enter, Tab or click-away, and a unit after a number converts
diff --git a/crates/ui-egui/src/widgets/panel.rs b/crates/ui-egui/src/widgets/panel.rs
index 43c52b1cf4..7833edc2bc 100644
--- a/crates/ui-egui/src/widgets/panel.rs
+++ b/crates/ui-egui/src/widgets/panel.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Color32, CornerRadius, Rect, Response, Sense, Stroke, StrokeKind, Tokens, Ui, pos2, theme, vec2};
 
 /// Match the Spectrum application-menu padding and blue/white hover state in
 /// secondary menus (status bar, dock hamburger, layer context menus; #2187).
diff --git a/crates/ui-egui/src/widgets/press_menu.rs b/crates/ui-egui/src/widgets/press_menu.rs
index 787f55add8..4211464ed6 100644
--- a/crates/ui-egui/src/widgets/press_menu.rs
+++ b/crates/ui-egui/src/widgets/press_menu.rs
@@ -115,7 +115,7 @@ pub fn show<R>(button: &Response, content: impl FnOnce(&mut Ui, &PressMenu) -> R
     shown
 }
 
-/// The same press-drag-release for an `egui::ComboBox` (#2735): the list opens on the press, so one
+/// The same press-drag-release for a `craft_ui::ComboBox` (#2735): the list opens on the press, so one
 /// gesture can press the box, drag onto an option and release to choose it, and a plain click
 /// still opens the list for a second click. egui's combo box shows its own list and toggles it on
 /// a whole click, so this works around it: [`PressCombo::before`] runs before the box (and gives
@@ -348,7 +348,7 @@ mod tests {
         assert!(!rig.frame(Vec::new()).open, "and closed the menu");
     }
 
-    /// A bare context with one `egui::ComboBox` of three options, driven with [`PressCombo`].
+    /// A bare context with one `craft_ui::ComboBox` of three options, driven with [`PressCombo`].
     struct ComboRig {
         ctx: egui::Context,
         value: usize,
@@ -374,7 +374,7 @@ mod tests {
             let mut output = self.ctx.run_ui(egui::RawInput { screen_rect: Some(rect), events, ..Default::default() }, |ui| {
                 ui.add_space(20.0);
                 let (combo, close) = PressCombo::before(ui, "channel");
-                let shown = egui::ComboBox::from_id_salt("channel").selected_text(OPTIONS[value]).close_behavior(close).show_ui(ui, |ui| {
+                let shown = craft_ui::ComboBox::from_id_salt("channel").selected_text(OPTIONS[value]).close_behavior(close).show_ui(ui, |ui| {
                     out.open = true;
                     for (i, label) in OPTIONS.into_iter().enumerate() {
                         let item = ui.selectable_label(value == i, label);
diff --git a/crates/ui-egui/src/widgets/scrub.rs b/crates/ui-egui/src/widgets/scrub.rs
index 45056106bb..8602af4e61 100644
--- a/crates/ui-egui/src/widgets/scrub.rs
+++ b/crates/ui-egui/src/widgets/scrub.rs
@@ -1,4 +1,4 @@
-use super::*;
+use super::{Rect, Response, Sense, Ui};
 
 /// A drag on a value field's label this frame, for the value field drawn next on the label's row
 /// (Photoshop's scrubby labels). Left by [`scrub_label`], taken by that field.
diff --git a/crates/ui-egui/src/widgets/slider.rs b/crates/ui-egui/src/widgets/slider.rs
index 49363da87e..c4112fecb5 100644
--- a/crates/ui-egui/src/widgets/slider.rs
+++ b/crates/ui-egui/src/widgets/slider.rs
@@ -1,7 +1,7 @@
 use super::fields::{FieldOpts, value_field_in};
 use super::panel::surface;
 use super::scrub::scrub_label_within;
-use super::*;
+use super::{Color32, Pos2, Rect, Response, Sense, Stroke, Tokens, Ui, Vec2, pos2, vec2};
 
 /// Thin-track slider with a round knob. `gradient` paints the track (e.g. hue spectrum).
 pub fn slider(ui: &mut Ui, value: &mut f32, range: std::ops::RangeInclusive<f32>, gradient: Option<&[Color32]>) -> Response {
diff --git a/crates/ui-egui/src/widgets/text_field.rs b/crates/ui-egui/src/widgets/text_field.rs
index 3a009d3635..b377fbf098 100644
--- a/crates/ui-egui/src/widgets/text_field.rs
+++ b/crates/ui-egui/src/widgets/text_field.rs
@@ -1,5 +1,5 @@
 use super::panel::surface;
-use super::*;
+use super::{Response, Sense, Stroke, StrokeKind, Tokens, Ui, Vec2, theme, vec2};
 
 /// The most characters a [`text_field`] holds unless its caller sets a limit: far beyond any
 /// search, name or hex value, yet a pasted multi-gigabyte string is cut at the field instead of
diff --git a/crates/ui-egui/src/widgets/units.rs b/crates/ui-egui/src/widgets/units.rs
index 388dddf26c..c4ea21dbde 100644
--- a/crates/ui-egui/src/widgets/units.rs
+++ b/crates/ui-egui/src/widgets/units.rs
@@ -1,5 +1,5 @@
 use super::fields::{FieldOpts, value_field_in};
-use super::*;
+use super::{Response, Ui};
 
 /// A size dialog's unit key (`px`, `in`, `cm`, `mm`, `pt`, `pica`, `percent`) as a unit.
 pub fn unit_of_key(key: &str) -> photocraft_engine::prefs::Unit {
diff --git a/crates/ui-egui/tests/it/crop_default_mode.rs b/crates/ui-egui/tests/it/crop_default_mode.rs
index 7c426410db..58d9709e99 100644
--- a/crates/ui-egui/tests/it/crop_default_mode.rs
+++ b/crates/ui-egui/tests/it/crop_default_mode.rs
@@ -126,7 +126,7 @@ fn a_ratio_dropdown_updates_the_preview_and_enter_without_touching_a_handle() {
 }
 
 #[test]
-fn the_swap_button_and_x_apply_the_same_inscribed_ratio() {
+fn the_swap_button_and_x_swap_the_ratio_about_the_centre() {
     // Windows WARP can access-violate when GPU harnesses initialize or tear down concurrently:
     // hold the GPU lock for the whole test, harness included.
     let _gpu = photocraft_testkit::gpu_lock();
@@ -148,7 +148,8 @@ fn the_swap_button_and_x_apply_the_same_inscribed_ratio() {
     h.run_steps(3);
     h.key_press(Key::X);
     h.run_steps(3);
-    assert_eq!(h.state().ui.crop_rect, Some(button));
+    // X turns the frame instead of fitting the turned ratio inside it (#7057).
+    assert_eq!(h.state().ui.crop_rect, Some([70.0, -20.0, 230.0, 220.0]));
     assert!(mid(screen_box(&h)).distance(before) < 0.01);
 }
 
diff --git a/crates/ui-egui/tests/it/custom_print_paper.rs b/crates/ui-egui/tests/it/custom_print_paper.rs
index 036393b95a..d6c66a21e3 100644
--- a/crates/ui-egui/tests/it/custom_print_paper.rs
+++ b/crates/ui-egui/tests/it/custom_print_paper.rs
@@ -6,15 +6,28 @@ use serde_json::{Map, Value, json};
 
 fn app() -> (PhotocraftApp, u64) {
     let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), photocraft_ui_egui::Services::default());
+    // Print lists this printer and does not ask the spooler.
+    app.session.printer_source = Some(std::sync::Arc::new(|| {
+        vec![craft_print::Printer { name: "Test native printer".into(), default: true, two_sided: None, description: String::new() }]
+    }));
     app.run("file.new", json!({"width": 120, "height": 80, "name": "Custom paper"})).unwrap();
-    let id = open_print(&mut app);
+    let id = photocraft_engine::print_cmds::with_spooler(|| open_print(&mut app));
+    assert_no_system_listing();
+    let fields = &mut app.ui.dialog_mut(id).unwrap().fields;
     // Every UI path in these fixtures is safe even if an unexpected Enter confirms the dialog.
-    app.ui.dialog_mut(id).unwrap().fields.insert("dryRun".into(), json!(true));
+    fields.insert("dryRun".into(), json!(true));
+    // The driver Printer menu lists the stand-in on Windows only, where the GDI route is.
+    assert_eq!(fields.get("__printers"), cfg!(windows).then(|| json!(["Test native printer"])).as_ref());
     // Exercise PDF paper controls even when native printers are available, on every OS.
-    app.ui.dialog_mut(id).unwrap().fields.insert("__printers".into(), json!(["Test native printer"]));
+    fields.insert("__printers".into(), json!(["Test native printer"]));
     (app, id)
 }
 
+/// No test in this binary asks the system spooler for its printers.
+fn assert_no_system_listing() {
+    assert_eq!(photocraft_engine::print_cmds::system_printer_listings(), 0, "a test asked the system spooler for its printers");
+}
+
 fn show(ui: &mut egui::Ui, app: &mut PhotocraftApp) {
     if ui.ctx().fonts(|fonts| fonts.families().contains(&egui::FontFamily::Name("medium".into()))) {
         photocraft_ui_egui::dialogs::show(app, ui.ctx());
@@ -195,6 +208,7 @@ fn custom_paper_ui_edits_reach_preview_and_pdf_and_restore_when_reopened() {
     assert!(String::from_utf8_lossy(&pdf).contains("/MediaBox [0 0 666.00 522.00]"));
     assert_eq!(h.state().session.file_menu.last_print.as_ref().unwrap()["paper"], json!([522.0, 666.0]));
     let id = open_print(h.state_mut());
+    assert_no_system_listing();
     h.state_mut().ui.dialog_mut(id).unwrap().fields.insert("dryRun".into(), json!(true));
     h.run_steps(3);
     assert!(shown(&h, "Custom"), "reopening array-valued settings must show Custom");
diff --git a/crates/ui-egui/tests/it/gpu_device_loss.rs b/crates/ui-egui/tests/it/gpu_device_loss.rs
index 37dd3db267..bfd5cdf401 100644
--- a/crates/ui-egui/tests/it/gpu_device_loss.rs
+++ b/crates/ui-egui/tests/it/gpu_device_loss.rs
@@ -66,7 +66,7 @@ fn injected_loss_stops_gpu_work_without_panicking() {
     // Every entry point is a no-op or an error now.
     let r = g.refresh(key, &d, None, None);
     assert_eq!(r.kind, "lost");
-    assert!(r.fallback.as_deref().unwrap_or("").contains("GPU device lost"));
+    assert!(r.fallback.as_ref().is_some_and(|f| f.to_string().contains("GPU device lost")));
     assert!(g.composite(&d, d.bounds(), false).is_err());
     assert!(!g.upload_rect(key, [0, 0], [1, 1], &[0; 4]));
     g.upload_full(key, [1, 1], &[0; 4]);
diff --git a/crates/ui-egui/tests/it/main.rs b/crates/ui-egui/tests/it/main.rs
index 2c90cf7981..e8d8b334ba 100644
--- a/crates/ui-egui/tests/it/main.rs
+++ b/crates/ui-egui/tests/it/main.rs
@@ -29,6 +29,7 @@ mod pattern_preview_canvas;
 mod radial_blur_center;
 mod remove_channel_target;
 mod system_locale;
+mod transform_readout_units;
 mod ui_scale_canvas;
 mod variables_data_sets;
 mod workspace_presets;
diff --git a/crates/ui-egui/tests/it/transform_readout_units.rs b/crates/ui-egui/tests/it/transform_readout_units.rs
new file mode 100644
index 0000000000..9dd848e46a
--- /dev/null
+++ b/crates/ui-egui/tests/it/transform_readout_units.rs
@@ -0,0 +1,116 @@
+//! #9400: while a Free Transform handle is dragged, the W/H readout beside the pointer shows the
+//! box's size in the Units & Rulers unit (as Photoshop does), not always its scale in percent.
+//!
+//! The real app runs offscreen on wgpu with real egui pointer events. Skips when no GPU adapter
+//! exists (like `drag_preview_canvas.rs`). Set `PHOTOCRAFT_TRANSFORM_READOUT_EVIDENCE_DIR` to save
+//! the frames, mid-drag, as PNGs.
+
+use egui::{Modifiers, PointerButton, Pos2};
+use egui_kittest::kittest::Queryable;
+use photocraft_engine::prefs::Unit;
+use photocraft_ui_egui::PhotocraftApp;
+use photocraft_ui_egui::canvas::ViewXform;
+use photocraft_ui_egui::control::{ControlRequest, handle};
+use serde_json::{Value, json};
+
+type Harness = egui_kittest::Harness<'static, PhotocraftApp>;
+
+fn harness() -> Option<Harness> {
+    let built = std::panic::catch_unwind(|| {
+        egui_kittest::Harness::builder().with_size(egui::vec2(900.0, 640.0)).with_max_steps(64).wgpu().build_eframe(|cc| {
+            PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
+            let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+            // The queries below use English labels; don't follow the system locale.
+            app.session.prefs.edit(|p| p.interface.language = "en".into());
+            if let Some(rs) = cc.wgpu_render_state.as_ref() {
+                app.set_wgpu(rs.clone());
+            }
+            app
+        })
+    });
+    match built {
+        Ok(h) => Some(h),
+        Err(_) => {
+            eprintln!("skipping: no GPU adapter");
+            None
+        }
+    }
+}
+
+fn control(h: &mut Harness, method: &str, params: Value) {
+    let ctx = h.ctx.clone();
+    let (req, _rx) = ControlRequest::new(method, params);
+    handle(h.state_mut(), &ctx, &req);
+    h.run_steps(3);
+}
+
+fn xf(h: &Harness) -> ViewXform {
+    ViewXform::active(h.state()).expect("a view")
+}
+
+fn press(h: &mut Harness, p: Pos2, pressed: bool) {
+    h.event(egui::Event::PointerMoved(p));
+    h.event(egui::Event::PointerButton { pos: p, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE });
+    h.step();
+}
+
+/// A 400 × 300 px document at 72 ppi, 100 %, with a 100 × 50 px box on its own layer at
+/// (100, 100) and Free Transform open on it.
+fn setup() -> Option<Harness> {
+    let mut h = harness()?;
+    h.run_steps(4);
+    {
+        let app = h.state_mut();
+        app.run("file.new", json!({"width": 400, "height": 300, "background": "white"})).expect("new");
+        app.run("layer.new.layer", json!({})).expect("layer");
+        app.run("select.rect", json!({"x": 100, "y": 100, "width": 100, "height": 50})).expect("select");
+        app.run("edit.fill", json!({"color": "#3366cc"})).expect("fill");
+        app.run("select.deselect", json!({})).expect("deselect");
+        app.sync_views();
+        app.ui.extras.rulers = true;
+        app.ui.extras.snap = false;
+        app.ui.view.show.smart_guides = false;
+    }
+    control(&mut h, "ui.set", json!({"tool": "move", "zoom": 1.0, "center": [200, 150]}));
+    control(&mut h, "ui.menu.invoke", json!({"id": "edit.freeTransform"}));
+    assert!(h.state().ui.transform.is_some(), "the box is open");
+    Some(h)
+}
+
+#[test]
+fn the_scale_readout_shows_the_size_in_the_ruler_unit() {
+    // Windows WARP can access-violate when GPU harnesses initialize or tear down concurrently:
+    // hold the GPU lock for the whole test, harness included.
+    let _gpu = photocraft_testkit::gpu_lock();
+    // The right edge from x 200 to 300 doubles the box (proportionally): 200 × 100 px, which at
+    // 72 ppi is 7.06 × 3.53 cm; 200 % of the original box with the rulers in percent.
+    for (unit, name, w, h_text) in
+        [(Unit::Pixels, "pixels", "200 px", "100 px"), (Unit::Centimeters, "centimeters", "7.06 cm", "3.53 cm"), (Unit::Percent, "percent", "200.0%", "200.0%")]
+    {
+        let Some(mut h) = setup() else { return };
+        h.state_mut().session.prefs.edit(|p| p.units_and_rulers.rulers = unit);
+        let x = xf(&h);
+        let (from, to) = (x.to_screen(200.0, 125.0), x.to_screen(300.0, 125.0));
+        press(&mut h, from, true);
+        for i in 1..=8 {
+            h.event(egui::Event::PointerMoved(from + (to - from) * (i as f32 / 8.0)));
+            h.step();
+        }
+        h.run_steps(2);
+        // `query_all`: in percent W and H both read 200.0%.
+        assert!(h.query_all_by_label(w).next().is_some(), "{name}: W reads {w}");
+        assert!(h.query_all_by_label(h_text).next().is_some(), "{name}: H reads {h_text}");
+        // The readout used to show percent whatever the ruler unit.
+        if unit != Unit::Percent {
+            assert!(h.query_all_by_label("200.0%").next().is_none(), "{name}: no percent readout");
+        }
+        if let Some(dir) = std::env::var_os("PHOTOCRAFT_TRANSFORM_READOUT_EVIDENCE_DIR") {
+            let dir = std::path::PathBuf::from(dir);
+            std::fs::create_dir_all(&dir).expect("evidence directory");
+            h.render().expect("render").save(dir.join(format!("transform-readout-{name}.png"))).expect("save evidence");
+        }
+        press(&mut h, to, false);
+        h.key_press(egui::Key::Escape);
+        h.run_steps(3);
+    }
+}
diff --git a/docs/context-menu-inventory.md b/docs/context-menu-inventory.md
index a932a58b20..e4c69c8e72 100644
--- a/docs/context-menu-inventory.md
+++ b/docs/context-menu-inventory.md
@@ -29,7 +29,7 @@ Canvas invariant: secondary click must not accidentally start a paint stroke, co
 
 | Surface | Current entries or behavior | Command route / gap |
 |---|---|---|
-| Layers panel row | Blending Options; Duplicate/Delete; Group from Layers; Quick Export PNG / Export As; Artboard/Frame from Layers; Convert to Smart Object; content-specific Rasterize; Add/Disable/Apply/Delete Layer Mask; Create/Release Clipping Mask; Link/Select Linked; Copy/Paste/Clear Layer Style; Merge Layers/Down, Merge Visible, Flatten Image; Rename Layer. Multi-select changes duplicate/delete/merge labels and target. | `layer_menu_ui::entries` supplies IDs for all except inline rename, then `menus::invoke` or engine dispatch. Missing or disabled commands are filtered/greyed. Check menu visibility and enabled state for groups, backgrounds, masks, type, adjustment/fill, smart objects, and multi-selection. |
+| Layers panel row | Blending Options; Duplicate/Delete; Group from Layers (New Group from Layers dialog, also for a multi-selection); Quick Export PNG / Export As; Artboard/Frame from Layers; Convert to Smart Object; content-specific Rasterize; Add/Disable/Apply/Delete Layer Mask; Create/Release Clipping Mask; Link/Select Linked; Copy/Paste/Clear Layer Style; Merge Layers/Down, Merge Visible, Flatten Image; Rename Layer. Multi-select changes duplicate/delete/merge labels and target. | `layer_menu_ui::entries` supplies IDs for all except inline rename, then `menus::invoke` or engine dispatch. Missing or disabled commands are filtered/greyed. Check menu visibility and enabled state for groups, backgrounds, masks, type, adjustment/fill, smart objects, and multi-selection. |
 | Channels panel row | Alpha: Duplicate/Delete/Rename, spot conversion or merge, selection-display and overlay controls. Quick Mask: Exit, display and overlay. Composite/color: Duplicate. Layer mask: Enable/Disable, Delete, Layer Mask Display Options… (also on double-click). Common: New Channel, New Spot Channel, Split, Merge. | `channel.*`, `layer.layerMask.*`, `select.editInQuickMaskMode`, `ui.renameChannel`. Check selection loading/saving, channel options, and per-row enablement against Photoshop. |
 | Brushes panel preset | Rename Brush, Delete Brush. | Routed through `brush.presets.*` panel actions. Check duplicate/export/import and library organization. |
 | Brushes panel group | Rename Group, Delete Group. | Routed through preset panel actions; confirm group deletion consequences. |
diff --git a/docs/control-protocol.md b/docs/control-protocol.md
index d291f45d3b..0c286693c2 100644
--- a/docs/control-protocol.md
+++ b/docs/control-protocol.md
@@ -46,7 +46,7 @@ The transport is `apps/photocraft/src/control_server.rs`, and the handlers are i
 
 - `engine.execute {command, params}`: run any engine or UI command by id. Engine commands run directly with their default params and never open a dialog. Use `ui.menu.invoke` for menu-click behaviour, which opens a command's dialog when no params are given. `params` must be a JSON object (omit it or pass `null` for none); an array, string, number or boolean is an error naming the command, in every transport (control channel, `serve`, MCP and the CLI)
 - `engine.commands`: list commands with enablement; the `result` is a JSON array of command objects (see [Command list replies](#command-list-replies))
-- `ui.inspect`: full UI state (tool, panels, views, dialogs, windows, window size). The menu tree is not included; use `ui.menu.list`. `brushPicker` is `null` while closed and `{pos: [x, y], size: [w, h]?, list: {collapsed, filter, renaming, showName, showStroke, showTip, scale}}` while the Brush Preset picker is open (coordinates in screen points; `size` is the picker's content size once its corner grip was dragged, `null` before that, and the drag remembers both dimensions; the three `show*` flags pick the parts of each preset's card — at least one is always on; `scale` is the footer slider, 0.15–2 with 1 the standard, multiplying the cards' width and height — the heights stop at half size and the name and tip-size text hold their 1.0 size — and dropping the tips' size numbers at 0.40 and below; the parts and the scale are remembered across restarts, while the search, collapsed groups and a rename in progress are not). `view` holds the View/Window/Type preferences: `screen_mode`, `extras`, `show` and `snap_to` flags, `flip_horizontal`, `arrange` (Window › Arrange layout), pixel aspect, font preview size, language options. `perf.timings.gpuInfo` holds the graphics adapter, backend, driver, the backend chosen at launch and why, the canvas renderer (`gpu`/`cpu`) and, after a device loss, `lost` (`help.systemInfo` returns the same as `info`)
+- `ui.inspect`: full UI state (tool, panels, views, dialogs, windows, window size). The menu tree is not included; use `ui.menu.list`. `brushPicker` is `null` while closed and `{pos: [x, y], size: [w, h]?, list: {collapsed, filter, renaming, showName, showStroke, showTip, scale}}` while the Brush Preset picker is open (coordinates in screen points; `size` is the picker's content size once its corner grip was dragged, `null` before that, and the drag remembers both dimensions; the three `show*` flags pick the parts of each preset's card — at least one is always on; `scale` is the footer slider, 0.15–2 with 1 the standard, multiplying the cards' width and height — the heights stop at half size and the name and tip-size text hold their 1.0 size — and dropping the tips' size numbers at 0.40 and below; the parts and the scale are remembered across restarts, while the search, collapsed groups and a rename in progress are not). `view` holds the View/Window/Type preferences: `screen_mode`, `extras`, `show` and `snap_to` flags, `flip_horizontal`, `arrange` (Window › Arrange layout), pixel aspect, font preview size, language options. `perf.timings.gpuInfo` holds the graphics adapter, backend, driver, the backend chosen at launch and why, the canvas renderer (`gpu`/`cpu`) and, after a device loss, `lost` (`help.systemInfo` returns the same as `info`). `perf.renderPath` says why the active document is drawn on the CPU: `current` is `null` on the GPU, else `{doc, kind, detail}` (`kind` is one of `overBudget`, `canvasTooLarge`, `compositorBuild`, `deviceLost`, `gpuError`, `unsupported`, `adjustPreview`, `viewTransform`, `softwareAdapter`, `cpuMode`; `detail` is the English reason, with the working set and budget for `overBudget`), and `history` holds the last 32 changes, oldest first (`{t, doc, kind, detail}`, `kind` `null` for back on the GPU, `doc` the changed document's id, or 0 for a change to every document). An adjustment dialog's CPU proxy preview has its own slot: `current` reports it (`adjustPreview`) only when neither the window nor the canvas has a reason, it isn't recorded while the whole window is off the GPU, and its history entries always have `kind` `adjustPreview`, with `detail` `null` when the preview stops using the proxy (never read as back on the GPU). `perf.timings.gpuFallback` is `current`'s `detail` as text
 - `ui.set {tool?, panels?, dockTabs?, dock?, dockWidth?, colorPanel?, maskTarget?, vectorMaskTarget?, filterMaskTarget?, selectionMode?, zoom?, center?, rotation?, fit?, theme?, brushSize?, brushSection?, brushTab?, brushesView?, brushPicker?, brushPickerName?, brushPickerStroke?, brushPickerTip?, brushPickerScale?, gradientBlendMode?, gradientClassic?, shapeStroke?}`: change UI state; any other field is an error, checked before anything changes (`zoom` is the canvas zoom where 1 = 100%, one document pixel per physical display pixel, so a scaled display doesn't magnify the image; `theme` is `pro`, `proMedium`, `studio`, `studioLight` or `classic`; `selectionMode` is the selection tools' options-bar mode, 0 New, 1 Add, 2 Subtract, 3 Intersect; `brushSection` indexes the Brush Settings sections, `brushTab` 0 = Brush Settings, 1 = Brushes; `brushesView` is `list` or `grid` for the Brushes panel; `brushPickerName`, `brushPickerStroke` and `brushPickerTip` are the Brush Preset picker's card parts (booleans, at least one on), and `brushPickerScale` its footer card-scale slider (0.15 to 2, 1 the standard); `brushPicker` is `[x, y]` in screen points to open the Brush Preset picker there (as a right-click with a painting tool does) or `null` to close it, and picking a preset in it is `tools.setBrush {"preset": name}`; `dock` is `{order: ["layers", …], heights: {"properties": 180}, collapsed: ["color"], tabOrder: {"layers": ["Paths", "Layers", "Channels"]}}`, the right-dock groups top to bottom, their heights in points, the groups collapsed to their tab strip and each group's tab order left to right by panel name (a group left out keeps its default order, unknown names are ignored and tabs not listed follow in their default order; `dockTabs` keeps indexing tabs in their default order); `dockWidth` sets the right dock width in points, clamped to 250..520; `colorPanel` is `{background?, mode?, ramp?, webSafeRamp?}`, merged into the Color panel's state: `background` is whether it edits the background colour, `mode` its panel-menu display (`hueCube`, `brightnessCube`, `colorWheel`, `grayscaleSlider`, `rgbSliders`, `hsbSliders`, `cmykSliders`, `labSliders` or `webColorSliders`), `ramp` the colour ramp under the sliders (`rgbSpectrum`, `cmykSpectrum`, `grayscaleRamp` or `currentColors`) and `webSafeRamp` Make Ramp Web Safe; `maskTarget` targets the active layer's mask, which, like Photoshop, swaps in the foreground/background pair kept for masks (white/black until one is picked) and swaps the pixels' pair back when the pixels are targeted again; `filterMaskTarget` targets the active smart object's filter mask (an error without smart filters), so painting, fills, filters and adjustments edit it (`"target":"filterMask"`) while Move and Edit › Transform still act on the smart object)
   - `typeTransform` is `null` outside a temporary Ctrl/Cmd Type-tool drag. During a drag it reports its source document/revision, original affine, oriented `frame` (layer, local bounds, document-space corners and pivot), and captured `gesture`. Drive it with `ui.pointer` and `command: true` at `down`; `move`/`up` may release the modifier. The document/history remain unchanged during preview, and `up` applies one `type.edit` within `textEdit`'s session. Pressing Escape during the drag cancels only the preview. This pointer state is never restored from saved UI state.
 - `ui.menu.invoke {id, params?, wait?}` / `ui.menu.list`: activate a menu item by id; list the menu tree. A menu item that starts a background job (a filter without a dialog, such as Blur More) replies with the job's result once it has been applied; with `"wait": false` the reply is `{job, pending: true}` at once. Window ends with the open documents as `window.document.<index>` (tab order, the active one checked, #2991); invoking one brings that document to the front and replies `{document: index}`. Camera Raw and the full-window workspaces (Liquify, Content-Aware Fill, Filter Gallery, Adaptive Wide Angle) are modal: while one is open, `ui.menu.invoke` refuses every other menu item ("menu command is unavailable while a modal dialog is open") and accepts only that workspace's own `{"ui": {...}}` requests (`filter.liquify`, `edit.contentAwareFill`, `filter.filterGallery`, `filter.adaptiveWideAngle`, `filter.cameraRaw`; `params` must hold only the `ui` object), so finish it with `{"ui":{"commit":true}}` or `{"ui":{"cancel":true}}` first. Those requests are refused too while a dialog, an unsaved-changes prompt or a crop that blocks the command is open: resolve that first, then commit or cancel the workspace. `ui.menu.list` reports the same gate: an item the modal state refuses is listed with `enabled: false`. `engine.execute` is not a menu click and is not gated
@@ -63,7 +63,7 @@ The transport is `apps/photocraft/src/control_server.rs`, and the handlers are i
 - `ui.set` also accepts `cropFill` (`background`, Photoshop's Background (Default), or `contentAware`), the Crop tool's Fill dropdown (#3823): with `contentAware`, committing a turned or extending frame passes `contentAware: true` to `image.crop`, which fills the area the image doesn't cover from its surroundings. `ui.inspect` reports it as `toolOptions.crop_content_aware`.
