diff --git a/.config/nextest.toml b/.config/nextest.toml
index 2585577ec1..83ee9cd6f6 100644
--- a/.config/nextest.toml
+++ b/.config/nextest.toml
@@ -1,5 +1,6 @@
 # cargo-nextest (https://nexte.st): runs every test in its own process, in parallel across test
-# binaries. Optional for local runs; `cargo test` keeps working and stays what CI runs (#2204).
+# binaries. CI runs it with the `ci` profile below (#6117); locally it is optional and `cargo test`
+# keeps working (#2204).
 #
 #   cargo nextest run --workspace        # all tests except doctests
 #   cargo test --doc --workspace         # nextest does not run doctests
@@ -11,5 +12,13 @@
 gpu = { max-threads = 4 }
 
 [[profile.default.overrides]]
-filter = 'package(photocraft-gpu) | (package(photocraft-ui-egui) & (kind(test) | test(/canvas|gpu|mip|type_tool/)))'
+filter = 'package(photocraft-gpu) | (package(photocraft-ui-egui) & (kind(test) | test(/canvas|gpu|mip|type_tool|background_redraw::|floating_group_titles|swap_arrow::tests::rendered_glyph/)))'
 test-group = 'gpu'
+
+# CI (`--profile ci`, .github/workflows/ci.yml). Stops at the first failure so a red PR frees its
+# runner, fails a test that hangs instead of letting it hold the runner, and repeats every failure
+# at the end of the log. The default profile's GPU override still applies.
+[profile.ci]
+fail-fast = true
+slow-timeout = { period = "60s", terminate-after = 10 }
+failure-output = "immediate-final"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dfc2564a59..ba8243353d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
   workflow_dispatch:
     inputs:
       fuzz:
@@ -22,8 +23,8 @@ env:
   PHOTOCRAFT_NO_PRINT: "1"
   LPDEST: photocraft-no-such-printer
   # Debug and test builds keep line tables (file:line in panic backtraces) but drop the rest of the
-  # debug info: faster codegen and links (Windows PDBs most of all), and a target dir small enough
-  # for the Linux job's second, craft-fonts build (it ran out of disk with full debug info).
+  # debug info: faster codegen and links, and a smaller target dir (the Linux test job ran out of
+  # disk with full debug info). The Windows test legs drop debuginfo entirely (see the test job).
   CARGO_PROFILE_DEV_DEBUG: line-tables-only
 
 # A newer push to a PR branch cancels its older run. Runs on main are never cancelled: a merge
@@ -39,10 +40,11 @@ jobs:
   # platform: the app shell, UI, text and fonts, GPU, pen input, build scripts or the lockfile.
   # macOS is tested only by release.yml.
   platforms:
+    timeout-minutes: 10
     name: select platforms
     runs-on: ubuntu-latest
     outputs:
-      os: ${{ steps.pick.outputs.os }}
+      legs: ${{ steps.pick.outputs.legs }}
       web: ${{ steps.pick.outputs.web }}
     steps:
       - uses: actions/checkout@v4
@@ -56,9 +58,15 @@ jobs:
         run: |
           # No macOS on PRs or main: the org's 5 macOS slots are kept for release builds, and
           # release.yml builds and tests macOS (a failing release is fixed and rebuilt).
-          all='["ubuntu-latest","windows-latest"]'
+          # Windows tests run as two legs in parallel: the unit tests and the integration tests. As
+          # one job they took ~28 min on the Windows runner; the legs take ~13 and ~15. Splitting
+          # the integration tests over a third runner (nextest --partition) saved ~2 min of wall
+          # time but cost ~7 runner-minutes and one more Windows slot per PR.
+          linux='{"os":"ubuntu-latest","part":"all"}'
+          win() { printf '{"os":"windows-latest","part":"%s"}' "$1"; }
+          all="[$linux,$(win unit),$(win integration)]"
           if [ "$EVENT" != pull_request ] || [ "$FULL" = true ]; then
-            echo "os=$all" >> "$GITHUB_OUTPUT"
+            echo "legs=$all" >> "$GITHUB_OUTPUT"
             echo "web=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
@@ -71,19 +79,25 @@ jobs:
             echo "web=false" >> "$GITHUB_OUTPUT"
           fi
           if git diff --name-only "$BASE" HEAD | grep -Eq '^(apps/|crates/(ui-egui|text|gpu|tablet|heif)/|Cargo\.lock$|(.*/)?build\.rs$|\.github/workflows/ci\.yml$)'; then
-            echo "os=$all" >> "$GITHUB_OUTPUT"
+            echo "legs=$all" >> "$GITHUB_OUTPUT"
           else
-            echo 'os=["ubuntu-latest"]' >> "$GITHUB_OUTPUT"
+            echo "legs=[$linux]" >> "$GITHUB_OUTPUT"
           fi
 
   test:
-    name: test (${{ matrix.os }})
+    timeout-minutes: 100
+    name: test (${{ matrix.os }}${{ matrix.part != 'all' && format(', {0}', matrix.part) || '' }})
     needs: platforms
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        os: ${{ fromJSON(needs.platforms.outputs.os) }}
+        include: ${{ fromJSON(needs.platforms.outputs.legs) }}
+    env:
+      # No debuginfo on Windows: writing PDBs for ~200 test binaries cost 2.2 of ~21 build minutes.
+      # A panic still names its file and line; only backtrace frames lose theirs (Linux keeps
+      # line-tables-only, so a backtrace with lines is one OS away).
+      CARGO_PROFILE_DEV_DEBUG: ${{ startsWith(matrix.os, 'windows') && '0' || 'line-tables-only' }}
     steps:
       - uses: actions/checkout@v4
 
@@ -106,49 +120,44 @@ jobs:
       # Only main saves caches; PRs restore main's. Every PR used to save its own set (up to
       # 3.8 GB), usable by that PR only, so the repo's 10 GB cache budget kept evicting main's.
       # A failing test still saves: the cache holds compiled dependencies, not test results.
+      # The Windows legs share one key (same dependencies); the integration leg saves it,
+      # because it also runs Clippy and so leaves Clippy's dependency metadata in it.
       - uses: Swatinem/rust-cache@v2
         with:
-          save-if: ${{ github.ref == 'refs/heads/main' }}
+          save-if: ${{ github.ref == 'refs/heads/main' && (matrix.part == 'all' || matrix.part == 'integration') }}
           cache-on-failure: true
 
+      # sccache caches the workspace crates' compiled libraries, which rust-cache leaves out:
+      # warm, each Windows leg built 4.5 min faster. Like rust-cache, only main writes (PRs read
+      # main's entries); a full set is ~90 MB, so it barely touches the 10 GB budget (#2688).
+      # Test executables can't be cached, so a PR still links its tests.
+      - name: Install sccache (Windows)
+        if: runner.os == 'Windows'
+        uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+        with:
+          version: v0.18.0
+
+      - name: Use sccache (Windows)
+        if: runner.os == 'Windows'
+        env:
+          MAIN: ${{ github.ref == 'refs/heads/main' }}
+        run: |
+          echo "SCCACHE_GHA_ENABLED=true" >> "$GITHUB_ENV"
+          echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+          if [ "$MAIN" != true ]; then echo "SCCACHE_GHA_RW_MODE=READ_ONLY" >> "$GITHUB_ENV"; fi
+        shell: bash
+
       - name: Format
         if: runner.os == 'Linux'
         run: cargo fmt --all -- --check
 
-      # `--features heif`: official builds open HEIC photos via the optional photocraft-heif crate.
-      - name: Test
-        run: cargo test --workspace --locked --features heif
-
-      # The same codecs without the optional decoder: HEIC must stay a clear "not in this build"
-      # error for distributors who leave it out.
-      - name: Test without heif
-        if: runner.os == 'Linux'
-        run: cargo test -p photocraft-heif -p photocraft-codecs -p photocraft-io --locked
-
-      # The same tests built with the optional craft-fonts input (crates/text/build.rs), so the
-      # Japanese font tests that skip without it run here. Linux only. Keep the exact `--workspace
-      # --features heif` of the Test step: any other package or feature selection resolves a
-      # different feature set, recompiles the whole dependency graph into the same target dir and
-      # runs the runner out of disk (as `-p photocraft-text -p photocraft-ui-egui` did after #800).
-      - name: Check out craft-fonts
-        if: runner.os == 'Linux'
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          repository: storytold/craft-fonts
-          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
-          path: craft-fonts
-
-      - name: Test with craft-fonts
-        if: runner.os == 'Linux'
-        env:
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-        run: cargo test --workspace --locked --features heif
-
+      # Keep formatting, strict Clippy, layering and scorecard checks ahead of tests.
       - name: Clippy
+        if: matrix.part == 'all' || matrix.part == 'integration'
         run: cargo clippy --workspace --all-targets --locked --features heif -- -D warnings
 
       - name: Dependency layering
+        if: matrix.part == 'all' || matrix.part == 'integration'
         run: cargo xtask layers
 
       # docs/scorecard.md must match its sources (checklists, budgets, baseline, corpus floors,
@@ -157,7 +166,131 @@ jobs:
         if: runner.os == 'Linux'
         run: cargo xtask scorecard --check
 
+      # nextest runs the test binaries in parallel (cargo test runs them one at a time), with the
+      # GPU tests capped by the `gpu` group in .config/nextest.toml (#2204).
+      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+        with:
+          tool: cargo-nextest@0.9.146
+
+      # `--features heif`: official builds open HEIC photos via the optional photocraft-heif crate.
+      # `--lib --bins --tests` leaves out the examples, which cargo test would build and link but
+      # never run (Clippy's `--all-targets` still checks they compile). nextest skips doctests, so
+      # they get their own step.
+      #
+      # On Windows the unit leg runs `--lib --bins` and the integration leg `--test '*'` (every
+      # integration-test target); the feature selection stays the same, so both legs share the
+      # dependency cache. The `ci` profile fails fast and terminates hung tests
+      # (.config/nextest.toml); assertion failures are not retried.
+      - name: Test
+        env:
+          PART: ${{ matrix.part }}
+        run: |
+          case "$PART" in
+            unit) targets=(--lib --bins) ;;
+            integration) targets=(--test '*') ;;
+            *) targets=(--lib --bins --tests) ;;
+          esac
+          cargo nextest run --profile ci --workspace --locked --features heif "${targets[@]}"
+        shell: bash
+
+      # Every command against adversarial params must return Err, never panic or hang (AGENTS.md
+      # Rule 9). It is `#[ignore]`d (slow), so Test skips it. Same packages, features and targets as
+      # Test, so nothing rebuilds: `--test panic_hunt` would drop the other crates' dev-dependency
+      # features and recompile the whole graph. The `ci` profile terminates it if it hangs.
+      - name: Panic hunt
+        if: runner.os == 'Linux'
+        run: >-
+          cargo nextest run --profile ci --workspace --locked --features heif --lib --bins --tests
+          --run-ignored only -E 'binary_id(photocraft-engine::panic_hunt)'
+
+      - name: Doctests
+        if: matrix.part == 'all' || matrix.part == 'unit'
+        run: cargo test --workspace --locked --features heif --doc
+
+  # The Windows tests used to be one job named `test (windows-latest)`; they're now legs named
+  # `test (windows-latest, unit)` and `test (windows-latest, integration)`. This job keeps the old
+  # name reporting, so a required status check on it (none today) would keep working. It fails
+  # unless the whole test matrix and both Linux variants passed. `needs` reports one result
+  # for all matrix legs; when a PR runs no Windows legs it still checks every Linux result.
+  windows-gate:
+    timeout-minutes: 5
+    name: test (windows-latest)
+    needs: [platforms, test, test-variants]
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-latest
+    steps:
+      - env:
+          PLATFORMS: ${{ needs.platforms.result }}
+          TEST: ${{ needs.test.result }}
+          VARIANTS: ${{ needs.test-variants.result }}
+        run: |
+          echo "platforms: $PLATFORMS, test: $TEST, variants: $VARIANTS"
+          [ "$PLATFORMS" = success ] && [ "$TEST" = success ] && [ "$VARIANTS" = success ]
+
+  # The two other builds of the Linux tests, in parallel with the test job instead of after it (they
+  # added ~10 min to its critical path). Each restores the test job's cache (`shared-key: test` is
+  # that job's key) and saves none: the dependencies are the same, and the 10 GB cache budget is
+  # tight (#2688).
+  test-variants:
+    timeout-minutes: 100
+    name: test (${{ matrix.variant }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        variant: [without heif, with craft-fonts]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Linux system dependencies (egui/winit/rfd)
+        run: |
+          nohup sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup \
+            /opt/hostedtoolcache/CodeQL </dev/null >/dev/null 2>&1 &
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev \
+            libgl1-mesa-dev libgtk-3-dev
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: test
+          save-if: false
+
+      - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+        with:
+          tool: cargo-nextest@0.9.146
+
+      # The same codecs without the optional decoder: HEIC must stay a clear "not in this build"
+      # error for distributors who leave it out.
+      - name: Test without heif
+        if: matrix.variant == 'without heif'
+        run: cargo nextest run -p photocraft-heif -p photocraft-codecs -p photocraft-io --locked --profile ci
+
+      # The tests built with the optional craft-fonts input (crates/text/build.rs), so the Japanese
+      # font tests that skip without it run. Keep the test job's exact `--workspace --features heif
+      # --lib --bins --tests`, so the restored dependencies match and only the workspace rebuilds.
+      # Filter execution to the three crates that read the optional font input (#6127).
+      - name: Check out craft-fonts
+        if: matrix.variant == 'with craft-fonts'
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          repository: storytold/craft-fonts
+          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+          path: craft-fonts
+
+      - name: Test with craft-fonts
+        if: matrix.variant == 'with craft-fonts'
+        env:
+          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
+          CRAFT_FONTS_REQUIRED: "1"
+        run: >-
+          cargo nextest run --profile ci --workspace --locked --features heif --lib --bins --tests
+          -E 'package(photocraft-text) | package(photocraft-io) | package(photocraft-ui-egui)'
+
   corpus:
+    timeout-minutes: 30
     # Real-file corpus tests (cargo feature `corpus`), on every PR and on main. The corpora are
     # pinned in xtask/src/corpus_pins.rs and sha256-verified (xtask/*.sha256) after both a cache
     # restore and a download; a missing corpus fails the tests. The cache key changes only when a
@@ -190,6 +323,7 @@ jobs:
         run: cargo xtask test-corpus
 
   wasm:
+    timeout-minutes: 30
     name: wasm32 check
     runs-on: ubuntu-latest
     steps:
@@ -206,6 +340,7 @@ jobs:
         run: cargo xtask wasm
 
   web:
+    timeout-minutes: 60
     name: web build and wasm size gate
     # PRs run it only when web-relevant files change (see `platforms`); main always does.
     needs: platforms
@@ -253,6 +388,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
 
   fuzz:
+    timeout-minutes: 60
     name: fuzz (${{ matrix.target.crate }}/${{ matrix.target.name }})
     # Placeholder: manual trigger only until a nightly schedule is enabled.
     if: github.event_name == 'workflow_dispatch' && inputs.fuzz
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 1d6c4c1f56..67e6b31894 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -27,6 +27,7 @@ concurrency:
 
 jobs:
   build:
+    timeout-minutes: 15
     name: mdBook build
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index fa0693f58e..970c6577a4 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -27,38 +27,10 @@ permissions:
 
 jobs:
   freebsd:
-    name: FreeBSD 14 (build + test + package)
-    runs-on: ubuntu-latest
-    timeout-minutes: 300
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build, test and package in a FreeBSD VM
-        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1
-        with:
-          release: "14.3"
-          usesh: true
-          cpu: 4
-          mem: 12288
-          # Nothing to bring back; copying the target dir out of the VM fails on large builds.
-          copyback: false
-          prepare: |
-            pkg install -y bash git curl pkgconf cmake python3 libxkbcommon wayland libX11 libXcursor libXrandr libXi libxcb mesa-libs vulkan-loader gtk3 fontconfig freetype2 alsa-lib
-            curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal
-          run: |
-            set -e
-            . "$HOME/.cargo/env"
-            # The checkout is synced in under another owner; let tests that call git read it.
-            git config --global --add safe.directory "*"
-            rustc --version
-            CARGO_PROFILE_DEV_DEBUG=0 cargo build --workspace --all-targets --locked --features heif
-            CARGO_PROFILE_DEV_DEBUG=0 cargo test --workspace --locked --features heif --exclude photocraft-ui-egui
-            CARGO_PROFILE_DEV_DEBUG=0 cargo test -p photocraft-ui-egui --locked --lib
-            CARGO_PROFILE_DEV_DEBUG=0 cargo test -p photocraft-ui-egui --locked --doc
-            # The VM's software Vulkan driver crashes (SIGSEGV) when several tests set up a GPU
-            # device at once, so the GPU integration tests run one at a time here.
-            CARGO_PROFILE_DEV_DEBUG=0 cargo test -p photocraft-ui-egui --locked --test '*' -- --test-threads=1
-            # The release package, as release.yml builds it. Free the debug build's disk first.
-            rm -rf target/debug
-            CARGO_BUILD_JOBS=4 bash packaging/freebsd/package.sh
-            tar -tzf dist/release/photocraft-*-freebsd-x86_64.tar.gz \
-              | grep -E '/bin/photocraft$|/bin/photocraft-cli$|/share/applications/ai\.storyteller\.photocraft\.desktop$|/share/doc/photocraft/LICENSE-MIT$'
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
+    with:
+      craft-fonts-ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+      cargo-build-extra-args: "--features heif"
+      custom-test-command: "CARGO_PROFILE_DEV_DEBUG=0 cargo test --workspace --locked --features heif --exclude photocraft-ui-egui && CARGO_PROFILE_DEV_DEBUG=0 cargo test -p photocraft-ui-egui --locked --lib && CARGO_PROFILE_DEV_DEBUG=0 cargo test -p photocraft-ui-egui --locked --doc && CARGO_PROFILE_DEV_DEBUG=0 cargo test -p photocraft-ui-egui --locked --test '*' -- --test-threads=1"
+      run-package-check: true
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
new file mode 100644
index 0000000000..18392587a8
--- /dev/null
+++ b/.github/workflows/nix.yml
@@ -0,0 +1,33 @@
+# Evaluates the Nix flake (no build, about a minute): `nix build` / `nix develop` stop at evaluation
+# when Cargo.lock gains something nix/package.nix can't vendor, and nothing else would notice.
+name: Nix
+
+on:
+  push:
+    branches: [main]
+    paths: ["flake.nix", "flake.lock", "nix/**", "Cargo.lock", ".github/workflows/nix.yml"]
+  pull_request:
+    paths: ["flake.nix", "flake.lock", "nix/**", "Cargo.lock", ".github/workflows/nix.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: nix-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  eval:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - name: nix flake check --no-build
+        run: |
+          if [ -f flake.nix ]; then
+            nix flake check --no-build --all-systems
+          else
+            echo "No flake.nix present in this repository; skipping check."
+          fi
diff --git a/.github/workflows/packaging-lint.yml b/.github/workflows/packaging-lint.yml
index 272715dc81..1d110e28f2 100644
--- a/.github/workflows/packaging-lint.yml
+++ b/.github/workflows/packaging-lint.yml
@@ -23,6 +23,7 @@ jobs:
     uses: storytold/craft-common-actions/.github/workflows/packaging-lint.yml@main
 