   Both gradient modes use the current preset, including its opacity stops. Select `Foreground to Transparent` through `gradient.presets.select`, or pass custom `stops` and `transparency: [[0,100],[1,0]]` (location 0..1, opacity 0..100). Use `applyToLayer: false` to edit only the tool preset. Classic gradient drags dispatch `paint.gradient` without overriding them.
 - `ui.set` also accepts the Crop tool's gear menu (#1919) as `cropShield`, an object patching any of `show_cropped_area` (Show Cropped Area; off hides everything outside the box behind the canvas colour, H in the app), `enabled` (Enable Crop Shield), `color` (`matchCanvas`, the pasteboard colour, or `custom`), `custom_color` (`[r, g, b]`, 0..255), `opacity` (0..100, default 75), `auto_adjust` (Auto Adjust Opacity: half the opacity while the box is dragged), `classic_mode` (Use Classic Mode, default off: the box turns and moves over the image; off is Photoshop's default mode, where the box stays upright and the view turns and pans the image behind it while the Crop tool shows a frame, P in the app; in both modes picking the tool turns a rotated view upright about its centre, Classic Mode keeping the camera upright with the frame drawn turned, and the view stays upright after a commit or cancel; Classic Mode greys out Show Cropped Area, which then acts as on, and Auto Center Preview) and `auto_center_preview` (default on: in default mode a box being resized keeps its centre where it is on screen, also after a pan, a drawn one moves to the middle of the canvas, and X re-centres it; a move never re-centres the box). `ui.inspect` reports it as `toolOptions.crop_shield`. The pending frame (`crop_rect`, `crop_angle`: its turn on the image) and the `image.crop` a commit runs are the same in both modes.
-- `ui.dialog.open {kind, fields?}` (kinds `newDocument`, `about`, `layerStyle {effect?}`, `colorPicker {target: foreground|background}`, `command {command}`, `newCropPreset` / `deleteCropPreset`: the Crop tool's New / Delete Crop Preset… dialogs, fields `name` and `selected: [names]`; crop presets are `crop` tool presets, so `tool.presets.new/list/edit {"tool":"crop"}` drive them too) / `ui.dialog.set {dialog, field, value}` / `ui.dialog.confirm {dialog, wait?}` / `ui.dialog.cancel {dialog}`. Like `ui.menu.invoke`, `ui.dialog.confirm` waits for a background job its command starts (a filter dialog's OK) and replies with the result; `"wait": false` replies `{job, pending: true}` at once
+- `ui.dialog.open {kind, fields?}` (kinds `newDocument`, `about`, `layerStyle {effect?}`, `colorPicker {target: foreground|background}`, `command {command}` (`layer.new.group` / `layer.new.groupFromLayers` open the New Group dialog: fields `name`, `color`, `mode`, `opacity`), `newCropPreset` / `deleteCropPreset`: the Crop tool's New / Delete Crop Preset… dialogs, fields `name` and `selected: [names]`; crop presets are `crop` tool presets, so `tool.presets.new/list/edit {"tool":"crop"}` drive them too) / `ui.dialog.set {dialog, field, value}` / `ui.dialog.confirm {dialog, wait?}` / `ui.dialog.cancel {dialog}`. Like `ui.menu.invoke`, `ui.dialog.confirm` waits for a background job its command starts (a filter dialog's OK) and replies with the result; `"wait": false` replies `{job, pending: true}` at once
   - A Layer Style color field opens the shared picker with `ui.dialog.open {"kind":"colorPicker","parent":12,"effect":"fx2","field":"color"}`. `parent` is the Layer Style dialog id; `effect` is its effect instance id. `field` must be one of that instance's color parameters (`color`, or `from`/`to` for Gradient Overlay). The picker previews over the pending style without changing the document. Picker OK changes only the parent parameter; Cancel discards the preview. Confirm the parent afterwards to apply the style. Parent confirmation is refused while its picker is open; parent cancellation closes both. The binding is exposed in `ui.inspect` as `__layerStyleColor`; changed/closed targets or a document switch invalidate it.
   - `ui.dialog.open {kind:"colorPicker", textStyle:{kind:"character"|"paragraph", id:u32}}` opens the shared Color Picker for an explicitly enabled Color attribute in Style Options. It opens the matching style panel/editor after validation; inherited colors must first be enabled through the existing style command. The picker reports its bound document/revision/style under `__textStyleColor` in `ui.inspect`. Changes preview in an isolated document; OK runs the existing style `set` command once, Cancel changes nothing. Document edits/switches or closed/changed Style Options discard the picker. `textStyle` cannot be combined with `parent`, `effect`, `field` or `target`.
   - The shell's own dialogs (Window › Workspace › New Workspace / Delete Workspace, View › Pixel Aspect Ratio › Custom Pixel Aspect Ratio…, View › Show › Show Extras Options…, View › 32-bit Preview Options…) are listed in `ui.inspect`'s `dialogs` with the id `"shell"` (at most one is open). `ui.dialog.set`, `ui.dialog.confirm` and `ui.dialog.cancel` take `{"dialog": "shell"}`; OK runs the dialog's command and keeps the dialog open if it fails
diff --git a/docs/deflate-zlib-rs-performance.md b/docs/deflate-zlib-rs-performance.md
new file mode 100644
index 0000000000..af05ebae0f
--- /dev/null
+++ b/docs/deflate-zlib-rs-performance.md
@@ -0,0 +1,97 @@
+# Deflate backend comparison
+
+Replace the workspace flate2 Rust backend with zlib-rs and runtime CPU detection. Tiles in .pcraft remain Zstandard; deflate changes its PNG previews.
+
+Size, import-speed and dependency tradeoffs remain maintainer decisions.
+Some PSD ZIP files grow by up to 0.71%. The macOS 16-bit city PSD import is about 6% slower in confirmation.
+The small web-layout PNG grows by 598 bytes (+1.40%). One .pcraft preview adds 25 bytes.
+Real photo PNGs become smaller and encode faster. The default and best levels are unchanged; callers that
+used level 1 (PDF export and print, brush tips, PNG Fast) now use level 3, because zlib-rs level 1 writes
+static Huffman blocks only (13-32% bigger on photos). Level 3 is never bigger than miniz's level 1 on the
+docs/images photos (0-16% smaller) and takes 1.2-3.4 times as long.
+There is no native-format tile speedup from deflate.
+
+The timings below measure only the backend switch. They exclude the later ZIP allocation, validation and slice decoder changes.
+
+Measured on 2026-10-19 against main `d95fdf31`, independently of the other performance changes.
+Host: Apple M4 Max, 16 CPUs, 128 GiB RAM, macOS arm64, rustc 1.99.1.
+Release settings: optimization level 3, no LTO, 16 codegen units and no debug information.
+Builds finish before measurement. Measurements use default priority without concurrent builds or profiling.
+Five alternating pairs follow a warmup. Confirmation uses nine pairs.
+Time changes compare medians, and intervals resample paired ratios. Negative changes mean less elapsed time.
+Small differences are not automatically established improvements or regressions.
+
+The full-resolution CC0 Pixls photographs are P1000475.RW2 (24 MP foliage centre crop, no resampling) and IMG_4059.CR2 (12 MP city), each converted to U8/U16/F32 with the ProPhoto RGB profile. F32 derives from 16-bit development, not HDR capture. MIT psd-tools masks.psd supplies a 640 x 1394 web layout with 22 imported layers and three masks; mask-index.psd supplies a 1000 x 867 illustrated card with a mask. The sources and hashes are pinned by the existing corpus. These are the available authored layered files, not a large layered-photo corpus. No generated noise, repeating ramps, enlarged charts or duplicated photo layers are used.
+
+The shared harness times in-memory operations. Input loading, image conversion, thumbnail rendering, hashes and equivalence checks are outside timers. Every save uses a fresh PcraftWriter and a real rendered thumbnail. Common reads use main-encoded files; own-output reads are separate. PSD exports use ZIP merged images at U8/U16, Raw merged images at F32, and normal RLE layer channels at U8/U16 / ZIP prediction at F32. Results do not measure filesystem throughput or browser performance.
+
+| Document | Operation | Main ms | Branch ms | Time change | Paired 95% interval | Main / branch bytes |
+|---|---|---:|---:|---:|---:|---:|
+| canon-16 | psd-import (confirm) | 168.891 | 178.614 | +5.8% | +3.5..+5.9% | 140,673,004 / 140,673,004 |
+| panasonic-8 | save | 166.659 | 162.322 | -2.6% | -3.9..-1.0% | 49,643,217 / 49,643,242 |
+| panasonic-8 | load-common | 410.794 | 409.622 | -0.3% | -0.5..+0.3% | 49,643,217 / 49,643,217 |
+| panasonic-8 | png-encode | 373.880 | 165.381 | -55.8% | -56.3..-47.4% | 24,569,965 / 24,238,416 |
+| panasonic-8 | png-decode | 168.141 | 167.247 | -0.5% | -2.0..+1.0% | 24,569,965 / 24,569,965 |
+| panasonic-8 | psd-export | 2938.276 | 1115.740 | -62.0% | -62.3..-61.6% | 98,823,859 / 98,837,585 |
+| panasonic-8 | psd-import | 275.713 | 174.046 | -36.9% | -38.8..-34.7% | 98,823,859 / 98,823,859 |
+| panasonic-16 | save | 357.998 | 355.900 | -0.6% | -1.8..+0.5% | 175,681,852 / 175,681,844 |
+| panasonic-16 | load-common | 387.986 | 391.411 | +0.9% | -1.3..+1.1% | 175,681,852 / 175,681,852 |
+| panasonic-16 | png-encode | 354.924 | 288.664 | -18.7% | -27.8..-14.2% | 111,583,441 / 109,241,690 |
+| panasonic-16 | png-decode | 434.083 | 433.645 | -0.1% | -1.0..+1.7% | 111,583,441 / 111,583,441 |
+| panasonic-16 | psd-export | 2645.838 | 2249.281 | -15.0% | -15.6..-13.8% | 274,409,683 / 275,654,405 |
+| panasonic-16 | psd-import | 371.291 | 374.777 | +0.9% | -1.1..+1.8% | 274,409,683 / 274,409,683 |
+| panasonic-32 | save | 639.677 | 631.556 | -1.3% | -5.2..+1.8% | 252,231,671 / 252,231,663 |
+| panasonic-32 | load-common | 1338.160 | 1326.936 | -0.8% | -1.1..-0.2% | 252,231,671 / 252,231,671 |
+| panasonic-32 | psd-export | 2522.700 | 1352.144 | -46.4% | -49.6..-44.6% | 461,042,978 / 459,545,262 |
+| panasonic-32 | psd-import | 356.077 | 310.425 | -12.8% | -20.2..-4.7% | 461,042,978 / 461,042,978 |
+| canon-8 | save | 89.139 | 85.965 | -3.6% | -8.9..+2.7% | 26,151,631 / 26,151,203 |
+| canon-8 | load-common | 219.711 | 219.088 | -0.3% | -0.3..+1.0% | 26,151,631 / 26,151,631 |
+| canon-8 | png-encode | 179.944 | 80.123 | -55.5% | -60.8..-40.0% | 13,720,268 / 13,551,023 |
+| canon-8 | png-decode | 69.704 | 70.040 | +0.5% | -0.4..+0.6% | 13,720,268 / 13,720,268 |
+| canon-8 | psd-export | 1074.094 | 475.802 | -55.7% | -56.1..-55.4% | 56,209,597 / 56,608,401 |
+| canon-8 | psd-import | 142.523 | 96.323 | -32.4% | -34.4..-26.9% | 56,209,597 / 56,209,597 |
+| canon-16 | save | 185.898 | 183.472 | -1.3% | -2.8..-0.2% | 88,750,003 / 88,749,555 |
+| canon-16 | load-common | 193.409 | 193.704 | +0.2% | -0.2..+0.8% | 88,750,003 / 88,750,003 |
+| canon-16 | png-encode | 169.432 | 135.364 | -20.1% | -26.2..-15.4% | 58,279,529 / 57,568,207 |
+| canon-16 | png-decode | 211.947 | 211.829 | -0.1% | -0.4..+0.5% | 58,279,529 / 58,279,529 |
+| canon-16 | psd-export | 1295.076 | 1130.697 | -12.7% | -13.5..-9.9% | 140,673,004 / 141,105,829 |
+| canon-32 | save | 340.781 | 334.426 | -1.9% | -5.3..+0.7% | 120,957,984 / 120,957,536 |
+| canon-32 | load-common | 774.663 | 778.401 | +0.5% | -1.3..+8.5% | 120,957,984 / 120,957,984 |
+| canon-32 | psd-export | 1028.651 | 647.483 | -37.1% | -40.5..-36.1% | 228,234,238 / 227,497,106 |
+| canon-32 | psd-import | 177.500 | 146.373 | -17.5% | -18.5..-17.1% | 228,234,238 / 228,234,238 |
+| layout-masks | save | 18.588 | 18.268 | -1.7% | -2.7..+0.6% | 433,949 / 433,924 |
+| layout-masks | load-common | 16.099 | 16.080 | -0.1% | -1.5..+0.6% | 433,949 / 433,949 |
+| layout-masks | png-encode | 3.911 | 2.557 | -34.6% | -36.0..-32.3% | 42,842 / 43,440 |
+| layout-masks | png-decode | 0.781 | 0.767 | -1.8% | -2.5..+2.2% | 42,842 / 42,842 |
+| layout-masks | psd-export | 56.043 | 46.949 | -16.2% | -18.5..-15.9% | 493,006 / 493,145 |
+| layout-masks | psd-import | 12.324 | 12.334 | +0.1% | -4.8..+2.3% | 493,006 / 493,006 |
+| layout-mask-index | save | 7.367 | 7.202 | -2.2% | -5.5..-0.7% | 344,892 / 344,746 |
+| layout-mask-index | load-common | 6.601 | 6.602 | +0.0% | -2.8..+4.7% | 344,892 / 344,892 |
+| layout-mask-index | png-encode | 11.520 | 5.971 | -48.2% | -49.5..-46.0% | 115,229 / 114,892 |
+| layout-mask-index | png-decode | 1.451 | 1.444 | -0.5% | -4.2..+0.5% | 115,229 / 115,229 |
+| layout-mask-index | psd-export | 19.135 | 12.721 | -33.5% | -34.0..-31.5% | 411,435 / 411,594 |
+| layout-mask-index | psd-import | 3.362 | 2.721 | -19.1% | -21.3..-11.2% | 411,435 / 411,435 |
+
+Every PNG encode decodes to identical source pixels, each PSD operation produces the same decoded layer/mask samples as main, and complete .pcraft documents compare equal at every depth. Compressed bytes may differ. The committed compatibility test independently inflates PNG IDAT and PSD ZIP/ZIP-prediction data using old miniz_oxide and checks .pcraft tiles plus thumbnails.
+
+## Allocation and validation changes
+
+ZIP lookup keys borrow valid UTF-8 entry paths, avoiding a second string allocation per entry. Invalid names keep their previous lossy spelling and duplicate-name lookup still selects the first entry. The bundle writer reserves the complete archive after compression, including its central directory. It rejects entry paths that exceed ZIP's 65,535-byte field before writing and checks that the central-directory size fits its ZIP field. These archive paths are independent of filesystem path limits.
+
+Affinity zlib entries, deep EXR ZIP chunks and compressed SVG input now decode directly from their byte slices. This removes flate2's 32 KiB input-buffer allocation and copy for each decoder. Output bounds, checksums and SVG concatenated gzip members remain covered by tests. These are structural allocation reductions, not measured timing gains.
+
+## Linux and Windows x86-64 validation
+
+[GitHub Actions run](https://github.com/reneleonhardt/photocraft/actions/runs/39444647224) passed the deflate compatibility test,
+the full IO/codecs/format package tests and `cargo xtask wasm` on Ubuntu 24.04 and Windows 2022 x86-64.
+The temporary `ci/deflate-zlib-rs-x86` branch at `46232997` contains the workflow and benchmark setup.
+The run's `deflate-x86-results` artifact contains all raw samples, the full table, input and binary hashes, backend features and host details.
+
+The timing host used an Intel Xeon 6973P-C with four vCPUs and rustc 1.99.1.
+Main at `d95fdf31` and the backend change at `a37198d4` used matching release settings.
+One warmup preceded nine alternating pairs on the same 12/24 MP photos at U8/U16.
+Both importers received the same baseline-encoded PSD files. Loading, conversion, hashes and checks stayed outside the elapsed-time measurements.
+PNG encode time fell 23.8–56.8%, PSD export time 18.1–58.2%, and PSD import time 7.8–21.6%.
+The 16-bit city import fell from 440.733 to 402.057 ms (-8.78%); the macOS slowdown did not recur on this runner.
+Photo PNGs became 1.2–2.1% smaller. Exported PSDs grew by 0.014–0.709%.
+All decoded pixels, dimensions, depths and profiles matched. These results cover this Linux host; Windows and F32 were not timed.
diff --git a/docs/development.md b/docs/development.md
index 337dcbaaf0..41d74bae67 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -386,7 +386,7 @@ can't run.
   counts/bounds without relaxing the pixel comparison.
 
 - The canvas is presented by a custom WGSL shader (`ui-egui/src/gpu_canvas.rs`): mip-mapped/nearest sampling, procedural checkerboard, pixel grid, tiling. Brush strokes upload only their damage rect.
-- **The canvas composites on the GPU** (`photocraft-gpu`, driven from `gpu_canvas.rs`), layer effects included. What the planner can't express returns `Unsupported` and the canvas falls back to the CPU compositor (`photocraft-compose`, also the reference for export and tests): Multichannel documents, and documents or effect regions over the texture limit. Pieces the GPU can't derive itself are rasterised once on the CPU and cached (`compose::masks` for vector masks, `compose::shape_split` for stroked shapes with clipped layers, effect distance fields). Timings of the interactive paths: `cargo run --release -p photocraft-ui-egui --example interactive_bench`; effects: `--example fx_bench` (`--compare files…` for GPU vs CPU); the cost of changing a chisel bevel's size (a dragged slider, GPU and CPU, ellipse and text): `--example bevel_bench`; large documents (open, refresh, thumbnails, a filter, a stroke, saves; one operation per run so `/usr/bin/time -l` gives its peak memory): `--example large_image_bench -- --size 14000x14000 --op psd`. The app requests the adapter's own texture limit (egui's default is 8192 px; see `gpu_canvas::use_adapter_limits`); beyond it the CPU fallback composites and uploads in bands (`compose::render_bands`), and exports, thumbnails and flattening stream bands too, so no full-size float composite is ever held. Rendering fidelity: `cargo run --release -p photocraft-io --example oracle_diff -- corpus/psd` (the whole PSD oracle table in seconds). `ui.inspect` → `perf.timings.gpuFallback` names the reason (`null` on the GPU path).
+- **The canvas composites on the GPU** (`photocraft-gpu`, driven from `gpu_canvas.rs`), layer effects included. What the planner can't express returns `Unsupported` and the canvas falls back to the CPU compositor (`photocraft-compose`, also the reference for export and tests): Multichannel documents, and documents or effect regions over the texture limit. Pieces the GPU can't derive itself are rasterised once on the CPU and cached (`compose::masks` for vector masks, `compose::shape_split` for stroked shapes with clipped layers, effect distance fields). Timings of the interactive paths: `cargo run --release -p photocraft-ui-egui --example interactive_bench`; effects: `--example fx_bench` (`--compare files…` for GPU vs CPU); the cost of changing a chisel bevel's size (a dragged slider, GPU and CPU, ellipse and text): `--example bevel_bench`; large documents (open, refresh, thumbnails, a filter, a stroke, saves; one operation per run so `/usr/bin/time -l` gives its peak memory): `--example large_image_bench -- --size 14000x14000 --op psd`. The app requests the adapter's own texture limit (egui's default is 8192 px; see `gpu_canvas::use_adapter_limits`); beyond it the CPU fallback composites and uploads in bands (`compose::render_bands`), and exports, thumbnails and flattening stream bands too, so no full-size float composite is ever held. Rendering fidelity: `cargo run --release -p photocraft-io --example oracle_diff -- corpus/psd` (the whole PSD oracle table in seconds). `ui.inspect` → `perf.renderPath` names the reason, typed, with the last 32 changes, and `perf.timings.gpuFallback` as text (`null` on the GPU path); the log has one `render path:` line per change, and the status bar says CPU Rendering (or GPU Memory Full) with the reason in its tooltip.
 - **Layer effects on the GPU** (`gpu/src/fx.rs`, kernels in `gpu/src/compose.wgsl`). Every enabled effect becomes a *map program* over the layer's effect region (shift, dilate, Gaussian blur, glow ramp, bevel height and shading, contour, stroke band), mirroring `compose::effects` step by step; the chunked composite then paints through the maps, clipped to that region, and copies the result back into the backdrop in place, so a small text layer costs only its own pixels. The layer's shape (`compose::layer_shape`) and its distance fields (`compose::effects::distance_field`: a transform whose tie-breaking a parallel GPU pass can't reproduce bit for bit) come from compose on the CPU: bands computed in parallel, except the Euclidean fields of precise glows and chiselled bevels (a halo as tall as the bevel size would make most of a band's work redundant), which are one window whose passes run on all threads, the CPU compositor's own way. Everything is cached per layer state: an unrelated edit, or an effect's colour or opacity, rebuilds nothing; a brush dab recomputes the touched 256² tiles grown by the effect reach; changing one effect's geometry rebuilds that effect only. Cache budget `gpu::FX_BUDGET` (1.5 GB, least recently drawn layers evicted first). `PHOTOCRAFT_FX_TRACE=1` prints the CPU time of each rebuild.
 - The canvas grows a stroke's damage rect by the effect reach of the layers around it (`canvas::effect_reach`), so effects beyond the dab refresh too (on both paths).
 - **Numbers** (7360 × 4912, 8 text layers + one painted layer with drop shadow + stroke + bevel, Hue/Saturation on top; M4 Pro; `cargo run --release -p photocraft-ui-egui --example fx_bench`), CPU fallback → GPU: full refresh with warm effect maps 5.7 s → 47 ms; Hue/Saturation tweak above the effects 4.7 s → 31 ms; brush dab on a plain layer 32 → 1.7 ms; brush dab on the effect layer (its maps rebuilt around the dab) 659 → 3.7 ms; first refresh (all maps built) 6.4 s → 0.39 s. With the CPU ~14× oversubscribed by parallel builds (min of 7 runs): 8.1 s → 0.33 s, 9.9 s → 0.28 s, 28 → 2.2 ms, 1.7 s → 89 ms; moving a text layer 7 px 336 → 13 ms. `fx_bench --compare corpus/psd/…/*.psd` reports the GPU vs CPU difference on real files (30 of the 31 corpus files with effects render on the GPU, worst 0.12/255).
@@ -406,7 +406,8 @@ cargo xtask scorecard            # regenerate docs/scorecard.md
 cargo xtask scorecard --check    # what CI runs: fails if the committed file is stale
 cargo xtask perf                 # full benchmark run (tens of minutes, release build)
 cargo xtask perf --quick         # small synthetic documents (about a minute once built)
-cargo xtask perf --update-baseline   # also write perf/baseline.json from this run
+cargo xtask perf --update-baseline   # also write perf/baseline.json from this run (refused when contended)
+cargo xtask perf --update-baseline --from a/results.json --from b/results.json ...   # baseline from saved runs
 ```
 
 **Sources.** The scorecard reads only committed files, so it is deterministic:
@@ -422,7 +423,9 @@ cargo xtask perf --update-baseline   # also write perf/baseline.json from this r
   a number.
 - `perf/baseline.json`: the numbers the scorecard shows, written only by
   `cargo xtask perf --update-baseline`, with the machine (CPU, RAM, GPU adapter, OS), its machine
-  class, commit, date and load average.
+  class, commit, date, load average, core count and how many runs it was built from. A baseline
+  recorded with `--allow-contended` carries `"contended": true`, and the scorecard labels any
+  contended baseline (one whose 1-minute load at the start was above `max_load_per_core` per core).
 - `crates/io/tests/it/corpus.rs`: the corpus floors (every `Source { .. }` constant).
 - `xtask/*-corpus.sha256`: file counts for pinned corpora, so stale counts in doc comments cannot
   change the reported denominators. No downloaded corpus is needed to generate the scorecard.
@@ -439,11 +442,27 @@ breaks, when a scenario's p50 regresses more than 15 % (`--threshold`, or `regre
 against a baseline from the same machine class and mode, or when a bench fails. Runs from
 different machine classes are never compared, and `--quick` numbers are only compared with a
 quick baseline. Machines that run other work give noisy numbers: check the load average in the
-summary before trusting a regression, and record it next to any number you quote.
+summary before trusting a regression, and record it next to any number you quote. A run whose
+1-minute load at the start (sampled before the release build, so the harness's own compile doesn't
+count) is above `settings.max_load_per_core` per core is marked **contended**
+in the summary, and `--update-baseline` refuses to record it unless `--allow-contended` is given.
+
+**Recording a baseline.** One run is noisy, especially on the shared nightly runner, so build the
+baseline from several: download the last five or more nightly `perf-results` artifacts
+(`gh run download <run id> -n perf-results -D runs/<run id>`), then run
+`cargo xtask perf --update-baseline --from runs/<id1>/results.json --from runs/<id2>/results.json ...`
+(add `--allow-contended` for the GitHub runner, which is never idle). It needs at least
+`settings.baseline_min_runs` runs of one machine class and mode, all from a clean tree. Each
+scenario gets the median p50 and the highest p50 of the runs; a regression is judged against that
+highest p50 (the runs' own noise), so only changes bigger than the runner's spread flag. It also
+prints which budgets could be enforced (within `settings.enforce_margin` of the budget in every
+run) and which enforced budgets went over in some run. Commit `perf/baseline.json` and the
+regenerated `docs/scorecard.md` in a PR.