   verified-appimage-inputs:
+    timeout-minutes: 10
     name: Verified AppImage inputs
     runs-on: ubuntu-latest
     steps:
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 26eca62464..cbbbe069a5 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -27,7 +27,7 @@ next to them.
 | `crates/ui-egui/src/i18n/sr.tsv` | Serbian (Latin, Ekavian) UI translations | PhotoCraft contributors | Original translations of PhotoCraft's English labels | MIT OR Apache-2.0, [`LICENSE-translations.txt`](crates/ui-egui/src/i18n/LICENSE-translations.txt) |
 | `assets/fonts/Inter-Regular.ttf`, `Inter-Medium.ttf`, `Inter-SemiBold.ttf` | Inter 4.001 (UI font) | The Inter Project Authors (Rasmus Andersson) | <https://github.com/rsms/inter> | SIL OFL 1.1, [`assets/fonts/OFL-Inter.txt`](assets/fonts/OFL-Inter.txt) |
 | `assets/fonts/JetBrainsMono-Regular.ttf` | JetBrains Mono 2.305 (numeric font) | The JetBrains Mono Project Authors | <https://github.com/JetBrains/JetBrainsMono> | SIL OFL 1.1, [`assets/fonts/OFL-JetBrainsMono.txt`](assets/fonts/OFL-JetBrainsMono.txt) |
-| `assets/icons/*.svg` except `slice-knife.svg`, `sampler.svg`, `artboard.svg`, `perspective-crop.svg`, `frame-placeholder.svg`, `gradient.svg`, `type-mask.svg`, `type-mask-vertical.svg`, `clip-below.svg`, `clip-release.svg`, `layer-mask.svg`, `adjustment-layer.svg`, `brush-replace.svg`, `quick-selection.svg`, `eraser-background.svg`, `eraser-magic.svg`, `lasso-magnetic.svg`, `direct-select.svg`, `convert-point.svg`, `pen-add-anchor.svg`, `pen-delete-anchor.svg`, `pen-freeform.svg`, `pen-curvature.svg`, `bandage-sparkle.svg`, `painting-symmetry.svg`, `symmetry-*.svg` and `marquee-{row,column}.svg` (113 files; `star-filled.svg` is `star.svg` with a solid fill) | Lucide icons | Lucide Icons and Contributors | <https://github.com/lucide-icons/lucide> (`icons/<name>.svg`; `align-*` are now named `text-align-*` upstream) | ISC, [`assets/icons/LICENSE-lucide.txt`](assets/icons/LICENSE-lucide.txt) |
+| `assets/icons/*.svg` except `slice-knife.svg`, `sampler.svg`, `artboard.svg`, `perspective-crop.svg`, `frame-placeholder.svg`, `ellipse-dashed.svg`, `gradient.svg`, `type-mask.svg`, `type-mask-vertical.svg`, `clip-below.svg`, `clip-release.svg`, `layer-mask.svg`, `adjustment-layer.svg`, `brush-replace.svg`, `quick-selection.svg`, `eraser-background.svg`, `eraser-magic.svg`, `lasso-magnetic.svg`, `direct-select.svg`, `convert-point.svg`, `pen-add-anchor.svg`, `pen-delete-anchor.svg`, `pen-freeform.svg`, `pen-curvature.svg`, `bandage-sparkle.svg`, `painting-symmetry.svg`, `symmetry-*.svg` and `marquee-{row,column}.svg` (113 files; `star-filled.svg` is `star.svg` with a solid fill) | Lucide icons | Lucide Icons and Contributors | <https://github.com/lucide-icons/lucide> (`icons/<name>.svg`; `align-*` are now named `text-align-*` upstream) | ISC, [`assets/icons/LICENSE-lucide.txt`](assets/icons/LICENSE-lucide.txt) |
 | `assets/icons/{check,chevron-down,chevron-left,chevron-right,chevron-up,chevrons-left,chevrons-right,circle,clock,compass,info,link,link-2,lock,minus,monitor,moon,move,navigation,plus,search,square,trash,triangle,type,x,zoom-in}.svg` | Lucide icons derived from Feather (subset of the row above) | Cole Bemis (Feather), Lucide Contributors | <https://github.com/feathericons/feather> via Lucide | MIT (Feather) and ISC (Lucide), [`assets/icons/LICENSE-lucide.txt`](assets/icons/LICENSE-lucide.txt) |
 | `assets/icons/slice-knife.svg` | Slice tool glyph | PhotoCraft contributors | Original work | MIT OR Apache-2.0 |
 | `assets/icons/sampler.svg` | Color Sampler tool glyph: a target reticle marking a sampled pixel | PhotoCraft contributors | Original work | MIT OR Apache-2.0 |
@@ -38,11 +38,12 @@ next to them.
 | `assets/icons/marquee-row.svg`, `assets/icons/marquee-column.svg` | Single Row and Single Column Marquee tool glyphs: a dashed row (column) between two edge bars, drawn on Lucide's 24 px grid and stroke | PhotoCraft contributors | Original work | MIT OR Apache-2.0 |
 | `assets/icons/clip-below.svg`, `assets/icons/clip-release.svg` | Clipping-mask cursors (⌥ over the line between two layers): a hooked arrow onto the layer below; the same with a small "no" badge to release | PhotoCraft contributors | Original work | MIT OR Apache-2.0 |
 | `assets/icons/layer-mask.svg`, `assets/icons/adjustment-layer.svg` | Layers panel footer glyphs: Add a mask (a frame around a solid disc) and New Fill or Adjustment Layer (a circle, one half solid), drawn on Lucide's 24 px grid and stroke | PhotoCraft contributors | Original work | MIT OR Apache-2.0 |
+| `assets/icons/ellipse-dashed.svg` | Elliptical Marquee tool glyph: a dashed horizontal ellipse, drawn on Lucide's 24 px grid and stroke | PhotoCraft contributors | Original work | MIT OR Apache-2.0 |
 | `assets/icons/frame-placeholder.svg` | Frame tool glyph: an empty placeholder frame, crossed corner to corner | PhotoCraft contributors | Original work | MIT OR Apache-2.0 |
 | `assets/icons/gradient.svg` | Gradient tool glyph: a rounded rectangle filled with a left-to-right linear ramp, drawn on Lucide's 24 px grid and stroke | PhotoCraft contributors | Original work | MIT OR Apache-2.0 |
 | `assets/icons/eraser-background.svg`, `assets/icons/eraser-magic.svg` | Background Eraser and Magic Eraser tool glyphs: Lucide `eraser` plus added marks | Lucide Icons and Contributors; marks by PhotoCraft contributors | Derived from <https://github.com/lucide-icons/lucide> `icons/eraser.svg` | ISC, [`assets/icons/LICENSE-lucide.txt`](assets/icons/LICENSE-lucide.txt) |
 | `assets/icons/brush-replace.svg` | Color Replacement tool glyph: Lucide `brush` plus two swap arrows | Lucide Icons and Contributors; arrows by PhotoCraft contributors | Derived from <https://github.com/lucide-icons/lucide> `icons/brush.svg` | ISC, [`assets/icons/LICENSE-lucide.txt`](assets/icons/LICENSE-lucide.txt) |
-| `assets/icons/quick-selection.svg` | Quick Selection tool glyph: Lucide `brush` plus a dashed selection arc around the bristles | Lucide Icons and Contributors; arc by PhotoCraft contributors | Derived from <https://github.com/lucide-icons/lucide> `icons/brush.svg` | ISC, [`assets/icons/LICENSE-lucide.txt`](assets/icons/LICENSE-lucide.txt) |
+| `assets/icons/quick-selection.svg` | Quick Selection tool glyph: Lucide `brush`, scaled to 70%, inside a dashed upright rounded "C" selection | Lucide Icons and Contributors; selection by PhotoCraft contributors | Derived from <https://github.com/lucide-icons/lucide> `icons/brush.svg` | ISC, [`assets/icons/LICENSE-lucide.txt`](assets/icons/LICENSE-lucide.txt) |
 | `assets/icons/bandage-sparkle.svg` | Remove tool glyph: Lucide `bandage` moved down, plus a sparkle mark | Lucide Icons and Contributors; mark by PhotoCraft contributors | Derived from <https://github.com/lucide-icons/lucide> `icons/bandage.svg` | ISC, [`assets/icons/LICENSE-lucide.txt`](assets/icons/LICENSE-lucide.txt) |
 | `assets/icons/direct-select.svg` | Direct Selection tool glyph: Lucide `mouse-pointer-2` plus an anchor square | Lucide Icons and Contributors; square by PhotoCraft contributors | Derived from <https://github.com/lucide-icons/lucide> `icons/mouse-pointer-2.svg` | ISC, [`assets/icons/LICENSE-lucide.txt`](assets/icons/LICENSE-lucide.txt) |
 | `assets/icons/pen-freeform.svg`, `assets/icons/pen-curvature.svg` | Freeform Pen and Curvature Pen tool glyphs: Lucide `pen-tool` scaled down, plus a freehand squiggle or a curve through two points | Lucide Icons and Contributors; marks by PhotoCraft contributors | Derived from <https://github.com/lucide-icons/lucide> `icons/pen-tool.svg` | ISC, [`assets/icons/LICENSE-lucide.txt`](assets/icons/LICENSE-lucide.txt) |
@@ -57,6 +58,7 @@ next to them.
 | `crates/ui-egui/src/theme.rs` (Solarized Dark palette) | Solarized colour scheme used by the Solarized Dark theme | Ethan Schoonover | <https://ethanschoonover.com/solarized/> | MIT, [`LICENSE-solarized.txt`](crates/ui-egui/src/LICENSE-solarized.txt) |
 | `crates/ui-egui/src/theme.rs` (Breeze Light and Breeze Dark themes) | The Breeze Light and Breeze Dark themes are original colour values on PhotoCraft's Studio layout, chosen to look close to KDE Plasma's Breeze (cool blue-greys, blue accent, 5 px frame radius) so the app blends into a Plasma desktop. None of Breeze's colour values, files or code are copied; the values are a few levels away from its schemes and tuned for text contrast | PhotoCraft contributors | Inspired by the look of KDE Breeze, <https://invent.kde.org/plasma/breeze> (its colour schemes are LGPL-2.0-or-later) | Original work |
 | `crates/ui-egui/src/theme.rs` (Soft Dark and Soft Light themes) | Original colour values and radii for two low-contrast themes on PhotoCraft's Studio layout; no third-party palette, file or code is used | PhotoCraft contributors | Original | Original work |
+| `crates/algo/data/libfacedetection.bin` (face detection weights, read by `crates/algo/src/faces.rs`, whose network code is a port of the library's) | libfacedetection CNN (YuNet design) weights and inference code, weights converted to half precision | Shiqi Yu | [ShiqiYu/libfacedetection](https://github.com/ShiqiYu/libfacedetection) (`src/facedetectcnn-data.cpp`, `facedetectcnn.cpp`, `facedetectcnn-model.cpp`) | BSD-3-Clause, [`LICENSE-libfacedetection.txt`](crates/algo/data/LICENSE-libfacedetection.txt) |
 
 ### Optional build input: craft-fonts (not files in this repo)
 
diff --git a/Cargo.lock b/Cargo.lock
index b3a268add9..26920a968e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1222,6 +1222,11 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "craft-docpath"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=82a24b006eefa036b43c09a67fb9a3fbd17ffe63#82a24b006eefa036b43c09a67fb9a3fbd17ffe63"
+
 [[package]]
 name = "craft-print"
 version = "0.1.0"
@@ -4613,7 +4618,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "arboard",
  "async-io",
@@ -4646,6 +4651,7 @@ dependencies = [
  "rfd",
  "ron",
  "serde_json",
+ "tempfile",
  "winit",
  "winresource",
  "winsafe",
@@ -4657,7 +4663,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-affinity"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "crc32fast",
  "flate2",
@@ -4667,7 +4673,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-algo"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "photocraft-color",
  "photocraft-geom",
@@ -4680,7 +4686,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-automation"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "base64 0.22.1",
  "cap-std",
@@ -4702,7 +4708,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-cli"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "photocraft-automation",
  "photocraft-codecs",
@@ -4716,7 +4722,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-cms"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "moxcms",
  "rayon",
@@ -4724,7 +4730,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-codecs"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "exr",
  "flate2",
@@ -4745,7 +4751,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-color"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "photocraft-cms",
  "serde",
@@ -4753,7 +4759,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-compose"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "criterion",
  "photocraft-color",
@@ -4768,7 +4774,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-doc"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "photocraft-color",
  "photocraft-geom",
@@ -4779,7 +4785,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-engine"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "blake3",
  "craft-print",
@@ -4795,6 +4801,7 @@ dependencies = [
  "photocraft-format",
  "photocraft-geom",
  "photocraft-io",
+ "photocraft-ipp",
  "photocraft-ops",
  "photocraft-paint",
  "photocraft-plugins",
@@ -4814,7 +4821,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-format"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "blake3",
  "crc32fast",
@@ -4835,14 +4842,14 @@ dependencies = [
 
 [[package]]
 name = "photocraft-geom"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "photocraft-gpu"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "half",
  "log",
@@ -4859,16 +4866,17 @@ dependencies = [
 
 [[package]]
 name = "photocraft-heif"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "heic-rs",
 ]
 
 [[package]]
 name = "photocraft-io"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "blake3",
+ "craft-docpath",
  "crc32fast",
  "flate2",
  "photocraft-affinity",
@@ -4893,16 +4901,20 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "photocraft-ipp"
+version = "0.10.0"
+
 [[package]]
 name = "photocraft-ops"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "photocraft-doc",
 ]
 
 [[package]]
 name = "photocraft-paint"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "photocraft-color",
  "photocraft-geom",
@@ -4913,7 +4925,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-plugins"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "photocraft-color",
  "photocraft-geom",
@@ -4928,7 +4940,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-psd"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "flate2",
  "photocraft-psd",
@@ -4939,7 +4951,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-raster"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "photocraft-color",
  "photocraft-geom",
@@ -4949,7 +4961,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-raw"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "flate2",
  "image",
@@ -4964,7 +4976,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-tablet"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "block2 0.6.2",
  "objc2 0.6.4",
@@ -4976,7 +4988,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-testkit"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "memory-stats",
  "photocraft-color",
@@ -4987,7 +4999,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-text"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "flate2",
  "parley",
@@ -5001,7 +5013,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-ui-egui"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "base64 0.22.1",
  "craft-print",
@@ -5037,12 +5049,13 @@ dependencies = [
  "serde_json",
  "sys-locale",
  "toml",
+ "unicode-bidi",
  "winsafe",
 ]
 
 [[package]]
 name = "photocraft-vector"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "photocraft-color",
  "photocraft-doc",
@@ -5053,7 +5066,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-web"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "eframe",
  "egui",
@@ -5075,7 +5088,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-web-boot"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "flate2",
  "js-sys",
@@ -6113,9 +6126,9 @@ dependencies = [
 
 [[package]]
 name = "ruzstd"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a252f5e20f038fe7b4ea53e073e65398d652c864cc162fc77c56c2f13717b888"
+checksum = "69e4ce4a039f42bf25920b95667e4d789e98749ab11bbb8d2c2936f788421bb5"
 dependencies = [
  "twox-hash",
 ]
@@ -8662,7 +8675,7 @@ checksum = "ec7a2a501ed189703dba8b08142f057e887dfc4b2cc4db2d343ac6376ba3e0b9"
 
 [[package]]
 name = "xtask"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "serde",
  "serde_json",
diff --git a/Cargo.toml b/Cargo.toml
index 663d268c3a..3f8dbb0a72 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/photocraft", "apps/photocraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.9.0"
+version = "0.10.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -36,9 +36,11 @@ photocraft-engine = { path = "crates/engine" }
 photocraft-ui-egui = { path = "crates/ui-egui" }
 photocraft-testkit = { path = "crates/testkit" }
 photocraft-tablet = { path = "crates/tablet" }
+photocraft-ipp = { path = "crates/ipp" }
 
 # external
 craft-print = { git = "https://github.com/storytold/craft-libs", rev = "3d37da389a3618ab9b76109da11416e9ca4ea719" }
+craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "82a24b006eefa036b43c09a67fb9a3fbd17ffe63" }
 thiserror = "2"
 serde = { version = "1", features = ["derive", "rc"] }
 serde_json = "1"
@@ -75,9 +77,18 @@ opt-level = 2
 opt-level = 1
 # Line tables keep file:line in panic backtraces but drop variable info, which roughly halves link
 # time and PDB size for the ~260 test binaries (#2204). CI sets the same through
-# CARGO_PROFILE_DEV_DEBUG. To inspect locals in a debugger, build with CARGO_PROFILE_DEV_DEBUG=true.
+# CARGO_PROFILE_DEV_DEBUG (and no debuginfo at all for the Windows tests). To inspect locals in a
+# debugger, build with CARGO_PROFILE_DEV_DEBUG=true.
 debug = "line-tables-only"
 
+# Test builds compile ui-egui without optimization: its library and unit tests were the biggest
+# test-build units after engine's (12.6 of ~63 compile minutes on the Windows CI runner), and its
+# tests run no heavier pixel code of their own (that lives in the crates that stay optimized).
+# Measured on CI: Windows build 18.9 -> 15.4 min, test run 10.0 -> 10.5. `cargo run` and
+# `cargo build` use the dev profile and are unaffected.
+[profile.test.package.photocraft-ui-egui]
+opt-level = 0
+
 [profile.release]
 lto = "thin"
 codegen-units = 1
@@ -127,17 +138,32 @@ opt-level = "z"
 [profile.wasm-release.package.naga]
 opt-level = "z"
 
-# Pixel processing keeps its speed-oriented optimization level.
+# The browser UI toolkit favors size to stay within the WebAssembly upload budget.
+[profile.wasm-release.package.egui]
+opt-level = "z"
+[profile.wasm-release.package.epaint]
+opt-level = "z"
+[profile.wasm-release.package.eframe]
+opt-level = "z"
+
+# Pixel processing keeps its speed-oriented optimization level, with two exceptions.
+# Colour-management transforms are built once and cached (`transform::cached`), so "z" costs
+# little runtime. The browser app composites per frame on the GPU (`crates/gpu`, WebGPU/WebGL2),
+# so the CPU compositor is not the browser's hot path there; "z" for compose keeps the wasm
+# under the 24 MiB gate (measured −122 KB vs opt-level 3). algo's filters run per pixel on
+# every interactive filter application; "z" there is the size lever of last resort (−331 KB),
+# taken because the gate is enforced in CI: if browser filters feel too slow, restore 3 here
+# and reclaim the bytes from a feature-gated decoder instead.
 [profile.wasm-release.package.photocraft-raster]
 opt-level = 3
 [profile.wasm-release.package.photocraft-color]
 opt-level = 3
 [profile.wasm-release.package.photocraft-cms]
-opt-level = 3
+opt-level = "z"
 [profile.wasm-release.package.photocraft-compose]
-opt-level = 3
+opt-level = "z"
 [profile.wasm-release.package.photocraft-algo]
-opt-level = 3
+opt-level = "z"
 [profile.wasm-release.package.photocraft-paint]
 opt-level = 3
 
diff --git a/NOTICE b/NOTICE
index 887010d4a6..a7302a940c 100644
--- a/NOTICE
+++ b/NOTICE
@@ -16,6 +16,7 @@ Inter font (assets/fonts/Inter-*.ttf) — SIL Open Font License 1.1. See assets/
 JetBrains Mono font (assets/fonts/JetBrainsMono-Regular.ttf) — SIL Open Font License 1.1. See assets/fonts/OFL-JetBrainsMono.txt.
 Lucide icons (assets/icons/*.svg, except slice-knife.svg) — ISC; icons derived from Feather also MIT. See assets/icons/LICENSE-lucide.txt.
 SCOWL English word list (assets/dict/en_US-scowl-50.txt.gz) — SCOWL license. See assets/dict/LICENSE-SCOWL.txt.
+libfacedetection face detection weights and network (crates/algo/data/libfacedetection.bin, crates/algo/src/faces/cnn.rs) — BSD-3-Clause, Copyright (c) 2015-2019, Shiqi Yu, all rights reserved. See crates/algo/data/LICENSE-libfacedetection.txt.
 