 
 **Measuring one scenario.** A full run is tens of minutes; one row is seconds once its bench is
-built. `xtask perf`'s own flags are `--quick`, `--update-baseline`, `--threshold`, `--bench`
-(repeatable, one bench per name), `--skip-build` and `--reuse`; it has no way to pick a single
+built. `xtask perf`'s own flags are `--quick`, `--update-baseline` (with `--from` and
+`--allow-contended`), `--threshold`, `--bench` (repeatable, one bench per name), `--skip-build`
+and `--reuse`; it has no way to pick a single
 *row*. The bench binary takes those filters itself — `--only <substring>` (row names are matched
 with `contains`), `--group <name>` and `--reps N` — so to time one row run the bench directly:
 
diff --git a/docs/file-format-parity.md b/docs/file-format-parity.md
index dc5975cc0b..f49fa461de 100644
--- a/docs/file-format-parity.md
+++ b/docs/file-format-parity.md
@@ -1,6 +1,8 @@
 # File-format parity
 
-> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-24 · **Change:** minor (Photoshop's `MTrn` merged-transparency marker, from a layered TIFF saved with Save Transparency, marks the merged transparency, #8877; layered TIFF writes the TySh text version and descriptor in PSD big-endian order while the header, matrix, warp and bounds keep container order, #9098; layered TIFF writes Photoshop's 14-byte global layer mask, so Photoshop opens the layers instead of only the composite, #9095; legacy PSD point text placed from the layout ink box after font resolution, #6094; `.atn`: a recorded Save As imports with its format and file (`file.saveAs`, `file.saveACopy` for As a Copy) instead of as a plain Save that wrote over the played file, #7102; folder destinations stop playback until #5430; `.asl` layer style libraries read and written, #1051; JPEG Options on File › Save, Save As and Save a Copy, FILE-215-19 partial (no Matte, progressive Scans or size preview); 32-bit Hue/Saturation unclipped and Colorize as Photoshop does them, Photoshop-oracle floor 190/258, #5781; JPEG Options on Save As and Save a Copy, FILE-215-19; TIFF compression for scripted saves, `tiffCompression`, #5301; the Nikon D4 white level follows the sample depth (12 and 14 bit), #5978; Apply Layer Comp action mapping, #7101; Cineon write: 10-bit gray/RGB; animated WebP frames load into video layers, #1198; Photoshop mixed-order TIFF type geometry, #4758; DDS textures save: uncompressed or BC1–BC3, optional mip chain, DDS Options in Save As (#1327); PSD smart filters: 53 filters (39 more: Pinch, Polar Coordinates, Ripple, Spherize, Twirl, Wave, ZigZag, Invert, Blur, Surface Blur, Smart Sharpen, Diffuse, Wind, Offset, Mezzotint, Clouds, Difference Clouds, Fibers, Lens Flare and others) plus Hue/Saturation and Perspective Warp mapped both ways, #6296, #6298, #6300, #6302, #6304, #6314, #6316, #6267, #6268, FILE-215-2; large-file fixtures: a 20 MP layered PSD, a 150-layer layout, a 2 GB PSD and a 4.4 GB PSB generated at test time and round-tripped, FILE-216-2 done, #5107; earlier: smart objects keep Photoshop's Cylinder warp through re-renders and saves, #4112; PNG `sTER` stereo pairing kept on save, #6063; PDF write one flattened page via Save As / Save a Copy / CLI, #3401; CMYK Invert, Posterize and Threshold on the inks; smart filter masks on PSD open and save; Photoshop-oracle floor 188/258; lossy DNG, compression 34892, decodes with its levels and LinearizationTable applied to the stored 8-bit samples, FILE-215-11; CMYK Hue/Saturation and Color Balance keep the black ink; CMYK Posterize on the stored values, psd-tools oracle floor 242/309; CMYK adjustment layers composite on the document's inks; Photoshop-oracle floor 165/258; CMYK Brightness/Contrast on the inks, CMYK Threshold's luma; modern Brightness/Contrast's brightness curve; Photoshop-oracle floor 151/258; Lab documents composite on their stored L, a, b; Photoshop-oracle floor 152/258; Levels on whole levels at every step with Photoshop's shadow toe; Photoshop-oracle floor 146/258, psd-tools 238/309; 32-bit adjustments unclipped; Photoshop-oracle floor 149/258; mask feathers blur with their exact variance; Threshold splits on Photoshop's luminosity; a pass-through clipping base with an adjustment renders isolated; psd-tools oracle floor 240/309; 16-bit Posterize as Photoshop bins it; psd-tools oracle floor 241/309; Gradient Map luminosity; Photoshop-oracle floor 147/258; PSD: `Mt16`/`Mt32` merged transparency read; palette PNGs open in Indexed Color mode, #4804; 16-bit Lab Invert; Photoshop-oracle floor 145/258; `.atn` import maps 112 events; DDS textures open, #1327; DPX read and write, #1049; #2465 fixed: CS2 placed layers with only a `PlLd` block open their contents; Photoshop Actions `.atn` read and write; `.shc` contour files read and write; earlier the same day: indexed BMP palette mode; Save keeps a JPEG's quality and a WebP's encoding; Amiga IFF write: 24-plane ILBM, Save As `.iff`; PSD stores spot channels as Photoshop does, ink 0 = solid, and numbers them in 1053, #7415 split; TIFF writes and reads alpha and spot channels as extra samples with Photoshop's channel resources, PSD output unchanged, FILE-215-7, FILE-215-17's TIFF part, #7415; Photoshop's `MTrn` merged-transparency marker, from a layered TIFF saved with Save Transparency, marks the merged transparency) · **Target:** Adobe Photoshop 2026
+> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-24 · **Change:** minor (PSD Filter Gallery: Halftone Pattern dot/circle/line settings survive PSD/PSB saves (#8940); Photoshop's `MTrn` merged-transparency marker, from a layered TIFF saved with Save Transparency, marks the merged transparency, #8877; layered TIFF writes the TySh text version and descriptor in PSD big-endian order while the header, matrix, warp and bounds keep container order, #9098; layered TIFF writes Photoshop's 14-byte global layer mask, so Photoshop opens the layers instead of only the composite, #9095; legacy PSD point text placed from the layout ink box after font resolution, #6094; `.atn`: a recorded Save As imports with its format and file (`file.saveAs`, `file.saveACopy` for As a Copy) instead of as a plain Save that wrote over the played file, #7102; folder destinations stop playback until #5430; `.asl` layer style libraries read and written, #1051; JPEG Options on File › Save, Save As and Save a Copy, FILE-215-19 partial (no Matte, progressive Scans or size preview); 32-bit Hue/Saturation unclipped and Colorize as Photoshop does them, Photoshop-oracle floor 190/258, #5781; JPEG Options on Save As and Save a Copy, FILE-215-19; TIFF compression for scripted saves, `tiffCompression`, #5301; the Nikon D4 white level follows the sample depth (12 and 14 bit), #5978; Apply Layer Comp action mapping, #7101; Cineon write: 10-bit gray/RGB; animated WebP frames load into video layers, #1198; Photoshop mixed-order TIFF type geometry, #4758; DDS textures save: uncompressed or BC1–BC3, optional mip chain, DDS Options in Save As (#1327); PSD smart filters: 53 filters (39 more: Pinch, Polar Coordinates, Ripple, Spherize, Twirl, Wave, ZigZag, Invert, Blur, Surface Blur, Smart Sharpen, Diffuse, Wind, Offset, Mezzotint, Clouds, Difference Clouds, Fibers, Lens Flare and others) plus Hue/Saturation and Perspective Warp mapped both ways, #6296, #6298, #6300, #6302, #6304, #6314, #6316, #6267, #6268, FILE-215-2; large-file fixtures: a 20 MP layered PSD, a 150-layer layout, a 2 GB PSD and a 4.4 GB PSB generated at test time and round-tripped, FILE-216-2 done, #5107; earlier: smart objects keep Photoshop's Cylinder warp through re-renders and saves, #4112; PNG `sTER` stereo pairing kept on save, #6063; PDF write one flattened page via Save As / Save a Copy / CLI, #3401; CMYK Invert, Posterize and Threshold on the inks; smart filter masks on PSD open and save; Photoshop-oracle floor 188/258; lossy DNG, compression 34892, decodes with its levels and LinearizationTable applied to the stored 8-bit samples, FILE-215-11; CMYK Hue/Saturation and Color Balance keep the black ink; CMYK Posterize on the stored values, psd-tools oracle floor 242/309; CMYK adjustment layers composite on the document's inks; Photoshop-oracle floor 165/258; CMYK Brightness/Contrast on the inks, CMYK Threshold's luma; modern Brightness/Contrast's brightness curve; Photoshop-oracle floor 151/258; Lab documents composite on their stored L, a, b; Photoshop-oracle floor 152/258; Levels on whole levels at every step with Photoshop's shadow toe; Photoshop-oracle floor 146/258, psd-tools 238/309; 32-bit adjustments unclipped; Photoshop-oracle floor 149/258; mask feathers blur with their exact variance; Threshold splits on Photoshop's luminosity; a pass-through clipping base with an adjustment renders isolated; psd-tools oracle floor 240/309; 16-bit Posterize as Photoshop bins it; psd-tools oracle floor 241/309; Gradient Map luminosity; Photoshop-oracle floor 147/258; PSD: `Mt16`/`Mt32` merged transparency read; palette PNGs open in Indexed Color mode, #4804; 16-bit Lab Invert; Photoshop-oracle floor 145/258; `.atn` import maps 112 events; DDS textures open, #1327; DPX read and write, #1049; #2465 fixed: CS2 placed layers with only a `PlLd` block open their contents; Photoshop Actions `.atn` read and write; `.shc` contour files read and write; earlier the same day: indexed BMP palette mode; Save keeps a JPEG's quality and a WebP's encoding; Amiga IFF write: 24-plane ILBM, Save As `.iff`; PSD stores spot channels as Photoshop does, ink 0 = solid, and numbers them in 1053, #7415 split; TIFF writes and reads alpha and spot channels as extra samples with Photoshop's channel resources, PSD output unchanged, FILE-215-7, FILE-215-17's TIFF part, #7415; Photoshop's `MTrn` merged-transparency marker, from a layered TIFF saved with Save Transparency, marks the merged transparency) · **Target:** Adobe Photoshop 2026
+
+**PSD Filter Gallery (#8940, 2026-10-23):** Halftone Pattern maps its size, contrast and dot/circle/line pattern as editable settings on import and export, with the reference application's descriptor keys (`HlSz`, `Cntr`, `ScrT`: `ScrD`/`ScrC`/`ScrL`). PSD/PSB round trips pass at 8/16/32 bits. This does not claim pixel equivalence for the existing renderer. Unknown or malformed settings remain verbatim on import.
 
 Every format Photoshop 2026 (27.11.0) reads or writes, with PhotoCraft's support, fidelity and
 tests. Photoshop's list comes from its `Info.plist` `CFBundleDocumentTypes`, the PiPL read/write
@@ -148,6 +150,7 @@ remaining gaps in #1606 stay tracked with per-sample corpus ceilings.
 | 2026-10-23 | minor | TIFF: alpha and spot channels are written and read as extra samples (at most 16) with Photoshop's channel resources (1006, 1045, 1077, 1053), spot ink stored 0 = solid as Photoshop 27.11's TIFFs store it; PSD output is unchanged. FILE-215-7 done, FILE-215-17 partial (its TIFF part) (#7415, supersedes #3121) |
 | 2026-10-23 | patch | PSD and layered TIFF: the `MTrn` block Photoshop writes in a layered TIFF saved with Save Transparency (a positive layer count, `nrTM` in an `II` file) marks the merged image's first extra channel as its transparency, like `Mtrn`/`Mt16`/`Mt32`: such a file no longer opens with its transparency also as an alpha channel (named "Transparency" in Photoshop 27.11's file), and a PSD save no longer writes it twice. A PSD save with an opaque composite drops any of these markers kept from the opened file, so its first alpha channel no longer reopens as transparency and vanishes (split from #7415; credit #3121) |
 | 2026-10-23 | minor | Amiga IFF write: Save As `.iff` stores a 24-plane ILBM (ByteRun1, alpha as a 1-bit mask plane), and 24-plane ILBMs open |
+| 2026-10-23 | minor | #8940: Filter Gallery Halftone Pattern maps size, contrast and dot/circle/line both ways with the reference application's descriptor keys (`HlSz`, `Cntr`, `ScrT`); PSD/PSB round trips at 8/16/32 bits, malformed descriptors preserved verbatim. Other gallery effects remain partial; no floor or estimate changed. |
 | 2026-10-22 | minor | 32-bit Hue/Saturation as Photoshop does it: the raised saturation isn't clipped (saturated colours leave 0..1), the chroma is scaled around the lightness by Photoshop's saturation factor (measured at every whole percent), so colours at or above lightness 1 keep their hue, and Colorize builds its colour with the saturation times 1 − \|Lightness\| (8 and 16 bits unchanged): photoshop rgb32 hue-saturation and hue-saturation-colorize pass; Photoshop-oracle floor 188 → 190 of 258 (#5781) |
 | 2026-10-19 | minor | JPEG Options on File › Save, Save As and Save a Copy (FILE-215-19 partial: no Matte, progressive Scans or size preview) |
 | 2026-10-18 | minor | Scripted TIFF saves take `tiffCompression` (none, LZW, ZIP), and the CLI `--tiff-compression` (#5301) |
diff --git a/docs/gaps.md b/docs/gaps.md
index a23e79b649..0c94561436 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -1,6 +1,6 @@
 # Where PhotoCraft falls short of Photoshop
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-26 · **Change:** minor (cropped selection morphology and command mask conversion performance evidence added; G9: 12 of 178 preferences do nothing, as the scorecard prefs audit counts them; G6: Art History Brush landed as partial, TOOL-213-20, #1610, so no toolbar tool is missing; G4: five hard-round built-in presets use 5% spacing to remove stacked-tip outlines and reduce pressure-opacity bands, #8842; G9: Crop tool canvas menu, #6561; G2: Content-Aware Scale seam carving 1.65–3.6× faster with unchanged output, P28 row 3.3 → 1.6 s on a 4-core VM, #5236; G9: UI scale presets done, 105–120% steps, #3222; G14: lossy DNG, raw sidecars, Camera Raw Defaults live, Calibration and Auto, CR3 assessed as not clean-room feasible; G8: PSD type on a path opens on its path and saves back into the file's `Txt2`, #7962; G11: a recorded Save As imports with its format and file (`file.saveAs`, `file.saveACopy` for As a Copy) instead of as a plain Save that wrote over the played file, #7102; folder destinations stop playback until #5430; adjustment clipping stays visible in compact Properties, #5231; G9: Color panel modes, ramp and copy commands, the same in every theme, UI-217-17, #6000; G17: Help › Check for Updates and an opt-out check once per launch, DIST-220-1 partial, #5485; G10: `.asl` style libraries landed, #1051; G8: area type (TYPE-218-10); G1: smart objects keep Photoshop's Cylinder warp, #4112; G8: paragraph direction buttons in the Paragraph panel and options bar, TYPE-218-2 partial; G1: 32-bit Hue/Saturation and Colorize as Photoshop does them, Photoshop-oracle floor 190/258, #5781; G11: compound layer properties export as separate Photoshop Set events, rename last, #8304; G11: Batch and droplets take the result at the action's Save step, so actions ending in Save As and Close work; G11: `.atn` steps that switch to another open document import, play and save back, #7103; G14: the Nikon D4 white level follows the sample depth, so 12-bit D4 NEFs no longer open 2.6 stops dark, #5978; G14: a Nikon NEF's Adobe RGB preview is read as Adobe RGB (maker-note ColorSpace 0x001E), #5987; Apply Layer Comp action mapping, #7101; G10: JPEG Options dialog landed, FILE-215-19 partial (no Matte, progressive Scans or size preview); G10: Cineon write; G10: DPX read and write, #1049, Cineon and Amiga IFF read; Classical Object Finder improvement; learned segmentation remains open; G4: named, stateful section locks and visible keyboard focus in Brush Settings; G4: independent Brush Pose tilt-axis overrides, #3825 partial; G4: Transfer Mixer-only controls, #3825 partial; G9: Preferences › File Handling › Save in Background takes effect, #6207, 24 of 169 preferences do nothing; G7: Content-Aware Move previews every selection the command takes, coarse then exact, TOOL-213-4 done, #6680; G4: Pattern Stamp and Background Eraser draw live, TOOL-213-7; G9: Animated Zoom pref read: holding the Zoom tool zooms continuously, #6210, prefs that do nothing 25 of 166; G2: a cancelled 24 MP Gaussian Blur job stops in at most 44 ms, P25 under its 200 ms budget in local runs, baseline not re-run, #6205; G1: generated large-file fixtures, a 4.38 GB PSB opens on Windows through io, FILE-216-2 done, #5107; G9: fill and adjustment layers copy and paste whole, #2344; G1: smart filter masks show on PSD open, Photoshop-oracle floor 188/258; G10: DPX read and write, #1049, Cineon read; G1: CMYK Hue/Saturation and Color Balance keep the black ink; G1: CMYK Posterize on the stored values, psd-tools oracle floor 242/309; G1: CMYK adjustment layers composite on the document's inks, Photoshop-oracle floor 165/258; G1: CMYK Brightness/Contrast on the inks, CMYK Threshold's luma; G1: modern Brightness/Contrast's brightness curve matches Photoshop, Photoshop-oracle floor 151/258; G1: Lab documents composite on their stored L, a, b, Photoshop-oracle floor 152/258; G1: Levels on whole levels at every step, Photoshop-oracle floor 146/258, psd-tools 238/309; G1: 32-bit Brightness/Contrast legacy, Channel Mixer, Photo Filter and Black & White tint unclipped as in Photoshop, Photoshop-oracle floor 149/258; G1: mask feathers blur with their exact variance, psd-tools oracle floor 240/309; G1: Threshold splits on Photoshop's luminosity, psd-tools oracle floor 241/309; G1: pass-through clipping base with an adjustment renders isolated, psd-tools oracle floor 240/309; G1: 16-bit Posterize as Photoshop bins it, psd-tools oracle floor 241/309; G1: Gradient Map driven by the W3C luminosity, Photoshop-oracle floor 147/258; G7: Field Blur's on-canvas pins, #3373; G4: Hue Jitter amount track, #3825 partial; G4: minimum field interaction, #3825 partial; G1: CMYK Invert, Posterize and Threshold on the inks, 16-bit Lab Invert; Photoshop-oracle floor 145/258; G11: `.atn` import maps 112 events: Select and Mask, Filter Gallery Spatter, Ripple, Crystallize, Pattern Fill layers, mask targeting, Step Backward, nudges in points, Bitmap mode; G5: Free Transform H/V skew fields; G9: toolbar tool shortcut editing; refreshed against main: G2, G5, G7, G9, G10, G13, G14, G17 items that landed; G10: DPX read and write, #1049; G4: checkbox-only Brush Settings rows; G11: Load/Save Actions `.atn` landed, AUTO-219-2 partial; G5: hold-a-key spring-loaded tools landed, #2672; G1: #2465 fixed; stale missing-tool rows corrected: Color Replacement, Red Eye and Add/Delete Anchor Point are live tools, so only Art History Brush is missing; no estimate changed; G10: Amiga IFF write; G10: PSD spot channels in Photoshop's polarity, earlier PhotoCraft PSDs keep their ink, #7415 split; G10: TIFF alpha and spot channels written and read as extra samples, FILE-215-7 done, FILE-215-17's TIFF part, #7415) · **Target:** Adobe Photoshop 2026
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-27 · **Change:** minor (G1: Halftone Pattern Filter Gallery settings survive PSD/PSB saves (#8940); cropped selection morphology and command mask conversion performance evidence added; G9: 12 of 181 preferences do nothing, as the scorecard prefs audit counts them; G6: Art History Brush landed as partial, TOOL-213-20, #1610, so no toolbar tool is missing; G4: five hard-round built-in presets use 5% spacing to remove stacked-tip outlines and reduce pressure-opacity bands, #8842; G9: Crop tool canvas menu, #6561; G2: Content-Aware Scale seam carving 1.65–3.6× faster with unchanged output, P28 row 3.3 → 1.6 s on a 4-core VM, #5236; G9: UI scale presets done, 105–120% steps, #3222; G14: lossy DNG, raw sidecars, Camera Raw Defaults live, Calibration and Auto, CR3 assessed as not clean-room feasible; G8: PSD type on a path opens on its path and saves back into the file's `Txt2`, #7962; G11: a recorded Save As imports with its format and file (`file.saveAs`, `file.saveACopy` for As a Copy) instead of as a plain Save that wrote over the played file, #7102; folder destinations stop playback until #5430; adjustment clipping stays visible in compact Properties, #5231; G9: Color panel modes, ramp and copy commands, the same in every theme, UI-217-17, #6000; G17: Help › Check for Updates and an opt-out check once per launch, DIST-220-1 partial, #5485; G10: `.asl` style libraries landed, #1051; G8: area type (TYPE-218-10); G1: smart objects keep Photoshop's Cylinder warp, #4112; G8: paragraph direction buttons in the Paragraph panel and options bar, TYPE-218-2 partial; G1: 32-bit Hue/Saturation and Colorize as Photoshop does them, Photoshop-oracle floor 190/258, #5781; G11: compound layer properties export as separate Photoshop Set events, rename last, #8304; G11: Batch and droplets take the result at the action's Save step, so actions ending in Save As and Close work; G11: `.atn` steps that switch to another open document import, play and save back, #7103; G14: the Nikon D4 white level follows the sample depth, so 12-bit D4 NEFs no longer open 2.6 stops dark, #5978; G14: a Nikon NEF's Adobe RGB preview is read as Adobe RGB (maker-note ColorSpace 0x001E), #5987; Apply Layer Comp action mapping, #7101; G10: JPEG Options dialog landed, FILE-215-19 partial (no Matte, progressive Scans or size preview); G10: Cineon write; G10: DPX read and write, #1049, Cineon and Amiga IFF read; Classical Object Finder improvement; learned segmentation remains open; G4: named, stateful section locks and visible keyboard focus in Brush Settings; G4: independent Brush Pose tilt-axis overrides, #3825 partial; G4: Transfer Mixer-only controls, #3825 partial; G9: Preferences › File Handling › Save in Background takes effect, #6207, 24 of 169 preferences do nothing; G7: Content-Aware Move previews every selection the command takes, coarse then exact, TOOL-213-4 done, #6680; G4: Pattern Stamp and Background Eraser draw live, TOOL-213-7; G9: Animated Zoom pref read: holding the Zoom tool zooms continuously, #6210, prefs that do nothing 25 of 166; G2: a cancelled 24 MP Gaussian Blur job stops in at most 44 ms, P25 under its 200 ms budget in local runs, baseline not re-run, #6205; G1: generated large-file fixtures, a 4.38 GB PSB opens on Windows through io, FILE-216-2 done, #5107; G9: fill and adjustment layers copy and paste whole, #2344; G1: smart filter masks show on PSD open, Photoshop-oracle floor 188/258; G10: DPX read and write, #1049, Cineon read; G1: CMYK Hue/Saturation and Color Balance keep the black ink; G1: CMYK Posterize on the stored values, psd-tools oracle floor 242/309; G1: CMYK adjustment layers composite on the document's inks, Photoshop-oracle floor 165/258; G1: CMYK Brightness/Contrast on the inks, CMYK Threshold's luma; G1: modern Brightness/Contrast's brightness curve matches Photoshop, Photoshop-oracle floor 151/258; G1: Lab documents composite on their stored L, a, b, Photoshop-oracle floor 152/258; G1: Levels on whole levels at every step, Photoshop-oracle floor 146/258, psd-tools 238/309; G1: 32-bit Brightness/Contrast legacy, Channel Mixer, Photo Filter and Black & White tint unclipped as in Photoshop, Photoshop-oracle floor 149/258; G1: mask feathers blur with their exact variance, psd-tools oracle floor 240/309; G1: Threshold splits on Photoshop's luminosity, psd-tools oracle floor 241/309; G1: pass-through clipping base with an adjustment renders isolated, psd-tools oracle floor 240/309; G1: 16-bit Posterize as Photoshop bins it, psd-tools oracle floor 241/309; G1: Gradient Map driven by the W3C luminosity, Photoshop-oracle floor 147/258; G7: Field Blur's on-canvas pins, #3373; G4: Hue Jitter amount track, #3825 partial; G4: minimum field interaction, #3825 partial; G1: CMYK Invert, Posterize and Threshold on the inks, 16-bit Lab Invert; Photoshop-oracle floor 145/258; G11: `.atn` import maps 112 events: Select and Mask, Filter Gallery Spatter, Ripple, Crystallize, Pattern Fill layers, mask targeting, Step Backward, nudges in points, Bitmap mode; G5: Free Transform H/V skew fields; G9: toolbar tool shortcut editing; refreshed against main: G2, G5, G7, G9, G10, G13, G14, G17 items that landed; G10: DPX read and write, #1049; G4: checkbox-only Brush Settings rows; G11: Load/Save Actions `.atn` landed, AUTO-219-2 partial; G5: hold-a-key spring-loaded tools landed, #2672; G1: #2465 fixed; stale missing-tool rows corrected: Color Replacement, Red Eye and Add/Delete Anchor Point are live tools, so only Art History Brush is missing; no estimate changed; G10: Amiga IFF write; G10: PSD spot channels in Photoshop's polarity, earlier PhotoCraft PSDs keep their ink, #7415 split; G10: TIFF alpha and spot channels written and read as extra samples, FILE-215-7 done, FILE-215-17's TIFF part, #7415) · **Target:** Adobe Photoshop 2026
 
 Every known shortfall against Photoshop 2026 (27.11.0), one entry each, ranked by user impact
 on the way to beta. This is the work list agents pick from: take the highest-ranked entry that
@@ -40,6 +40,7 @@ what an agent can't finish alone.
 ## Feature gaps
 
 ### G1. PSD fidelity and Photoshop acceptance
+- **Done 2026-10-23 (#8940):** Filter Gallery Halftone Pattern preserves size, contrast and dot/circle/line through PSD/PSB import/export, with the reference application's descriptor keys (`HlSz`, `Cntr`, `ScrT`). Malformed descriptors stay verbatim. Other unsupported gallery effects remain opaque on import or produce an export warning.
 - **Missing:** PSDs we write are not always accepted by Photoshop, and Photoshop-authored files
   don't always render as Photoshop renders them.
 - **Partial (2026-10-15, #5972 A1):** `GdFl` noise fills render when all three RGB ranges are
@@ -285,7 +286,7 @@ what an agent can't finish alone.
 - **Progress (2026-10-15):** the Color panel has Photoshop's panel-menu modes (Hue Cube, Brightness
   Cube, Color Wheel, Grayscale/RGB/HSB/CMYK/Lab/Web Color sliders), its colour ramp and copy
   commands, the same in every theme (UI-217-17, #2569, #6000; `ui-egui/src/color_panel_ui.rs`).
-- **Missing:** 12 of 178 preferences do nothing (scorecard prefs audit, 2026-10-25); panel groups can't
+- **Missing:** 12 of 181 preferences do nothing (scorecard prefs audit, 2026-10-27); panel groups can't
   float or tear off into OS windows (UI-217-5, #1828, #1213, #2305); more themes (UI-217-11, #2661); a single pixel layer
   copies without its mask and styles (UI-217-23; fill and adjustment layers copy whole, #2344); tool-specific context menus beyond brushes, selections, Pen and
   Crop
@@ -395,6 +396,7 @@ what an agent can't finish alone.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-27 | minor | G9: 12 of 181 preferences do nothing, the scorecard's count with integration batch 9 (#9775) on main; no estimate changed |
 | 2026-10-26 | minor | Expand/Contract/Border distance work, mask reads and replacement cropped to nonzero bounds; bounded distances for radii ≤5; 36 MP exact-output comparisons improve 1.54–37.82× across eight cases; percentages, estimates and scorecard budgets unchanged |
 | 2026-10-25 | minor | G9: the count of preferences that do nothing is the scorecard's again, 12 of 178 (it still said 24 of 171, from 2026-10-15); no estimate changed |
 | 2026-10-25 | minor | G6: Art History Brush landed as partial (TOOL-213-20, #1610), so no toolbar tool is missing; no percentage or estimate changed |
@@ -402,6 +404,7 @@ what an agent can't finish alone.
 | 2026-10-23 | minor | G10: PSD stores and reads spot channels as Photoshop does (ink 0 = solid) with their identifiers (1053); PSDs from PhotoCraft 0.1.0–0.16.0 keep their ink (#7415 split, part 4); FILE-215-17 stays partial; estimate unchanged |
 | 2026-10-23 | minor | G10: TIFF alpha and spot channels written and read as extra samples with Photoshop's channel resources, PSD output unchanged (#7415); FILE-215-7 leaves the list, FILE-215-17 narrows to RGB/CMYK spot preview and PDF Separation |
 | 2026-10-23 | minor | G10: Amiga IFF write landed (24-plane ILBM, Save As `.iff`) and 24-plane ILBMs open |
+| 2026-10-23 | minor | #8940: Filter Gallery Halftone Pattern maps size, contrast and dot/circle/line both ways with the reference application's descriptor keys (`HlSz`, `Cntr`, `ScrT`); PSD/PSB round trips at 8/16/32 bits, malformed descriptors preserved verbatim. Other gallery effects remain partial; no floor or estimate changed. |
 | 2026-10-22 | minor | G17: Help › Check for Updates and an opt-out check once per launch (#5485), DIST-220-1 partial; estimate unchanged |
 | 2026-10-22 | minor | G1: 32-bit Hue/Saturation unclipped with Photoshop's saturation factor, bright colours keep their hue, Colorize's saturation scaled by 1 − \|Lightness\|; photoshop rgb32 hue-saturation and hue-saturation-colorize pass; Photoshop-oracle floor 188 → 190 of 258 (#5781) |
 | 2026-10-21 | minor | G9: adjustment clipping remains visible in compact Properties (#5231); no readiness percentage or estimate changed |
diff --git a/docs/mcp.md b/docs/mcp.md
index 75cacd6e41..8846a3be1c 100644
--- a/docs/mcp.md
+++ b/docs/mcp.md
@@ -57,6 +57,15 @@ Paths are relative to the corresponding root, or absolute paths beneath it; with
 filesystem authority is absent. Bridge mode uses `--bridge` and `--control-token-file` as
 described in [development.md](development.md). UI tools require a running desktop app.
 
+A client has the full rights of the roots it is given: it can read any file below the read
+root, and `doc_save`, `doc_export` and the export tools can create files anywhere below the
+write root. `doc_save` and `doc_export` replace an existing file only when its extension is an
+image or document format PhotoCraft writes (PNG, JPEG, TIFF, PSD, PSB, .pcraft, OpenRaster,
+PDF, …) or its bytes are an image; anything else (`src/main.rs`, `.env`) is refused and left
+untouched. The multi-file exports (layers, data sets) never replace a file. An agent reads
+text from documents (layer names, metadata) that may try to steer it, so prefer a dedicated
+output folder as the write root over a whole project.
+
 Use absolute root paths in MCP client configurations, since a relative root is resolved from
 the client's launch directory. In bridge mode, configure roots on the **desktop app**; root
 flags on `photocraft-cli mcp --bridge` are rejected. Explicit `--control-token` and
@@ -89,7 +98,7 @@ protocol messages. For `serve`, explicit credential flags require `--port` (or
 Existing document/session/job/UI tools remain listed, including the documented
 `doc_render_preview` spelling. There are no hidden legacy aliases. Every tool has a title
 and all four annotation hints. Generic command/control tools conservatively advertise writes;
-file saves may replace existing targets. Hints do not grant permission.
+file saves may replace existing image and document files. Hints do not grant permission.
 
 After a failed batch, `completed` and per-step `results` report successful steps, not a
 rolled-back transaction. Inspect the document and its history with `doc_inspect`; commands
diff --git a/docs/releasing.md b/docs/releasing.md
index 502e46b3ac..cb115b04ff 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -153,18 +153,31 @@ goes in `CARGO_TARGET_<TRIPLE>_RUSTFLAGS`, so host build scripts aren't affected
   not panic.
 - Release builds use the GUI subsystem, so Start Menu launches don't open a console window.
   The CLI stays console subsystem 3 so its output reaches the terminal.
-- `photocraft.wxs` (WiX v5) is a per-machine install into Program Files with an advertised
-  Start Menu shortcut. PhotoCraft becomes the default app for `.pcraft` and is listed under
-  "Open with" for PSD/PSB and image files. It also registers App Paths (Win+R `photocraft`).
+- `photocraft.wxs` (WiX v5) is a dual-scope package (Microsoft "Single Package Authoring"):
+  it installs per-user by default, without a UAC prompt, into `%LOCALAPPDATA%\Programs\ArtCraft\PhotoCraft`
+  (Windows Installer redirects the ProgramFiles folder in a per-user install); the setup
+  wizard's "Everyone on this computer" option, or `msiexec ... ALLUSERS=1`, installs per-machine into
+  `Program Files\ArtCraft\PhotoCraft` (`Program Files (x86)` for the 32-bit build). It installs an advertised Start Menu shortcut associated with the
+  `PhotocraftExe` file component. PhotoCraft
+  becomes the default app for `.pcraft` and is listed under "Open with" for PSD/PSB and image
+  files (in a per-user install those registrations and the `InstallDir` record live under
+  HKCU instead of HKLM; the package's registry roots follow the context automatically). It also
+  registers App Paths (Win+R `photocraft`). An install updates the copy registered in its own
+  context; installing in the other context while a copy already exists is stopped with a
+  message, not a silent duplicate (a scope change needs an explicit uninstall first).
   The MSI version is the numeric `X.Y.Z`, because MSI has no pre-release field. Same-version
   upgrades are allowed so that release candidates replace each other.
-- Double-clicking the MSI opens a setup wizard (WixUI_InstallDir without the licence page):
-  Welcome, install folder (remembered for upgrades in `HKLM\Software\PhotoCraft\InstallDir`),
+- Double-clicking the MSI opens a setup wizard (WixUI_InstallDir without the licence page; the scope page appears only for a new full-UI install, not for
+  maintenance, uninstall or reduced and silent runs):
+  a scope page ("Only for me" or "Everyone on this computer"), Welcome, the install folder
+  (remembered for upgrades in `HKLM` or `HKCU\Software\PhotoCraft\InstallDir` according to context),
   Ready, a progress page, and a Finish page that says where to find the app, with a ticked "Launch
   PhotoCraft" box. The pages name the full version (`photocraft.en-us.wxl`). `package.ps1` draws
   the wizard's banner and side bitmaps from the app icon, so no WiX stock art ships. `msiexec /qn`
-  still installs silently. Building needs the WiX UI and Util extensions:
-  `wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2`.
+  installs a new product silently per-user unless `ALLUSERS=1` is passed. Maintenance keeps the
+  existing installation context, and a major upgrade of an existing per-machine installation without
+  `ALLUSERS=1` is rejected rather than installed per-user. Building needs the WiX UI
+  and Util extensions: `wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2`.
 - Shortcut icon identifiers keep the executable's `.exe` extension: MSI uses the identifier
   as the cached icon filename, and an extensionless filename can render as a blank document
   icon. `packaging/windows/check-icons.ps1` checks the references and extensions in CI;
diff --git a/docs/scorecard.md b/docs/scorecard.md
index d025e67944..b9f9bb0a1e 100644
--- a/docs/scorecard.md
+++ b/docs/scorecard.md
@@ -6,10 +6,10 @@ Generated by `cargo xtask scorecard` from `perf/budgets.toml`, `perf/baseline.js
 
 | Area | Done | Partial | Missing | Key numbers |
 |---|---:|---:|---:|---|
-| [Performance](#performance) | 3 | 22 | 31 | 65 scenarios: 3 within budget, 22 over budget or failing, 9 tracked only, 27 not run, 4 not measurable yet (baseline 2026-10-05) |
+| [Performance](#performance) | 3 | 22 | 42 | 76 scenarios: 3 within budget, 22 over budget or failing, 9 tracked only, 38 not run, 4 not measurable yet (baseline 2026-10-05) |
 | [File compatibility](#file-compatibility) | 11 | 14 | 2 | io corpus: oracle ≥ 148/170, round trip ≥ 169/170; psd-tools corpus: oracle ≥ 249/309, round trip ≥ 308/309; photoshop oracles: oracle ≥ 190/258, round trip ≥ 258/258 |
 | [Tools](#tools) | 36 | 9 | 0 |  |
-| [Workspace and UI](#workspace-and-ui) | 15 | 6 | 2 | settings that do nothing: 12 of 178 (target 0) |
+| [Workspace and UI](#workspace-and-ui) | 15 | 6 | 2 | settings that do nothing: 12 of 181 (target 0) |
 | [Type](#type) | 5 | 5 | 0 |  |
 | [Automation](#automation) | 5 | 2 | 4 | 631 of 631 menu items live (100.0%) |
 | [Reliability](#reliability) | 5 | 2 | 0 | never-crash lints on 30 of 30 crates; panic_hunt present |
@@ -18,9 +18,11 @@ Generated by `cargo xtask scorecard` from `perf/budgets.toml`, `perf/baseline.js
 
 ## Performance
 
-Budgets: `perf/budgets.toml` (targets from #209, #210, #211). Numbers: the committed baseline (`perf/baseline.json`, full run), updated only by `cargo xtask perf --update-baseline`. The nightly `perf-nightly` workflow runs `cargo xtask perf` on a fixed macOS runner and fails on a broken enforced budget or a p50 regression over 15 % against a baseline from the same machine class. "Over budget" rows are targets the code doesn't meet yet: they are reported, and only their regressions fail.
+Budgets: `perf/budgets.toml` (targets from #209, #210, #211). Numbers: the committed baseline (`perf/baseline.json`, full run), updated only by `cargo xtask perf --update-baseline`. The nightly `perf-nightly` workflow runs `cargo xtask perf` on a fixed macOS runner and fails on a broken enforced budget. Its p50 regression check (over 15 %, against the baseline's highest p50 when it was built from several runs) runs only on machine class `macos-aarch64-apple-m4-pro-apple-m4-pro`, the baseline's. "Over budget" rows are targets the code doesn't meet yet: they are reported, and only their regressions fail.
 
-Baseline: 2026-10-05, commit `f5d2bcb54a`, Apple M4 Pro (48 GB), GPU Apple M4 Pro, macOS 15.6; load average 224.90 / 226.31 / 196.03 (1/5/15 min) at the start of the run.
+Baseline: 2026-10-05, 1 run, commit `f5d2bcb54a`, Apple M4 Pro (48 GB), GPU Apple M4 Pro, macOS 15.6; load average 224.90 / 226.31 / 196.03 (1/5/15 min) at the start of the run.
+
+**contended baseline** (load 224.90 on 14 cores): these numbers measure machine load, not the code.
 
 | Id | Scenario | Target | p50 ms | p95 ms | max ms | Peak RSS | GPU | Status | Issue |
 |---|---|---|---:|---:|---:|---:|---:|---|---|
@@ -48,7 +50,7 @@ Baseline: 2026-10-05, commit `f5d2bcb54a`, Apple M4 Pro (48 GB), GPU Apple M4 Pr
 | P21 | Content-Aware Fill on 10 MP | ≤ 1500 ms p95 | 218 | 256 | 256 | 1.8 GB | 1.8 GB | pass | [#210](https://github.com/storytold/photocraft/issues/210) |
 | P22 | Spot Healing stroke on 10 MP | ≤ 500 ms p95 | 157 | 247 | 247 | 1.8 GB | 1.9 GB | pass | [#210](https://github.com/storytold/photocraft/issues/210) |
 | P24 | Import 500 brushes (longest UI-thread step) | ≤ 100 ms max | – | – | – | – | – | not run | [#210](https://github.com/storytold/photocraft/issues/210) |
-| P25 | Cancel a Gaussian Blur job on 24 MP (until the worker exits) | ≤ 200 ms max | – | – | – | – | – | not run | [#210](https://github.com/storytold/photocraft/issues/210) |
+| P25 | Cancel a Gaussian Blur job on 24 MP (until the worker exits) | ≤ 200 ms p95 | – | – | – | – | – | not run | [#210](https://github.com/storytold/photocraft/issues/210) |
 | P49 | Cancel a Content-Aware Fill job on 24 MP (until the worker exits) | ≤ 200 ms max | – | – | – | – | – | not run | [#210](https://github.com/storytold/photocraft/issues/210) |
 | P50 | App frame time while a 24 MP Gaussian Blur job runs | ≤ 16 ms p95 | – | – | – | – | – | not run | [#210](https://github.com/storytold/photocraft/issues/210) |
 | P26 | Select › Modify › Smooth on 24 MP (radius 50) | ≤ 100 ms p95 | 99.9 | 216 | 251 | 1.0 GB | – | over budget (target not met yet) | [#211](https://github.com/storytold/photocraft/issues/211) |
@@ -85,6 +87,17 @@ Baseline: 2026-10-05, commit `f5d2bcb54a`, Apple M4 Pro (48 GB), GPU Apple M4 Pr
 | P66 | Relight on 24 MP | ≤ 1000 ms p95 | – | – | – | – | – | not run | [#211](https://github.com/storytold/photocraft/issues/211) |
 | P67 | Reduce Noise on 24 MP | ≤ 1000 ms p95 | – | – | – | – | – | not run | [#211](https://github.com/storytold/photocraft/issues/211) |
 | P68 | Photomerge multi-band blend, synthetic | track timing and peak RSS; no calibrated performance budget | – | – | – | – | – | not run | [#7758](https://github.com/storytold/photocraft/issues/7758) |
+| P69 | Move a layer with layer styles, CPU compositor | track only | – | – | – | – | – | not run | [#9330](https://github.com/storytold/photocraft/issues/9330) |
+| P70 | Change layer opacity, CPU compositor | ≤ 40 ms p95 | – | – | – | – | – | not run | [#9330](https://github.com/storytold/photocraft/issues/9330) |
+| P71 | Change layer fill, CPU compositor | ≤ 40 ms p95 | – | – | – | – | – | not run | [#9330](https://github.com/storytold/photocraft/issues/9330) |
+| P72 | Change blend mode, CPU compositor | ≤ 40 ms p95 | – | – | – | – | – | not run | [#9330](https://github.com/storytold/photocraft/issues/9330) |
+| P73 | Toggle visibility, CPU compositor | ≤ 20 ms p95 | – | – | – | – | – | not run | [#9330](https://github.com/storytold/photocraft/issues/9330) |
+| P74 | Undo a move, CPU compositor | track only | – | – | – | – | – | not run | [#9330](https://github.com/storytold/photocraft/issues/9330) |
+| P75 | Redo an opacity change, CPU compositor | track only | – | – | – | – | – | not run | [#9330](https://github.com/storytold/photocraft/issues/9330) |
+| P76 | Change layer opacity with Advanced Blending on another layer | ≤ 40 ms p95 | – | – | – | – | – | not run | [#6689](https://github.com/storytold/photocraft/issues/6689) |
+| P77 | Toggle an adjustment layer's visibility | ≤ 10 ms p95 | – | – | – | – | – | not run | [#6535](https://github.com/storytold/photocraft/issues/6535) |
+| P78 | Hide the top adjustment layer among 150 full-canvas layers, 6 MP, GPU budget forced to 512 MB (CPU fallback) | ≤ 30 ms p95 | – | – | – | – | – | not run | [#6533](https://github.com/storytold/photocraft/issues/6533) |
+| P79 | Zoomed-out reduced composite of a 30000x30000 document with one painted layer (#9330 target: 60000x60000) | track only | – | – | – | – | – | not run | [#1015](https://github.com/storytold/photocraft/issues/1015) |
 
 **Not measurable yet** (the code can't do it yet; no number is recorded):
 
@@ -187,7 +200,7 @@ Corpus floors (`crates/io/tests/it/corpus.rs`): the enforced minimums; the corpu
 
 ## Workspace and UI
 
-**Settings that do nothing: 12 of 178** (target 0, #204). Counted by the prefs audit (`xtask/src/scorecard.rs`): a `Preferences` field counts as read when code outside the prefs model (`prefs.rs` except its `impl Session` blocks; tests excluded; the schema-driven dialog never names a field) accesses `section.field`, or `.section` and `.field` in the same file, or calls a section method that reads `self.field`. It is a heuristic lower bound: a generic name can look read when it isn't.
+**Settings that do nothing: 12 of 181** (target 0, #204). Counted by the prefs audit (`xtask/src/scorecard.rs`): a `Preferences` field counts as read when code outside the prefs model (`prefs.rs` except its `impl Session` blocks; tests excluded; the schema-driven dialog never names a field) accesses `section.field`, or `.section` and `.field` in the same file, or calls a section method that reads `self.field`. It is a heuristic lower bound: a generic name can look read when it isn't.
 
 Unread: `general.color_picker`, `workspace.auto_show_hidden_panels`, `workspace.enable_floating_document_window_docking`, `performance.gpu_adapter`, `performance.legacy_compositing`, `scratch_disks.disks`, `units_and_rulers.column_width`, `units_and_rulers.gutter`, `plug_ins.show_extension_panels`, `plug_ins.allow_scripts_to_connect`, `type_.text_engine`, `enhanced_controls.scrubby_slider_acceleration`.
 
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index 81b0ab81d6..4490d693c2 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -1,6 +1,6 @@
 # UI parity: tools, handles, modifiers and feel
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-25 · **Change:** minor (12 of 178 preferences do nothing, from the scorecard; Art History Brush in the History group of the Y flyout, partial, TOOL-213-20, #1610; Histogram panel: Compact / Expanded / All Channels views, Luminosity and Colors channels, Source, range statistics, Uncached Refresh, live adjustment overlay, Cache Levels preference; the font menu opens on the current family, marked in the recent group when it is a recent one, #9160; Type options bar alignment and direction follow the target paragraph; a swatch click recolours selected type and shape layers with any tool, #9238; UI scale presets done: 105–120% steps, #3222; ⇧⌥ blend mode letters; painting tool Mode menus; ⌥ + an adjustment's shortcut reopens it at its last settings, ⌥⌘L / ⌥⌘M, #8900; Crop default mode: moving the image under the box snaps the frame's edges and centre, #8580; View › Extras hides the Move transform controls, #6699; adjustment clipping stays visible in compact Properties, #5231; Color panel modes from its panel menu, the same in every theme, UI-217-17, #6000; a picked colour recolours the selected type and shapes; Hand tool ⌘ / ⌥ are Zoom In / Zoom Out while held, #6434; the wheel steps value fields, #5473; a dragged guide shows its X or Y beside the pointer, #7680; Type options bar "T" icon scrubs the font size, #6437; Move tool: dragged selected pixels take their own outline as the selection, #7538; artboard backgrounds remain below child Free Transform previews; ⌫/Delete removes the selected smart filter, #4751; Object Finder foreground/background discrimination (#6548); rounded triangle, polygon and star corners; shape Fill/Stroke popovers accept hex RGB values, #6176; a guide let go over either ruler is removed, #6286; Crop rows corrected: saved crop presets and Delete Cropped Pixels off are done, #6562; marching ants in device pixels, #7489; Animated Zoom: holding the Zoom tool zooms continuously, #6210; shape Density and Feather, TOOL-214-12, #5846; Pen Auto Add/Delete on the path being drawn, #6140; Show Transform Controls frames every selected layer; guide keys and clicks; menu bar from the keyboard, #4988; Crop tool Content-Aware Fill; on-canvas corner radius widgets, TOOL-214-12; Curvature Pen edits the active path; Clip Thumbnails to Layer Bounds; Pen ⇧ 45°; last selected tool restored at launch; Layers panel filter-type dropdown with Kind, Name and Mode, #5048; Free Transform box and marching ants follow the selection, #5297; History: the trash deletes the selected snapshot, rows drag onto the trash, #5324; smart filter reordering by drag; smart object perspective row corrected to done, #426; Free Transform H/V skew fields; toolbar tool shortcuts can be reassigned; ⇧-dragged guides land on ruler ticks; layer and selection keys; tool keys; spring-loaded tool letters; type formatting keys; Pen Auto Add/Delete, #4144; smart filter rows; stale missing-tool rows corrected: Color Replacement, Red Eye and the Add/Delete Anchor Point pair are live toolbar tools, Frame landed; no percentage changed; selection-modifier and ⌥-wheel rows match their tests; Properties › Transform shows a shape's path geometry, without its stroke) · **Target:** Adobe Photoshop 2026
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-27 · **Change:** minor (New Group dialog and button modifiers; new layers go into an open active group and join a clipping mask, except that type, shapes, pastes and placed files go above a group whose lock would refuse them; Color panel Hue and Brightness Cube show the out-of-gamut ⚠ and nearest printable colour when the field is at least 53 pt tall, #8672; 12 of 181 preferences do nothing, from the scorecard; Art History Brush in the History group of the Y flyout, partial, TOOL-213-20, #1610; Histogram panel: Compact / Expanded / All Channels views, Luminosity and Colors channels, Source, range statistics, Uncached Refresh, live adjustment overlay, Cache Levels preference; the font menu opens on the current family, marked in the recent group when it is a recent one, #9160; Type options bar alignment and direction follow the target paragraph; a swatch click recolours selected type and shape layers with any tool, #9238; UI scale presets done: 105–120% steps, #3222; ⇧⌥ blend mode letters; painting tool Mode menus; ⌥ + an adjustment's shortcut reopens it at its last settings, ⌥⌘L / ⌥⌘M, #8900; Crop default mode: moving the image under the box snaps the frame's edges and centre, #8580; View › Extras hides the Move transform controls, #6699; adjustment clipping stays visible in compact Properties, #5231; Color panel modes from its panel menu, the same in every theme, UI-217-17, #6000; a picked colour recolours the selected type and shapes; Hand tool ⌘ / ⌥ are Zoom In / Zoom Out while held, #6434; the wheel steps value fields, #5473; a dragged guide shows its X or Y beside the pointer, #7680; Type options bar "T" icon scrubs the font size, #6437; Move tool: dragged selected pixels take their own outline as the selection, #7538; artboard backgrounds remain below child Free Transform previews; ⌫/Delete removes the selected smart filter, #4751; Object Finder foreground/background discrimination (#6548); rounded triangle, polygon and star corners; shape Fill/Stroke popovers accept hex RGB values, #6176; a guide let go over either ruler is removed, #6286; Crop rows corrected: saved crop presets and Delete Cropped Pixels off are done, #6562; marching ants in device pixels, #7489; Animated Zoom: holding the Zoom tool zooms continuously, #6210; shape Density and Feather, TOOL-214-12, #5846; Pen Auto Add/Delete on the path being drawn, #6140; Show Transform Controls frames every selected layer; guide keys and clicks; menu bar from the keyboard, #4988; Crop tool Content-Aware Fill; on-canvas corner radius widgets, TOOL-214-12; Curvature Pen edits the active path; Clip Thumbnails to Layer Bounds; Pen ⇧ 45°; last selected tool restored at launch; Layers panel filter-type dropdown with Kind, Name and Mode, #5048; Free Transform box and marching ants follow the selection, #5297; History: the trash deletes the selected snapshot, rows drag onto the trash, #5324; smart filter reordering by drag; smart object perspective row corrected to done, #426; Free Transform H/V skew fields; toolbar tool shortcuts can be reassigned; ⇧-dragged guides land on ruler ticks; layer and selection keys; tool keys; spring-loaded tool letters; type formatting keys; Pen Auto Add/Delete, #4144; smart filter rows; stale missing-tool rows corrected: Color Replacement, Red Eye and the Add/Delete Anchor Point pair are live toolbar tools, Frame landed; no percentage changed; selection-modifier and ⌥-wheel rows match their tests; Properties › Transform shows a shape's path geometry, without its stroke) · **Target:** Adobe Photoshop 2026
 
 How PhotoCraft's direct manipulation compares with Photoshop 2026 (27.11.0): the toolbox, the
 handles and modifier keys of each gesture, nudging, snapping, numeric precision, navigation,
@@ -224,18 +224,24 @@ Paragraph; the rest open as in-app floating windows.
 | Panel groups float and tear off into OS windows | missing | UI-217-5, #1828, #1213 |
 | Drag panels to reorder and regroup | partial | #2272, #2305 |
 | Docked resize pushes the neighbour | partial | #2573 |
-| Color panel modes from its panel menu (Hue Cube, Brightness Cube, Color Wheel, Grayscale/RGB/HSB/CMYK/Lab/Web Color sliders), colour ramp (RGB/CMYK Spectrum, Grayscale Ramp, Current Colors, Make Ramp Web Safe; Shift-click cycles, Alt-click picks the other colour), Copy Color as HTML / Hex Code; the same in every theme | done | `color_panel_ui.rs`, `color_panel_tests.rs`; UI-217-17, #2569, #6000 |
+| Color panel modes from its panel menu (Hue Cube, Brightness Cube, Color Wheel, Grayscale/RGB/HSB/CMYK/Lab/Web Color sliders), colour ramp (RGB/CMYK Spectrum, Grayscale Ramp, Current Colors, Make Ramp Web Safe; Shift-click cycles, Alt-click picks the other colour), Copy Color as HTML / Hex Code; the out-of-gamut ⚠ with the nearest printable colour under the chips (sliders always; the cubes when the field is at least 53 pt tall); the same in every theme | done | `color_panel_ui.rs`, `color_panel_tests.rs`; UI-217-17, #2569, #6000, #8672 |
 | A colour picked in the Color or Swatches panel or the Color Picker recolours the selection: selected characters while editing; every selected type layer with a Type tool; every selected shape's fill with a shape, Pen or path selection tool; only the foreground with other tools, the Move tool too; a swatch click recolours the selected type layers and shape fills whatever the tool (#9238); one history step (a Color panel drag too) | done: `apply_color.rs`, `apply_color_tests.rs` | |
 | Window size and dock width remembered | done | UI-217-2 |
 | Histogram panel: Compact (the default, of the entire image), Expanded and All Channels views (the channel kept across them); RGB/CMYK/Lab/Gray channels, Luminosity and Colors (overlaid, mixed where they overlap); Show Channels in Color and Show Statistics; Source (Entire Image, Selected Layer, Adjustment Composite) for multilayer documents; Mean, Std Dev, Median, Pixels, Level, Count, Percentile and Cache Level for the pointer level or a dragged range; the cached-data warning, Uncached Refresh (menu, button, warning click, double-click); the adjusted histogram over the original while an adjustment previews; Cache Levels 1–8 in Preferences › Performance; Color Sampler levels marked on the graph | partial | `histogram_panel.rs`, `histogram_panel_tests.rs`, `tone.rs`; differs: filter dialogs that preview on the CPU proxy aren't counted live, a selection doesn't limit the histogram yet, with Source Selected Layer an adjustment dialog's preview isn't counted, and new strings are English-only so far |
 | Command palette with recents | done | UI-217-7 |
 | Menu bar from the keyboard: Alt / F10 focus the bar, ← → ↓ ↩ drive it, Alt+letter opens a menu, underlined mnemonics run items | done | `menu_keys.rs`, #4988; macOS uses the native bar |
-| Every preference takes effect | partial | 12 of 178 do nothing (scorecard, 2026-10-25) |
+| Every preference takes effect | partial | 12 of 181 do nothing (scorecard, 2026-10-27) |
 | UI scale presets | done | UI-217-9; 75–125% in 5% steps (#2492, #3222) |
 | History snapshots: camera button, New Snapshot dialog (⌥-click: Name, From), the first snapshot (the document as opened), snapshot rows (click returns and selects, rename, delete; the trash deletes the selected snapshot, and a snapshot or state dragged onto it, #5324), `history.*Snapshot` commands | partial | `history_cmds.rs`, `snapshot_rows` in `panels.rs`, `snapshot_dialog.rs`; the snapshot History Options and History Brush sources to come (#2966) |
 | Themes: Photoshop's four greys | partial | five themes; #2661 |
 | Document tabs: overflow, context menu, reorder | done | UI-217-6; middle-click close #2570 |
 | Layers panel: wheel steps blend modes, drop on New/Trash | partial | UI-217-14 |
+| Layers panel New Group button: click with 2+ layers selected groups them (CC 2014+), ⇧-click groups, one layer gives an empty group, ⌥-click opens the New Group dialog, ⌘-click adds the group below the active layer | done | #2561, `new_group_button_tests.rs` |
+| New Group dialog (Name, Color, Mode, Opacity) for Layer › New › Group… / Group from Layers…, the Layers panel menu and the row menu; ⌘G stays immediate | done | `dialogs/new_group_ui.rs`, `dialogs/new_group_ui/tests.rs` |
+| Groups made from layers (⌘G, New Group button, Group from Layers) start collapsed; selecting a layer inside opens the group | done | `group_options.rs` tests, `new_group_button_tests.rs` |
+| New layers (New Layer/Group, adjustment, fill, type, shape, paste, place…) go in as the top layer of an open active group (or an artboard the new content is on), above a closed one; type, shapes, pastes, placed files and frames go above a group whose lock (all, pixels, transparency or position) would refuse them; a new frame starts closed | done | `layer_place.rs`, `layer_place_tests.rs` |
+| A new layer or group inside a clipping mask joins it (clipped when the layer above its slot is), so the clipped layers keep their base | done | `layer_place_tests.rs` (#2203) |
+| Layers panel New Layer button: ⌘-click adds the layer below the active one (never under the Background) | done | `layer_place_tests.rs`, `new_group_button_tests.rs` |
 | Layers panel filter-type dropdown (Kind, Name, Effect, Mode, Attribute, Color, Smart Object, Selected, Artboard) | partial | Kind, Name and Mode; the other six missing. `layer_filter_ui.rs`, `ui.set {layerFilter}` (#5048) |
 | Adjustment scope: clipping control visible above tall Properties editors in a compact dock | done (2026-10-21) | `panels.rs`, `clipping_indicator_tests.rs`; #5231; stack-wide default retained |
 | Smart filter rows: click selects, drag onto another smart object moves, ⌥-drag copies, drag onto Delete removes; with a row selected, the Delete button and the ⌫/Delete key remove that filter, not the smart object | done | `smart_ui.rs`, `layer.smartFilter.transfer` (#4271), `smart_ui::keys` (#4751) |
@@ -246,8 +252,10 @@ Paragraph; the rest open as in-app floating windows.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-27 | minor | Every preference takes effect: 12 of 181 do nothing, the scorecard's count with integration batch 9 (#9775) on main; new layers go above a group whose lock would refuse them (#4329) |
 | 2026-10-25 | minor | Every preference takes effect: 12 of 178 do nothing, the scorecard's count (it still said 46 of 149) |
 | 2026-10-25 | minor | Art History Brush is in the History group of the Y flyout (partial, TOOL-213-20, #1610) |
+| 2026-10-24 | minor | Color panel: Hue Cube and Brightness Cube show Photoshop's out-of-gamut ⚠ and the nearest printable colour under the chips when the field is at least 53 pt tall, as the slider modes did; a click takes it (#8672). No percentage changed |
 | 2026-10-24 | minor | Swatches: a click recolours the selected type layers and shape fills whatever the tool, as Photoshop 2025 does (measured with the Move and Brush tools); the Color panel still recolours them only with a Type, shape or Pen tool (#9238). Scores unchanged. |
 | 2026-10-24 | minor | Type options bar: the alignment and paragraph-direction buttons show the edited or selected type layer's paragraph instead of the tool defaults, as Photoshop's bar does. Scores unchanged. |
 | 2026-10-24 | minor | Font menus (options bar, Character panel): the current family is marked in the recent group when it is a recent one, and the menu opens showing it, as Photoshop's does, scrolled to the marked row when it sits below the fold; the arrows walk on from the marked row (#9160). Scores unchanged. |
@@ -269,6 +277,8 @@ Paragraph; the rest open as in-app floating windows.
 | 2026-10-13 | minor | Stale "missing tool" rows corrected against main: Color Replacement (`paint.colorReplacement`), Red Eye (`paint.redEye`) and Add/Delete Anchor Point (the P flyout cycle) are live toolbar tools, so only Art History Brush is missing; no percentage or estimate changed |
 | 2026-10-13 | minor | Smart object perspective (non-affine) corrected to done: #426 landed four-corner placements with PSD round trip; scorecard FILE-215-6 flipped |
 | 2026-10-10 | major | First version, from a source audit against Photoshop 2026 27.11.0's shortcuts file and the open issues |
+| 2026-10-12 | minor | New Group button groups two or more selected layers (CC 2014+); New Group dialog (Layer › New, Layers panel menu, row menu, ⌥-click); ⌘-click New Group adds the group below; groups made from layers start collapsed (#2561) |
+| 2026-10-12 | minor | New layers go into an open active group (or the artboard their content is on) and join the clip group they land in (#2203); ⌘-click New Layer adds below |
 | 2026-10-12 | minor | Closed #3632: Distort and Ctrl/Cmd corner drags snap actual corners to guides and intersections; shared guide snapping respects Extras and Canvas Guides visibility, with offset, visibility and constrained-alignment regressions |
 | 2026-10-10 | minor | Fixed Crop live resize snapping feedback and outdated-camera rendering, applied ratios immediately to centred inscribed previews, and removed two-point options-bar overflow; added pointer, rendering, dropdown/Enter, Swap/X and scrolling regressions |
 | 2026-10-11 | minor | Flick panning done: releasing a moving Hand drag (tool, Space or middle button) glides and decays, gated by Enable Flick Panning |
diff --git a/packaging/windows/INSTALLATION.md b/packaging/windows/INSTALLATION.md
new file mode 100644
index 0000000000..982a5b4202
--- /dev/null
+++ b/packaging/windows/INSTALLATION.md
@@ -0,0 +1,35 @@
+# Windows installation policy checks
+
+New installations default to the current account under `Programs\ArtCraft\<App>`.