 Builds made with craft-fonts (CRAFT_FONTS_DIR; all official releases) also embed the fonts listed in
 https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md (today BIZ UDPGothic, Shippori Mincho and
diff --git a/README.md b/README.md
index d1e839323c..12e2ef4b12 100644
--- a/README.md
+++ b/README.md
@@ -275,6 +275,8 @@ flatpak install --user photocraft-<version>-linux-x86_64.flatpak   # or -linux-a
 flatpak run ai.storyteller.photocraft
 ```
 
+The Flatpak prints through the host's CUPS socket (File › Print talks IPP to it directly, no `lp` needed); without CUPS, or without a printer, File › Print opens the system print dialog through the print portal. See [printing](docs/printing.md).
+
 The AppImage needs no install: the first run registers its launcher icon and menu entry in `~/.local/share` so the dock shows PhotoCraft's icon on Wayland. Set `PHOTOCRAFT_NO_DESKTOP_INTEGRATION=1` to skip that, and see [`docs/releasing.md`](docs/releasing.md) › Linux to undo it.
 
 On a Wayland session, files dropped on the window don't open yet: winit 0.30, the windowing library under egui, has no Wayland drag and drop (#386). Use File › Open, or copy the image in your file manager and paste it with Ctrl+V. To drag and drop, start PhotoCraft under XWayland: `WAYLAND_DISPLAY= photocraft`, `WAYLAND_DISPLAY= ./photocraft-<version>-linux-x86_64.AppImage`, or `flatpak run --nosocket=wayland --socket=x11 ai.storyteller.photocraft`. On Wayland, PhotoCraft shows the command for your install in a notice until you dismiss it. Preferences › Performance › Linux display server = X11 does the same on every launch. With a fractional display scale (125%, 150%, 175%) an XWayland window is drawn at a lower resolution and enlarged by the compositor, so the interface is blurred there; native Wayland stays sharp (#1072).
@@ -300,6 +302,19 @@ Maintainers: [`docs/releasing.md`](docs/releasing.md) explains how releases are
 > [!IMPORTANT]
 > **Status:** PhotoCraft is in early alpha, and we want to be straight about where it stands: much of Photoshop's feature surface exists in some form, but **it is not yet a Photoshop replacement for daily professional work**. The biggest gaps are AI/generative features, 15 missing tools, depth in typography and pro workflows, and plug-in compatibility. Every Photoshop menu item is wired to a command ([`docs/parity-checklist.md`](docs/parity-checklist.md)), but that measures wiring, not behaviour. The honest, dimension-by-dimension picture and where we're going next are in the [roadmap](ROADMAP.md) and [parity assessment](docs/target-app-parity.md). Expect rough edges, and please file issues (include your OS, document size, layer count and a screenshot). You can also tell us what broke on [Discord](https://discord.gg/artcraft).
 
+## Community packages
+
+These installers are maintained by community members, not by the PhotoCraft team.
+
+On Gentoo, the [::snakebyte overlay](https://github.com/switch87/snakebyte-overlay) packages the Linux release as `media-gfx/photocraft-bin`:
+
+```sh
+eselect repository add snakebyte git https://github.com/switch87/snakebyte-overlay.git
+emaint sync -r snakebyte
+echo 'media-gfx/photocraft-bin ~amd64' >> /etc/portage/package.accept_keywords/photocraft
+emerge --ask media-gfx/photocraft-bin
+```
+
 ## Documentation
 
 Developer, architecture, automation, format, and security documentation is maintained in the [PhotoCraft documentation book](book/).
diff --git a/apps/photocraft-cli/Cargo.toml b/apps/photocraft-cli/Cargo.toml
index a6d3b49389..f4848f379a 100644
--- a/apps/photocraft-cli/Cargo.toml
+++ b/apps/photocraft-cli/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "photocraft-cli"
-description = "Headless Photocraft: convert, inspect, run commands, batch, MCP server"
+description = "Headless PhotoCraft: convert, inspect, run commands, batch, MCP server"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
diff --git a/apps/photocraft-cli/src/lib.rs b/apps/photocraft-cli/src/lib.rs
index b93d4ccc8f..03001ab02d 100644
--- a/apps/photocraft-cli/src/lib.rs
+++ b/apps/photocraft-cli/src/lib.rs
@@ -1,4 +1,4 @@
-//! Headless Photocraft command line. `run` is the whole program, so it can be
+//! Headless PhotoCraft command line. `run` is the whole program, so it can be
 //! tested in-process as well as through the binary.
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
@@ -12,7 +12,7 @@ use photocraft_io::ExportOptions;
 use serde_json::{Value, json};
 
 pub const USAGE: &str = "\
-photocraft-cli: headless Photocraft
+photocraft-cli: headless PhotoCraft
 
 USAGE:
   photocraft-cli convert <in> <out> [--format <ext>] [--quality <1-100>] [--tiff-layers] [--tga-bits <24|32>] [--dpx-bits <8|10|12|16>]
diff --git a/apps/photocraft-web/Cargo.toml b/apps/photocraft-web/Cargo.toml
index a4ded64181..4ecad80ae4 100644
--- a/apps/photocraft-web/Cargo.toml
+++ b/apps/photocraft-web/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "photocraft-web"
-description = "Photocraft in the browser (eframe web runner, WebGPU with WebGL2 fallback)"
+description = "PhotoCraft in the browser (eframe web runner, WebGPU with WebGL2 fallback)"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -34,7 +34,7 @@ rfd = { workspace = true }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
 js-sys = "0.3"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Storage", "Event", "EventTarget", "MouseEvent", "PointerEvent", "BeforeUnloadEvent", "AbortController", "AbortSignal", "DomException", "Response", "IdbFactory", "IdbOpenDbRequest", "IdbDatabase", "IdbRequest", "IdbTransaction", "IdbTransactionMode", "IdbObjectStore", "IdbCursor", "IdbCursorWithValue", "RequestInit", "Navigator"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "DomRect", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Storage", "Event", "EventTarget", "MouseEvent", "PointerEvent", "BeforeUnloadEvent", "AbortController", "AbortSignal", "DomException", "Response", "IdbFactory", "IdbOpenDbRequest", "IdbDatabase", "IdbRequest", "IdbTransaction", "IdbTransactionMode", "IdbObjectStore", "IdbCursor", "IdbCursorWithValue", "RequestInit", "Navigator"] }
 
 [dev-dependencies]
 serde_json = { workspace = true }
diff --git a/apps/photocraft-web/src/main.rs b/apps/photocraft-web/src/main.rs
index 5ba75f5254..0802a02ebf 100644
--- a/apps/photocraft-web/src/main.rs
+++ b/apps/photocraft-web/src/main.rs
@@ -1,4 +1,4 @@
-//! Photocraft in the browser.
+//! PhotoCraft in the browser.
 //!
 //! Runs the same [`photocraft_ui_egui::PhotocraftApp`] as the desktop app through eframe's web
 //! runner (wgpu: WebGPU where available, WebGL2 otherwise). Build with `trunk build --release`
@@ -6,10 +6,10 @@
 //!
 //! Differences from the desktop app:
 //! - no TCP control server (browsers can't listen on sockets);
-//! - File → Open uses the browser file picker; bytes arrive asynchronously through
-//!   `Services::inbox`;
+//! - file pickers return browser file contents asynchronously through `Services::file_dialog`;
+//!   this includes File → Open and commands such as Place Embedded;
 //! - saving/exporting triggers a browser download;
-//! - dropped files are read asynchronously by `web::WebShell` and delivered through the inbox.
+//! - dropped files are read asynchronously by `web::WebShell` and delivered through `Services::inbox`.
 //!
 //! URL query flags: `?cpu` forces the CPU canvas path (same as `PHOTOCRAFT_CPU_CANVAS=1`);
 //! `?webgl` forces the WebGL2 backend instead of WebGPU.
diff --git a/apps/photocraft-web/src/web.rs b/apps/photocraft-web/src/web.rs
index eb350d17eb..6fd3620483 100644
--- a/apps/photocraft-web/src/web.rs
+++ b/apps/photocraft-web/src/web.rs
@@ -1,6 +1,8 @@
 //! The browser shell: web `Services`, drag-and-drop, and the eframe web runner.
 
+use std::cell::Cell;
 use std::collections::{HashMap, HashSet};
+use std::rc::Rc;
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::{Arc, Mutex};
 
@@ -79,11 +81,13 @@ pub fn start() {
                 Box::new(move |cc| {
                     PhotocraftApp::setup_context(&cc.egui_ctx, ThemeKind::Pro);
                     let inbox: Inbox = Arc::default();
+                    let place_inbox: Inbox = Arc::default();
                     let served: Served = Arc::default();
                     load_font_manifest(served.clone(), cc.egui_ctx.clone());
                     let (session, warnings) = crate::preset_bridge::session(presets.clone());
                     preset_warnings.extend(warnings);
-                    let mut app = PhotocraftApp::new(session, services(inbox.clone()));
+                    let drag = listen_drag(&pen_target);
+                    let mut app = PhotocraftApp::new(session, services(inbox.clone(), place_inbox.clone(), drag_pos_service(pen_target.clone(), drag)));
                     if !preset_warnings.is_empty() {
                         photocraft_ui_egui::notices::post(&mut app, i18n::t("Some brush presets could not be loaded"), preset_warnings, true, None);
                     }
@@ -97,7 +101,7 @@ pub fn start() {
                     }
                     let unsaved = Arc::new(AtomicBool::new(false));
                     guard_unload(unsaved.clone());
-                    Ok(Box::new(WebShell { app, inbox, unsaved, served, database, presets }))
+                    Ok(Box::new(WebShell { app, inbox, place_inbox, unsaved, served, database, presets }))
                 }),
             )
             .await;
@@ -140,6 +144,38 @@ fn listen_pen(target: &web_sys::HtmlCanvasElement, feed: photocraft_ui_egui::sty
     }
 }
 
+/// The pointer in a drag over the page, in CSS pixels relative to the viewport (`clientX`,
+/// `clientY`): the last `dragover` or `drop` event's.
+type DragPos = Rc<Cell<Option<(f32, f32)>>>;
+
+/// Follows files dragged over the canvas. eframe's drop events carry no pointer position and the
+/// page gets no pointer events during a drag, so this is where a drop lands: on the document's
+/// canvas it places the files, elsewhere it opens them (#5749).
+fn listen_drag(target: &web_sys::HtmlCanvasElement) -> DragPos {
+    use wasm_bindgen::closure::Closure;
+    let pos = DragPos::default();
+    for kind in ["dragover", "drop"] {
+        let pos = pos.clone();
+        // A DragEvent is a MouseEvent: only its client position is read.
+        let cb = Closure::<dyn FnMut(web_sys::MouseEvent)>::new(move |e: web_sys::MouseEvent| pos.set(Some((e.client_x() as f32, e.client_y() as f32))));
+        if target.add_event_listener_with_callback(kind, cb.as_ref().unchecked_ref()).is_ok() {
+            cb.forget();
+        }
+    }
+    pos
+}
+
+/// `Services::cursor_pos` for the web: the last drag position in egui points, mapped as eframe
+/// maps pointer events (relative to the canvas, divided by the zoom factor).
+fn drag_pos_service(canvas: web_sys::HtmlCanvasElement, pos: DragPos) -> photocraft_ui_egui::CursorPosFn {
+    Box::new(move |ctx: &egui::Context| {
+        let (x, y) = pos.get()?;
+        let rect = canvas.get_bounding_client_rect();
+        let zoom = ctx.zoom_factor();
+        (zoom.is_finite() && zoom > 0.0).then(|| egui::pos2((x - rect.left() as f32) / zoom, (y - rect.top() as f32) / zoom))
+    })
+}
+
 /// Closing or reloading the tab while a document has unsaved changes asks first, as closing the
 /// desktop window does: the browser shows its own "Leave site?" prompt (#1380). `unsaved` is
 /// refreshed every frame by [`WebShell`].
@@ -219,10 +255,13 @@ async fn fetch_bytes(url: &str, integrity: Option<&str>) -> Result<Vec<u8>, Stri
 }
 
 /// Wraps the app to read dropped files asynchronously (browsers can't read them synchronously,
-/// so the app's own drop path can't handle them) and feed them through the inbox.
+/// so the app's own drop path can't handle them) and feed them through the inboxes.
 struct WebShell {
     app: PhotocraftApp,
+    /// Dropped files to open as documents.
     inbox: Inbox,
+    /// Dropped files to place on the active document's canvas.
+    place_inbox: Inbox,
     /// Read by the `beforeunload` listener ([`guard_unload`]).
     unsaved: Arc<AtomicBool>,
     served: Served,
@@ -285,17 +324,26 @@ impl WebShell {
 impl eframe::App for WebShell {
     fn logic(&mut self, ctx: &egui::Context, frame: &mut eframe::Frame) {
         let dropped = ctx.input_mut(|i| std::mem::take(&mut i.raw.dropped_files));
-        for f in dropped {
-            let inbox = self.inbox.clone();
+        if !dropped.is_empty() {
+            let names: Vec<String> =
+                dropped.iter().map(|f| f.path().file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "dropped".into())).collect();
+            // Decided now, where the drop landed: on the document's canvas the files are placed
+            // as layers (as on the desktop), elsewhere opened.
+            let places = self.app.dropped_on_canvas(ctx, &names);
+            let files: Vec<_> = dropped.into_iter().zip(names).zip(places).collect();
+            let (inbox, place_inbox) = (self.inbox.clone(), self.place_inbox.clone());
             let ctx = ctx.clone();
+            // One after another, so they open or place in the order they were dropped.
             wasm_bindgen_futures::spawn_local(async move {
-                let name = f.path().file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "dropped".into());
-                match f.bytes_async().await {
-                    Ok(bytes) => {
-                        inbox.lock().unwrap_or_else(|e| e.into_inner()).push((name, bytes));
-                        ctx.request_repaint();
+                for ((f, name), place) in files {
+                    match f.bytes_async().await {
+                        Ok(bytes) => {
+                            let queue = if place { &place_inbox } else { &inbox };
+                            queue.lock().unwrap_or_else(|e| e.into_inner()).push((name, bytes));
+                            ctx.request_repaint();
+                        }
+                        Err(e) => log::error!("couldn't read dropped file {name}: {e}"),
                     }
-                    Err(e) => log::error!("couldn't read dropped file {name}: {e}"),
                 }
             });
         }
@@ -333,7 +381,7 @@ impl eframe::App for WebShell {
     }
 }
 
-fn services(inbox: Inbox) -> Services {
+fn services(inbox: Inbox, place_inbox: Inbox, cursor_pos: photocraft_ui_egui::CursorPosFn) -> Services {
     Services {
         screen_pick: screen_color_service(),
         import: Some(Box::new(|name: &str, bytes: &[u8], max_svg_group_depth: usize| {
@@ -384,6 +432,8 @@ fn services(inbox: Inbox) -> Services {
             photocraft_codecs::encode(&img, photocraft_codecs::Format::Png, &EncodeOptions::default()).map_err(|e| e.to_string())
         })),
         inbox: Some(inbox),
+        place_inbox: Some(place_inbox),
+        cursor_pos: Some(cursor_pos),
         // Preferences live in the browser's localStorage.
         load_prefs: Some(Box::new(|| local_storage()?.get_item(PREFS_KEY).ok().flatten())),
         save_prefs: Some(Box::new(|text: &str| local_storage().ok_or("no localStorage")?.set_item(PREFS_KEY, text).map_err(|e| format!("{e:?}")))),
diff --git a/apps/photocraft/Cargo.toml b/apps/photocraft/Cargo.toml
index e5af663471..505947e222 100644
--- a/apps/photocraft/Cargo.toml
+++ b/apps/photocraft/Cargo.toml
@@ -4,7 +4,7 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 default-run = "photocraft"
-description = "Photocraft: an open-source, native image editor"
+description = "PhotoCraft: an open-source, native image editor"
 build = "build.rs"
 
 [features]
@@ -65,6 +65,8 @@ dispatch2 = { version = "=0.3.1", default-features = false, features = ["std"] }
 # Drop position on X11 (`cursor.rs`): pure-Rust X client, already in Cargo.lock; pinned exactly.
 [target.'cfg(target_os = "linux")'.dependencies]
 photocraft-cms = { workspace = true }
+# The print portal's PDF: a private (0600) temporary file, removed when the dialog is done.
+tempfile = "3"
 x11rb = { version = "=0.13.2", default-features = false, features = ["image", "randr", "xkb"] }
 # Clipboard images in types other than PNG on Wayland (`services.rs`, #2546): arboard asks for
 # image/png only. Already in Cargo.lock (arboard's wayland-data-control); pinned exactly.
diff --git a/apps/photocraft/src/app_dirs.rs b/apps/photocraft/src/app_dirs.rs
index 2897bebdb0..5775e254df 100644
--- a/apps/photocraft/src/app_dirs.rs
+++ b/apps/photocraft/src/app_dirs.rs
@@ -9,6 +9,9 @@
 //!    folder can't be written (read-only medium, Program Files), the app warns and falls back.
 //! 3. The platform convention: macOS `~/Library/Application Support/Photocraft`, Windows
 //!    `%APPDATA%\Photocraft`, Linux `$XDG_CONFIG_HOME/photocraft` or `~/.config/photocraft`.
+//!
+//! One exception: on Windows the platform convention keeps crash-recovery autosaves out of the
+//! roaming profile ([`recovery_dir`]).
 
 use std::ffi::OsString;
 use std::path::{Path, PathBuf};
@@ -60,6 +63,379 @@ pub fn config_dir() -> Option<PathBuf> {
     current().dir.clone()
 }
 
+/// The crash-recovery folder's name.
+const RECOVERY: &str = "Recovery";
+
+/// Where crash-recovery autosaves live, with any left in the settings directory by an earlier
+/// version moved there first ([`adopt_legacy_recovery`]). Call it once, at startup.
+pub fn recovery_dir() -> Option<PathBuf> {
+    let data = current();
+    let dir = resolve_recovery(data, |k| std::env::var_os(k))?;
+    Some(match data.dir.as_ref().map(|d| d.join(RECOVERY)) {
+        Some(legacy) => adopt_legacy_recovery(&legacy, &dir),
+        None => dir,
+    })
+}
+
+/// The recovery folder for `data` (#5648). Autosaves hold whole documents and are rewritten every
+/// few minutes, so on Windows the platform convention puts them in the machine-local
+/// `%LOCALAPPDATA%\Photocraft\Recovery`: the roaming `%APPDATA%` may be synced at sign-in and
+/// sign-out or capped by policy. They stay out of `%TEMP%`, which cleanup tools may empty before
+/// a crashed document is recovered. The override and portable folders keep everything in one
+/// place, and other platforms already keep these folders local.
+pub fn resolve_recovery(data: &DataDir, env: impl Fn(&str) -> Option<OsString>) -> Option<PathBuf> {
+    if cfg!(windows)
+        && data.mode == Mode::Platform
+        && let Some(local) = env("LOCALAPPDATA").filter(|l| !l.is_empty())
+    {
+        return Some(PathBuf::from(local).join("Photocraft").join(RECOVERY));
+    }
+    data.dir.as_ref().map(|d| d.join(RECOVERY))
+}
+
+/// The lock file, beside the recovery folder, that keeps two PhotoCraft processes starting at
+/// once (`--new-instance`, control launches) from moving the same autosaves.
+const MIGRATION_LOCK: &str = "recovery-migration.lock";
+
+/// How long a launch waits for another one's move before going ahead without moving anything.
+const MIGRATION_WAIT: std::time::Duration = std::time::Duration::from_secs(5);
+
+/// Suffix of a copy staged for publishing ([`stage_copy`]): disposable, the original still exists.
+const STAGED: &str = ".moving";
+
+/// Suffix of an original set aside while it is copied to another volume ([`move_across`]): it
+/// may be the only copy, so it is put back, never thrown away, if the move doesn't finish.
+const HELD: &str = ".held";
+
+/// Move autosaves from `legacy` (the recovery folder of versions before #5648) into `dir`, so a
+/// crash just before an update is still offered for recovery. Returns the folder this process
+/// uses for its recovery store. That is `legacy` only when `dir` doesn't exist and no process can
+/// be moving autosaves (the move failed, or its lock can't be made), so nothing deletes what is
+/// written there. A launch that finds another one moving uses `dir`, which the move never
+/// replaces or removes. See [`adopt_locked`] for how they move.
+pub fn adopt_legacy_recovery(legacy: &Path, dir: &Path) -> PathBuf {
+    adopt_legacy_recovery_waiting(legacy, dir, MIGRATION_WAIT)
+}
+
+/// [`adopt_legacy_recovery`], waiting up to `wait` for another process's move.
+fn adopt_legacy_recovery_waiting(legacy: &Path, dir: &Path, wait: std::time::Duration) -> PathBuf {
+    let held_aside = || legacy.parent().is_some_and(|p| !side_entries(p, legacy, HELD).is_empty());
+    if legacy == dir || (!legacy.is_dir() && !held_aside()) {
+        return dir.to_path_buf();
+    }
+    // An empty old folder has nothing to move (`remove_dir` only removes an empty one).
+    if !held_aside() && std::fs::remove_dir(legacy).is_ok() {
+        return dir.to_path_buf();
+    }
+    let unmoved = || if dir.exists() || !legacy.is_dir() { dir.to_path_buf() } else { legacy.to_path_buf() };
+    let Some(parent) = dir.parent() else { return unmoved() };
+    let lock =
+        std::fs::create_dir_all(parent).and_then(|()| std::fs::OpenOptions::new().create(true).truncate(false).write(true).open(parent.join(MIGRATION_LOCK)));
+    let Ok(lock) = lock else {
+        // No lock file means no other process can be moving: the old folder is safe to use.