+The first setup page offers installation for everyone. Scope is selected before duplicate
+checks and directory costing. An update uses the existing context's remembered exact folder;
+`INSTALLFOLDER` supplied explicitly is never replaced. It is a secure MSI property so the
+chosen folder reaches the elevated installer. Silent machine updates pass `ALLUSERS=1`.
+A cross-context copy is refused; changing context means uninstalling the old copy first.
+
+App registration follows the selected context. Existing optional shortcuts and file-handler
+choices stay app-owned. No new cleanup operation or model/settings migration is introduced.
+Packaged resources remain package-owned; separately downloaded shared models are not caches
+and are outside this installer's ownership.
+
+## Repeatable metadata tests
+
+On Windows with WiX 5.0.2 and its matching UI/Util extensions:
+
+```powershell
+./packaging/windows/test-install-policy.ps1 -OutputDirectory ./target/install-policy-tests
+```
+
+The script builds x64, x86 and arm64 packages with deliberately non-executable payloads. It
+uses the actual package source and compiled database. A safe Windows Installer session checks
+24 scope/registration/maintenance cases, remembered and explicit custom folders, sequencing,
+upgrade identity and the original registration inventory recorded in `install-policy.json`.
+The release packaging script runs the compiled checker before signing. Packaging CI runs the
+small fixture builds without compiling the Rust application.
+
+Never install or distribute the `NOT-INSTALLABLE.msi` fixtures as an app. Passing these checks
+does not prove real installation, elevation, legacy-version upgrades, registry writes, optional
+shortcut/menu behaviour, cancellation, rollback or uninstall. Those still require the real
+payload in an authorised clean Windows test environment. Cross-architecture metadata is not
+execution evidence on those architectures. Existing open installer/association PRs must be
+reconciled before publication. Nothing here changes macOS/Linux native packaging conventions.
diff --git a/packaging/windows/README.md b/packaging/windows/README.md
new file mode 100644
index 0000000000..63025f400c
--- /dev/null
+++ b/packaging/windows/README.md
@@ -0,0 +1,3 @@
+# Windows packaging
+
+See [installation policy checks](INSTALLATION.md) for the installer scope and path gates.
diff --git a/packaging/windows/check-install-policy.ps1 b/packaging/windows/check-install-policy.ps1
new file mode 100644
index 0000000000..5463c0083c
--- /dev/null
+++ b/packaging/windows/check-install-policy.ps1
@@ -0,0 +1,370 @@
+<#
+.SYNOPSIS
+  Check the compiled installation policy without installing any product.
+.DESCRIPTION
+  Uses Windows Installer's safe session (OpenPackage option 1). Only property-setting custom
+  actions are exercised. No AppSearch, install, repair, removal or file-writing action runs.
+#>
+param([Parameter(Mandatory = $true)] [string] $MsiPath)
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+$policy = Get-Content -Raw -LiteralPath (Join-Path $PSScriptRoot 'install-policy.json') | ConvertFrom-Json
+function Read-Rows($Database, [string] $Sql, [int] $Columns) {
+  $view = $Database.OpenView($Sql)
+  try {
+    [void]$view.Execute()
+    while ($null -ne ($record = $view.Fetch())) {
+      try {
+        $values = @(for ($i = 1; $i -le $Columns; $i++) {
+          $record.GetType().InvokeMember('StringData', 'GetProperty', $null, $record, @($i))
+        })
+        ,$values
+      } finally { [void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($record) }
+    }
+  } finally {
+    [void]$view.Close()
+    [void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($view)
+  }
+}
+function Set-SessionProperty($Session, [string] $Name, [string] $Value) {
+  [void]$Session.GetType().InvokeMember('Property', 'SetProperty', $null, $Session, @($Name, $Value))
+}
+function Get-SessionProperty($Session, [string] $Name) {
+  $Session.GetType().InvokeMember('Property', 'GetProperty', $null, $Session, @($Name))
+}
+function Get-PackageTemplate($Database) {
+  # Summary information property 7 is the platform: "Intel;1033", "x64;1033" or "Arm64;1033".
+  $summary = $Database.GetType().InvokeMember('SummaryInformation', 'GetProperty', $null, $Database, @(0))
+  try { [string]$summary.GetType().InvokeMember('Property', 'GetProperty', $null, $summary, @(7)) }
+  finally { [void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($summary) }
+}
+$installer = $null; $database = $null; $session = $null
+try {
+  $installer = New-Object -ComObject WindowsInstaller.Installer
+  $file = (Resolve-Path -LiteralPath $MsiPath).Path
+  $database = $installer.OpenDatabase($file, 0)
+  $session = $installer.OpenPackage($file, 1)
+  $properties = @{}
+  foreach ($row in (Read-Rows $database 'SELECT `Property`, `Value` FROM `Property`' 2)) { $properties[$row[0]] = $row[1] }
+  $secureProperties = @($properties['SecureCustomProperties'] -split ';')
+  if ('INSTALLFOLDER' -notin $secureProperties) {
+    throw 'The selected installation folder must survive elevation (secure INSTALLFOLDER).'
+  }
+  if ($policy.mode -eq 'perUser') {
+    if ($properties.ContainsKey('ALLUSERS')) { throw 'Launcher must remain per-user; machine self-update is not part of this change.' }
+    if ($properties['UpgradeCode'].Trim('{}') -ne $policy.upgradeCode) { throw 'Launcher upgrade identity changed.' }
+    $dirs = @{}
+    foreach ($row in (Read-Rows $database 'SELECT `Directory`, `Directory_Parent`, `DefaultDir` FROM `Directory`' 3)) { $dirs[$row[0]] = @($row[1],$row[2]) }
+    if ($dirs['INSTALLFOLDER'][0] -ne 'CraftSuiteFolder' -or $dirs['CraftSuiteFolder'][1] -ne 'ArtCraft' -or
+        $dirs['CraftSuiteFolder'][0] -ne 'LocalProgramsFolder' -or $dirs['LocalProgramsFolder'][0] -ne 'LocalAppDataFolder') {
+      throw 'Launcher new-install folder must be under the per-user ArtCraft suite root.'
+    }
+    foreach ($explicit in @('', 'F:\Chosen exact launcher')) {
+      Set-SessionProperty $session 'PREVIOUSINSTALLFOLDER' 'E:\Existing exact launcher'
+      Set-SessionProperty $session 'INSTALLFOLDER' $explicit
+      $row = @(Read-Rows $database 'SELECT `Condition` FROM `InstallUISequence` WHERE `Action` = ''CraftRestoreLauncherFolder''' 1)[0]
+      if ($session.EvaluateCondition($row[0]) -eq 1) {
+        if ($session.DoAction('CraftRestoreLauncherFolder') -ne 1) { throw 'Launcher restore action failed.' }
+      }
+      $expected = if ($explicit) { $explicit } else { 'E:\Existing exact launcher' }
+      if ((Get-SessionProperty $session 'INSTALLFOLDER') -ne $expected) { throw 'Launcher custom or existing path was lost.' }
+    }
+    $rows = @(Read-Rows $database 'SELECT `Root`, `Key`, `Name`, `Value` FROM `Registry`' 4)
+    if (@($rows | Where-Object { $_[0] -ne '1' }).Count) { throw 'Launcher registration must stay under the current account.' }
+    foreach ($entry in $policy.registry) {
+      if (@($rows | Where-Object { $_[0] -eq $entry[0] -and $_[1] -eq $entry[1] -and $_[2] -eq $entry[2] -and $_[3] -eq $entry[3] }).Count -ne 1) {
+        throw 'Launcher registration or shortcut preference changed unexpectedly.'
+      }
+    }
+    Write-Output 'PASS ArtCraft Launcher: per-user scope, suite folder, remembered/custom paths and existing registration. No installation performed.'
+    return
+  }
+  if ($properties['ALLUSERS'] -ne '2' -or $properties['MSIINSTALLPERUSER'] -ne '1') {
+    throw 'Policy regression: new packages must default to the per-user dual-scope context.'
+  }
+  if ($properties['UpgradeCode'].Trim('{}') -ne $policy.upgradeCode) { throw 'The existing upgrade identity must not change.' }
+  $directories = @{}
+  foreach ($row in (Read-Rows $database 'SELECT `Directory`, `Directory_Parent`, `DefaultDir` FROM `Directory`' 3)) {
+    $directories[$row[0]] = @($row[1], $row[2])
+  }
+  if ($directories['INSTALLFOLDER'][0] -ne 'CraftSuiteFolder' -or
+      $directories['CraftSuiteFolder'][1] -ne 'ArtCraft') { throw 'Expected the app under the ArtCraft suite folder.' }
+  $programs = $directories['CraftSuiteFolder'][0]
+  if ($programs -eq 'ProgramFiles6432Folder') { $programs = $directories[$programs][0] }
+  if ($programs -notin 'ProgramFilesFolder', 'ProgramFiles64Folder') {
+    throw 'Use Windows Installer native folder redirection, not a hard-coded profile path.'
+  }
+  $guards = @(Read-Rows $database 'SELECT `Condition`, `Description` FROM `LaunchCondition`' 2 |
+    Where-Object { $_[0] -match 'CRAFT_(USER|MACHINE)_DIR' })
+  if ($guards.Count -ne 2) { throw 'Expected both duplicate-installation guards.' }
+  $cases = 0
+  foreach ($scope in @('', '2', '1')) {
+    foreach ($user in @('', 'D:\Existing user app')) {
+      foreach ($machine in @('', 'E:\Existing machine app')) {
+        foreach ($installed in @('', '1')) {
+          Set-SessionProperty $session 'ALLUSERS' $scope
+          Set-SessionProperty $session 'Installed' $installed
+          Set-SessionProperty $session 'CRAFT_USER_DIR' $user
+          Set-SessionProperty $session 'CRAFT_MACHINE_DIR' $machine
+          $allowed = $true
+          foreach ($guard in $guards) {
+            $value = $session.EvaluateCondition($guard[0])
+            if ($value -notin 0, 1) { throw 'Invalid duplicate guard.' }
+            if ($value -eq 0) { $allowed = $false }
+          }
+          $opposite = if ($scope -eq '1') { $user } else { $machine }
+          $expected = [bool]$installed -or -not [bool]$opposite
+          if ($allowed -ne $expected) { throw "Scope regression: ALLUSERS='$scope', user=$([bool]$user), machine=$([bool]$machine), maintenance=$([bool]$installed)." }
+          $cases++
+        }
+      }
+    }
+  }
+  # Execute the actual authored type-51 actions in a safe session, not copied resolver logic.
+  foreach ($scope in @('', '2', '1')) {
+    foreach ($explicit in @('', 'F:\Chosen exact app')) {
+      Set-SessionProperty $session 'ALLUSERS' $scope
+      Set-SessionProperty $session 'INSTALLFOLDER' $explicit
+      Set-SessionProperty $session 'CRAFT_USER_DIR' 'D:\Existing user app'
+      Set-SessionProperty $session 'CRAFT_MACHINE_DIR' 'E:\Existing machine app'
+      $action = if ($scope -eq '1') { 'CraftRestoreMachineFolder' } else { 'CraftRestoreUserFolder' }
+      # Evaluate the compiled condition, so the test exercises it instead of calling the action directly.
+      $restore = @(Read-Rows $database ('SELECT `Condition` FROM `InstallExecuteSequence` WHERE `Action` = ''{0}''' -f $action) 1)[0]
+      $selected = $session.EvaluateCondition($restore[0]) -eq 1
+      if ($selected -eq [bool]$explicit) { throw "$action must run only when no folder was supplied (condition: $($restore[0]))." }
+      if ($selected -and $session.DoAction($action) -ne 1) { throw 'Remembered-folder property action failed.' }
+      $expected = if ($explicit) { $explicit } elseif ($scope -eq '1') { 'E:\Existing machine app' } else { 'D:\Existing user app' }
+      if ((Get-SessionProperty $session 'INSTALLFOLDER') -ne $expected) { throw 'Custom or remembered folder was not preserved.' }
+    }
+  }
+  $ui = @{}
+  foreach ($row in (Read-Rows $database 'SELECT `Action`, `Sequence` FROM `InstallUISequence`' 2)) { $ui[$row[0]] = [int]$row[1] }
+  if (-not ($ui['AppSearch'] -lt $ui['CraftPreferMachineScope'] -and
+      $ui['CraftPreferMachineScope'] -lt $ui['CraftScopeDlg'] -and
+      $ui['CraftScopeDlg'] -lt $ui['FindRelatedProducts'] -and
+      $ui['FindRelatedProducts'] -lt $ui['LaunchConditions'] -and
+      $ui['CraftScopeDlg'] -lt $ui['CraftRestoreUserFolder'] -and $ui['CraftRestoreUserFolder'] -lt $ui['CostInitialize'] -and
+      $ui['CraftScopeDlg'] -lt $ui['CraftRestoreMachineFolder'] -and $ui['CraftRestoreMachineFolder'] -lt $ui['CostInitialize'])) {
+    throw 'Scope must be chosen after AppSearch and before FindRelatedProducts, launch checks and costing.'
+  }
+  # Windows Installer resolves Program Files for the context it started in, before the wizard's scope choice.
+  # The wizard therefore sets the new-install folder itself, and only in the wizard.
+  $defaults = @(Read-Rows $database 'SELECT `Action`, `Sequence`, `Condition` FROM `InstallUISequence`' 3 | Where-Object { $_[0] -like 'CraftDefault*' })
+  if ($defaults.Count -lt 2) { throw 'The wizard must set the new-install folder after the scope page; Program Files is resolved before the choice.' }
+  foreach ($row in $defaults) {
+    if (-not ($ui['CraftScopeDlg'] -lt [int]$row[1] -and [int]$row[1] -lt $ui['CostInitialize'])) { throw "$($row[0]) must run after the scope page and before costing." }
+  }
+  if (@(Read-Rows $database 'SELECT `Action` FROM `InstallExecuteSequence`' 1 | Where-Object { $_[0] -like 'CraftDefault*' }).Count) {
+    throw 'Silent installs must not use the wizard-only default folder actions.'
+  }
+  # The machine default comes from the environment of the package architecture, not from a folder name.
+  # x86 packages use Program Files (x86) on 64-bit Windows; x64 and Arm64 packages use the 64-bit root.
+  $machineRoot = if ((Get-PackageTemplate $database) -match '^Intel') {
+    if (Get-SessionProperty $session 'VersionNT64') { ${env:ProgramFiles(x86)} } else { $env:ProgramFiles }
+  } elseif ($env:ProgramW6432) { $env:ProgramW6432 } else { $env:ProgramFiles }
+  $machineFolder = (Join-Path $machineRoot "ArtCraft\$($policy.name)") + '\'
+  foreach ($scope in @('1', '')) {
+    Set-SessionProperty $session 'ALLUSERS' $scope
+    Set-SessionProperty $session 'INSTALLFOLDER' ''
+    Set-SessionProperty $session 'CRAFT_MACHINE_DIR' ''
+    Set-SessionProperty $session 'CRAFT_USER_DIR' ''
+    foreach ($row in @($defaults | Sort-Object { [int]$_[1] })) {
+      if ($session.EvaluateCondition($row[2]) -eq 1 -and $session.DoAction($row[0]) -ne 1) { throw "$($row[0]) failed." }
+    }
+    $folder = Get-SessionProperty $session 'INSTALLFOLDER'
+    $wanted = if ($scope -eq '1') { $machineFolder } else { (Join-Path $env:LOCALAPPDATA "Programs\ArtCraft\$($policy.name)") + '\' }
+    if ($folder -ine $wanted) { throw "Wizard default folder for ALLUSERS='$scope' is '$folder', expected '$wanted'." }
+  }
+  # Replay the wizard's compiled folder actions in sequence order, as the full UI runs them. A remembered
+  # folder must win over the new-install default, and a folder the user typed must survive both.
+  $uiFolderActions = @(Read-Rows $database 'SELECT `Action`, `Sequence`, `Condition` FROM `InstallUISequence`' 3 |
+    Where-Object { $_[0] -match '^Craft(Restore|Default)' } | Sort-Object { [int]$_[1] })
+  $userDefault = (Join-Path $env:LOCALAPPDATA "Programs\ArtCraft\$($policy.name)") + '\'
+  foreach ($case in @(
+      @('1', 'D:\Remembered user app', 'E:\Remembered machine app', '', 'E:\Remembered machine app'),
+      @('', 'D:\Remembered user app', 'E:\Remembered machine app', '', 'D:\Remembered user app'),
+      @('1', '', '', '', $machineFolder),
+      @('', '', '', '', $userDefault),
+      @('1', 'D:\Remembered user app', 'E:\Remembered machine app', 'F:\Chosen exact app', 'F:\Chosen exact app'))) {
+    Set-SessionProperty $session 'Installed' ''
+    Set-SessionProperty $session 'ALLUSERS' $case[0]
+    Set-SessionProperty $session 'CRAFT_USER_DIR' $case[1]
+    Set-SessionProperty $session 'CRAFT_MACHINE_DIR' $case[2]
+    Set-SessionProperty $session 'INSTALLFOLDER' $case[3]
+    foreach ($row in $uiFolderActions) {
+      if ($session.EvaluateCondition($row[2]) -eq 1 -and $session.DoAction($row[0]) -ne 1) { throw "$($row[0]) failed." }
+    }
+    $folder = Get-SessionProperty $session 'INSTALLFOLDER'
+    if ($folder -ine $case[4]) { throw "Full-UI folder for ALLUSERS='$($case[0])' is '$folder', expected '$($case[4])'." }
+  }
+  $execute = @{}
+  foreach ($row in (Read-Rows $database 'SELECT `Action`, `Sequence` FROM `InstallExecuteSequence`' 2)) { $execute[$row[0]] = [int]$row[1] }
+  foreach ($action in @('CraftRestoreUserFolder','CraftRestoreMachineFolder')) {
+    if (-not ($execute['AppSearch'] -lt $execute[$action] -and $execute[$action] -lt $execute['CostInitialize'])) {
+      throw 'Silent updates must restore the folder before directory costing.'
+    }
+  }
+  foreach ($resolver in @('CraftUFromLegacyExe','CraftMFromLegacyExe')) {
+    if (-not ($execute['AppSearch'] -lt $execute[$resolver] -and $execute[$resolver] -lt $execute['LaunchConditions'])) {
+      throw 'Both legacy folder resolvers must run after AppSearch and before the launch checks.'
+    }
+  }
+  # AppSearch itself never runs in this safe session, so check the compiled searches and then run the
+  # property actions that turn the search results into the remembered folder, once per scope.
+  $appSearch = @{}
+  foreach ($row in (Read-Rows $database 'SELECT `Property`, `Signature_` FROM `AppSearch`' 2)) { $appSearch[$row[0]] = $row[1] }
+  $locators = @{}
+  foreach ($row in (Read-Rows $database 'SELECT `Signature_`, `Root`, `Key`, `Name`, `Type` FROM `RegLocator`' 5)) { $locators[$row[0]] = $row }
+  $appPaths = '^Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\[^\\]+\.exe$'
+  # Suffix, how to match the key, key, value name, locator type (2 = raw value, 1 = file; the 64-bit flag is masked off).
+  $searchContract = @(
+    @('DIR',       'exact', "Software\$($policy.name)", 'InstallDir',    '2'),
+    @('FOLDER',    'exact', "Software\$($policy.name)", 'InstallFolder', '2'),
+    @('PATH',      'regex', $appPaths,                  'Path',          '2'),
+    @('EXEFOLDER', 'regex', $appPaths,                  '',              '1'),
+    @('EXE',       'regex', $appPaths,                  '',              '1'))
+  $resolverCases = @(
+    @{ name = 'every record, DIR wins';        dir = 'D:\Dir\'; folder = 'D:\Folder\'; path = 'D:\Path\'; exeFolder = 'D:\Exe\'; exe = 'D:\Exe\app.exe'; existing = '';            expected = 'D:\Dir\' },
+    @{ name = 'FOLDER wins without DIR';       dir = '';        folder = 'D:\Folder\'; path = 'D:\Path\'; exeFolder = 'D:\Exe\'; exe = 'D:\Exe\app.exe'; existing = '';            expected = 'D:\Folder\' },
+    @{ name = 'PATH wins without DIR, FOLDER'; dir = '';        folder = '';           path = 'D:\Path\'; exeFolder = 'D:\Exe\'; exe = 'D:\Exe\app.exe'; existing = '';            expected = 'D:\Path\' },
+    @{ name = 'legacy exe folder is last';     dir = '';        folder = '';           path = '';         exeFolder = 'D:\Exe\'; exe = 'D:\Exe\app.exe'; existing = '';            expected = 'D:\Exe\' },
+    @{ name = 'legacy folder needs the exe';   dir = '';        folder = '';           path = '';         exeFolder = 'D:\Exe\'; exe = '';               existing = '';            expected = '' },
+    @{ name = 'a preset folder is kept';       dir = 'D:\Dir\'; folder = 'D:\Folder\'; path = 'D:\Path\'; exeFolder = 'D:\Exe\'; exe = 'D:\Exe\app.exe'; existing = 'P:\Preset\'; expected = 'P:\Preset\' })
+  foreach ($scopeSpec in @(@('U', '1', 'CRAFT_USER_DIR'), @('M', '2', 'CRAFT_MACHINE_DIR'))) {
+    $letter = $scopeSpec[0]; $target = $scopeSpec[2]
+    foreach ($item in $searchContract) {
+      $property = "CRAFT_${letter}_$($item[0])"
+      $locator = if ($appSearch.ContainsKey($property)) { $locators[$appSearch[$property]] } else { $null }
+      $keyOk = $null -ne $locator -and $(if ($item[1] -eq 'exact') { $locator[2] -eq $item[2] } else { $locator[2] -match $item[2] })
+      if (-not $keyOk -or $locator[1] -ne $scopeSpec[1] -or $locator[3] -ne $item[3] -or ([int]$locator[4] -band 3) -ne [int]$item[4]) {
+        throw "Compiled search for $property is missing or points at the wrong registry location."
+      }
+    }
+    $chain = @(Read-Rows $database 'SELECT `Action`, `Sequence`, `Condition` FROM `InstallExecuteSequence`' 3 |
+      Where-Object { $_[0] -match "^Craft${letter}From" } | Sort-Object { [int]$_[1] })
+    $order = @($chain | ForEach-Object { $_[0] }) -join ','
+    if ($order -ne "Craft${letter}FromDIR,Craft${letter}FromFOLDER,Craft${letter}FromPATH,Craft${letter}FromLegacyExe") {
+      throw "Remembered-folder resolvers for scope $letter run in the wrong order: $order"
+    }
+    foreach ($case in $resolverCases) {
+      Set-SessionProperty $session $target $case.existing
+      Set-SessionProperty $session "CRAFT_${letter}_DIR" $case.dir
+      Set-SessionProperty $session "CRAFT_${letter}_FOLDER" $case.folder
+      Set-SessionProperty $session "CRAFT_${letter}_PATH" $case.path
+      Set-SessionProperty $session "CRAFT_${letter}_EXEFOLDER" $case.exeFolder
+      Set-SessionProperty $session "CRAFT_${letter}_EXE" $case.exe
+      foreach ($row in $chain) {
+        if ($session.EvaluateCondition($row[2]) -eq 1 -and $session.DoAction($row[0]) -ne 1) { throw "$($row[0]) failed." }
+      }
+      $got = Get-SessionProperty $session $target
+      if ($got -ne $case.expected) { throw "Resolver chain for scope $letter, case '$($case.name)': got '$got', expected '$($case.expected)'." }
+    }
+  }
+  # Switching the first-page choice must reset BOTH properties, including a back-and-forth change.
+  $events = @(Read-Rows $database 'SELECT `Event`, `Argument`, `Condition`, `Ordering` FROM `ControlEvent` WHERE `Dialog_` = ''CraftScopeDlg'' AND `Control_` = ''Next'' ORDER BY `Ordering`' 4)
+  # Model the full-UI upgrade entry with an existing machine-wide copy. Run
+  # the actual preference action, then the compiled Next events before discovery.
+  Set-SessionProperty $session 'ALLUSERS' '2'
+  Set-SessionProperty $session 'CRAFT_SCOPE' 'user'
+  Set-SessionProperty $session 'CRAFT_USER_DIR' ''
+  Set-SessionProperty $session 'CRAFT_MACHINE_DIR' 'E:\Existing machine app'
+  $preference = @(Read-Rows $database 'SELECT `Condition` FROM `InstallUISequence` WHERE `Action` = ''CraftPreferMachineScope''' 1)[0]
+  if ($session.EvaluateCondition($preference[0]) -ne 1 -or $session.DoAction('CraftPreferMachineScope') -ne 1 -or
+      (Get-SessionProperty $session 'CRAFT_SCOPE') -ne 'machine') {
+    throw 'Full-UI machine upgrades must initially select the existing machine context.'
+  }
+  foreach ($choice in @('machine','user','machine','user')) {
+    Set-SessionProperty $session 'CRAFT_SCOPE' $choice
+    foreach ($event in $events) {
+      if ($event[0] -notmatch '^\[([^\]]+)\]$') { continue }
+      $property = $Matches[1]
+      if ($session.EvaluateCondition($event[2]) -eq 1) {
+        Set-SessionProperty $session $property $(if ($event[1] -eq '{}') { '' } else { $event[1] })
+      }
+    }
+    $allUsers = Get-SessionProperty $session 'ALLUSERS'
+    $perUser = Get-SessionProperty $session 'MSIINSTALLPERUSER'
+    if (($choice -eq 'machine' -and ($allUsers -ne '1' -or $perUser)) -or
+        ($choice -eq 'user' -and ($allUsers -or $perUser -ne '1'))) {
+      throw 'Scope selector does not reset the requested installation context.'
+    }
+  }
+  $actions = @(Read-Rows $database 'SELECT `Action`, `Source`, `Target`, `Type` FROM `CustomAction`' 4)
+  $savedOptions = @($actions | Where-Object { $_[0] -match '^CraftLoadOption[0-9]+M$' })
+  foreach ($option in $savedOptions) {
+    if ([int]$option[3] -ne 51) { throw 'Saved-option test may run only property-setting actions.' }
+    $number = [regex]::Match($option[0], '[0-9]+').Value
+    foreach ($scope in @('2','1')) {
+      Set-SessionProperty $session 'ALLUSERS' $scope
+      Set-SessionProperty $session "CRAFT_OPTION_${number}_M" 'saved-machine-choice'
+      Set-SessionProperty $session "CRAFT_OPTION_${number}_U" 'saved-user-choice'
+      Set-SessionProperty $session $option[1] ''
+      $action = "CraftLoadOption$number" + $(if ($scope -eq '1') { 'M' } else { 'U' })
+      if ($session.DoAction($action) -ne 1) { throw 'Saved-option property action failed.' }
+      $expected = if ($scope -eq '1') { 'saved-machine-choice' } else { 'saved-user-choice' }
+      if ((Get-SessionProperty $session $option[1]) -ne $expected) { throw 'Saved installer choices leaked across contexts.' }
+    }
+  }
+  # Follow the compiled control conditions, not the source's intended appearance.
+  $controls = @(Read-Rows $database 'SELECT `Dialog_`, `Control`, `Type`, `Attributes`, `Text` FROM `Control`' 5)
+  $conditions = @()
+  if (@(Read-Rows $database 'SELECT `Name` FROM `_Tables` WHERE `Name` = ''ControlCondition''' 1).Count) {
+    $conditions = @(Read-Rows $database 'SELECT `Dialog_`, `Control_`, `Action`, `Condition` FROM `ControlCondition`' 4)
+  }
+  function Test-ControlVisible($Control) {
+    $visible = ([int]$Control[3] -band 1) -ne 0
+    foreach ($condition in $conditions) {
+      if ($condition[0] -eq $Control[0] -and $condition[1] -eq $Control[1] -and $session.EvaluateCondition($condition[3]) -eq 1) {
+        if ($condition[2] -eq 'Show') { $visible = $true }
+        if ($condition[2] -eq 'Hide') { $visible = $false }
+      }
+    }
+    return $visible
+  }
+  foreach ($button in @($controls | Where-Object { $_[0] -in 'InstallWelcome','InstallMaintenance','DesktopShortcutDlg' -and ([int]$_[3] -band 8388608) -ne 0 })) {
+    $plain = @($controls | Where-Object { $_[0] -eq $button[0] -and $_[1] -eq ($button[1] + 'User') })
+    if ($plain.Count -ne 1 -or ([int]$plain[0][3] -band 8388608)) { throw 'Scope-aware buttons need an unshielded per-user counterpart.' }
+    foreach ($scope in @('', '2', '1')) {
+      Set-SessionProperty $session 'ALLUSERS' $scope
+      if ((Test-ControlVisible $button) -ne ($scope -eq '1') -or (Test-ControlVisible $plain[0]) -ne ($scope -ne '1')) {
+        throw 'The elevation shield must follow the selected scope.'
+      }
+    }
+    $dialog = $button[0]; $shieldId = $button[1]; $plainId = $plain[0][1]
+    $shieldEvents = @(Read-Rows $database "SELECT ``Event``, ``Argument``, ``Condition``, ``Ordering`` FROM ``ControlEvent`` WHERE ``Dialog_`` = '$dialog' AND ``Control_`` = '$shieldId' ORDER BY ``Ordering``" 4 | ForEach-Object { $_ -join '|' })
+    $plainEvents = @(Read-Rows $database "SELECT ``Event``, ``Argument``, ``Condition``, ``Ordering`` FROM ``ControlEvent`` WHERE ``Dialog_`` = '$dialog' AND ``Control_`` = '$plainId' ORDER BY ``Ordering``" 4 | ForEach-Object { $_ -join '|' })
+    if (($shieldEvents -join "`n") -ne ($plainEvents -join "`n")) { throw 'Per-user and machine buttons must perform the same operation.' }
+  }
+  foreach ($scope in @('', '2', '1')) {
+    Set-SessionProperty $session 'ALLUSERS' $scope
+    foreach ($text in @($controls | Where-Object { $_[4] -like '*for all users*' })) {
+      if ((Test-ControlVisible $text) -ne ($scope -eq '1')) { throw 'The welcome-page scope text must follow the selected scope.' }
+    }
+  }
+  if ($policy.id -in 'deckcraft','filmcraft','soundcraft') {
+    foreach ($route in @(@('WelcomeDlg','Next','InstallDirDlg'),@('InstallDirDlg','Back','WelcomeDlg'))) {
+      $dialog = $route[0]; $control = $route[1]
+      $routes = @(Read-Rows $database "SELECT ``Argument``, ``Condition`` FROM ``ControlEvent`` WHERE ``Dialog_`` = '$dialog' AND ``Control_`` = '$control' AND ``Event`` = 'NewDialog' ORDER BY ``Ordering``" 2)
+      Set-SessionProperty $session 'Installed' ''
+      $destination = ''
+      foreach ($event in $routes) { if ($session.EvaluateCondition($event[1]) -eq 1) { $destination = $event[0] } }
+      if ($destination -ne $route[2]) { throw 'Skipping the licence page must work in both navigation directions.' }
+    }
+  }
+  $registry = @(Read-Rows $database 'SELECT `Root`, `Key`, `Name`, `Value` FROM `Registry`' 4)
+  if (@($registry | Where-Object { $_[0] -in '1', '2' }).Count) { throw 'Registration must follow the selected context, not force HKCU or HKLM.' }
+  if (@($registry | Where-Object { $_[0] -eq '0' -and $_[1] -match '^Software\\Classes(\\|$)' }).Count) {
+    throw 'HKCR keys must be relative to Classes.'
+  }
+  foreach ($entry in $policy.registry) {
+    $found = @($registry | Where-Object { $_[0] -eq $entry[0] -and $_[1] -eq $entry[1] -and $_[2] -eq $entry[2] -and $_[3] -eq $entry[3] })
+    if ($found.Count -ne 1) { throw "Lost or changed registration: $($entry[1]) / $($entry[2])" }
+  }
+  $installDir = @($registry | Where-Object { $_[0] -eq '-1' -and $_[1] -eq "Software\$($policy.name)" -and $_[2] -eq 'InstallDir' -and $_[3] -eq '[INSTALLFOLDER]' })
+  if ($installDir.Count -ne 1) { throw 'A context-sensitive installation-folder record is required.' }
+  Write-Output "PASS $($policy.name): $cases scope cases, folder preservation, action sequencing and registry contract. No installation performed."
+} finally {
+  foreach ($com in @($session, $database, $installer)) {
+    if ($null -ne $com) { [void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($com) }
+  }
+}
diff --git a/packaging/windows/install-policy.json b/packaging/windows/install-policy.json
new file mode 100644
index 0000000000..fcba1850ae
--- /dev/null
+++ b/packaging/windows/install-policy.json
@@ -0,0 +1,305 @@
+{
+  "id": "photocraft",
+  "name": "PhotoCraft",
+  "upgradeCode": "D9660F32-2D0A-4ABE-B73D-17BE25F1542C",
+  "sources": [
+    "photocraft.wxs"
+  ],
+  "icon": "assets/app-icon/photocraft.ico",
+  "localization": [
+    "photocraft.en-us.wxl"
+  ],
+  "extensions": [
+    "UI",
+    "Util"
+  ],
+  "payloads": [
+    "photocraft-cli.exe",
+    "photocraft.exe"
+  ],
+  "registry": [
+    [
+      "-1",
+      "Software\\Classes\\Photocraft.PhotoshopDocument\\shell\\open\\command",
+      "",
+      "\"[#PhotocraftExe]\" \"%1\""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Photocraft.Image\\shell\\open\\command",
+      "",
+      "\"[#PhotocraftExe]\" \"%1\""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.psd\\OpenWithProgids",
+      "Photocraft.PhotoshopDocument",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.psb\\OpenWithProgids",
+      "Photocraft.PhotoshopDocument",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.pdn\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.ora\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.kra\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.krz\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.png\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.jpg\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.jpeg\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.tif\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.tiff\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.webp\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.gif\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.bmp\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.tga\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.exr\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.hdr\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.avif\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.qoi\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\.ico\\OpenWithProgids",
+      "Photocraft.Image",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe",
+      "FriendlyAppName",
+      "PhotoCraft"
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\shell\\open\\command",
+      "",
+      "\"[#PhotocraftExe]\" \"%1\""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".pcraft",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".psd",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".psb",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".pdn",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".ora",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".kra",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".krz",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".png",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".jpg",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".jpeg",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".tif",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".tiff",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".webp",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".gif",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".bmp",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".tga",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".exr",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".hdr",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".avif",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".qoi",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Classes\\Applications\\photocraft.exe\\SupportedTypes",
+      ".ico",
+      ""
+    ],
+    [
+      "-1",
+      "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\photocraft.exe",
+      "",
+      "[#PhotocraftExe]"
+    ],
+    [
+      "-1",
+      "Software\\PhotoCraft",
+      "InstallDir",
+      "[INSTALLFOLDER]"
+    ]
+  ],
+  "mode": "dualScope"
+}
diff --git a/packaging/windows/install-policy.wxi b/packaging/windows/install-policy.wxi
new file mode 100644
index 0000000000..14bdc04162
--- /dev/null
+++ b/packaging/windows/install-policy.wxi
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Include xmlns="http://wixtoolset.org/schemas/v4/wxs">
+  <!-- Choose scope before launch checks and directory costing. Never move an existing copy. -->
+  <!-- Only for me leaves ALLUSERS unset. Publishing ALLUSERS=2 here makes FindRelatedProducts treat the run as
+       per-machine and skip the existing per-user copy, so an interactive upgrade installs beside it
+       (two registered products, and uninstall leaves files behind). Checked with real msiexec runs. -->
+  <Property Id="INSTALLFOLDER" Secure="yes" />
+  <Property Id="CRAFT_SCOPE" Value="user" Secure="yes" />
+  <Property Id="CRAFT_U_DIR" Secure="yes"><RegistrySearch Id="CRAFT_U_DIRSearch" Root="HKCU" Key="Software\PhotoCraft" Name="InstallDir" Type="raw" /></Property>
+  <SetProperty Id="CRAFT_USER_DIR" Action="CraftUFromDIR" Value="[CRAFT_U_DIR]" After="AppSearch" Sequence="both" Condition="NOT CRAFT_USER_DIR AND CRAFT_U_DIR" />
+  <Property Id="CRAFT_U_FOLDER" Secure="yes"><RegistrySearch Id="CRAFT_U_FOLDERSearch" Root="HKCU" Key="Software\PhotoCraft" Name="InstallFolder" Type="raw" /></Property>
+  <SetProperty Id="CRAFT_USER_DIR" Action="CraftUFromFOLDER" Value="[CRAFT_U_FOLDER]" After="CraftUFromDIR" Sequence="both" Condition="NOT CRAFT_USER_DIR AND CRAFT_U_FOLDER" />
+  <Property Id="CRAFT_U_PATH" Secure="yes"><RegistrySearch Id="CRAFT_U_PATHSearch" Root="HKCU" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\photocraft.exe" Name="Path" Type="raw" /></Property>
+  <SetProperty Id="CRAFT_USER_DIR" Action="CraftUFromPATH" Value="[CRAFT_U_PATH]" After="CraftUFromFOLDER" Sequence="both" Condition="NOT CRAFT_USER_DIR AND CRAFT_U_PATH" />
+  <Property Id="CRAFT_U_EXEFOLDER" Secure="yes"><RegistrySearch Id="CRAFT_ULegacyFolder" Root="HKCU" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\photocraft.exe" Type="file" /></Property>
+  <Property Id="CRAFT_U_EXE" Secure="yes"><RegistrySearch Id="CRAFT_ULegacyExe" Root="HKCU" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\photocraft.exe" Type="file"><FileSearch Id="CRAFT_ULegacyFile" Name="photocraft.exe" /></RegistrySearch></Property>
+  <SetProperty Id="CRAFT_USER_DIR" Action="CraftUFromLegacyExe" Value="[CRAFT_U_EXEFOLDER]" After="CraftUFromPATH" Sequence="both" Condition="NOT CRAFT_USER_DIR AND CRAFT_U_EXEFOLDER AND CRAFT_U_EXE" />
+  <Property Id="CRAFT_USER_DIR" Secure="yes" />
+  <Property Id="CRAFT_M_DIR" Secure="yes"><RegistrySearch Id="CRAFT_M_DIRSearch" Root="HKLM" Key="Software\PhotoCraft" Name="InstallDir" Type="raw" /></Property>
+  <SetProperty Id="CRAFT_MACHINE_DIR" Action="CraftMFromDIR" Value="[CRAFT_M_DIR]" After="CraftUFromLegacyExe" Sequence="both" Condition="NOT CRAFT_MACHINE_DIR AND CRAFT_M_DIR" />
+  <Property Id="CRAFT_M_FOLDER" Secure="yes"><RegistrySearch Id="CRAFT_M_FOLDERSearch" Root="HKLM" Key="Software\PhotoCraft" Name="InstallFolder" Type="raw" /></Property>
+  <SetProperty Id="CRAFT_MACHINE_DIR" Action="CraftMFromFOLDER" Value="[CRAFT_M_FOLDER]" After="CraftMFromDIR" Sequence="both" Condition="NOT CRAFT_MACHINE_DIR AND CRAFT_M_FOLDER" />
+  <Property Id="CRAFT_M_PATH" Secure="yes"><RegistrySearch Id="CRAFT_M_PATHSearch" Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\photocraft.exe" Name="Path" Type="raw" /></Property>
+  <SetProperty Id="CRAFT_MACHINE_DIR" Action="CraftMFromPATH" Value="[CRAFT_M_PATH]" After="CraftMFromFOLDER" Sequence="both" Condition="NOT CRAFT_MACHINE_DIR AND CRAFT_M_PATH" />
+  <Property Id="CRAFT_M_EXEFOLDER" Secure="yes"><RegistrySearch Id="CRAFT_MLegacyFolder" Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\photocraft.exe" Type="file" /></Property>
+  <Property Id="CRAFT_M_EXE" Secure="yes"><RegistrySearch Id="CRAFT_MLegacyExe" Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\photocraft.exe" Type="file"><FileSearch Id="CRAFT_MLegacyFile" Name="photocraft.exe" /></RegistrySearch></Property>
+  <SetProperty Id="CRAFT_MACHINE_DIR" Action="CraftMFromLegacyExe" Value="[CRAFT_M_EXEFOLDER]" After="CraftMFromPATH" Sequence="both" Condition="NOT CRAFT_MACHINE_DIR AND CRAFT_M_EXEFOLDER AND CRAFT_M_EXE" />
+  <Property Id="CRAFT_MACHINE_DIR" Secure="yes" />
+  <SetProperty Id="CRAFT_SCOPE" Action="CraftPreferMachineScope" Value="machine" After="CraftMFromLegacyExe" Sequence="ui" Condition="ALLUSERS = 1 OR (CRAFT_MACHINE_DIR AND NOT CRAFT_USER_DIR)" />
+  <SetProperty Id="INSTALLFOLDER" Action="CraftRestoreUserFolder" Value="[CRAFT_USER_DIR]" Before="CostInitialize" Sequence="both" Condition="NOT INSTALLFOLDER AND ALLUSERS &lt;&gt; 1 AND CRAFT_USER_DIR" />
+  <!-- The wizard can change the context after Windows Installer has already resolved Program Files for the first one.
+       Give the new-install folder explicitly so Everyone never lands in the profile and Only for me never lands in Program Files. -->
+  <?if $(sys.BUILDARCH) = x86 ?>
+  <SetProperty Id="INSTALLFOLDER" Action="CraftDefaultMachineFolder" Value="[%ProgramFiles(x86)]\ArtCraft\PhotoCraft\" After="CraftRestoreUserFolder" Sequence="ui" Condition="NOT INSTALLFOLDER AND ALLUSERS = 1 AND VersionNT64" />
+  <SetProperty Id="INSTALLFOLDER" Action="CraftDefaultMachineFolder32" Value="[%ProgramFiles]\ArtCraft\PhotoCraft\" After="CraftDefaultMachineFolder" Sequence="ui" Condition="NOT INSTALLFOLDER AND ALLUSERS = 1 AND NOT VersionNT64" />
+  <SetProperty Id="INSTALLFOLDER" Action="CraftDefaultUserFolder" Value="[LocalAppDataFolder]Programs\ArtCraft\PhotoCraft\" After="CraftDefaultMachineFolder32" Sequence="ui" Condition="NOT INSTALLFOLDER AND ALLUSERS &lt;&gt; 1" />
+  <?else?>
+  <SetProperty Id="INSTALLFOLDER" Action="CraftDefaultMachineFolder" Value="[%ProgramW6432]\ArtCraft\PhotoCraft\" After="CraftRestoreUserFolder" Sequence="ui" Condition="NOT INSTALLFOLDER AND ALLUSERS = 1" />
+  <SetProperty Id="INSTALLFOLDER" Action="CraftDefaultUserFolder" Value="[LocalAppDataFolder]Programs\ArtCraft\PhotoCraft\" After="CraftDefaultMachineFolder" Sequence="ui" Condition="NOT INSTALLFOLDER AND ALLUSERS &lt;&gt; 1" />
+  <?endif?>
+  <SetProperty Id="INSTALLFOLDER" Action="CraftRestoreMachineFolder" Value="[CRAFT_MACHINE_DIR]" Before="CraftRestoreUserFolder" Sequence="both" Condition="NOT INSTALLFOLDER AND ALLUSERS = 1 AND CRAFT_MACHINE_DIR" />
+  <Launch Condition="Installed OR ALLUSERS &lt;&gt; 1 OR NOT CRAFT_USER_DIR" Message="This app is already installed for your account. Choose Only for me to update it, or uninstall that copy before changing who it is installed for." />
+  <Launch Condition="Installed OR ALLUSERS = 1 OR NOT CRAFT_MACHINE_DIR" Message="This app is already installed for everyone. Choose Everyone to update it, or pass ALLUSERS=1 to msiexec. Uninstall that copy before changing who it is installed for." />
+  <UI>
+    <TextStyle Id="CraftScopeText" FaceName="Segoe UI" Size="9" />
+    <TextStyle Id="CraftScopeTitle" FaceName="Segoe UI" Size="12" Bold="yes" />
+    <Dialog Id="CraftScopeDlg" Width="370" Height="220" Title="[ProductName] Setup" NoMinimize="yes">
+      <Control Id="Title" Type="Text" X="20" Y="15" Width="330" Height="30" Text="{\CraftScopeTitle}Who should use [ProductName]?" />
+      <Control Id="Info" Type="Text" X="20" Y="50" Width="330" Height="30" Text="{\CraftScopeText}An update keeps the existing folder. New copies use the ArtCraft folder under Programs." />
+      <Control Id="Scope" Type="RadioButtonGroup" X="20" Y="88" Width="330" Height="60" Property="CRAFT_SCOPE">
+        <RadioButtonGroup Property="CRAFT_SCOPE">
+          <RadioButton Value="user" X="0" Y="0" Width="330" Height="20" Text="Only for me (no administrator permission needed)" />
+          <RadioButton Value="machine" X="0" Y="30" Width="330" Height="20" Text="Everyone on this computer (asks an administrator)" />
+        </RadioButtonGroup>
+      </Control>
+      <Control Id="Next" Type="PushButton" X="214" Y="182" Width="66" Height="20" Default="yes" Text="Next">
+        <Publish Property="ALLUSERS" Value="1" Order="1" Condition="CRAFT_SCOPE = &quot;machine&quot;" />
+        <Publish Property="ALLUSERS" Value="{}" Order="2" Condition="CRAFT_SCOPE = &quot;user&quot;" />
+        <Publish Property="MSIINSTALLPERUSER" Value="{}" Order="3" Condition="CRAFT_SCOPE = &quot;machine&quot;" />
+        <Publish Property="MSIINSTALLPERUSER" Value="1" Order="4" Condition="CRAFT_SCOPE = &quot;user&quot;" />
+        <Publish Event="EndDialog" Value="Return" Order="5" />
+      </Control>
+      <Control Id="Cancel" Type="PushButton" X="290" Y="182" Width="60" Height="20" Cancel="yes" Text="Cancel"><Publish Event="EndDialog" Value="Exit" /></Control>
+    </Dialog>
+  </UI>
+  <InstallUISequence>
+    <Show Dialog="CraftScopeDlg" After="CraftPreferMachineScope" Condition="NOT Installed AND NOT REMOVE AND UILevel = 5" />
+    <!-- Related-product discovery runs once, so full UI must choose its context first. -->
+    <FindRelatedProducts After="CraftScopeDlg" />
+  </InstallUISequence>
+</Include>
diff --git a/packaging/windows/package.ps1 b/packaging/windows/package.ps1
index 0913011598..e78eb8905e 100644
--- a/packaging/windows/package.ps1
+++ b/packaging/windows/package.ps1
@@ -4,7 +4,7 @@
 
 .DESCRIPTION
   Produces, in $env:DIST (default: dist/release):
-    photocraft-<version>-windows-<arch>.msi            per-machine installer (WiX v5)
+    photocraft-<version>-windows-<arch>.msi            installer (WiX v5, per-user by default, per-machine optional)
     photocraft-<version>-windows-<arch>-portable.zip   photocraft.exe + photocraft-cli.exe + portable.txt
 
   The binaries link the C runtime statically (+crt-static), so neither the MSI nor the portable
@@ -158,6 +158,9 @@ Invoke-Native 'wix build' {
 Invoke-Native 'MSI shortcut icon validation (ICE50)' {
   wix msi validate $Msi -ice ICE50 -intermediateFolder (Join-Path $Stage 'msi-validation')
 }
+# Inspect the compiled tables and evaluate the duplicate guards with Windows Installer.
+# ICE validation alone cannot catch a well-formed condition with its meaning reversed.
+& (Join-Path $PSScriptRoot 'check-install-policy.ps1') -MsiPath $Msi
 # wix writes its debug symbols (.wixpdb) next to the MSI; keep them out of the release assets.
 Remove-Item -Force -ErrorAction SilentlyContinue ([IO.Path]::ChangeExtension($Msi, '.wixpdb'))
 & (Join-Path $PSScriptRoot 'sign.ps1') $Msi
diff --git a/packaging/windows/photocraft.en-us.wxl b/packaging/windows/photocraft.en-us.wxl
index faa2835abf..1992ed3988 100644
--- a/packaging/windows/photocraft.en-us.wxl
+++ b/packaging/windows/photocraft.en-us.wxl
@@ -8,4 +8,6 @@
   <String Id="WelcomeDlgDescription" Value="The Setup Wizard will install [ProductName] version [PhotocraftVersion] on your computer. Click Next to continue or Cancel to exit the Setup Wizard." />
   <String Id="VerifyReadyDlgInstallTitle" Value="{\WixUI_Font_Title}Ready to install [ProductName] [PhotocraftVersion]" />
   <String Id="ExitDialogTitle" Value="{\WixUI_Font_Bigger}Completed the [ProductName] [PhotocraftVersion] Setup Wizard" />
+  <String Id="PhotocraftInstallDirNote" Value="PhotoCraft installs for your user account only, into your own Programs folder, without asking an administrator for permission." />
+  <String Id="PhotocraftAllUsers" Value="Install for all users of this computer (asks an administrator)" />
 </WixLocalization>
diff --git a/packaging/windows/photocraft.wxs b/packaging/windows/photocraft.wxs
index 449591fe7c..6ff961fd99 100644
--- a/packaging/windows/photocraft.wxs
+++ b/packaging/windows/photocraft.wxs
@@ -1,37 +1,14 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--
-  PhotoCraft MSI (WiX Toolset v5: `dotnet tool install -g wix`, plus the UI and Util extensions:
-  `wix extension add -g WixToolset.UI.wixext/5.0.2 WixToolset.Util.wixext/5.0.2`). Built by package.ps1:
-
-    wix build photocraft.wxs -arch x64 -ext WixToolset.UI.wixext -ext WixToolset.Util.wixext
-      -culture en-US -loc photocraft.en-us.wxl -d Version=1.2.3 -d DisplayVersion=1.2.3-rc.1
-      -d BinDir=... -d IconPath=... -d BannerBmp=... -d DialogBmp=... -o out.msi
-
-  Per-machine install with a setup wizard that names the version: Welcome, install folder
-  (Program Files\PhotoCraft by default, remembered for upgrades), Ready, a progress page, and a
-  Finish page with a ticked "Launch PhotoCraft" box. Installs a Start Menu shortcut, makes
-  PhotoCraft the owner of `.pcraft`, and offers it under "Open with" for PSD/PSB and the image
-  formats it reads (without taking over the user's default app for them), plus photocraft-cli.
-  `msiexec /qn` still installs silently.
--->
-<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs"
-     xmlns:ui="http://wixtoolset.org/schemas/v4/wxs/ui">
+<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs" xmlns:ui="http://wixtoolset.org/schemas/v4/wxs/ui">
   <?ifndef HasCraftFontLicences ?>
   <?define HasCraftFontLicences=0 ?>
-  <?endif ?>
-  <Package
-      Name="PhotoCraft"
-      Manufacturer="Learning Machines LLC"
-      Version="$(var.Version)"
-      UpgradeCode="D9660F32-2D0A-4ABE-B73D-17BE25F1542C"
-      Scope="perMachine"
-      Compressed="yes"
-      Language="1033">
+  <?endif?>
+  <Package Name="PhotoCraft" Manufacturer="Learning Machines LLC" Version="$(var.Version)" UpgradeCode="D9660F32-2D0A-4ABE-B73D-17BE25F1542C" Scope="perUserOrMachine" Compressed="yes" Language="1033">
     <SummaryInformation Description="PhotoCraft image editor" Manufacturer="Learning Machines LLC" />
+    <?include $(sys.SOURCEFILEDIR)install-policy.wxi?>
     <!-- Same-version upgrades let successive pre-releases of one X.Y.Z replace each other
          (MSI versions are numeric, so 1.2.3-rc.1 and 1.2.3-rc.2 are both 1.2.3). -->
-    <MajorUpgrade AllowSameVersionUpgrades="yes"
-        DowngradeErrorMessage="A newer version of PhotoCraft is already installed." />
+    <MajorUpgrade AllowSameVersionUpgrades="yes" DowngradeErrorMessage="A newer version of PhotoCraft is already installed." />
     <MediaTemplate EmbedCab="yes" CompressionLevel="high" />
 
     <!-- MSI caches this icon using its Id as the filename. Advertised shortcuts to an
@@ -43,19 +20,18 @@
     <Property Id="ARPHELPLINK" Value="https://discord.gg/artcraft" />
 
     <StandardDirectory Id="ProgramFiles6432Folder">
-      <Directory Id="INSTALLFOLDER" Name="PhotoCraft" />
+      <Directory Id="CraftSuiteFolder" Name="ArtCraft">
+        <Directory Id="INSTALLFOLDER" Name="PhotoCraft" />
+      </Directory>
     </StandardDirectory>
     <StandardDirectory Id="ProgramMenuFolder" />
 
     <!-- An upgrade installs where the user put the previous version (written by PhotocraftApp). -->
-    <Property Id="INSTALLFOLDER">
-      <RegistrySearch Id="PreviousInstallFolder" Root="HKLM" Key="Software\PhotoCraft" Name="InstallDir" Type="raw" />
-    </Property>
 
     <Feature Id="Main" Title="PhotoCraft" Level="1">
       <?if $(var.HasCraftFontLicences) = 1 ?>
       <ComponentGroupRef Id="CraftFontLicences" />
-      <?endif ?>
+      <?endif?>
       <ComponentGroupRef Id="PhotocraftFiles" />
     </Feature>
 
@@ -65,8 +41,7 @@
     <UI>
       <Publish Dialog="WelcomeDlg" Control="Next" Event="NewDialog" Value="InstallDirDlg" Order="2" Condition="NOT Installed" />
       <Publish Dialog="InstallDirDlg" Control="Back" Event="NewDialog" Value="WelcomeDlg" Order="2" />
-      <Publish Dialog="ExitDialog" Control="Finish" Event="DoAction" Value="LaunchPhotocraft"
-          Condition="WIXUI_EXITDIALOGOPTIONALCHECKBOX = 1 AND NOT Installed" />
+      <Publish Dialog="ExitDialog" Control="Finish" Event="DoAction" Value="LaunchPhotocraft" Condition="WIXUI_EXITDIALOGOPTIONALCHECKBOX = 1 AND NOT Installed" />
     </UI>
     <!-- Our own art, generated by package.ps1 from the app icon (not WiX's stock bitmaps). -->
     <WixVariable Id="WixUIBannerBmp" Value="$(var.BannerBmp)" />
@@ -90,13 +65,11 @@
     <ComponentGroup Id="CraftFontLicences" Directory="INSTALLFOLDER">
       <Files Include="$(var.DocsDir)\**" />
     </ComponentGroup>
-    <?endif ?>
+    <?endif?>
     <ComponentGroup Id="PhotocraftFiles" Directory="INSTALLFOLDER">
       <Component Id="PhotocraftApp" Guid="A6DE41B7-A80F-4C59-A17E-BB68065BF67E">
         <File Id="PhotocraftExe" Source="$(var.BinDir)\photocraft.exe" KeyPath="yes">
-          <Shortcut Id="StartMenuShortcut" Directory="ProgramMenuFolder" Name="PhotoCraft"
-              Description="PhotoCraft image editor" WorkingDirectory="INSTALLFOLDER" Advertise="yes"
-              Icon="PhotocraftIcon.exe" IconIndex="0" />
+          <Shortcut Id="StartMenuShortcut" Directory="ProgramMenuFolder" Name="PhotoCraft" Description="PhotoCraft image editor" WorkingDirectory="INSTALLFOLDER" Advertise="yes" Icon="PhotocraftIcon.exe" IconIndex="0" />
         </File>
 
         <!-- .pcraft: PhotoCraft's own format; PhotoCraft is its default app. -->
@@ -107,56 +80,56 @@
         </ProgId>
         <!-- PSD/PSB and images: offered under "Open with", never forced as the default. -->
         <ProgId Id="Photocraft.PhotoshopDocument" Description="PSD Document" Icon="PhotocraftExe" IconIndex="0" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Photocraft.PhotoshopDocument\shell\open\command" Value="&quot;[#PhotocraftExe]&quot; &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Photocraft.PhotoshopDocument\shell\open\command" Value="&quot;[#PhotocraftExe]&quot; &quot;%1&quot;" Type="string" />
         <ProgId Id="Photocraft.Image" Description="Image" Icon="PhotocraftExe" IconIndex="0" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Photocraft.Image\shell\open\command" Value="&quot;[#PhotocraftExe]&quot; &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.psd\OpenWithProgids" Name="Photocraft.PhotoshopDocument" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.psb\OpenWithProgids" Name="Photocraft.PhotoshopDocument" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.pdn\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.ora\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.kra\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.krz\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.png\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.jpg\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.jpeg\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.tif\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.tiff\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.webp\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.gif\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.bmp\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.tga\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.exr\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.hdr\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.avif\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.qoi\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\.ico\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Photocraft.Image\shell\open\command" Value="&quot;[#PhotocraftExe]&quot; &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.psd\OpenWithProgids" Name="Photocraft.PhotoshopDocument" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.psb\OpenWithProgids" Name="Photocraft.PhotoshopDocument" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.pdn\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.ora\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.kra\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.krz\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.png\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.jpg\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.jpeg\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.tif\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.tiff\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.webp\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.gif\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.bmp\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.tga\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.exr\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.hdr\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.avif\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.qoi\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\.ico\OpenWithProgids" Name="Photocraft.Image" Value="" Type="string" />
 
         <!-- "Open with" app list and the Run dialog (Win+R "photocraft"). -->
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe" Name="FriendlyAppName" Value="PhotoCraft" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\shell\open\command" Value="&quot;[#PhotocraftExe]&quot; &quot;%1&quot;" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".pcraft" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".psd" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".psb" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".pdn" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".ora" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".kra" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".krz" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".png" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".jpg" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".jpeg" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".tif" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".tiff" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".webp" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".gif" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".bmp" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".tga" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".exr" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".hdr" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".avif" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".qoi" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".ico" Value="" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\photocraft.exe" Value="[#PhotocraftExe]" Type="string" />
-        <RegistryValue Root="HKLM" Key="Software\PhotoCraft" Name="InstallDir" Value="[INSTALLFOLDER]" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe" Name="FriendlyAppName" Value="PhotoCraft" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\shell\open\command" Value="&quot;[#PhotocraftExe]&quot; &quot;%1&quot;" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".pcraft" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".psd" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".psb" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".pdn" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".ora" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".kra" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".krz" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".png" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".jpg" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".jpeg" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".tif" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".tiff" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".webp" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".gif" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".bmp" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".tga" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".exr" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".hdr" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".avif" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".qoi" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Classes\Applications\photocraft.exe\SupportedTypes" Name=".ico" Value="" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\photocraft.exe" Value="[#PhotocraftExe]" Type="string" />
+        <RegistryValue Root="HKMU" Key="Software\PhotoCraft" Name="InstallDir" Value="[INSTALLFOLDER]" Type="string" />
       </Component>
 
       <Component Id="PhotocraftCli">
diff --git a/packaging/windows/test-install-policy.ps1 b/packaging/windows/test-install-policy.ps1
new file mode 100644
index 0000000000..d455d19d16
--- /dev/null
+++ b/packaging/windows/test-install-policy.ps1
@@ -0,0 +1,54 @@
+<#
+.SYNOPSIS
+  Build non-executable installer metadata fixtures; never install them.