+        log::warn!("couldn't open the recovery move lock in {}; autosaves stay where they are", parent.display());
+        return unmoved();
+    };
+    let deadline = std::time::Instant::now() + wait;
+    loop {
+        match lock.try_lock() {
+            Ok(()) => break,
+            Err(std::fs::TryLockError::WouldBlock) if std::time::Instant::now() < deadline => std::thread::sleep(std::time::Duration::from_millis(50)),
+            Err(std::fs::TryLockError::WouldBlock) => {
+                // Another process is moving and may yet remove the old folder: never write there.
+                log::info!("another PhotoCraft is moving crash-recovery autosaves; using {}", dir.display());
+                return dir.to_path_buf();
+            }
+            Err(std::fs::TryLockError::Error(e)) => {
+                // Locking fails for every process here alike, so none can be moving.
+                log::warn!("couldn't lock {}: {e}; autosaves stay where they are", parent.join(MIGRATION_LOCK).display());
+                return unmoved();
+            }
+        }
+    }
+    // The lock file stays (removing it would race a process about to lock it); the OS releases
+    // the lock when `lock` is dropped or the process ends.
+    let used = adopt_locked(legacy, dir);
+    if used == legacy {
+        // This process writes its autosaves to the old folder: it keeps the lock for as long as it
+        // runs, so no other launch moves (and removes) the folder under it.
+        KEPT_LOCKS.lock().unwrap_or_else(std::sync::PoisonError::into_inner).push(lock);
+    }
+    used
+}
+
+/// Migration locks of the old folders this process uses (see [`adopt_legacy_recovery`]), kept
+/// until it ends.
+static KEPT_LOCKS: std::sync::Mutex<Vec<std::fs::File>> = std::sync::Mutex::new(Vec::new());
+
+/// The move itself, under the migration lock. First, what a process that ended mid-move left is
+/// tidied: originals it set aside are put back, copies it staged are removed. An empty `legacy`
+/// is then just removed. Otherwise the whole folder moves if `dir` doesn't exist yet; when both
+/// exist, each autosave (`<key>.pcraft` bundle and `<key>.json` sidecar, see
+/// `photocraft_format::autosave`) moves as a whole, bundle first, unless `dir` already has either
+/// part, and one that stays is left in `legacy` untouched. Every move is a [`move_path`].
+fn adopt_locked(legacy: &Path, dir: &Path) -> PathBuf {
+    if let Some(parent) = legacy.parent() {
+        for held in side_entries(parent, legacy, HELD) {
+            put_back(&held, legacy);
+        }
+    }
+    // Autosave parts held aside inside the old folder by a per-autosave move.
+    let held_parts: Vec<(PathBuf, String)> = std::fs::read_dir(legacy)
+        .into_iter()
+        .flatten()
+        .flatten()
+        .filter_map(|e| e.file_name().to_str().and_then(|n| side_of(n, HELD)).map(|orig| (e.path(), orig.to_owned())))
+        .collect();
+    for (held, original) in held_parts {
+        put_back(&held, &legacy.join(original));
+    }
+    for folder in [dir.parent(), Some(dir)].into_iter().flatten() {
+        remove_stale_staging(folder);
+    }
+    // Another process may have finished the move while this one waited.
+    if !legacy.is_dir() {
+        return dir.to_path_buf();
+    }
+    if std::fs::remove_dir(legacy).is_ok() {
+        return dir.to_path_buf();
+    }
+    if !dir.exists() {
+        // The common case: the whole folder moves at once.
+        return match move_path(legacy, dir) {
+            Ok(()) => {
+                log::info!("moved crash-recovery autosaves from {} to {}", legacy.display(), dir.display());
+                dir.to_path_buf()
+            }
+            Err(e) => {
+                log::warn!("couldn't move crash-recovery autosaves from {} to {} ({e}); using the old folder", legacy.display(), dir.display());
+                if legacy.is_dir() { legacy.to_path_buf() } else { dir.to_path_buf() }
+            }
+        };
+    }
+    move_entries(legacy, dir);
+    // Only an emptied folder goes; anything that couldn't move stays for a later launch.
+    let _ = std::fs::remove_dir(legacy);
+    dir.to_path_buf()
+}
+
+/// Move each autosave of `from` into `to` (both folders): bundle first, then sidecar, skipped if
+/// `to` has either part. Temp files of an interrupted write (`photocraft_format::atomic`) go
+/// along too, for the recovery store's startup sweep there.
+fn move_entries(from: &Path, to: &Path) {
+    let Ok(entries) = std::fs::read_dir(from) else { return };
+    let names: Vec<String> = entries.flatten().filter_map(|e| e.file_name().to_str().map(str::to_owned)).collect();
+    let keys: std::collections::BTreeSet<&str> = names.iter().filter_map(|n| n.strip_suffix(".pcraft").or_else(|| n.strip_suffix(".json"))).collect();
+    for key in keys {
+        let parts = [format!("{key}.pcraft"), format!("{key}.json")];
+        if parts.iter().any(|p| std::fs::symlink_metadata(to.join(p)).is_ok()) {
+            continue;
+        }
+        // A bundle that moves without its sidecar is still listed (`list_recovery` reads a
+        // committed bundle's manifest); a sidecar must never move without its bundle.
+        for part in &parts {
+            let src = from.join(part);
+            if std::fs::symlink_metadata(&src).is_ok()
+                && let Err(e) = move_path(&src, &to.join(part))
+            {
+                log::warn!("couldn't move {} to {}: {e}", src.display(), to.display());
+                break;
+            }
+        }
+    }
+    for name in names.iter().filter(|n| n.ends_with(".pcsave.tmp")) {
+        let _ = move_path(&from.join(name), &to.join(name));
+    }
+}
+
+/// How deep [`copy_tree`] follows folders: an autosave bundle is a few levels deep.
+const MAX_COPY_DEPTH: u32 = 16;
+
+fn already_exists(path: &Path) -> std::io::Error {
+    std::io::Error::new(std::io::ErrorKind::AlreadyExists, format!("{} already exists", path.display()))
+}
+
+/// A path beside `of`, named `.<name>.<pid>-<n><suffix>`, that no other call uses.
+fn side_path(of: &Path, suffix: &str) -> std::io::Result<PathBuf> {
+    static NEXT: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(0);
+    let parent = of.parent().ok_or_else(|| std::io::Error::other(format!("{} has no parent folder", of.display())))?;
+    let name = of.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+    Ok(parent.join(format!(".{name}.{}-{}{suffix}", std::process::id(), NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed))))
+}
+
+/// The name `side` was made from, if it is a [`side_path`] name with `suffix`.
+fn side_of<'a>(side: &'a str, suffix: &str) -> Option<&'a str> {
+    let rest = side.strip_prefix('.')?.strip_suffix(suffix)?;
+    let (name, ids) = rest.rsplit_once('.')?;
+    let (pid, n) = ids.split_once('-')?;
+    let digits = |s: &str| !s.is_empty() && s.bytes().all(|b| b.is_ascii_digit());
+    (!name.is_empty() && digits(pid) && digits(n)).then_some(name)
+}
+
+/// The side paths with `suffix` in `folder` made from `of`.
+fn side_entries(folder: &Path, of: &Path, suffix: &str) -> Vec<PathBuf> {
+    let Some(name) = of.file_name().and_then(|n| n.to_str()) else { return Vec::new() };
+    std::fs::read_dir(folder)
+        .into_iter()
+        .flatten()
+        .flatten()
+        .filter(|e| e.file_name().to_str().and_then(|n| side_of(n, suffix)) == Some(name))
+        .map(|e| e.path())
+        .collect()
+}
+
+/// Move the file or folder `from` to `to` without ever replacing anything at `to`. On one volume
+/// a folder is renamed (Windows refuses an existing target; elsewhere only an empty folder could
+/// be replaced) and a file is hard-linked, which fails on an existing target, and then unlinked
+/// at `from`. Otherwise (another volume, e.g. a roaming profile redirected to a network share
+/// while `%LOCALAPPDATA%` stays local) it is copied ([`move_across`]).
+fn move_path(from: &Path, to: &Path) -> std::io::Result<()> {
+    if std::fs::symlink_metadata(to).is_ok() {
+        return Err(already_exists(to));
+    }
+    let meta = std::fs::symlink_metadata(from)?;
+    let moved = if meta.is_dir() { std::fs::rename(from, to) } else { std::fs::hard_link(from, to).and_then(|()| std::fs::remove_file(from)) };
+    match moved {
+        Ok(()) => Ok(()),
+        Err(e) if matches!(e.kind(), std::io::ErrorKind::AlreadyExists | std::io::ErrorKind::DirectoryNotEmpty) => Err(e),
+        Err(_) => move_across(from, to),
+    }
+}
+
+/// Move `from` to `to` by copying. `from` is first renamed aside on its own volume
+/// (`.<name>.<pid>-<n>.held`, [`hold`]), so a process still writing to the old path (another
+/// launch that couldn't take the lock, an older PhotoCraft) starts a new `from` there instead of
+/// adding to what is copied, and nothing it writes is removed. The held original is copied to a
+/// staged path ([`stage_copy`]), published without replacing anything ([`publish`]), and only
+/// then removed. If the copy or publish fails, the held original is put back ([`put_back`]).
+fn move_across(from: &Path, to: &Path) -> std::io::Result<()> {
+    let held = hold(from)?;
+    match stage_copy(&held, to).and_then(|staged| publish(&staged, to)) {
+        Ok(()) => {
+            let removed = if std::fs::symlink_metadata(&held)?.is_dir() { std::fs::remove_dir_all(&held) } else { std::fs::remove_file(&held) };
+            if let Err(e) = removed {
+                log::warn!("copied {} to {} but couldn't remove {}: {e}", from.display(), to.display(), held.display());
+            }
+            Ok(())
+        }
+        Err(e) => {
+            put_back(&held, from);
+            Err(e)
+        }
+    }
+}
+
+/// Rename `from` aside on its own volume (see [`move_across`]); returns where it is now.
+fn hold(from: &Path) -> std::io::Result<PathBuf> {
+    let held = side_path(from, HELD)?;
+    std::fs::rename(from, &held)?;
+    Ok(held)
+}
+
+/// Return the held original `held` to `original`. If `original` has been made again meanwhile (a
+/// writer that kept using the old path), the held folder's entries move into it without replacing
+/// anything ([`move_entries`]); whatever can't move stays held, logged, and is tried again under
+/// the next move's lock ([`adopt_locked`] puts back what a process that ended mid-move held).
+/// Nothing held is ever removed with data in it.
+fn put_back(held: &Path, original: &Path) {
+    if std::fs::symlink_metadata(original).is_err() && std::fs::rename(held, original).is_ok() {
+        return;
+    }
+    if held.is_dir() && original.is_dir() {
+        move_entries(held, original);
+        if std::fs::remove_dir(held).is_ok() {
+            return;
+        }
+    }
+    log::warn!("{} is kept aside: {} exists", held.display(), original.display());
+}
+
+/// Copy `from` to a staging path beside `to` that this call creates exclusively, so nothing
+/// another process made is ever written to or cleaned up. On failure the staged copy is removed.
+fn stage_copy(from: &Path, to: &Path) -> std::io::Result<PathBuf> {
+    let staged = side_path(to, STAGED)?;
+    let is_dir = std::fs::symlink_metadata(from)?.is_dir();
+    let copied = if is_dir { copy_tree(from, &staged, 0) } else { copy_file(from, &staged) };
+    if let Err(e) = copied {
+        // `copy_tree` and `copy_file` create `staged` exclusively, and everything under a
+        // fresh folder is new: `AlreadyExists` means `staged` was someone else's to keep.
+        if e.kind() != std::io::ErrorKind::AlreadyExists {
+            let _ = if is_dir { std::fs::remove_dir_all(&staged) } else { std::fs::remove_file(&staged) };
+        }
+        return Err(e);
+    }
+    Ok(staged)
+}
+
+/// Remove copies a process left staged in `folder` when it ended mid-move: disposable, since the
+/// original is still in place or held aside. Called only under the migration lock, which every
+/// staging happens under. Links are never followed.
+fn remove_stale_staging(folder: &Path) {
+    let Ok(entries) = std::fs::read_dir(folder) else { return };
+    for entry in entries.flatten() {
+        if !entry.file_name().to_str().is_some_and(|n| side_of(n, STAGED).is_some()) {
+            continue;
+        }
+        let removed = match entry.file_type() {
+            Ok(t) if t.is_dir() => std::fs::remove_dir_all(entry.path()),
+            Ok(t) if t.is_file() => std::fs::remove_file(entry.path()),
+            _ => continue,
+        };
+        if let Err(e) = removed {
+            log::warn!("couldn't remove the stale staged copy {}: {e}", entry.path().display());
+        }
+    }
+}
+
+/// Give the staged copy its final name `to` without replacing anything there (see [`move_path`]
+/// for the folder and file cases). On failure the staged copy is removed and `to` is untouched.
+fn publish(staged: &Path, to: &Path) -> std::io::Result<()> {
+    let is_dir = std::fs::symlink_metadata(staged)?.is_dir();
+    let published = if std::fs::symlink_metadata(to).is_ok() {
+        Err(already_exists(to))
+    } else if is_dir {
+        std::fs::rename(staged, to)
+    } else {
+        std::fs::hard_link(staged, to).and_then(|()| std::fs::remove_file(staged))
+    };
+    if published.is_err() {
+        let _ = if is_dir { std::fs::remove_dir_all(staged) } else { std::fs::remove_file(staged) };
+    }
+    published
+}
+
+/// Copy the folder `from` to the new folder `to` (created here; an existing `to` is an error):
+/// plain files and folders only (a link or other special file is refused), at most
+/// [`MAX_COPY_DEPTH`] levels.
+fn copy_tree(from: &Path, to: &Path, depth: u32) -> std::io::Result<()> {
+    if depth > MAX_COPY_DEPTH {
+        return Err(std::io::Error::other(format!("{} is nested too deep", from.display())));
+    }
+    std::fs::create_dir(to)?;
+    for entry in std::fs::read_dir(from)? {
+        let entry = entry?;
+        let target = to.join(entry.file_name());
+        if entry.file_type()?.is_dir() {
+            copy_tree(&entry.path(), &target, depth.saturating_add(1))?;
+        } else {
+            copy_file(&entry.path(), &target)?;
+        }
+    }
+    Ok(())
+}
+
+/// Copy one plain file (a link or other special file is refused) to the new file `to` (an
+/// existing `to` is an error), flushed to disk.
+fn copy_file(from: &Path, to: &Path) -> std::io::Result<()> {
+    if !std::fs::symlink_metadata(from)?.file_type().is_file() {
+        return Err(std::io::Error::other(format!("{} is not a plain file", from.display())));
+    }
+    let mut src = std::fs::File::open(from)?;
+    let mut dst = std::fs::OpenOptions::new().write(true).create_new(true).open(to)?;
+    std::io::copy(&mut src, &mut dst)?;
+    dst.sync_all()
+}
+
 /// Resolve the data directory from the environment (`env`) and the executable's folder.
 pub fn resolve(env: impl Fn(&str) -> Option<OsString>, exe_dir: Option<&Path>) -> DataDir {
     if let Some(d) = env("PHOTOCRAFT_CONFIG_DIR").filter(|d| !d.is_empty()) {
@@ -223,6 +599,300 @@ mod tests {
         let _ = std::fs::remove_dir_all(&root);
     }
 
+    /// #5648: on Windows, autosaves go to the machine-local `%LOCALAPPDATA%`, not the roaming
+    /// profile; an override or portable folder keeps them inside itself.
+    #[test]
+    fn autosaves_stay_out_of_the_roaming_profile() {
+        let root = temp("recovery-local");
+        let settings = root.join("appdata").join("Photocraft");
+        let local = root.join("local");
+        let env = env_of(&[("LOCALAPPDATA", &local)]);
+        let platform = DataDir { dir: Some(settings.clone()), mode: Mode::Platform, warning: None };
+        let expected = if cfg!(windows) { local.join("Photocraft").join("Recovery") } else { settings.join("Recovery") };
+        assert_eq!(resolve_recovery(&platform, &env), Some(expected));
+        for mode in [Mode::Override, Mode::Portable] {
+            let d = DataDir { dir: Some(settings.clone()), mode, warning: None };
+            assert_eq!(resolve_recovery(&d, &env), Some(settings.join("Recovery")), "{mode:?}");
+        }
+        // No (or an empty) LOCALAPPDATA: beside the settings, as before.
+        let empty = PathBuf::new();
+        assert_eq!(resolve_recovery(&platform, env_of(&[("LOCALAPPDATA", &empty)])), Some(settings.join("Recovery")));
+        assert_eq!(resolve_recovery(&platform, |_| None), Some(settings.join("Recovery")));
+        let nowhere = DataDir { dir: None, mode: Mode::Platform, warning: None };
+        assert_eq!(resolve_recovery(&nowhere, |_| None), None);
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// An autosave bundle and its sidecar, as `format::Autosaver` writes them.
+    fn autosave(dir: &Path, key: &str) {
+        std::fs::create_dir_all(dir.join(format!("{key}.pcraft"))).unwrap();
+        std::fs::write(dir.join(format!("{key}.pcraft")).join("manifest.json"), key).unwrap();
+        std::fs::write(dir.join(format!("{key}.json")), key).unwrap();
+    }
+
+    #[test]
+    fn autosaves_from_the_old_folder_move_to_the_new_one() {
+        let root = temp("recovery-move");
+        let legacy = root.join("roaming").join("Recovery");
+        let dir = root.join("local").join("Photocraft").join("Recovery");
+        autosave(&legacy, "a");
+        assert_eq!(adopt_legacy_recovery(&legacy, &dir), dir);
+        assert!(!legacy.exists(), "the old folder is gone");
+        assert_eq!(std::fs::read_to_string(dir.join("a.pcraft").join("manifest.json")).unwrap(), "a");
+        assert!(dir.join("a.json").is_file());
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn autosaves_merge_into_an_existing_folder_without_overwriting() {
+        let root = temp("recovery-merge");
+        let legacy = root.join("roaming").join("Recovery");
+        let dir = root.join("local").join("Recovery");
+        autosave(&legacy, "old");
+        autosave(&legacy, "both");
+        // A temp file of an interrupted write moves along, for the recovery store's sweep.
+        let temp_file = ".old.json.4294967294-0.pcsave.tmp";
+        std::fs::write(legacy.join(temp_file), b"partial").unwrap();
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::write(dir.join("both.json"), "newer").unwrap();
+        assert_eq!(adopt_legacy_recovery(&legacy, &dir), dir);
+        assert!(dir.join(temp_file).is_file() && !legacy.join(temp_file).exists());
+        assert!(dir.join("old.pcraft").is_dir() && dir.join("old.json").is_file(), "a whole autosave moves");
+        assert_eq!(std::fs::read_to_string(dir.join("both.json")).unwrap(), "newer", "never overwritten");
+        assert!(!dir.join("both.pcraft").exists(), "a clashing autosave isn't split");
+        assert!(legacy.join("both.pcraft").is_dir() && legacy.join("both.json").is_file(), "it stays behind whole");
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn autosaves_that_cannot_move_keep_being_used_where_they_are() {
+        let root = temp("recovery-stuck");
+        let legacy = root.join("roaming").join("Recovery");
+        autosave(&legacy, "a");
+        // A file where the new folder's parent should be: nothing can be created there.
+        std::fs::write(root.join("blocked"), b"in the way").unwrap();
+        let dir = root.join("blocked").join("Recovery");
+        assert_eq!(adopt_legacy_recovery(&legacy, &dir), legacy);
+        assert!(legacy.join("a.json").is_file(), "nothing lost");
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn an_empty_old_folder_is_removed_even_where_it_cannot_move() {
+        let root = temp("recovery-empty");
+        let legacy = root.join("roaming").join("Recovery");
+        std::fs::create_dir_all(&legacy).unwrap();
+        std::fs::write(root.join("blocked"), b"in the way").unwrap();
+        let dir = root.join("blocked").join("Recovery");
+        assert_eq!(adopt_legacy_recovery(&legacy, &dir), dir, "nothing to keep listed");
+        assert!(!legacy.exists(), "the empty old folder is gone");
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// Where a rename can't cross volumes (a roaming profile on a network share), an autosave
+    /// is copied whole, nested folders included, and only then removed.
+    #[test]
+    fn a_move_across_volumes_copies_then_removes() {
+        let root = temp("recovery-copy");
+        let legacy = root.join("roaming").join("Recovery");
+        autosave(&legacy, "a");
+        std::fs::create_dir_all(legacy.join("a.pcraft").join("tiles")).unwrap();
+        std::fs::write(legacy.join("a.pcraft").join("tiles").join("t0.zst"), b"tile").unwrap();
+        let dir = root.join("local").join("Recovery");
+        std::fs::create_dir_all(root.join("local")).unwrap();
+        move_across(&legacy, &dir).unwrap();
+        assert!(!legacy.exists(), "the original is removed after the copy");
+        assert_eq!(side_leftovers(&root.join("roaming")), 0, "nothing is left held aside");
+        assert_eq!(std::fs::read_to_string(dir.join("a.pcraft").join("manifest.json")).unwrap(), "a");
+        assert_eq!(std::fs::read(dir.join("a.pcraft").join("tiles").join("t0.zst")).unwrap(), b"tile");