+#>
+param(
+  [Parameter(Mandatory = $true)] [string] $OutputDirectory,
+  [ValidateSet('x64','x86','arm64')] [string[]] $Architectures = @('x64','x86','arm64')
+)
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+$root = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
+$policy = Get-Content -Raw -LiteralPath (Join-Path $PSScriptRoot 'install-policy.json') | ConvertFrom-Json
+[void](New-Item -ItemType Directory -Force -Path $OutputDirectory)
+$output = (Resolve-Path -LiteralPath $OutputDirectory).Path
+Add-Type -AssemblyName System.Drawing
+foreach ($arch in $Architectures) {
+  $stage = Join-Path $output $arch
+  [void](New-Item -ItemType Directory -Force -Path $stage)
+  foreach ($name in $policy.payloads) {
+    $destination = Join-Path $stage $name
+    [void](New-Item -ItemType Directory -Force -Path ([IO.Path]::GetDirectoryName($destination)))
+    Set-Content -LiteralPath $destination -Encoding Ascii -Value 'NON-EXECUTABLE MSI METADATA TEST FIXTURE'
+  }
+  foreach ($folder in @('docs','models','notices')) {
+    $path = Join-Path $stage $folder
+    [void](New-Item -ItemType Directory -Force -Path $path)
+    Set-Content -LiteralPath (Join-Path $path "$folder-fixture.txt") -Value 'Metadata test fixture, not a user file or model.'
+  }
+  foreach ($model in @('metadata-one.rten','metadata-two.rten')) {
+    Set-Content -LiteralPath (Join-Path (Join-Path $stage 'models') $model) -Encoding Ascii -Value 'NON-EXECUTABLE MODEL METADATA FIXTURE'
+  }
+  foreach ($spec in @(@('banner.bmp',493,58),@('dialog.bmp',493,312))) {
+    $bitmap = [Drawing.Bitmap]::new($spec[1],$spec[2],[Drawing.Imaging.PixelFormat]::Format24bppRgb)
+    try { $bitmap.Save((Join-Path $stage $spec[0]),[Drawing.Imaging.ImageFormat]::Bmp) }
+    finally { $bitmap.Dispose() }
+  }
+  Set-Content -LiteralPath (Join-Path $stage 'licence.rtf') -Encoding Ascii -Value '{\rtf1 Metadata test fixture.}'
+  $sources = @($policy.sources | ForEach-Object { Join-Path $PSScriptRoot $_ })
+  $msi = Join-Path $stage "$($policy.id)-NOT-INSTALLABLE.msi"
+  $extensions = @($policy.extensions | ForEach-Object { '-ext'; "WixToolset.$_.wixext" })
+  & wix build @sources -arch $arch @extensions `
+    -culture en-US -d 'Version=0.0.1' -d 'DisplayVersion=0.0.1-metadata-test' `
+    -d "BinDir=$stage" -d "IconPath=$(Join-Path $root $policy.icon)" `
+    -d "DocsDir=$(Join-Path $stage 'docs')" -d "ModelsDir=$(Join-Path $stage 'models')" `
+    -d "AppNoticesDir=$(Join-Path $stage 'notices')" -d 'HasCraftFontLicences=1' -d 'HasCli=1' `
+    -d "BannerBmp=$(Join-Path $stage 'banner.bmp')" -d "DialogBmp=$(Join-Path $stage 'dialog.bmp')" `
+    -d "UiBannerBmp=$(Join-Path $stage 'banner.bmp')" -d "UiDialogBmp=$(Join-Path $stage 'dialog.bmp')" `
+    -d "LicenseRtf=$(Join-Path $stage 'licence.rtf')" -o $msi @($policy.localization | ForEach-Object { '-loc'; Join-Path $PSScriptRoot $_ })
+  if ($LASTEXITCODE -ne 0) { throw "WiX validation failed for $arch (exit $LASTEXITCODE)." }
+  $shell = (Get-Process -Id $PID).Path
+  & $shell -NoProfile -ExecutionPolicy Bypass -File (Join-Path $PSScriptRoot 'check-install-policy.ps1') -MsiPath $msi
+  if ($LASTEXITCODE -ne 0) { throw "Compiled installer policy failed for $arch (exit $LASTEXITCODE)." }
+  Write-Output "PASS $arch metadata-only package. This is not an executable installer."
+}
diff --git a/perf/budgets.toml b/perf/budgets.toml
index 7a16f37e2f..b538808553 100644
--- a/perf/budgets.toml
+++ b/perf/budgets.toml
@@ -16,6 +16,16 @@
 regression_pct = 15.0
 # …and by more than this many milliseconds (timer noise on very fast rows).
 regression_min_ms = 1.0
+# A run whose 1-minute load at the start is above this many per core is contended: its numbers
+# measure the machine's load, so `--update-baseline` refuses it (`--allow-contended` records it,
+# labelled as contended, and the scorecard says so).
+max_load_per_core = 1.0
+# `--update-baseline --from <results.json>...` needs at least this many saved runs. Each scenario
+# gets the median p50 and the highest (the noise ceiling regressions are judged against).
+baseline_min_runs = 5
+# `--from` lists a budget as "could enforce" when its metric stays within this share of the
+# budget in every run.
+enforce_margin = 0.6
 
 [[bench]]
 name = "perf_scenarios"
@@ -23,6 +33,14 @@ package = "photocraft-ui-egui"
 quick_args = ["--quick"]
 note = "the #209/#210/#211 rows: layered 20 MP, 150 layers, 16/32-bit, open, retouch, selection"
 
+[[bench]]
+name = "perf_scenarios_cpu"
+package = "photocraft-ui-egui"
+example = "perf_scenarios"
+args = ["--cpu", "--group", "layered"]
+quick_args = ["--quick", "--cpu", "--group", "layered"]
+note = "the layered #209 rows on the forced CPU compositor (#9330); run with perf_scenarios so the machine class keeps the GPU"
+
 [[bench]]
 name = "interactive_bench"
 package = "photocraft-ui-egui"
@@ -237,7 +255,10 @@ issue = 209
 bench = "perf_scenarios"
 row = "brush dab 60 px on 32-bit 20 layers + refresh"
 budget_ms = 100
-enforce = false  # over budget in the 2026-10-05 baseline
+# Not enforced: met on an idle M4 Pro (p95 2.95 ms), but over budget once in the 8 nightlies on
+# macos-15 (p95 103.7 ms on 2026-10-18). `cargo xtask perf --update-baseline --from` over those
+# 8 nightlies (2026-10-18 to 10-25) lists it as flaky. Budget enforcement applies on the runner.
+enforce = false
 
 [[scenario]]
 id = "P17"
@@ -323,7 +344,9 @@ title = "Cancel a Gaussian Blur job on 24 MP (until the worker exits)"
 issue = 210
 bench = "perf_scenarios"
 row = "cancel Gaussian Blur r 50 job on 24 MP"
-metric = "max"
+# Judged on p95, not max. Note: with n <= 20, `rank()` makes p95 equal max, so on the nightly
+# runner (n = 8) this has no effect until reps >= 21. The 2026-10-18 nightly read 299 ms either way.
+metric = "p95"
 budget_ms = 200
 
 [[scenario]]
@@ -631,3 +654,100 @@ issue = 7758
 bench = "bench_multiband"
 row = "Photomerge multiband blend"
 target = "track timing and peak RSS; no calibrated performance budget"
+
+# ---- cliff rows (#7494): off-happy-path paths, reported only ---------------------------------
+
+[[scenario]]
+id = "P69"
+title = "Move a layer with layer styles, CPU compositor"
+issue = 9330
+bench = "perf_scenarios_cpu"
+row = "move styled layer 10 px + refresh"
+enforce = false  # tracked only
+
+[[scenario]]
+id = "P70"
+title = "Change layer opacity, CPU compositor"
+issue = 9330
+bench = "perf_scenarios_cpu"
+row = "set layer opacity + refresh"
+budget_ms = 40
+enforce = false  # #9330 done-when: within 2x the GPU budget
+
+[[scenario]]
+id = "P71"
+title = "Change layer fill, CPU compositor"
+issue = 9330
+bench = "perf_scenarios_cpu"
+row = "set layer fill + refresh"
+budget_ms = 40
+enforce = false  # #9330 done-when: within 2x the GPU budget
+
+[[scenario]]
+id = "P72"
+title = "Change blend mode, CPU compositor"
+issue = 9330
+bench = "perf_scenarios_cpu"
+row = "set blend mode + refresh"
+budget_ms = 40
+enforce = false  # #9330 done-when: within 2x the GPU budget
+
+[[scenario]]
+id = "P73"
+title = "Toggle visibility, CPU compositor"
+issue = 9330
+bench = "perf_scenarios_cpu"
+row = "toggle visibility + refresh"
+budget_ms = 20
+enforce = false  # #9330 done-when: within 2x the GPU budget
+
+[[scenario]]
+id = "P74"
+title = "Undo a move, CPU compositor"
+issue = 9330
+bench = "perf_scenarios_cpu"
+row = "undo move + refresh"
+enforce = false  # tracked only
+
+[[scenario]]
+id = "P75"
+title = "Redo an opacity change, CPU compositor"
+issue = 9330
+bench = "perf_scenarios_cpu"
+row = "redo opacity change + refresh"
+enforce = false  # tracked only
+
+[[scenario]]
+id = "P76"
+title = "Change layer opacity with Advanced Blending on another layer"
+issue = 6689
+bench = "perf_scenarios"
+row = "set opacity on a layer with Advanced Blending + refresh"
+budget_ms = 40
+enforce = false  # new; 2x P2
+
+[[scenario]]
+id = "P77"
+title = "Toggle an adjustment layer's visibility"
+issue = 6535
+bench = "perf_scenarios"
+row = "toggle adjustment layer visibility + refresh"
+budget_ms = 10
+enforce = false  # new; as P5
+
+[[scenario]]
+id = "P78"
+title = "Hide the top adjustment layer among 150 full-canvas layers, 6 MP, GPU budget forced to 512 MB (CPU fallback)"
+issue = 6533
+bench = "perf_scenarios"
+row = "hide the top adjustment layer among many full-canvas layers, over the GPU budget + refresh"
+budget_ms = 30
+enforce = false  # new; as P61
+
+[[scenario]]
+id = "P79"
+title = "Zoomed-out reduced composite of a 30000x30000 document with one painted layer (#9330 target: 60000x60000)"
+issue = 1015
+bench = "perf_scenarios"
+row = "zoomed-out reduced composite of the huge document with one painted layer"
+enforce = false  # tracked only
diff --git a/xtask/src/perf.rs b/xtask/src/perf.rs
index c1890d1cbd..d900669984 100644
--- a/xtask/src/perf.rs
+++ b/xtask/src/perf.rs
@@ -2,13 +2,20 @@
 //! by scenario id, and check it against `perf/budgets.toml` and `perf/baseline.json` (#221).
 //!
 //! ```text
-//! cargo xtask perf [--quick] [--update-baseline] [--threshold PCT] [--bench NAME]... [--skip-build] [--reuse]
+//! cargo xtask perf [--quick] [--update-baseline [--allow-contended]] [--threshold PCT] [--bench NAME]... [--skip-build] [--reuse]
+//! cargo xtask perf --update-baseline --from results.json [--from results.json]... [--allow-contended]
 //! ```
 //!
 //! - `--quick`: only the benches with `quick_args` (small synthetic documents; minutes, not tens
 //!   of minutes). Quick numbers are compared only with a quick baseline, and budgets don't apply
 //!   (they are set for the full-size documents).
 //! - `--update-baseline`: write this run into `perf/baseline.json` (the only way it changes).
+//!   A contended run (1-minute load at the start above `settings.max_load_per_core` per core) is
+//!   refused; `--allow-contended` records it, labelled `"contended": true`.
+//! - `--from FILE`: with `--update-baseline`, build the baseline from saved `results.json` files
+//!   (at least `settings.baseline_min_runs`, one machine class and mode, clean trees) instead of
+//!   running: per scenario the median p50 and the highest (the noise ceiling regressions are
+//!   judged against). Prints which budgets could be enforced and which enforced ones are flaky.
 //! - `--threshold PCT`: the regression threshold (default `settings.regression_pct`, 15 %).
 //! - `--bench NAME`: run only these benches (repeatable).
 //! - `--skip-build`: don't run `cargo build` first. `--reuse`: don't run the benches either;
@@ -18,7 +25,8 @@
 //! nightly job posts as its summary) and one `target/perf/<bench>.json` per bench.
 //!
 //! Exit status: non-zero when an enforced budget breaks (full mode), a scenario's p50 regresses
-//! more than the threshold against a baseline from the same machine class and mode, or a bench
+//! more than the threshold against a baseline from the same machine class and mode (against its
+//! noise ceiling when it was built from several runs), or a bench
 //! fails. Runs from different machine classes are never compared.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
@@ -54,11 +62,18 @@ pub struct Settings {
     pub regression_pct: f64,
     /// …and by more than this many milliseconds (timer noise on sub-millisecond rows).
     pub regression_min_ms: f64,
+    /// A run is contended when its 1-minute load at the start exceeds this many per core: its
+    /// numbers measure the machine's load, so `--update-baseline` refuses it.
+    pub max_load_per_core: f64,
+    /// `--update-baseline --from` needs at least this many saved runs.
+    pub baseline_min_runs: usize,
+    /// A budget could be enforced when its metric stays within this share of the budget in every run.
+    pub enforce_margin: f64,
 }
 
 impl Default for Settings {
     fn default() -> Self {
-        Self { regression_pct: 15.0, regression_min_ms: 1.0 }
+        Self { regression_pct: 15.0, regression_min_ms: 1.0, max_load_per_core: 1.0, baseline_min_runs: 5, enforce_margin: 0.6 }
     }
 }
 
@@ -171,6 +186,15 @@ pub fn parse_budgets(text: &str) -> Result<Budgets, String> {
     if !(b.settings.regression_min_ms.is_finite() && b.settings.regression_min_ms >= 0.0) {
         return Err(format!("{BUDGETS}: settings.regression_min_ms must be finite and >= 0"));
     }
+    if !(b.settings.max_load_per_core.is_finite() && b.settings.max_load_per_core > 0.0) {
+        return Err(format!("{BUDGETS}: settings.max_load_per_core must be > 0"));
+    }
+    if b.settings.baseline_min_runs == 0 {
+        return Err(format!("{BUDGETS}: settings.baseline_min_runs must be >= 1"));
+    }
+    if !(b.settings.enforce_margin.is_finite() && b.settings.enforce_margin > 0.0 && b.settings.enforce_margin <= 1.0) {
+        return Err(format!("{BUDGETS}: settings.enforce_margin must be in (0, 1]"));
+    }
     Ok(b)
 }
 
@@ -185,6 +209,8 @@ pub struct Stats {
     pub max: Option<f64>,
     pub peak_rss: Option<u64>,
     pub gpu_bytes: Option<u64>,
+    /// A baseline built from several runs: the highest p50 among them (its noise ceiling).
+    pub p50_max: Option<f64>,
 }
 
 impl Stats {
@@ -197,7 +223,12 @@ impl Stats {
     }
 
     pub fn to_json(&self) -> Value {
-        json!({"n": self.n, "p50_ms": self.p50, "p95_ms": self.p95, "max_ms": self.max, "peak_rss_bytes": self.peak_rss, "gpu_bytes": self.gpu_bytes})
+        let mut v =
+            json!({"n": self.n, "p50_ms": self.p50, "p95_ms": self.p95, "max_ms": self.max, "peak_rss_bytes": self.peak_rss, "gpu_bytes": self.gpu_bytes});
+        if let (Some(m), Some(o)) = (self.p50_max, v.as_object_mut()) {
+            o.insert("p50_max_ms".into(), json!(m));
+        }
+        v
     }
 
     pub fn from_json(v: &Value) -> Self {
@@ -208,6 +239,7 @@ impl Stats {
             max: v.get("max_ms").and_then(Value::as_f64),
             peak_rss: v.get("peak_rss_bytes").and_then(Value::as_u64),
             gpu_bytes: v.get("gpu_bytes").and_then(Value::as_u64),
+            p50_max: v.get("p50_max_ms").and_then(Value::as_f64),
         }
     }
 }
@@ -237,6 +269,7 @@ pub fn row_stats(row: &Value) -> Stats {
         max: f("max_ms"),
         peak_rss: row.get("peak_rss_bytes").and_then(Value::as_u64),
         gpu_bytes: row.get("gpu_bytes").and_then(Value::as_u64),
+        p50_max: None,
     };
     if !samples.is_empty() {
         s.p50 = rank(&samples, 0.5);
@@ -310,8 +343,10 @@ pub struct Outcome {
 }
 
 /// Budget and regression verdict for one scenario. `budgets_apply` is false in quick mode.
+/// A regression is judged against the baseline's noise ceiling (the highest p50 of the runs it was
+/// built from), or its p50 when it came from one run.
 pub fn verdict(sc: &Scenario, stats: &Stats, base: Option<&Stats>, settings: &Settings, threshold: f64, budgets_apply: bool) -> Status {
-    if let (Some(cur), Some(b)) = (stats.p50, base.and_then(|b| b.p50))
+    if let (Some(cur), Some(b)) = (stats.p50, base.and_then(|b| b.p50_max.or(b.p50)))
         && regressed(cur, b, threshold, settings.regression_min_ms)
     {
         return Status::Regressed;
@@ -590,34 +625,181 @@ pub fn baseline_for(baseline: &Value, class: &str, mode: &str) -> Result<BTreeMa
     Ok(sc.iter().map(|(k, v)| (k.clone(), Stats::from_json(v))).collect())
 }
 
-/// `old` with this run's mode replaced (or a fresh baseline when the machine class changed).
-pub fn updated_baseline(old: Option<&Value>, results: &Value) -> Value {
-    let class = results.get("machine").and_then(|m| m.get("class")).cloned().unwrap_or(Value::Null);
-    let mode = results.get("mode").and_then(Value::as_str).unwrap_or("full").to_string();
+/// A run is contended when its 1-minute load at the start exceeds `max_per_core` per core:
+/// its numbers measure the machine's load, not the code.
+/// Without a load (Windows) or a core count, nothing can be judged: not contended.
+pub fn contended(load: Option<[f64; 3]>, cores: Option<usize>, max_per_core: f64) -> bool {
+    match (load, cores) {
+        (Some([one, _, _]), Some(c)) if c > 0 => one > c as f64 * max_per_core,
+        _ => false,
+    }
+}
+
+fn load_of(v: Option<&Value>) -> Option<[f64; 3]> {
+    let a = v?.as_array()?;
+    Some([a.first()?.as_f64()?, a.get(1)?.as_f64()?, a.get(2)?.as_f64()?])
+}
+
+fn cores_of(machine: Option<&Value>) -> Option<usize> {
+    machine?.get("cores")?.as_u64().map(|c| c as usize)
+}
+
+/// Whether a `results.json` (or a baseline mode plus its machine) was contended at the start.
+pub fn run_contended(load_avg_start: Option<&Value>, machine: Option<&Value>, max_per_core: f64) -> bool {
+    contended(load_of(load_avg_start), cores_of(machine), max_per_core)
+}
+
+/// What `baseline_from_runs` accepts.
+pub struct BaselineRules {
+    /// Fewer runs are refused.
+    pub min_runs: usize,
+    pub max_load_per_core: f64,
+    /// Accept contended runs (the baseline then records `"contended": true`).
+    pub allow_contended: bool,
+}
+
+fn median(v: &mut [f64]) -> Option<f64> {
+    v.sort_by(f64::total_cmp);
+    let n = v.len();
+    match n {
+        0 => None,
+        _ if n % 2 == 1 => v.get(n / 2).copied(),
+        _ => Some((v.get(n / 2 - 1)? + v.get(n / 2)?) / 2.0),
+    }
+}
+
+/// `old` with one mode replaced by a baseline built from `runs` (saved `results.json` values of
+/// one machine class and mode), or a fresh baseline when the machine class changed. Per scenario:
+/// `p50_ms` is the median of the runs' p50 and, from two runs on, `p50_max_ms` their maximum (the
+/// noise ceiling regressions are judged against); p95 is the median, max and memory the maximum.
+/// One run is the plain `--update-baseline` case. Refused: too few runs, mixed machine classes or
+/// modes, dirty trees when there are several runs, and contended runs unless allowed.
+pub fn baseline_from_runs(old: Option<&Value>, runs: &[Value], rules: &BaselineRules) -> Result<Value, String> {
+    if runs.len() < rules.min_runs.max(1) {
+        return Err(format!("a baseline needs at least {} run(s), got {}", rules.min_runs.max(1), runs.len()));
+    }
+    let class_of = |r: &Value| r.get("machine").and_then(|m| m.get("class")).cloned().unwrap_or(Value::Null);
+    let mode_of = |r: &Value| r.get("mode").and_then(Value::as_str).unwrap_or("full").to_string();
+    let mut runs: Vec<&Value> = runs.iter().collect();
+    runs.sort_by_key(|r| r.get("date").and_then(Value::as_str).unwrap_or("").to_string());
+    let Some(last) = runs.last().copied() else { return Err("no runs".into()) };
+    let (class, mode) = (class_of(last), mode_of(last));
+    if runs.iter().any(|r| class_of(r) != class) {
+        return Err("the runs are from different machine classes: a baseline needs one".into());
+    }
+    if runs.iter().any(|r| mode_of(r) != mode) {
+        return Err("the runs mix full and quick modes: a baseline needs one".into());
+    }
+    if runs.len() > 1
+        && let Some(r) = runs.iter().find(|r| r.get("dirty").and_then(Value::as_bool) == Some(true))
+    {
+        return Err(format!("run {} was taken on a dirty tree: a baseline needs committed code", r.get("date").and_then(Value::as_str).unwrap_or("?")));
+    }
+    let is_contended = |r: &Value| run_contended(r.get("load_avg_start"), r.get("machine"), rules.max_load_per_core);
+    let any_contended = runs.iter().any(|r| is_contended(r));
+    if any_contended && !rules.allow_contended {
+        let msgs: Vec<String> = runs
+            .iter()
+            .filter(|r| is_contended(r))
+            .map(|r| {
+                format!(
+                    "load {} on {} cores at the start of {}",
+                    load_of(r.get("load_avg_start")).map_or_else(|| "?".into(), |l| format!("{:.2}", l[0])),
+                    cores_of(r.get("machine")).map_or_else(|| "?".into(), |c| c.to_string()),
+                    r.get("date").and_then(Value::as_str).unwrap_or("the run")
+                )
+            })
+            .collect();
+        return Err(format!(
+            "contended run, baseline not written: {} (above {} per core). Its numbers measure machine load; rerun on an idle machine, or pass --allow-contended to record it labelled as contended",
+            msgs.join("; "),
+            rules.max_load_per_core
+        ));
+    }
+
+    let mut per: BTreeMap<String, Vec<Stats>> = BTreeMap::new();
+    let mut failed = serde_json::Map::new();
+    for r in &runs {
+        for (k, v) in r.get("scenarios").and_then(Value::as_object).into_iter().flatten() {
+            if v.get("p50_ms").is_some_and(|x| !x.is_null()) {
+                per.entry(k.clone()).or_default().push(Stats::from_json(v));
+            } else if let Some(e) = v.get("status").and_then(Value::as_str).and_then(|s| s.strip_prefix(MISSING_PREFIX)) {
+                // A crashed row (a crash the bench found): kept so the scorecard says so.
+                failed.insert(k.clone(), json!(e));
+            }
+        }
+    }
+    let mut scenarios = serde_json::Map::new();
+    for (k, st) in &per {
+        // A row that crashed in any run stays failed, and one missing from some runs is left
+        // out: no partial aggregate under a full run count.
+        if failed.contains_key(k) || st.len() != runs.len() {
+            continue;
+        }
+        let mut p50: Vec<f64> = st.iter().filter_map(|s| s.p50).collect();
+        let mut p95: Vec<f64> = st.iter().filter_map(|s| s.p95).collect();
+        let fmax = |f: fn(&Stats) -> Option<f64>| st.iter().filter_map(f).reduce(f64::max);
+        let umax = |f: fn(&Stats) -> Option<u64>| st.iter().filter_map(f).max();
+        let s = Stats {
+            n: st.iter().map(|s| s.n).sum(),
+            p50_max: (runs.len() > 1).then(|| fmax(|s| s.p50)).flatten(),
+            p50: median(&mut p50),
+            p95: median(&mut p95),
+            max: fmax(|s| s.max),
+            peak_rss: umax(|s| s.peak_rss),
+            gpu_bytes: umax(|s| s.gpu_bytes),
+        };
+        scenarios.insert(k.clone(), s.to_json());
+    }
+
     let mut modes = old.filter(|o| o.get("machine_class") == Some(&class)).and_then(|o| o.get("modes")).and_then(Value::as_object).cloned().unwrap_or_default();
-    let scenarios: serde_json::Map<String, Value> = results
-        .get("scenarios")
-        .and_then(Value::as_object)
-        .map(|m| m.iter().filter(|(_, v)| v.get("p50_ms").is_some_and(|x| !x.is_null())).map(|(k, v)| (k.clone(), Stats::from_json(v).to_json())).collect())
-        .unwrap_or_default();
-    // Scenarios whose bench row failed (a crash the bench found): kept so the scorecard says so.
-    let failed: serde_json::Map<String, Value> = results
-        .get("scenarios")
-        .and_then(Value::as_object)
-        .map(|m| m.iter().filter_map(|(k, v)| v.get("status")?.as_str()?.strip_prefix(MISSING_PREFIX).map(|e| (k.clone(), json!(e)))).collect())
-        .unwrap_or_default();
-    modes.insert(
-        mode,
-        json!({
-            "date": results.get("date"),
-            "commit": results.get("commit"),
-            "load_avg_start": results.get("load_avg_start"),
-            "load_avg_end": results.get("load_avg_end"),
-            "scenarios": scenarios,
-            "failed": failed,
-        }),
-    );
-    json!({"schema": 1, "machine_class": class, "machine": results.get("machine"), "modes": modes})
+    let mut entry = json!({
+        "date": last.get("date"),
+        "commit": last.get("commit"),
+        "load_avg_start": last.get("load_avg_start"),
+        "load_avg_end": last.get("load_avg_end"),
+        "cores": cores_of(last.get("machine")),
+        "runs": runs.len(),
+        "scenarios": scenarios,
+        "failed": failed,
+    });
+    if let Some(o) = entry.as_object_mut() {
+        if any_contended {
+            o.insert("contended".into(), json!(true));
+        }
+        if runs.len() > 1 {
+            let each: Vec<Value> = runs
+                .iter()
+                .map(|r| json!({"date": r.get("date"), "commit": r.get("commit"), "load_avg_start": r.get("load_avg_start"), "contended": is_contended(r)}))
+                .collect();
+            o.insert("run_list".into(), json!(each));
+        }
+    }
+    modes.insert(mode, entry);
+    Ok(json!({"schema": 1, "machine_class": class, "machine": last.get("machine"), "modes": modes}))
+}
+
+/// From saved runs: budgets that could be enforced (not enforced, and within `enforce_margin` of
+/// the budget in every run) and enforced budgets that went over in some run (flaky).