+        assert_eq!(std::fs::read_to_string(dir.join("a.json")).unwrap(), "a");
+        // One file on its own, as the per-autosave moves do.
+        move_across(&dir.join("a.json"), &root.join("a.json")).unwrap();
+        assert!(!dir.join("a.json").exists() && root.join("a.json").is_file());
+        assert_eq!(side_leftovers(&dir) + side_leftovers(&root), 0);
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn a_failed_copy_puts_the_original_back_and_leaves_no_partial_copy() {
+        let root = temp("recovery-copy-fail");
+        let legacy = root.join("Recovery");
+        autosave(&legacy, "a");
+        // Deeper than any bundle: the copy gives up part way.
+        let mut deep = legacy.join("a.pcraft");
+        for _ in 0..=MAX_COPY_DEPTH {
+            deep = deep.join("d");
+        }
+        std::fs::create_dir_all(&deep).unwrap();
+        let dir = root.join("Local");
+        assert!(move_across(&legacy, &dir).is_err());
+        assert!(!dir.exists(), "nothing is published");
+        assert_eq!(side_leftovers(&root), 0, "no staged copy, nothing left held aside");
+        assert!(legacy.join("a.json").is_file() && deep.is_dir(), "the original is back in place");
+        // A target that already exists is never copied into or removed.
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::write(dir.join("keep"), b"mine").unwrap();
+        assert!(move_across(&legacy.join("a.json"), &dir).is_err());
+        assert_eq!(std::fs::read(dir.join("keep")).unwrap(), b"mine");
+        assert!(legacy.join("a.json").is_file());
+        assert_eq!(side_leftovers(&root) + side_leftovers(&legacy), 0);
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// Staged (`.moving`) and held (`.held`) side paths left in `dir`.
+    fn side_leftovers(dir: &Path) -> usize {
+        std::fs::read_dir(dir)
+            .unwrap()
+            .flatten()
+            .filter(|e| e.file_name().to_str().is_some_and(|n| side_of(n, STAGED).is_some() || side_of(n, HELD).is_some()))
+            .count()
+    }
+
+    /// The target appears after the copy is staged (another process got there first): publishing
+    /// fails, that process's target keeps its contents, the staged copy is removed and the
+    /// original is left as it was. Folder and file alike.
+    #[test]
+    fn a_target_that_appears_while_copying_is_never_replaced_or_removed() {
+        let root = temp("recovery-race");
+        let legacy = root.join("roaming").join("Recovery");
+        autosave(&legacy, "a");
+        let local = root.join("local");
+        std::fs::create_dir_all(&local).unwrap();
+        // A whole folder.
+        let dir = local.join("Recovery");
+        let staged = stage_copy(&legacy, &dir).unwrap();
+        autosave(&dir, "theirs");
+        let e = publish(&staged, &dir).unwrap_err();
+        assert_eq!(e.kind(), std::io::ErrorKind::AlreadyExists);
+        assert_eq!(std::fs::read_to_string(dir.join("theirs.json")).unwrap(), "theirs", "their folder is intact");
+        assert!(!dir.join("a.json").exists(), "nothing was copied into it");
+        assert!(!staged.exists() && side_leftovers(&local) == 0, "only the staged copy is removed");
+        assert!(legacy.join("a.json").is_file(), "the original is untouched");
+        // One file.
+        let to = dir.join("a.json");
+        let staged = stage_copy(&legacy.join("a.json"), &to).unwrap();
+        std::fs::write(&to, "theirs").unwrap();
+        assert_eq!(publish(&staged, &to).unwrap_err().kind(), std::io::ErrorKind::AlreadyExists);
+        assert_eq!(std::fs::read_to_string(&to).unwrap(), "theirs");
+        assert!(!staged.exists() && legacy.join("a.json").is_file());
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// A process holds the lock and is copying the old folder (held aside, copy staged) when a
+    /// second launch gives up waiting. The second launch must get the new folder, never the old
+    /// one, and what it writes there survives the first one finishing: the publish refuses the
+    /// now-existing folder and the original is put back, so both autosaves stay (#6412 review).
+    #[test]
+    fn a_launch_that_times_out_never_writes_where_a_move_removes() {
+        let root = temp("recovery-timeout");
+        let legacy = root.join("roaming").join("Recovery");
+        autosave(&legacy, "old");
+        let local = root.join("local");
+        std::fs::create_dir_all(&local).unwrap();
+        let dir = local.join("Recovery");
+        // First process: takes the lock, sets the original aside and stages its copy, then pauses.
+        let first = std::fs::OpenOptions::new().create(true).truncate(false).write(true).open(local.join(MIGRATION_LOCK)).unwrap();
+        first.lock().unwrap();
+        let held = hold(&legacy).unwrap();
+        let staged = stage_copy(&held, &dir).unwrap();
+        // Second launch: times out and writes a newer autosave where it was told to.
+        let chosen = adopt_legacy_recovery_waiting(&legacy, &dir, std::time::Duration::ZERO);
+        assert_eq!(chosen, dir, "a launch that couldn't get the lock never uses the old folder");
+        autosave(&chosen, "new");
+        // First process resumes: publish, and on failure put the original back (as `move_across`).
+        assert_eq!(publish(&staged, &dir).unwrap_err().kind(), std::io::ErrorKind::AlreadyExists);
+        put_back(&held, &legacy);
+        drop(first);
+        assert_eq!(std::fs::read_to_string(dir.join("new.json")).unwrap(), "new", "the newer autosave survives");
+        assert_eq!(std::fs::read_to_string(legacy.join("old.json")).unwrap(), "old", "the old one is back in place");
+        assert_eq!(side_leftovers(&local) + side_leftovers(&root.join("roaming")), 0);
+        // The next launch merges them.
+        assert_eq!(adopt_legacy_recovery_waiting(&legacy, &dir, std::time::Duration::ZERO), dir);
+        assert!(dir.join("old.json").is_file() && dir.join("new.json").is_file() && !legacy.exists());
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// A writer that still uses the old path while it is being copied (an older PhotoCraft)
+    /// starts a new folder there; the move removes only the original it held aside.
+    #[test]
+    fn a_write_to_the_old_path_during_a_copy_is_not_removed() {
+        let root = temp("recovery-old-writer");
+        let legacy = root.join("roaming").join("Recovery");
+        autosave(&legacy, "old");
+        let local = root.join("local");
+        std::fs::create_dir_all(&local).unwrap();
+        let dir = local.join("Recovery");
+        let held = hold(&legacy).unwrap();
+        let staged = stage_copy(&held, &dir).unwrap();
+        autosave(&legacy, "new");
+        publish(&staged, &dir).unwrap();
+        std::fs::remove_dir_all(&held).unwrap();
+        assert_eq!(std::fs::read_to_string(dir.join("old.json")).unwrap(), "old");
+        assert_eq!(std::fs::read_to_string(legacy.join("new.json")).unwrap(), "new", "the new write is untouched");
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// What a process killed mid-move left is tidied at the next move: a held original is put
+    /// back (it may be the only copy) and moved, a staged copy is removed; other dot-files and
+    /// look-alike names are not touched.
+    #[test]
+    fn a_killed_move_is_tidied_next_time() {
+        let root = temp("recovery-stale");
+        let roaming = root.join("roaming");
+        let legacy = roaming.join("Recovery");
+        autosave(&legacy, "a");
+        let held = hold(&legacy).unwrap();
+        assert!(!legacy.exists() && held.is_dir());
+        let local = root.join("local");
+        let dir = local.join("Recovery");
+        let stale = local.join(".Recovery.4294967294-3.moving");
+        autosave(&stale, "half");
+        let kept = [local.join(".Recovery.moving"), local.join(".keep.1-x.moving"), local.join("notes.txt")];
+        for k in &kept {
+            std::fs::write(k, b"x").unwrap();
+        }
+        assert_eq!(adopt_legacy_recovery_waiting(&legacy, &dir, std::time::Duration::ZERO), dir);
+        assert_eq!(std::fs::read_to_string(dir.join("a.json")).unwrap(), "a", "the held original was put back and moved");
+        assert!(!stale.exists(), "the stale staged copy is gone");
+        assert_eq!(side_leftovers(&roaming), 0);
+        assert!(kept.iter().all(|k| k.is_file()), "only side names are touched");
+        assert_eq!(side_of(".a.json.12-0.moving", STAGED), Some("a.json"));
+        assert!(side_of("a.json.12-0.moving", STAGED).is_none() && side_of(".a.json.-0.moving", STAGED).is_none());
+        assert!(side_of(".a.json.12-0.held", STAGED).is_none() && side_of(".a.json.12-0.held", HELD) == Some("a.json"));
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// While another process holds the move lock, a launch moves nothing and uses the new folder;
+    /// once the lock is released, the move happens.
+    #[test]
+    fn a_move_waits_for_another_process_holding_the_lock() {
+        let root = temp("recovery-lock");
+        let legacy = root.join("roaming").join("Recovery");
+        autosave(&legacy, "a");
+        let dir = root.join("local").join("Recovery");
+        std::fs::create_dir_all(root.join("local")).unwrap();
+        let held = std::fs::OpenOptions::new().create(true).truncate(false).write(true).open(root.join("local").join(MIGRATION_LOCK)).unwrap();
+        held.lock().unwrap();
+        assert_eq!(adopt_legacy_recovery_waiting(&legacy, &dir, std::time::Duration::ZERO), dir);
+        assert!(legacy.join("a.json").is_file() && !dir.exists(), "nothing moved under another's lock");
+        drop(held);
+        assert_eq!(adopt_legacy_recovery_waiting(&legacy, &dir, std::time::Duration::ZERO), dir);
+        assert!(dir.join("a.json").is_file() && !legacy.exists());
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn no_old_folder_or_the_same_folder_changes_nothing() {
+        let root = temp("recovery-noop");
+        let dir = root.join("Recovery");
+        assert_eq!(adopt_legacy_recovery(&root.join("missing"), &dir), dir);
+        assert!(!dir.exists(), "nothing is created up front");
+        autosave(&dir, "a");
+        assert_eq!(adopt_legacy_recovery(&dir, &dir), dir);
+        assert!(dir.join("a.json").is_file());
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
     #[test]
     fn missing_exe_dir_or_env_never_panics() {
         let d = resolve(|_| None, None);
diff --git a/apps/photocraft/src/control_server.rs b/apps/photocraft/src/control_server.rs
index 258d89e1ec..30ae610b70 100644
--- a/apps/photocraft/src/control_server.rs
+++ b/apps/photocraft/src/control_server.rs
@@ -5,11 +5,12 @@ use std::io::{BufReader, Write};
 use std::net::{TcpListener, TcpStream};
 use std::sync::Arc;
 use std::sync::mpsc::{Receiver, Sender, channel};
-use std::time::Instant;
+use std::time::{Duration, Instant};
 
 use photocraft_automation::budgets::write_reply;
 use photocraft_automation::security::{
-    ConnectionLimiter, LineRead, MAX_CONNECTIONS, MAX_REQUEST_BYTES, authentication_reply, configure_stream, read_bounded_line, repeat_auth_reply,
+    AUTH_DEADLINE, AuthDeadlineStream, ConnectionLimiter, LineRead, MAX_CONNECTIONS, MAX_REQUEST_BYTES, authentication_reply, configure_stream,
+    read_bounded_line, repeat_auth_reply,
 };
 use photocraft_ui_egui::ControlRequest;
 use photocraft_ui_egui::control::REPLY_DEADLINE;
@@ -47,11 +48,17 @@ pub fn start(port: u16, token: String, ctx: egui::Context) -> Receiver<ControlRe
 }
 
 fn serve(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::Context) {
+    serve_with_auth_deadline(stream, token, tx, ctx, AUTH_DEADLINE);
+}
+
+/// [`serve`] for a connection that must complete `auth` within `auth_deadline` of connecting,
+/// however much it sends meanwhile (#4965); after that only the idle timeout applies.
+fn serve_with_auth_deadline(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::Context, auth_deadline: Duration) {
     if configure_stream(&stream).is_err() {
         return;
     }
     let Ok(read) = stream.try_clone() else { return };
-    let mut reader = BufReader::new(read);
+    let mut reader = BufReader::new(AuthDeadlineStream::new(read, auth_deadline));
     let mut out = stream;
     let mut line = String::new();
     let mut authenticated = false;
@@ -74,6 +81,9 @@ fn serve(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::
         if !authenticated {
             let (reply, ok) = authentication_reply(&line, token);
             authenticated = ok;
+            if ok && reader.get_mut().authenticated().is_err() {
+                break;
+            }
             if write_reply(&mut out, &reply).is_err() || out.flush().is_err() || !authenticated {
                 break;
             }
@@ -120,7 +130,34 @@ fn serve(stream: TcpStream, token: &str, tx: Sender<ControlRequest>, ctx: egui::
 mod tests {
     use super::*;
     use std::io::BufRead;
-    use std::time::Duration;
+
+    /// #4965: a connection that keeps sending without authenticating is closed at the deadline
+    /// (releasing its connection permit), and nothing it sent is dispatched.
+    #[test]
+    fn an_unauthenticated_connection_is_closed_at_the_deadline_whatever_it_sends() {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        let (tx, rx) = channel::<ControlRequest>();
+        let server = std::thread::spawn(move || {
+            let (stream, _) = listener.accept().unwrap();
+            let started = Instant::now();
+            serve_with_auth_deadline(stream, "unused", tx, egui::Context::default(), Duration::from_millis(300));
+            started.elapsed()
+        });
+        // Blank lines and partial frames, one byte every 20 ms: each read succeeds long before
+        // the idle timeout.
+        let mut stream = TcpStream::connect(addr).unwrap();
+        for i in 0..150 {
+            let byte: &[u8] = if i % 5 == 0 { b"\n" } else { b" " };
+            if stream.write_all(byte).is_err() {
+                break;
+            }
+            std::thread::sleep(Duration::from_millis(20));
+        }
+        let served = server.join().unwrap();
+        assert!(served < Duration::from_secs(3), "the trickle did not extend the deadline: {served:?}");
+        assert!(rx.try_recv().is_err(), "nothing was dispatched");
+    }
 
     #[test]
     fn oversized_reply_preserves_framing_id_and_the_next_control_request() {
diff --git a/apps/photocraft/src/file_dialog_probe.rs b/apps/photocraft/src/file_dialog_probe.rs
index 9ee14c0afb..eed74a58f2 100644
--- a/apps/photocraft/src/file_dialog_probe.rs
+++ b/apps/photocraft/src/file_dialog_probe.rs
@@ -70,25 +70,61 @@ pub fn start() {
 
 /// Whether the portal's `FileChooser` interface is on the session bus: `Some(false)` only when the
 /// bus or the interface is definitely absent, `None` for anything inconclusive (a slow reply).
+///
+/// Asks the portal object to introspect itself rather than reading the interface's `version`
+/// property: xdg-desktop-portal exports `FileChooser` only when a backend offers it, and without
+/// one a property read fails with `InvalidArgs` ("No such interface"), an error the old check
+/// didn't count as absent (#5739). The interface list answers the question directly.
 #[cfg(target_os = "linux")]
 fn file_chooser_portal() -> Option<bool> {
     let Ok(conn) = zbus::blocking::connection::Builder::session().and_then(|b| b.method_timeout(std::time::Duration::from_secs(5)).build()) else {
         return Some(false);
     };
-    let proxy = zbus::blocking::proxy::Builder::<zbus::blocking::Proxy<'_>>::new(&conn)
-        .destination("org.freedesktop.portal.Desktop")
-        .and_then(|b| b.path("/org/freedesktop/portal/desktop"))
-        .and_then(|b| b.interface("org.freedesktop.portal.FileChooser"))
-        .and_then(|b| b.cache_properties(zbus::proxy::CacheProperties::No).build())
-        .ok()?;
-    match proxy.get_property::<u32>("version") {
-        Ok(_) => Some(true),
-        Err(zbus::Error::MethodError(name, _, _)) => {
-            let name = name.as_str();
-            let absent = ["ServiceUnknown", "UnknownObject", "UnknownInterface", "UnknownProperty"].iter().any(|n| name.ends_with(n));
-            absent.then_some(false)
-        }
-        Err(_) => None,
+    let reply = conn.call_method(
+        Some("org.freedesktop.portal.Desktop"),
+        "/org/freedesktop/portal/desktop",
+        Some("org.freedesktop.DBus.Introspectable"),
+        "Introspect",
+        &(),
+    );
+    match reply {
+        Ok(message) => match message.body().deserialize::<String>() {
+            Ok(xml) => Some(interface_listed(&xml)),
+            Err(_) => None,
+        },
+        Err(e) => classify_error(&e),
+    }
+}
+
+/// Whether introspection XML lists the portal's `FileChooser` interface (not a longer name such as
+/// `FileChooser2`).
+#[cfg(target_os = "linux")]
+fn interface_listed(xml: &str) -> bool {
+    ["\"", "'"].iter().any(|quote| xml.contains(&format!("<interface name={quote}org.freedesktop.portal.FileChooser{quote}")))
+}
+
+/// What a failed call says about the interface: `Some(false)` when the D-Bus error means the
+/// service, object or interface isn't there, `None` for anything else (a timeout, a dropped
+/// connection, an unknown error), which counts as present.
+#[cfg(target_os = "linux")]
+fn classify_error(e: &zbus::Error) -> Option<bool> {
+    use zbus::fdo::Error as Fdo;
+    // Names a bus daemon or portal answers with when the thing asked about is absent.
+    const ABSENT: [&str; 7] = ["ServiceUnknown", "NameHasNoOwner", "UnknownObject", "UnknownInterface", "UnknownMethod", "UnknownProperty", "InvalidArgs"];
+    match e {
+        zbus::Error::FDO(fdo) => matches!(
+            **fdo,
+            Fdo::ServiceUnknown(_)
+                | Fdo::NameHasNoOwner(_)
+                | Fdo::UnknownObject(_)
+                | Fdo::UnknownInterface(_)
+                | Fdo::UnknownMethod(_)
+                | Fdo::UnknownProperty(_)
+                | Fdo::InvalidArgs(_)
+        )
+        .then_some(false),
+        zbus::Error::MethodError(name, _, _) => ABSENT.iter().any(|n| name.as_str().ends_with(n)).then_some(false),
+        _ => None,
     }
 }
 
@@ -126,4 +162,69 @@ mod tests {
         assert!(!on_path("kdialog", &path));
         std::fs::remove_dir_all(&dir).unwrap();
     }
+
+    #[cfg(target_os = "linux")]
+    mod portal {
+        use super::super::*;
+
+        const WITH_FILE_CHOOSER: &str = r#"<!DOCTYPE node PUBLIC "-//freedesktop//DTD D-BUS Object Introspection 1.0//EN" "http://www.freedesktop.org/standards/dbus/introspect.dtd">
+<node>
+  <interface name="org.freedesktop.DBus.Peer"/>
+  <interface name="org.freedesktop.portal.Settings"><property name="version" type="u" access="read"/></interface>
+  <interface name="org.freedesktop.portal.FileChooser">
+    <method name="OpenFile"/>
+  </interface>
+</node>"#;
+        const WITHOUT_FILE_CHOOSER: &str = r#"<node>
+  <interface name="org.freedesktop.DBus.Peer"/>
+  <interface name="org.freedesktop.portal.Settings"/>
+</node>"#;
+
+        fn method_error(name: &'static str) -> zbus::Error {
+            let call = zbus::message::Message::method_call("/a", "M").unwrap().build(&()).unwrap();
+            let reply = zbus::message::Message::error(&call.header(), name).unwrap().build(&"detail").unwrap();
+            zbus::Error::MethodError(name.try_into().unwrap(), Some("detail".into()), reply)
+        }
+
+        #[test]
+        fn the_interface_list_says_whether_a_file_chooser_is_offered() {
+            assert!(interface_listed(WITH_FILE_CHOOSER));
+            assert!(interface_listed("<interface name='org.freedesktop.portal.FileChooser'>"), "single quotes");
+            assert!(!interface_listed(WITHOUT_FILE_CHOOSER), "portal without a backend");
+            assert!(!interface_listed(r#"<interface name="org.freedesktop.portal.FileChooser2">"#), "longer name");
+            assert!(!interface_listed(""));
+        }
+
+        #[test]
+        fn dbus_errors_for_a_missing_interface_mean_absent() {
+            // zbus's fdo proxies hand D-Bus errors back as `Error::FDO`, a plain method call as
+            // `MethodError`; both forms count. The portal answers `InvalidArgs` ("No such interface")
+            // when no backend offers the interface (#5739).
+            for e in [
+                zbus::fdo::Error::InvalidArgs("No such interface".into()),
+                zbus::fdo::Error::UnknownInterface("x".into()),
+                zbus::fdo::Error::ServiceUnknown("x".into()),
+                zbus::fdo::Error::NameHasNoOwner("x".into()),
+                zbus::fdo::Error::UnknownObject("x".into()),
+            ] {
+                let desc = format!("{e:?}");
+                assert_eq!(classify_error(&zbus::Error::FDO(Box::new(e))), Some(false), "{desc}");
+            }
+        }
+
+        #[test]
+        fn method_error_names_still_count_as_absent() {