+pub fn enforce_report(budgets: &Budgets, runs: &[Value]) -> (Vec<String>, Vec<String>) {
+    let (mut could, mut flaky) = (Vec::new(), Vec::new());
+    let margin = budgets.settings.enforce_margin;
+    for sc in &budgets.scenario {
+        let (Some(budget), None) = (sc.budget_ms, &sc.not_measurable) else { continue };
+        let key = format!("{}_ms", sc.metric.label());
+        let vals: Vec<f64> = runs.iter().filter_map(|r| r.get("scenarios")?.get(&sc.id)?.get(&key)?.as_f64()).collect();
+        let Some(worst) = vals.iter().copied().reduce(f64::max) else { continue };
+        let m = sc.metric.label();
+        if sc.enforce {
+            let over = vals.iter().filter(|v| **v > budget).count();
+            if over > 0 {
+                flaky.push(format!("{} {}: over {} ms in {over} of {} runs (worst {m} {})", sc.id, sc.title, fmt_num(budget), runs.len(), fmt_num(worst)));
+            }
+        } else if vals.len() == runs.len() && worst <= margin * budget {
+            could.push(format!("{} {}: worst {m} {} ms ≤ {margin} × {} ms in all {} runs", sc.id, sc.title, fmt_num(worst), fmt_num(budget), runs.len()));
+        }
+    }
+    (could, flaky)
 }
 
 // ---- running ---------------------------------------------------------------------------------
@@ -629,10 +811,22 @@ struct Opts {
     benches: Vec<String>,
     skip_build: bool,
     reuse: bool,
+    /// `--update-baseline --from`: build the baseline from these saved `results.json` files.
+    from: Vec<PathBuf>,
+    allow_contended: bool,
 }
 
 fn parse_opts(rest: &[&str]) -> Result<Opts, String> {
-    let mut o = Opts { quick: false, update_baseline: false, threshold: None, benches: Vec::new(), skip_build: false, reuse: false };
+    let mut o = Opts {
+        quick: false,
+        update_baseline: false,
+        threshold: None,
+        benches: Vec::new(),
+        skip_build: false,
+        reuse: false,
+        from: Vec::new(),
+        allow_contended: false,
+    };
     let mut it = rest.iter();
     while let Some(a) = it.next() {
         match *a {
@@ -648,9 +842,14 @@ fn parse_opts(rest: &[&str]) -> Result<Opts, String> {
                 o.threshold = Some(v);
             }
             "--bench" => o.benches.push(it.next().ok_or("--bench needs a name")?.to_string()),
+            "--from" => o.from.push(PathBuf::from(it.next().ok_or("--from needs a results.json path")?)),
+            "--allow-contended" => o.allow_contended = true,
             other => return Err(format!("perf: unknown option `{other}`")),
         }
     }
+    if !o.from.is_empty() && !o.update_baseline {
+        return Err("--from builds a baseline: use it with --update-baseline".into());
+    }
     Ok(o)
 }
 
@@ -670,6 +869,10 @@ pub fn run(root: &Path, rest: &[&str]) -> Result<(), String> {
     let o = parse_opts(rest)?;
     let text = std::fs::read_to_string(root.join(BUDGETS)).map_err(|e| format!("read {BUDGETS}: {e}"))?;
     let budgets = parse_budgets(&text)?;
+    let baseline_value: Option<Value> = std::fs::read_to_string(root.join(BASELINE)).ok().and_then(|t| serde_json::from_str(&t).ok());
+    if !o.from.is_empty() {
+        return baseline_from_files(root, &budgets, baseline_value.as_ref(), &o);
+    }
     let mode = if o.quick { "quick" } else { "full" };
     let threshold = o.threshold.unwrap_or(budgets.settings.regression_pct);
     let target = target_dir()?;
@@ -699,6 +902,9 @@ pub fn run(root: &Path, rest: &[&str]) -> Result<(), String> {
         plan.push((b, args));
     }
 
+    // Sampled before the build: the harness's own compile isn't contention. The load after the
+    // build is still recorded, as the first bench's `load_avg_before`.
+    let load_start = load_avg();
     if !o.skip_build {
         let mut by_pkg: BTreeMap<&str, Vec<&str>> = BTreeMap::new();
         for (b, _) in &plan {
@@ -714,7 +920,6 @@ pub fn run(root: &Path, rest: &[&str]) -> Result<(), String> {
         }
     }
 
-    let load_start = load_avg();
     let mut reports: BTreeMap<String, Result<Value, String>> = BTreeMap::new();
     let mut bench_meta = serde_json::Map::new();
     for (b, args) in &plan {
@@ -786,7 +991,6 @@ pub fn run(root: &Path, rest: &[&str]) -> Result<(), String> {
         obj.insert("class".into(), json!(class));
     }
 
-    let baseline_value: Option<Value> = std::fs::read_to_string(root.join(BASELINE)).ok().and_then(|t| serde_json::from_str(&t).ok());
     let (baseline, baseline_note) = match baseline_value.as_ref().map(|b| baseline_for(b, &class, mode)) {
         Some(Ok(b)) => (Some(b), None),
         Some(Err(e)) => (None, Some(e)),
@@ -823,6 +1027,7 @@ pub fn run(root: &Path, rest: &[&str]) -> Result<(), String> {
     let bench_failures: Vec<String> = reports.iter().filter_map(|(n, r)| r.as_ref().err().map(|e| format!("bench {n}: {e}"))).collect();
     let commit = git(root, &["rev-parse", "HEAD"]);
     let dirty = git(root, &["status", "--porcelain"]).is_some_and(|s| !s.is_empty());
+    let is_contended = contended(load_start, m.get("cores").and_then(Value::as_u64).map(|c| c as usize), budgets.settings.max_load_per_core);
     let results = json!({
         "schema": 1,
         "mode": mode,
@@ -832,6 +1037,7 @@ pub fn run(root: &Path, rest: &[&str]) -> Result<(), String> {
         "machine": m,
         "load_avg_start": load_start,
         "load_avg_end": load_end,
+        "contended": is_contended,
         "threshold_pct": threshold,
         "baseline_note": baseline_note,
         "benches": bench_meta,
@@ -846,14 +1052,54 @@ pub fn run(root: &Path, rest: &[&str]) -> Result<(), String> {
     println!("\n{summary}");
     println!("wrote {}", out_dir.join("results.json").display());
 
+    let mut errors: Vec<String> = Vec::new();
     if o.update_baseline {
-        let nb = updated_baseline(baseline_value.as_ref(), &results);
-        let text = serde_json::to_string_pretty(&nb).map_err(|e| format!("encode baseline: {e}"))?;
-        write(&root.join(BASELINE), &format!("{text}\n"))?;
-        println!("updated {BASELINE} ({mode}, machine class {class})");
+        // The results are written either way; a contended run never silently becomes the baseline.
+        let rules = BaselineRules { min_runs: 1, max_load_per_core: budgets.settings.max_load_per_core, allow_contended: o.allow_contended };
+        match baseline_from_runs(baseline_value.as_ref(), std::slice::from_ref(&results), &rules) {
+            Ok(nb) => {
+                write_baseline(root, &nb)?;
+                println!("updated {BASELINE} ({mode}, machine class {class}{})", if is_contended { ", labelled contended" } else { "" });
+            }
+            // A refused baseline still reports this run's perf failures below.
+            Err(e) => errors.push(e),
+        }
     }
     let all: Vec<&String> = failures.iter().chain(&bench_failures).collect();
-    if all.is_empty() { Ok(()) } else { Err(format!("{} perf failure(s):\n  {}", all.len(), all.iter().map(|s| s.as_str()).collect::<Vec<_>>().join("\n  "))) }
+    if !all.is_empty() {
+        errors.push(format!("{} perf failure(s):\n  {}", all.len(), all.iter().map(|s| s.as_str()).collect::<Vec<_>>().join("\n  ")));
+    }
+    if errors.is_empty() { Ok(()) } else { Err(errors.join("\n")) }
+}
+
+fn write_baseline(root: &Path, baseline: &Value) -> Result<(), String> {
+    let text = serde_json::to_string_pretty(baseline).map_err(|e| format!("encode baseline: {e}"))?;
+    write(&root.join(BASELINE), &format!("{text}\n"))
+}
+
+/// `--update-baseline --from <results.json>...`: no benches run. Prints the enforcement report.
+fn baseline_from_files(root: &Path, budgets: &Budgets, old: Option<&Value>, o: &Opts) -> Result<(), String> {
+    let runs = o
+        .from
+        .iter()
+        .map(|p| {
+            let t = std::fs::read_to_string(p).map_err(|e| format!("read {}: {e}", p.display()))?;
+            serde_json::from_str::<Value>(&t).map_err(|e| format!("{}: {e}", p.display()))
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+    let (could, flaky) = enforce_report(budgets, &runs);
+    let list = |v: &[String]| if v.is_empty() { "  none".to_string() } else { v.iter().map(|l| format!("  {l}")).collect::<Vec<_>>().join("\n") };
+    println!("Budgets that could be enforced (within {} of the budget in every run):\n{}", budgets.settings.enforce_margin, list(&could));
+    println!("Enforced budgets that went over in some run (flaky):\n{}", list(&flaky));
+    let rules = BaselineRules {
+        min_runs: budgets.settings.baseline_min_runs,
+        max_load_per_core: budgets.settings.max_load_per_core,
+        allow_contended: o.allow_contended,
+    };
+    let nb = baseline_from_runs(old, &runs, &rules)?;
+    write_baseline(root, &nb)?;
+    println!("updated {BASELINE} from {} runs (machine class {})", runs.len(), nb.get("machine_class").and_then(Value::as_str).unwrap_or("?"));
+    Ok(())
 }
 
 /// The committed baseline's full-mode numbers judged against the budgets (what the scorecard
@@ -911,6 +1157,9 @@ pub fn render_summary(results: &Value, outcomes: &[Outcome], baseline_note: Opti
         fmt_load(results.get("load_avg_start")),
         fmt_load(results.get("load_avg_end")),
     );
+    if results.get("contended").and_then(Value::as_bool) == Some(true) {
+        out.push_str("- **contended run**: numbers measure machine load (the 1-minute load at the start was above `max_load_per_core` per core)\n");
+    }
     if let Some(n) = baseline_note {
         out.push_str(&format!("- {n}\n"));
     }
@@ -1068,10 +1317,199 @@ not_measurable = "needs a frame harness"
         assert_eq!(counts(&out), (0, 0, 0, 1), "not-run scenarios are not tracked; the scorecard counts them separately");
     }
 
+    fn rules(min_runs: usize, allow_contended: bool) -> BaselineRules {
+        BaselineRules { min_runs, max_load_per_core: 1.0, allow_contended }
+    }
+
+    /// The plain `--update-baseline` case: one run.
+    fn one(old: Option<&Value>, results: &Value) -> Value {
+        baseline_from_runs(old, std::slice::from_ref(results), &rules(1, false)).unwrap()
+    }
+
+    /// A saved run of class `c` with one p50 (and p95) per scenario.
+    fn run_of(date: &str, load: f64, rows: &[(&str, f64)]) -> Value {
+        let sc: serde_json::Map<String, Value> =
+            rows.iter().map(|(k, v)| (k.to_string(), json!({"n": 5, "p50_ms": v, "p95_ms": v * 1.5, "max_ms": v * 2.0}))).collect();
+        json!({"mode": "full", "date": date, "commit": format!("c-{date}"), "dirty": false, "machine": {"class": "c", "cores": 3}, "load_avg_start": [load, load, load], "scenarios": sc})
+    }
+
+    #[test]
+    fn contention_is_judged_on_start_load_per_core() {
+        assert!(contended(Some([224.9, 226.31, 196.03]), Some(14), 1.0), "the committed 2026-10-05 baseline");
+        assert!(!contended(Some([0.5, 3.0, 9.0]), Some(12), 1.0), "only the 1-minute load counts");
+        assert!(!contended(None, Some(12), 1.0), "no load (Windows): can't judge");
+        assert!(!contended(Some([50.0, 0.0, 0.0]), None, 1.0));
+        assert!(!contended(Some([9.5, 0.0, 0.0]), Some(3), 4.0), "the threshold is configurable");
+        assert!(contended(Some([9.5, 0.0, 0.0]), Some(3), 3.0));
+        assert!(run_contended(Some(&json!([224.9, 226.31, 196.03])), Some(&json!({"cores": 14})), 1.0));
+    }
+
+    #[test]
+    fn update_baseline_refuses_contended_run_unless_allowed() {
+        let mut r = run_of("2026-10-05", 224.9, &[("P1", 3.0)]);
+        r["machine"]["cores"] = json!(14);
+        let e = baseline_from_runs(None, std::slice::from_ref(&r), &rules(1, false)).unwrap_err();
+        assert!(e.contains("224.90") && e.contains("14 cores") && e.contains("--allow-contended"), "{e}");
+        let b = baseline_from_runs(None, std::slice::from_ref(&r), &rules(1, true)).unwrap();
+        let m = &b["modes"]["full"];
+        assert_eq!(m["contended"], json!(true));
+        assert_eq!(m["cores"], json!(14));
+        assert_eq!(m["runs"], json!(1));
+        // A quiet run isn't labelled, and one run has no noise ceiling.
+        let b = one(None, &run_of("d", 0.5, &[("P1", 3.0)]));
+        assert!(b["modes"]["full"].get("contended").is_none());
+        assert!(b["modes"]["full"]["scenarios"]["P1"].get("p50_max_ms").is_none());
+    }
+
+    #[test]
+    fn baseline_from_runs_takes_median_and_noise_ceiling() {
+        let runs: Vec<Value> = [(1, 2174.0, 30.5), (2, 2868.0, 45.3), (3, 2000.0, 28.0), (4, 2500.0, 31.0), (5, 2300.0, 40.0)]
+            .iter()
+            .map(|(d, a, b)| run_of(&format!("2026-10-2{d}"), 1.0, &[("P44", *a), ("P46", *b)]))
+            .collect();
+        let b = baseline_from_runs(None, &runs, &rules(5, false)).unwrap();
+        let m = &b["modes"]["full"];
+        assert_eq!(m["runs"], json!(5));
+        assert_eq!(m["date"], json!("2026-10-25"), "the latest run dates the baseline");
+        assert_eq!(m["run_list"].as_array().map(Vec::len), Some(5));
+        assert_eq!(m["run_list"][0]["load_avg_start"], json!([1.0, 1.0, 1.0]));
+        assert_eq!(m["run_list"][0]["contended"], json!(false));
+        let got = baseline_for(&b, "c", "full").unwrap();
+        let p44 = &got["P44"];
+        assert_eq!((p44.p50, p44.p50_max, p44.n), (Some(2300.0), Some(2868.0), 25));
+        assert_eq!(got["P46"].p50, Some(31.0));
+        assert_eq!(median(&mut [4.0, 1.0, 3.0, 2.0]), Some(2.5));
+    }
+
+    #[test]
+    fn baseline_from_runs_keeps_a_row_failed_in_any_run() {
+        let mut runs: Vec<Value> = (1..=3).map(|d| run_of(&format!("2026-10-2{d}"), 1.0, &[("P1", 3.0), ("P2", 5.0)])).collect();
+        runs[1]["scenarios"]["P1"] = json!({"status": format!("{MISSING_PREFIX}bench crashed")});
+        let b = baseline_from_runs(None, &runs, &rules(3, false)).unwrap();
+        let m = &b["modes"]["full"];
+        assert!(m["scenarios"].get("P1").is_none(), "no partial aggregate: {m}");
+        assert_eq!(m["failed"]["P1"], json!("bench crashed"));
+        assert_eq!(m["scenarios"]["P2"]["p50_ms"], json!(5.0));
+        assert!(m["failed"].get("P2").is_none());
+    }
+
+    #[test]
+    fn baseline_from_runs_leaves_out_a_row_missing_from_some_runs() {
+        let mut runs: Vec<Value> = (1..=3).map(|d| run_of(&format!("2026-10-2{d}"), 1.0, &[("P1", 3.0), ("P2", 5.0)])).collect();
+        runs[0]["scenarios"].as_object_mut().unwrap().remove("P1");
+        let b = baseline_from_runs(None, &runs, &rules(3, false)).unwrap();
+        let m = &b["modes"]["full"];
+        assert!(m["scenarios"].get("P1").is_none(), "2 of 3 runs is no baseline: {m}");
+        assert_eq!(m["scenarios"]["P2"]["p50_ms"], json!(5.0));
+        assert_eq!(m["runs"], json!(3));
+    }
+
+    #[test]
+    fn baseline_from_runs_rejects_mixed_classes_modes_dirty_and_too_few() {
+        let runs: Vec<Value> = (1..=5).map(|d| run_of(&format!("2026-10-2{d}"), 1.0, &[("P1", 3.0)])).collect();
+        assert!(baseline_from_runs(None, &runs, &rules(5, false)).is_ok());
+        assert!(baseline_from_runs(None, &runs[..4], &rules(5, false)).unwrap_err().contains("at least 5"));
+        let mut m = runs.clone();
+        m[2]["machine"]["class"] = json!("other");
+        assert!(baseline_from_runs(None, &m, &rules(5, false)).unwrap_err().contains("machine classes"));
+        let mut m = runs.clone();
+        m[2]["mode"] = json!("quick");
+        assert!(baseline_from_runs(None, &m, &rules(5, false)).unwrap_err().contains("modes"));
+        let mut m = runs.clone();
+        m[2]["dirty"] = json!(true);
+        assert!(baseline_from_runs(None, &m, &rules(5, false)).unwrap_err().contains("dirty"));
+        let mut m = runs.clone();
+        m[2]["load_avg_start"] = json!([9.5, 9.0, 9.0]);
+        assert!(baseline_from_runs(None, &m, &rules(5, false)).unwrap_err().contains("contended"));
+        assert_eq!(baseline_from_runs(None, &m, &rules(5, true)).unwrap()["modes"]["full"]["run_list"][2]["contended"], json!(true));
+    }
+
+    #[test]
+    fn regression_is_judged_against_the_noise_ceiling() {
+        // Runner numbers (macos-15, 7 nightlies): median and highest p50 per row.
+        let b = parse_budgets(TOML).unwrap();
+        let s = &b.settings;
+        let sc = &b.scenario[1]; // no enforced budget in play: opacity, budget 20, not enforced
+        let base = |p50: f64, max: f64| Stats { p50: Some(p50), p50_max: Some(max), ..Default::default() };
+        let cur = |p50: f64| Stats { p50: Some(p50), ..Default::default() };
+        assert_eq!(verdict(sc, &cur(3935.0), Some(&base(2174.0, 2868.0)), s, 15.0, false), Status::Regressed, "P44 +81 % (#5694)");
+        assert_eq!(verdict(sc, &cur(76.9), Some(&base(30.5, 45.3)), s, 15.0, false), Status::Regressed, "P46 +152 % (#5697)");
+        assert_eq!(verdict(sc, &cur(387.0), Some(&base(258.0, 448.0)), s, 15.0, false), Status::Tracked, "P11 +50 % (#5695) is within runner noise");
+        // A single-run baseline falls back to its p50.
+        let single = Stats { p50: Some(258.0), ..Default::default() };
+        assert_eq!(verdict(sc, &cur(387.0), Some(&single), s, 15.0, false), Status::Regressed);
+    }
+
+    #[test]
+    fn enforce_report_needs_margin_in_every_run() {
+        let toml = r#"
+[[bench]]
+name = "b"
+package = "p"
+
+[[scenario]]
+id = "P16"
+title = "dab"
+bench = "b"
+row = "r16"
+budget_ms = 100
+enforce = false
+
+[[scenario]]
+id = "P29"
+title = "wand"
+bench = "b"
+row = "r29"
+budget_ms = 100
+enforce = false
+
+[[scenario]]
+id = "P30"
+title = "liquify"
+bench = "b"
+row = "r30"
+budget_ms = 100
+enforce = false
+
+[[scenario]]
+id = "P25"
+title = "cancel"
+bench = "b"
+row = "r25"
+budget_ms = 200
+
+[[scenario]]
+id = "P99"
+title = "track"
+bench = "b"
+row = "r99"
+"#;
+        let b = parse_budgets(toml).unwrap();
+        // run_of stores p95 = 1.5 × p50 (the default metric is p95).
+        let runs: Vec<Value> = [(30.0, 20.0, 30.0, 100.0), (35.2, 22.0, 45.0, 110.0), (20.0, 22.0, 30.0, 199.4)]
+            .iter()
+            .enumerate()
+            .map(|(i, (a, c, d, e))| run_of(&format!("d{i}"), 1.0, &[("P16", *a), ("P29", *c), ("P30", *d), ("P25", *e), ("P99", 1.0)]))
+            .collect();
+        let (could, flaky) = enforce_report(&b, &runs);
+        assert_eq!(could.len(), 2, "{could:?}");
+        assert!(could[0].starts_with("P16 ") && could[0].contains("52.8"), "{could:?}");
+        assert!(could[1].starts_with("P29 "));
+        assert!(!could.iter().any(|l| l.starts_with("P30")), "67.5 > 60 once: not suggested");
+        assert_eq!(flaky.len(), 1, "{flaky:?}");
+        assert!(flaky[0].starts_with("P25 ") && flaky[0].contains("in 1 of 3 runs"), "{flaky:?}");
+        // A row missing from one run can't be vouched for.
+        let mut gap = runs.clone();
+        if let Some(o) = gap[1]["scenarios"].as_object_mut() {
+            o.remove("P29");
+        }
+        assert!(!enforce_report(&b, &gap).0.iter().any(|l| l.starts_with("P29")));
+    }
+
     #[test]
     fn baselines_never_cross_machine_classes() {
         let results = json!({"mode": "full", "date": "d", "commit": "c", "machine": {"class": "macos-aarch64-m4"}, "scenarios": {"P1": {"p50_ms": 3.0, "p95_ms": 4.0, "max_ms": 5.0, "n": 3}, "P3": {"status": "not measurable yet"}}});
-        let b = updated_baseline(None, &results);
+        let b = one(None, &results);
         let got = baseline_for(&b, "macos-aarch64-m4", "full").unwrap();
         assert_eq!(got.get("P1").and_then(|s| s.p50), Some(3.0));
         assert!(!got.contains_key("P3"), "rows without numbers are not baselined");
@@ -1079,18 +1517,18 @@ not_measurable = "needs a frame harness"
         assert!(baseline_for(&b, "macos-aarch64-m4", "quick").is_err());
         // Same class: the other mode is kept. New class: replaced.
         let quick = json!({"mode": "quick", "machine": {"class": "macos-aarch64-m4"}, "scenarios": {"P1": {"p50_ms": 1.0}}});
-        let b2 = updated_baseline(Some(&b), &quick);
+        let b2 = one(Some(&b), &quick);
         assert!(baseline_for(&b2, "macos-aarch64-m4", "full").is_ok());
         assert!(baseline_for(&b2, "macos-aarch64-m4", "quick").is_ok());
         // A crashed row is kept as a failure, and the scorecard shows it.
         let crashed = json!({"mode": "full", "machine": {"class": "c"}, "scenarios": {"P1": {"status": "**missing**: panicked: boom"}}});
-        let bc = updated_baseline(None, &crashed);
+        let bc = one(None, &crashed);
         let b = parse_budgets(TOML).unwrap();
         let o = outcomes_from_baseline(&b, Some(&bc));
         assert_eq!(o[0].status, Status::Missing("panicked: boom".into()));
         assert_eq!(o[1].status, Status::NotRun);
         let other = json!({"mode": "quick", "machine": {"class": "other"}, "scenarios": {}});
-        let b3 = updated_baseline(Some(&b2), &other);
+        let b3 = one(Some(&b2), &other);
         assert!(baseline_for(&b3, "other", "full").is_err());
     }
 
@@ -1127,5 +1565,11 @@ not_measurable = "needs a frame harness"
         assert!(o.quick && o.reuse && o.skip_build);
         assert_eq!(o.threshold, Some(20.0));
         assert_eq!(o.benches, ["a"]);
+        assert!(!o.allow_contended && o.from.is_empty());
+        let o = parse_opts(&["--update-baseline", "--from", "a.json", "--from", "b.json", "--allow-contended"]).unwrap();
+        assert!(o.update_baseline && o.allow_contended);
+        assert_eq!(o.from, [PathBuf::from("a.json"), PathBuf::from("b.json")]);
+        assert!(parse_opts(&["--from", "a.json"]).is_err(), "--from needs --update-baseline");
+        assert!(parse_opts(&["--update-baseline", "--from"]).is_err());
     }
 }
diff --git a/xtask/src/scorecard.rs b/xtask/src/scorecard.rs
index 5c9985c945..69352ea0ff 100644
--- a/xtask/src/scorecard.rs
+++ b/xtask/src/scorecard.rs
@@ -17,7 +17,7 @@ use std::collections::{BTreeMap, BTreeSet};
 use std::path::{Path, PathBuf};
 
 use serde::Deserialize;
-use serde_json::Value;
+use serde_json::{Value, json};
 
 use crate::perf;
 
@@ -591,12 +591,14 @@ here supersede estimates elsewhere.\n\n## Summary\n\n| Area | Done | Partial | M
 
     // Performance.
     s.push_str("\n## Performance\n\n");
+    let class = inp.baseline.as_ref().and_then(|b| b.get("machine_class")).and_then(Value::as_str).unwrap_or("none");
     s.push_str(&format!(
         "Budgets: `perf/budgets.toml` (targets from #209, #210, #211). Numbers: the committed baseline \
 (`perf/baseline.json`, full run), updated only by `cargo xtask perf --update-baseline`. The nightly \
 `perf-nightly` workflow runs `cargo xtask perf` on a fixed macOS runner and fails on a broken enforced \
-budget or a p50 regression over {:.0} % against a baseline from the same machine class. \"Over budget\" \
-rows are targets the code doesn't meet yet: they are reported, and only their regressions fail.\n\n",
+budget. Its p50 regression check (over {:.0} %, against the baseline's highest p50 when it was built from \
+several runs) runs only on machine class `{class}`, the baseline's. \"Over budget\" rows are targets the \
+code doesn't meet yet: they are reported, and only their regressions fail.\n\n",
         inp.budgets.settings.regression_pct
     ));
     match (&base_date, full) {
@@ -604,12 +606,22 @@ rows are targets the code doesn't meet yet: they are reported, and only their re
             let load = perf::fmt_load(f.get("load_avg_start"));
             let commit = f.get("commit").and_then(Value::as_str).map_or_else(|| "unknown".into(), |c| c.get(..10).unwrap_or(c).to_string());
             let ram = machine.and_then(|m| m.get("ram_bytes")).and_then(Value::as_u64).map_or_else(|| "?".into(), |b| format!("{} GB", b >> 30));
+            let runs = f.get("runs").and_then(Value::as_u64).unwrap_or(1);
+            let runs = if runs == 1 { "1 run".to_string() } else { format!("{runs} runs (median p50; the latest run's date and commit)") };
             s.push_str(&format!(
-                "Baseline: {d}, commit `{commit}`, {} ({ram}), GPU {}, {}; load average {load} (1/5/15 min) at the start of the run.\n\n",
+                "Baseline: {d}, {runs}, commit `{commit}`, {} ({ram}), GPU {}, {}; load average {load} (1/5/15 min) at the start of the run.\n\n",
                 ms("cpu"),
                 ms("gpu_adapter"),
                 ms("os_version")
             ));
+            let cores = f.get("cores").or_else(|| machine.and_then(|m| m.get("cores")));
+            let contended = f.get("contended").and_then(Value::as_bool) == Some(true)
+                || perf::run_contended(f.get("load_avg_start"), Some(&json!({"cores": cores})), inp.budgets.settings.max_load_per_core);
+            if contended {
+                let one = f.get("load_avg_start").and_then(|l| l.get(0)).and_then(Value::as_f64).map_or_else(|| "?".into(), |x| format!("{x:.2}"));
+                let n = cores.and_then(Value::as_u64).map_or_else(|| "?".into(), |c| c.to_string());
+                s.push_str(&format!("**contended baseline** (load {one} on {n} cores): these numbers measure machine load, not the code.\n\n"));
+            }
         }
         _ => s.push_str("Baseline: **not run** (no `perf/baseline.json` full run yet).\n\n"),
     }
@@ -891,6 +903,29 @@ cc  c.psd
         assert_eq!(anchor("File compatibility"), "file-compatibility");
     }
 
+    #[test]
+    fn scorecard_labels_a_contended_baseline() {
+        let mut inp = gather(&crate::root()).unwrap_or_else(|e| panic!("{e}"));
+        let base = |load: f64, extra: Value| {
+            let mut full = json!({"date": "2026-10-05T00:00:00Z", "commit": "f5d2bcb54abd", "load_avg_start": [load, 1.0, 1.0], "scenarios": {}});
+            if let (Some(f), Some(x)) = (full.as_object_mut(), extra.as_object()) {
+                f.extend(x.clone());
+            }
+            json!({"machine_class": "mac-m4", "machine": {"cores": 14, "cpu": "Apple M4 Pro"}, "modes": {"full": full}})
+        };
+        inp.baseline = Some(base(224.9, json!({})));
+        let a = render(&inp);
+        assert!(a.contains("**contended baseline** (load 224.90 on 14 cores)"), "labelled from the load the baseline already has");
+        assert!(a.contains("runs only on machine class `mac-m4`"));
+        assert!(a.contains("2026-10-05, 1 run,"));
+        inp.baseline = Some(base(2.0, json!({"runs": 5})));
+        let a = render(&inp);
+        assert!(!a.contains("contended baseline"));
+        assert!(a.contains("5 runs (median p50"));
+        inp.baseline = Some(base(2.0, json!({"contended": true, "cores": 3})));
+        assert!(render(&inp).contains("(load 2.00 on 3 cores)"), "a baseline recorded with --allow-contended");
+    }
+
     #[test]
     fn staleness_check_and_determinism() {
         let root = crate::root();