+            for name in ["org.freedesktop.DBus.Error.ServiceUnknown", "org.freedesktop.DBus.Error.InvalidArgs", "org.freedesktop.DBus.Error.UnknownMethod"] {
+                assert_eq!(classify_error(&method_error(name)), Some(false), "{name}");
+            }
+            assert_eq!(classify_error(&method_error("org.freedesktop.DBus.Error.AccessDenied")), None);
+        }
+
+        #[test]
+        fn inconclusive_errors_are_not_absent() {
+            assert_eq!(classify_error(&zbus::Error::FDO(Box::new(zbus::fdo::Error::NoReply("slow".into())))), None);
+            assert_eq!(classify_error(&zbus::Error::FDO(Box::new(zbus::fdo::Error::Failed("x".into())))), None);
+            assert_eq!(classify_error(&zbus::Error::InputOutput(std::sync::Arc::new(std::io::Error::other("gone")))), None);
+        }
+    }
 }
diff --git a/apps/photocraft/src/gpu_startup.rs b/apps/photocraft/src/gpu_startup.rs
index 66acb9a42f..e79b4bafac 100644
--- a/apps/photocraft/src/gpu_startup.rs
+++ b/apps/photocraft/src/gpu_startup.rs
@@ -443,6 +443,14 @@ pub fn read_display_server(path: Option<&Path>) -> photocraft_engine::prefs::Lin
         .unwrap_or_default()
 }
 
+/// Preferences › Performance › Low-Latency Drawing (`performance.lowLatencyDrawing`, off unless
+/// turned on), read before the window opens: it picks the surface's present mode.
+pub fn read_low_latency(path: Option<&Path>) -> bool {
+    let v: Value = path.and_then(|p| std::fs::read_to_string(p).ok()).and_then(|t| serde_json::from_str(&t).ok()).unwrap_or(Value::Null);
+    let default = photocraft_engine::prefs::Preferences::default().performance.low_latency_drawing;
+    v.get("performance").and_then(|p| p.get("lowLatencyDrawing")).and_then(Value::as_bool).unwrap_or(default)
+}
+
 /// Read the policy leniently at startup, including old settings without renderingMode.
 pub fn read_rendering_prefs(path: Option<&Path>) -> (GpuBackend, RenderingMode) {
     let v: Value = path.and_then(|p| std::fs::read_to_string(p).ok()).and_then(|t| serde_json::from_str(&t).ok()).unwrap_or(Value::Null);
@@ -463,6 +471,23 @@ mod tests {
         Marker { backend: backend.into(), adapter: "Intel(R) UHD Graphics".into(), adapter_backend: adapter_backend.into(), ..Default::default() }
     }
 
+    #[test]
+    fn low_latency_drawing_is_read_before_the_window_opens_and_defaults_off() {
+        let dir = std::env::temp_dir().join(format!("photocraft-low-latency-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let file = dir.join("preferences.json");
+        let read = |json: &str| {
+            std::fs::write(&file, json).unwrap();
+            read_low_latency(Some(&file))
+        };
+        assert!(read(r#"{"performance":{"lowLatencyDrawing":true}}"#));
+        assert!(!read(r#"{"performance":{"lowLatencyDrawing":false}}"#));
+        assert!(!read(r#"{"performance":{"lowLatencyDrawing":"nope"}}"#), "garbage keeps the default (off)");
+        assert!(!read("not json"));
+        assert!(!read_low_latency(None), "no settings file: the default (off)");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     #[test]
     fn display_server_preference_is_read_before_the_window_opens() {
         use photocraft_engine::prefs::LinuxDisplayServer;
diff --git a/apps/photocraft/src/logging.rs b/apps/photocraft/src/logging.rs
index 292428b8ce..33b7df2462 100644
--- a/apps/photocraft/src/logging.rs
+++ b/apps/photocraft/src/logging.rs
@@ -4,7 +4,9 @@
 //! lost device, the crash guard's panic report) vanished. A launch from a desktop menu has no
 //! terminal, so the file is what a bug report can attach: `<settings dir>/logs/photocraft.log`
 //! (see `app_dirs`). Each start moves the previous log to `photocraft.1.log` (and that one to
-//! `.2`), so the log of a run that crashed survives the next launch.
+//! `.2`), so the log of a run that crashed survives the next launch. A start while another
+//! instance is still running leaves that instance's log alone and writes `photocraft-<pid>.log`
+//! (see [`rotate`]).
 //!
 //! Levels: `info` for PhotoCraft's own crates, `warn` for everything else (wgpu and naga are
 //! chatty). `RUST_LOG` replaces that with env_logger-style directives: `debug`,
@@ -15,7 +17,7 @@
 //! written once the file is attached. Writing never panics: a file that can't be created or
 //! written leaves standard error as the only sink.
 
-use std::fs::File;
+use std::fs::{File, OpenOptions, TryLockError};
 use std::io::Write;
 use std::path::{Path, PathBuf};
 use std::sync::{Mutex, OnceLock, PoisonError};
@@ -116,10 +118,76 @@ fn numbered(dir: &Path, n: usize) -> PathBuf {
     if n == 0 { dir.join(LOG_FILE) } else { dir.join(format!("photocraft.{n}.log")) }
 }
 
-/// Shift the previous logs up one (`.log` → `.1.log` → … → `.<KEEP>.log`, the oldest dropped)
-/// and create a fresh, empty log file in `dir` (created if missing).
-pub fn rotate(dir: &Path) -> std::io::Result<(PathBuf, File)> {
+/// Held by the instance that writes [`LOG_FILE`], from its start until it exits. A separate lock
+/// file rather than a lock on the log itself: Windows locks are mandatory, and a locked log could
+/// not be opened for a bug report while the app runs.
+pub const OWNER_LOCK: &str = "photocraft.lock";
+/// Held while one start rotates and prunes the logs, so two starts at once can't interleave.
+pub const ROTATE_LOCK: &str = "rotate.lock";
+
+/// The log of an instance started while another one was writing [`LOG_FILE`].
+fn instance_log(dir: &Path, pid: u32) -> PathBuf {
+    dir.join(format!("photocraft-{pid}.log"))
+}
+
+/// The lock file that marks [`instance_log`] as in use.
+fn instance_lock(dir: &Path, pid: u32) -> PathBuf {
+    dir.join(format!("photocraft-{pid}.lock"))
+}
+
+/// The process id in an [`instance_log`] file name.
+fn instance_pid(name: &str) -> Option<u32> {
+    let digits = name.strip_prefix("photocraft-")?.strip_suffix(".log")?;
+    if digits.is_empty() || !digits.bytes().all(|b| b.is_ascii_digit()) {
+        return None;
+    }
+    digits.parse().ok()
+}
+
+fn open_lock(path: &Path) -> std::io::Result<File> {
+    OpenOptions::new().read(true).write(true).create(true).truncate(false).open(path)
+}
+
+/// Take `file`'s lock without waiting: `Ok(true)` holds it, `Ok(false)` when another process holds it.
+fn try_hold(file: &File) -> std::io::Result<bool> {
+    match file.try_lock() {
+        Ok(()) => Ok(true),
+        Err(TryLockError::WouldBlock) => Ok(false),
+        Err(TryLockError::Error(e)) => Err(e),
+    }
+}
+
+/// Open a fresh, empty log file in `dir` (created if missing).
+///
+/// Normally the previous logs shift up one (`.log` → `.1.log` → … → `.<KEEP>.log`, the oldest
+/// dropped). While another instance is still writing [`LOG_FILE`] (it holds [`OWNER_LOCK`]), the
+/// chain is left alone and this start writes `photocraft-<pid>.log` instead: rotating would move
+/// that instance's live log away and, a few launches later, delete it (#6432). Such side-by-side
+/// logs are pruned to the newest [`KEEP`] once their instances have exited. On a file system
+/// without locks every start rotates, as before.
+pub fn rotate(dir: &Path) -> std::io::Result<LogFile> {
     std::fs::create_dir_all(dir)?;
+    // Waits only for another start's few file operations; without locking support, go on.
+    let guard = open_lock(&dir.join(ROTATE_LOCK)).ok().filter(|g| g.lock().is_ok());
+    let log = rotate_locked(dir);
+    drop(guard);
+    log
+}
+
+fn rotate_locked(dir: &Path) -> std::io::Result<LogFile> {
+    prune_instance_logs(dir);
+    let owner = open_lock(&dir.join(OWNER_LOCK))?;
+    let state = try_hold(&owner);
+    if let Ok(false) = state {
+        let pid = std::process::id();
+        let lock = open_lock(&instance_lock(dir, pid))?;
+        let held = try_hold(&lock).unwrap_or(false);
+        let path = instance_log(dir, pid);
+        let file = File::create(&path)?;
+        return Ok(LogFile { path, file, owner: held.then_some(lock) });
+    }
+    // This start holds the owner lock (or the file system has no locks).
+    let held = state.unwrap_or(false);
     for n in (1..=KEEP).rev() {
         match std::fs::rename(numbered(dir, n - 1), numbered(dir, n)) {
             Err(e) if e.kind() != std::io::ErrorKind::NotFound => return Err(e),
@@ -128,7 +196,40 @@ pub fn rotate(dir: &Path) -> std::io::Result<(PathBuf, File)> {
     }
     let path = numbered(dir, 0);
     let file = File::create(&path)?;
-    Ok((path, file))
+    Ok(LogFile { path, file, owner: held.then_some(owner) })
+}
+
+/// Remove the side-by-side logs of instances that have exited, all but the newest [`KEEP`].
+/// A log whose lock file is held belongs to a running instance and is never touched. Failures
+/// are ignored: pruning only saves disk space.
+fn prune_instance_logs(dir: &Path) {
+    let Ok(entries) = std::fs::read_dir(dir) else { return };
+    let mut finished: Vec<(SystemTime, u32)> = Vec::new();
+    for entry in entries.flatten() {
+        let Some(pid) = entry.file_name().to_str().and_then(instance_pid) else { continue };
+        // A missing lock file means nobody holds it; an unknown lock state counts as running.
+        let running = match OpenOptions::new().read(true).write(true).open(instance_lock(dir, pid)) {
+            Ok(lock) => !try_hold(&lock).unwrap_or(false),
+            Err(_) => false,
+        };
+        if !running {
+            let modified = entry.metadata().and_then(|m| m.modified()).unwrap_or(SystemTime::UNIX_EPOCH);
+            finished.push((modified, pid));
+        }
+    }
+    finished.sort_unstable_by(|a, b| b.cmp(a));
+    for &(_, pid) in finished.iter().skip(KEEP) {
+        let _ = std::fs::remove_file(instance_log(dir, pid));
+        let _ = std::fs::remove_file(instance_lock(dir, pid));
+    }
+}
+
+/// A log file opened by [`rotate`].
+pub struct LogFile {
+    pub path: PathBuf,
+    pub file: File,
+    /// The held lock that marks `path` as in use; `None` where locking isn't supported.
+    owner: Option<File>,
 }
 
 /// One formatted log line: `<timestamp> <LEVEL> [<thread>] <target>: <message>\n`.
@@ -205,17 +306,20 @@ pub struct AppLogger {
     filter: Filter,
     stderr: bool,
     sink: Mutex<Sink>,
+    /// The lock that marks the attached log file as in use (see [`rotate`]); held until exit.
+    owner: Mutex<Option<File>>,
 }
 
 impl AppLogger {
     pub fn new(filter: Filter, stderr: bool) -> AppLogger {
-        AppLogger { filter, stderr, sink: Mutex::new(Sink::new(MAX_FILE_BYTES)) }
+        AppLogger { filter, stderr, sink: Mutex::new(Sink::new(MAX_FILE_BYTES)), owner: Mutex::new(None) }
     }
 
     /// Rotate the logs in `dir` and send records to the fresh file; returns its path.
     pub fn attach_dir(&self, dir: &Path) -> Result<PathBuf, String> {
-        let (path, file) = rotate(dir).map_err(|e| format!("{}: {e}", dir.display()))?;
+        let LogFile { path, file, owner } = rotate(dir).map_err(|e| format!("{}: {e}", dir.display()))?;
         self.sink.lock().unwrap_or_else(PoisonError::into_inner).attach(file);
+        *self.owner.lock().unwrap_or_else(PoisonError::into_inner) = owner;
         Ok(path)
     }
 }
@@ -318,7 +422,7 @@ mod tests {
     fn rotation_keeps_the_previous_logs_and_starts_an_empty_file() {
         let dir = temp_dir("rotate");
         for run in 1..=4 {
-            let (path, _file) = rotate(&dir).expect("rotate");
+            let LogFile { path, file: _file, owner: _owner } = rotate(&dir).expect("rotate");
             assert_eq!(path, dir.join(LOG_FILE));
             assert_eq!(std::fs::read_to_string(&path).expect("read"), "");
             std::fs::write(&path, format!("run {run}")).expect("write");
@@ -330,6 +434,64 @@ mod tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 
+    /// #6432: a second launch moved the running instance's live log to `.1.log`, a third to
+    /// `.2.log`, and a fourth deleted it.
+    #[test]
+    fn a_second_start_leaves_the_running_instance_log_alone() {
+        let dir = temp_dir("second");
+        let mut first = rotate(&dir).expect("first start");
+        assert_eq!(first.path, dir.join(LOG_FILE));
+        first.file.write_all(b"first, before\n").expect("write");
+        for _ in 0..KEEP + 1 {
+            let second = rotate(&dir).expect("second start");
+            assert_eq!(second.path, instance_log(&dir, std::process::id()));
+            assert_eq!(read(&second.path), "");
+        }
+        first.file.write_all(b"first, after\n").expect("write");
+        assert_eq!(read(&dir.join(LOG_FILE)), "first, before\nfirst, after\n");
+        assert!(!dir.join("photocraft.1.log").exists(), "the running instance's log was rotated");
+        // Once the first instance is gone, the next start rotates as before.
+        drop(first);
+        let third = rotate(&dir).expect("third start");
+        assert_eq!(third.path, dir.join(LOG_FILE));
+        assert_eq!(read(&dir.join("photocraft.1.log")), "first, before\nfirst, after\n");
+        drop(third);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn instance_logs_are_pruned_only_when_no_one_holds_them() {
+        let dir = temp_dir("prune");
+        let first = rotate(&dir).expect("first start");
+        // Earlier side-by-side runs that have exited, oldest first; the oldest has no lock file
+        // (as if its lock file had been removed), the others an unlocked one.
+        let now = SystemTime::now();
+        for (age, pid) in [(400u64, 1u32), (300, 2), (200, 3), (100, 4)] {
+            let path = instance_log(&dir, pid);
+            std::fs::write(&path, format!("run {pid}")).expect("write");
+            File::options().write(true).open(&path).expect("open").set_modified(now - Duration::from_secs(age)).expect("mtime");
+            if pid != 1 {
+                std::fs::write(instance_lock(&dir, pid), "").expect("lock file");
+            }
+        }
+        // One older still running: its log is never removed, however old.
+        let live = instance_log(&dir, 5);
+        std::fs::write(&live, "live").expect("write");
+        File::options().write(true).open(&live).expect("open").set_modified(now - Duration::from_secs(900)).expect("mtime");
+        let held = File::create(instance_lock(&dir, 5)).expect("lock file");
+        held.try_lock().expect("hold");
+
+        let second = rotate(&dir).expect("second start");
+        assert_eq!(second.path, instance_log(&dir, std::process::id()));
+        // The newest KEEP finished ones stay, the rest go with their lock files.
+        assert!(instance_log(&dir, 4).exists() && instance_log(&dir, 3).exists());
+        assert!(!instance_log(&dir, 2).exists() && !instance_log(&dir, 1).exists());
+        assert!(!instance_lock(&dir, 2).exists());
+        assert_eq!(read(&live), "live");
+        drop((first, second, held));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     #[test]
     fn rotation_into_an_unusable_directory_is_an_error_not_a_panic() {
         let dir = temp_dir("blocked");
@@ -355,7 +517,7 @@ mod tests {
     #[test]
     fn lines_logged_before_the_file_exists_are_written_when_it_is_attached() {
         let dir = temp_dir("pending");
-        let (path, file) = rotate(&dir).expect("rotate");
+        let LogFile { path, file, .. } = rotate(&dir).expect("rotate");
         let mut sink = Sink::new(MAX_FILE_BYTES);
         sink.write("early 1\n");
         sink.write("early 2\n");
@@ -368,7 +530,7 @@ mod tests {
     #[test]
     fn the_pending_buffer_is_bounded_and_says_how_much_it_dropped() {
         let dir = temp_dir("bounded");
-        let (path, file) = rotate(&dir).expect("rotate");
+        let LogFile { path, file, .. } = rotate(&dir).expect("rotate");
         let mut sink = Sink::new(MAX_FILE_BYTES);
         for i in 0..MAX_PENDING + 5 {
             sink.write(&format!("line {i}\n"));
@@ -384,7 +546,7 @@ mod tests {
     #[test]
     fn the_file_stops_at_its_size_cap_with_one_note() {
         let dir = temp_dir("cap");
-        let (path, file) = rotate(&dir).expect("rotate");
+        let LogFile { path, file, .. } = rotate(&dir).expect("rotate");
         let mut sink = Sink::new(100);
         sink.attach(file);
         for i in 0..50 {
diff --git a/apps/photocraft/src/main.rs b/apps/photocraft/src/main.rs
index de1155edbd..05355e55bf 100644
--- a/apps/photocraft/src/main.rs
+++ b/apps/photocraft/src/main.rs
@@ -1,8 +1,23 @@
-//! Photocraft desktop app.
+//! PhotoCraft desktop app.
 //!
 //! Usage: `photocraft [--control <port>] [--control-token <64-hex> |
 //! --control-token-file <path>] [--automation-read-root <dir>]
-//! [--automation-write-root <dir>] [--safe-gpu] [--in-window-menus] [files…]`
+//! [--automation-write-root <dir>] [--safe-gpu] [--in-window-menus] [--present-mode <mode>]
+//! [--frame-latency <n>] [--stroke-trace <stderr|file.csv>] [--new-instance] [--] [files…]`
+//! (`photocraft --help` prints [`USAGE`]; `--version` prints the version).
+//!
+//! Any other argument starting with `-` is a usage error (exit status 2, issue #6431), so a typo
+//! such as `--safegpu` doesn't open the window and then fail to open the flag as a file. A file
+//! whose name starts with `-` goes after `--`.
+//!
+//! On Windows and Linux a launch hands its files to the PhotoCraft that is already running (new
+//! tabs in its window) and exits; `--new-instance` starts a separate copy instead, as does any
+//! `--control` launch (see `single_instance`).
+//!
+//! `--present-mode` (`fifo`, `autovsync`, `novsync`) and `--frame-latency` (1–3) override how
+//! frames reach the display for this launch (`PHOTOCRAFT_PRESENT_MODE` / `…_FRAME_LATENCY`;
+//! `presentation`); `--stroke-trace` times each brush stroke's frames (`PHOTOCRAFT_STROKE_TRACE`;
+//! `photocraft_ui_egui::stroke_trace`).
 //!
 //! `--safe-gpu` starts with the CPU renderer (no GPU canvas; a software adapter for the window
 //! where the platform has one) for this launch, e.g. after a graphics driver crash. A start that
@@ -44,8 +59,18 @@ mod linux_libs;
 mod logging;
 mod monitor_profile;
 mod photoshop_settings;
+// Save As through the desktop portal, which reports the file type picked (#6121).
+#[cfg(target_os = "linux")]
+mod portal_save;
+mod presentation;
+// The print portal needs the session bus (zbus, Linux only); its pure helpers are tested everywhere.
+#[cfg(any(target_os = "linux", test))]
+mod print_portal;
 mod screen_color;
 mod services;
+// macOS gets one instance from LaunchServices (open-documents Apple events).
+#[cfg(any(not(target_os = "macos"), test))]
+mod single_instance;
 // Windows gets pen pressure from winit (WM_POINTER); the web runner has its own listener.
 #[cfg(any(target_os = "macos", target_os = "linux", test))]
 mod tablet;
@@ -132,21 +157,63 @@ fn parse_control_port(value: &str, source: &str) -> Result<u16, String> {
     value.trim().parse().map_err(|_| format!("{source}: `{value}` is not a valid port (expected a number from 0 to 65535)"))
 }
 
-/// Process exit status for the collected `--control` / `PHOTOCRAFT_CONTROL_PORT` errors: `None`
-/// when there are none, else 2 (a command-line usage error), never 0.
-fn control_args_exit_code(errors: &[String]) -> Option<i32> {
+/// Process exit status for the collected usage errors (a bad `--control` /
+/// `PHOTOCRAFT_CONTROL_PORT`, an unknown option): `None` when there are none, else 2 (a
+/// command-line usage error), never 0.
+fn usage_exit_code(errors: &[String]) -> Option<i32> {
     if errors.is_empty() { None } else { Some(2) }
 }
 
+/// `photocraft --help`. Keep in step with the options `main` accepts and the module docs.
+const USAGE: &str = "\
+Usage: photocraft [options] [--] [files…]
+
+Opens PhotoCraft with the given files.
+
+Options:
+  -h, --help                       Print this help and exit
+      --version                    Print the version, commit and build date and exit
+      --safe-gpu                   Start with the CPU renderer for this launch (after a graphics driver crash)
+      --in-window-menus            macOS: keep the menus inside the window instead of the menu bar
+      --new-instance               Windows and Linux: start a separate PhotoCraft instead of opening
+                                   the files in the one already running
+      --present-mode <mode>        How frames reach the display: fifo, autovsync or novsync
+      --frame-latency <n>          Frames queued for the display: 1 to 3
+      --stroke-trace <stderr|file.csv>
+                                   Time each brush stroke's frames
+      --control <port>             Start the localhost JSON-lines control server on this port
+      --control-token <64-hex>     Control server token (default: a new random one, printed)
+      --control-token-file <path>  Read the control server token from this file, or create it
+                                   with a new one
+      --automation-read-root <dir> Directory the control server may read files from
+      --automation-write-root <dir>
+                                   Directory the control server may write files to
+  --                               Treat every later argument as a file, even one starting with `-`
+
+A bad --present-mode, --frame-latency or --stroke-trace value is reported and ignored.
+Environment: PHOTOCRAFT_CONTROL_PORT, PHOTOCRAFT_CONTROL_TOKEN, PHOTOCRAFT_CONTROL_TOKEN_FILE,
+PHOTOCRAFT_AUTOMATION_READ_ROOT, PHOTOCRAFT_AUTOMATION_WRITE_ROOT, PHOTOCRAFT_PRESENT_MODE,
+PHOTOCRAFT_FRAME_LATENCY, PHOTOCRAFT_STROKE_TRACE, PHOTOCRAFT_IN_WINDOW_MENUS, PHOTOCRAFT_NEW_INSTANCE,
+PHOTOCRAFT_CONFIG_DIR.
+";
+
+/// Print to standard output for `--help` / `--version`. Unlike `println!`, never panics when
+/// stdout is closed or a pipe (`photocraft --help | head -1`).
+fn print_stdout(text: &str) {
+    use std::io::Write as _;
+    let mut out = std::io::stdout().lock();
+    let _ = out.write_all(text.as_bytes()).and_then(|()| out.flush());
+}
+
 #[cfg(test)]
 mod control_port_tests {
-    use super::{control_args_exit_code, parse_control_port};
+    use super::{parse_control_port, usage_exit_code};
 
     #[test]
     fn control_port_errors_exit_non_zero() {
-        assert_eq!(control_args_exit_code(&[]), None);
+        assert_eq!(usage_exit_code(&[]), None);
         let errors = vec![parse_control_port("nope", "--control").unwrap_err()];
-        assert_eq!(control_args_exit_code(&errors), Some(2));
+        assert_eq!(usage_exit_code(&errors), Some(2));
     }
 
     #[test]
@@ -174,11 +241,11 @@ fn main() -> eframe::Result {
     // The system font scan can take seconds (minutes on some Macs): run it off the UI thread.
     photocraft_ui_egui::type_tool::warm_fonts();
     let mut control_port: Option<u16> = None;
-    let mut control_arg_errors: Vec<String> = Vec::new();
+    let mut usage_errors: Vec<String> = Vec::new();
     if let Some(value) = std::env::var("PHOTOCRAFT_CONTROL_PORT").ok().filter(|v| !v.trim().is_empty()) {
         match parse_control_port(&value, "PHOTOCRAFT_CONTROL_PORT") {
             Ok(port) => control_port = Some(port),
-            Err(error) => control_arg_errors.push(error),
+            Err(error) => usage_errors.push(error),
         }
     }
     let mut control_token = None;
@@ -191,45 +258,98 @@ fn main() -> eframe::Result {
     // reported in a notice once the app is up; a control token is a usage error like a bad port.
     let mut unreadable_paths: Vec<String> = Vec::new();
     let mut safe_gpu = false;
+    let mut new_instance = false;
+    // Options that apply only to the process they're given to; a launch with any keeps its own.
+    let mut launch_options: Vec<&'static str> = Vec::new();
+    let (mut present_mode_arg, mut frame_latency_arg, mut stroke_trace_arg): (Option<String>, Option<String>, Option<String>) = (None, None, None);
     let mut in_window_menus = std::env::var_os("PHOTOCRAFT_IN_WINDOW_MENUS").is_some_and(|v| !v.is_empty() && v != "0");
     let mut args = std::env::args_os().skip(1);
+    // After `--`, every argument is a file, even one that starts with `-`.
+    let mut only_files = false;
     while let Some(a) = args.next() {
+        if only_files {
+            match a.into_string() {
+                Ok(s) => files.push(s),
+                Err(raw) => unreadable_paths.push(raw.to_string_lossy().into_owned()),
+            }
+            continue;
+        }
         match a.to_str() {
+            Some("--") => only_files = true,
+            Some("--help" | "-h") => {
+                print_stdout(USAGE);
+                return Ok(());
+            }
             Some("--control") => match args.next() {
                 Some(value) => match parse_control_port(&value.to_string_lossy(), "--control") {
                     Ok(port) => control_port = Some(port),
-                    Err(error) => control_arg_errors.push(error),
+                    Err(error) => usage_errors.push(error),
                 },
-                None => control_arg_errors.push("--control: missing port value (expected `--control <port>`)".to_string()),
+                None => usage_errors.push("--control: missing port value (expected `--control <port>`)".to_string()),
             },
             Some("--control-token") => match args.next().map(std::ffi::OsString::into_string) {
                 Some(Ok(token)) => control_token = Some(token),
-                Some(Err(raw)) => control_arg_errors.push(format!("--control-token: value is not valid Unicode (`{}`)", raw.to_string_lossy())),
+                Some(Err(raw)) => usage_errors.push(format!("--control-token: value is not valid Unicode (`{}`)", raw.to_string_lossy())),
                 None => control_token = None,
             },
             Some("--control-token-file") => control_token_file = args.next().map(std::path::PathBuf::from),
-            Some("--automation-read-root") => automation_read_root = args.next().map(std::path::PathBuf::from),
-            Some("--automation-write-root") => automation_write_root = args.next().map(std::path::PathBuf::from),
-            Some("--safe-gpu") => safe_gpu = true,
-            Some("--in-window-menus") => in_window_menus = true,
+            Some("--automation-read-root") => {
+                launch_options.push("--automation-read-root");
+                automation_read_root = args.next().map(std::path::PathBuf::from);
+            }
+            Some("--automation-write-root") => {
+                launch_options.push("--automation-write-root");
+                automation_write_root = args.next().map(std::path::PathBuf::from);
+            }
+            Some("--safe-gpu") => {
+                launch_options.push("--safe-gpu");
+                safe_gpu = true;
+            }
+            Some(flag @ ("--present-mode" | "--frame-latency" | "--stroke-trace")) => {
+                launch_options.push(match flag {
+                    "--present-mode" => "--present-mode",
+                    "--frame-latency" => "--frame-latency",
+                    _ => "--stroke-trace",
+                });
+                let flag = flag.to_string();
+                match args.next().map(std::ffi::OsString::into_string) {
+                    Some(Ok(v)) => match flag.as_str() {
+                        "--present-mode" => present_mode_arg = Some(v),
+                        "--frame-latency" => frame_latency_arg = Some(v),
+                        _ => stroke_trace_arg = Some(v),
+                    },
+                    // A bad value is reported and ignored; it never fails the launch.
+                    _ => eprintln!("photocraft: {flag}: missing or unreadable value; ignored"),
+                }
+            }
+            Some("--in-window-menus") => {
+                launch_options.push("--in-window-menus");
+                in_window_menus = true;
+            }
+            Some("--new-instance") => new_instance = true,
             Some("--version") => {
-                println!("photocraft {}", photocraft_engine::build_info::long_version());
+                print_stdout(&format!("photocraft {}\n", photocraft_engine::build_info::long_version()));
                 return Ok(());
             }
             // Old macOS passes a process serial number when launched from Finder.
             Some(s) if s.starts_with("-psn_") => {}
+            // A typo such as `--safegpu`, or `--help` spelt another way, must not open the window
+            // and then fail to open the flag as a file (#6431).
+            Some(s) if s.starts_with('-') => usage_errors.push(format!("unknown option `{s}` (put `--` before a file name that starts with `-`)")),
             Some(s) => files.push(s.to_owned()),
             None => unreadable_paths.push(a.to_string_lossy().into_owned()),
         }
     }
 
-    // A malformed control port must not silently drop the control server (issue #701): name the
-    // bad value and fail the launch, like `photocraft-cli serve --port` does for the same typo.
-    // Exit status 2 is the usual command-line usage error, so a launcher sees the failure.
-    if let Some(code) = control_args_exit_code(&control_arg_errors) {
-        for error in &control_arg_errors {
+    // A malformed control port must not silently drop the control server (issue #701), and an
+    // unknown option must not open the window (#6431): name the bad argument and fail the launch,
+    // like `photocraft-cli` does for the same typos. Exit status 2 is the usual command-line usage
+    // error, so a launcher sees the failure.
+    if let Some(code) = usage_exit_code(&usage_errors) {
+        for error in &usage_errors {
             eprintln!("photocraft: {error}");
         }
+        eprintln!("Run `photocraft --help` for usage.");
         std::process::exit(code);
     }
 
@@ -243,6 +363,48 @@ fn main() -> eframe::Result {
         }
     }
 
+    // One PhotoCraft per user (#3708): files opened from Explorer or a file manager while it runs
+    // become tabs in its window. Only with the per-user settings folder (a portable copy's may be
+    // shared between users), and not for automation, `--new-instance` or per-process options.
+    #[cfg(not(target_os = "macos"))]
+    let single_instance = {
+        let new_instance_env = std::env::var("PHOTOCRAFT_NEW_INSTANCE").ok();
+        let context = single_instance::LaunchContext {
+            per_user_settings: app_dirs::current().mode == app_dirs::Mode::Platform,
+            new_instance_flag: new_instance,
+            new_instance_env: new_instance_env.as_deref(),
+            control: control_port.is_some(),
+            unreadable_paths: !unreadable_paths.is_empty(),
+            launch_options: &launch_options,
+        };
+        match (single_instance::skip_reason(&context), services::config_dir()) {
+            (Some(reason), _) => {
+                log::info!("running as a separate PhotoCraft: {reason}");
+                None
+            }
+            (None, None) => None,
+            (None, Some(dir)) => {
+                let paths: Vec<String> = files.iter().map(|f| single_instance::absolute(f)).collect();
+                match single_instance::claim(&dir, &paths) {
+                    single_instance::Launch::Forwarded => {
+                        log::info!("handed {} file(s) to the running PhotoCraft", paths.len());
+                        return Ok(());
+                    }
+                    single_instance::Launch::Primary(primary) => Some(primary),
+                    single_instance::Launch::Standalone(reason) => {
+                        log::warn!("starting a separate PhotoCraft: {reason}");
+                        None
+                    }
+                }
+            }
+        }
+    };
+    // Lives until the event loop returns, then `shutdown` lets the next launch become the primary.
+    #[cfg(not(target_os = "macos"))]
+    let single_instance = &single_instance;
+    #[cfg(target_os = "macos")]
+    let _ = (new_instance, &launch_options);
+
     // The display server to open the window on: Xwayland for a pen on Wayland, which gives this
     // app no pen input (#639).
     #[cfg(target_os = "linux")]
@@ -364,6 +526,21 @@ fn main() -> eframe::Result {
     let gpu_note: std::sync::Arc<std::sync::Mutex<Option<String>>> = Default::default();
     // The adapter's real texture limits (egui asks for 8192 px), so big documents stay on the GPU.
     gpu_startup::configure(&mut options.wgpu_options.wgpu_setup, &plan, os, sentinel.clone(), gpu_note.clone());
+    // Preferences › Performance › Low-Latency Drawing (#1343): without vsync a stroke shows about
+    // 50 ms sooner; wgpu picks Immediate, else Mailbox, else Fifo by what the driver offers.
+    if gpu_startup::read_low_latency(services::prefs_file().as_deref()) {
+        options.wgpu_options.surface.present_mode = eframe::wgpu::PresentMode::AutoNoVsync;
+    }
+    // Testers' present mode and frame latency overrides (#1343), after the preference.
+    let present = presentation::Overrides::from_args_or_env(present_mode_arg.as_deref(), frame_latency_arg.as_deref());
+    options.wgpu_options.surface = present.apply(options.wgpu_options.surface);
+    let present_desc = presentation::describe(&options.wgpu_options.surface, &present);
+    // Without vsync, frames are capped at 240 fps (#4472) so repaint loops don't spin flat out.
+    let uncapped = !matches!(
+        options.wgpu_options.surface.present_mode,
+        eframe::wgpu::PresentMode::Fifo | eframe::wgpu::PresentMode::FifoRelaxed | eframe::wgpu::PresentMode::AutoVsync
+    );
+    log::info!("presentation: {present_desc}");
     let sentinel_ms = t_sentinel.elapsed().as_secs_f64() * 1000.0;
     log::info!("GPU startup: {:?} ({sentinel_ms:.2} ms)", plan);
     let retry_cpu = !safe_gpu && plan.backend != photocraft_engine::prefs::GpuBackend::Cpu;
@@ -391,7 +568,16 @@ fn main() -> eframe::Result {
                         services::xwayland_command(var("FLATPAK_ID").as_deref(), var("APPIMAGE").as_deref(), std::env::var_os("DISPLAY").is_some());
                 }
             }
-            let mut app = PhotocraftApp::new(Session::new(), services);
+            #[cfg(target_os = "linux")]
+            let session = {
+                let mut session = Session::new();
+                session.print_spooler = print_portal::spooler();
+                session
+            };
+            #[cfg(not(target_os = "linux"))]
+            let session = Session::new();
+            let mut app = PhotocraftApp::new(session, services);
+            app.min_frame_ms = uncapped.then_some(1000.0 / 240.0);
             app.integrated_titlebar = cfg!(target_os = "macos");
             app.custom_titlebar = custom_titlebar;
             // Only the title bar's free gap drags the window, never the menus (mac_window.rs).
@@ -423,6 +609,10 @@ fn main() -> eframe::Result {
             // composites on the CPU).
             let info = &mut app.perf.gpu_info;
             info.preference = pref.name().to_string();
+            info.present = present_desc.clone();
+            if let Some(v) = &stroke_trace_arg {
+                app.stroke_trace.set(v);
+            }
             info.selected = if plan.env.is_some() { "env".into() } else { plan.backend.name().to_string() };
             info.fallback = match (plan.reason.clone(), gpu_note.lock().unwrap_or_else(std::sync::PoisonError::into_inner).clone()) {
                 (Some(reason), Some(note)) => Some(format!("{reason}. {note}")),
@@ -485,6 +675,11 @@ fn main() -> eframe::Result {
             }
             #[cfg(not(target_os = "macos"))]
             let _ = in_window_menus;
+            // Files from later launches (Explorer, file managers) open here as new tabs.
+            #[cfg(not(target_os = "macos"))]
+            if let Some(primary) = single_instance {
+                app.services.os_events = Some(primary.connect(&cc.egui_ctx));
+            }
             // Where file drags and drops are (winit 0.30 doesn't say).
             app.services.cursor_pos = cursor::service(cc);
             // The custom title bar's undecorated window must stay borderless, or its caption and
@@ -522,6 +717,13 @@ fn main() -> eframe::Result {
             Ok(Box::new(app))
         }),
     );
+    // The window is gone: refuse further files and free the lock, so a launch that is waiting (or
+    // the CPU-compatibility relaunch below) becomes the primary instead of handing its files to a
+    // process that is exiting.
+    #[cfg(not(target_os = "macos"))]
+    if let Some(primary) = single_instance {
+        primary.shutdown();
+    }
     // Closed or failed outside graphics initialization: not a driver crash. A renderer error
     // keeps the marker, so the next start tries a safer backend, unless there is no safer one:
     // a failed CPU start would otherwise pin every later start to CPU.
diff --git a/apps/photocraft/src/portal_save.rs b/apps/photocraft/src/portal_save.rs
new file mode 100644
index 0000000000..42588e2bc4
--- /dev/null
+++ b/apps/photocraft/src/portal_save.rs
@@ -0,0 +1,183 @@
+//! File › Save As through the XDG desktop portal on Linux (#6121, #4328, #4394).
+//!
+//! The GTK file chooser behind the portal keeps the typed name when the user picks another file
+//! type, and rfd 0.17 reads only the file name from the portal's answer, so `image.psd` with PNG
+//! picked came back as `image.psd` and was written as a PSD. The answer does say which type was
+//! picked (`current_filter`), so Save As asks the portal itself and gives a name the dialog left
+//! alone that type's extension ([`crate::services::with_chosen_type`]). rfd stays the fallback
+//! (zenity, or no portal), and this can go once an rfd release reads the picked type
+//! (PolyMeilex/rfd#341).
+//!
+//! The dialog is attached to the window on X11. On Wayland it has no parent: naming the window to
+//! the portal needs an xdg-foreign handle, which takes `unsafe` code the workspace forbids.
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+
+use zbus::zvariant::{OwnedObjectPath, OwnedValue, Value};
+
+/// One file type in the dialog: its label and extensions (`("PNG", ["png"])`).
+pub type Filter = (String, Vec<String>);
+
+/// A Save dialog to show.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct SaveRequest {
+    /// The portal's parent window identifier (`x11:<xid>`), or empty.
+    pub parent: String,
+    /// The name the dialog shows: the stem of the suggested file (`test`), see
+    /// `services::dialog_file_name`.
+    pub name: Option<String>,
+    /// The suggested file's name (`test.psd`): a name that comes back with its extension still
+    /// takes the extension of the type picked ([`crate::services::with_chosen_type`]).
+    pub suggested: Option<String>,
+    pub folder: Option<PathBuf>,
+    pub filters: Vec<Filter>,
+    /// The filter the dialog starts on.
+    pub current: Option<usize>,
+}
+
+/// What the user chose: the path, as typed, and the label of the file type picked.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Saved {
+    pub path: PathBuf,
+    pub filter: Option<String>,
+}
+
+/// The portal's parent window identifier for `window`: `x11:<xid>` on X11, empty elsewhere.
+pub fn parent_id(window: Option<eframe::wgpu::rwh::RawWindowHandle>) -> String {
+    use eframe::wgpu::rwh::RawWindowHandle;
+    match window {
+        Some(RawWindowHandle::Xlib(h)) => format!("x11:{:x}", h.window),
+        Some(RawWindowHandle::Xcb(h)) => format!("x11:{:x}", h.window.get()),
+        _ => String::new(),
+    }
+}
+
+/// Shows the portal's Save dialog and waits for it. `Ok(None)` is Cancel; `Err` means the portal
+/// couldn't show it (no portal, no FileChooser), so the caller falls back to rfd.
+pub fn save_file(conn: &zbus::blocking::Connection, req: &SaveRequest) -> Result<Option<Saved>, String> {
+    use futures_lite::StreamExt;
+    use zbus::blocking::Proxy;
+    let unique = conn.unique_name().ok_or("Portal connection has no unique name")?.as_str().trim_start_matches(':').replace('.', "_");
+    static NEXT: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(0);
+    let token = format!("photocraft_save_{}_{}", std::process::id(), NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed));
+    let path = format!("/org/freedesktop/portal/desktop/request/{unique}/{token}");
+    // Listen before asking, so a quick answer isn't missed.
+    let request = Proxy::new(conn, "org.freedesktop.portal.Desktop", path.as_str(), "org.freedesktop.portal.Request").map_err(|e| e.to_string())?;
+    let mut replies = futures_lite::future::block_on(request.inner().receive_signal("Response")).map_err(|e| e.to_string())?;
+    let chooser = Proxy::new(conn, "org.freedesktop.portal.Desktop", "/org/freedesktop/portal/desktop", "org.freedesktop.portal.FileChooser")
+        .map_err(|e| e.to_string())?;
+    let handle: OwnedObjectPath = chooser.call("SaveFile", &(req.parent.as_str(), "Save As", options(req, &token))).map_err(|e| e.to_string())?;
+    // A portal older than 0.9 ignores `handle_token` and answers on a request path of its own,
+    // which it returns: listen there instead, as the Request documentation asks.
+    let reply = if handle.as_str() == path {
+        futures_lite::future::block_on(replies.next())
+    } else {
+        let request = Proxy::new(conn, "org.freedesktop.portal.Desktop", handle.as_str(), "org.freedesktop.portal.Request").map_err(|e| e.to_string())?;
+        let mut replies = futures_lite::future::block_on(request.inner().receive_signal("Response")).map_err(|e| e.to_string())?;
+        futures_lite::future::block_on(replies.next())
+    }
+    .ok_or("The save dialog closed without an answer")?;
+    let (code, results): (u32, HashMap<String, OwnedValue>) = reply.body().deserialize().map_err(|e| e.to_string())?;
+    answer(code, &results)
+}
+
+/// The `SaveFile` options for `req`.
+fn options<'a>(req: &'a SaveRequest, token: &'a str) -> HashMap<&'static str, Value<'a>> {
+    let mut o: HashMap<&'static str, Value<'a>> = HashMap::from([("handle_token", Value::from(token)), ("modal", Value::from(true))]);
+    if let Some(name) = &req.name {
+        o.insert("current_name", Value::from(name.as_str()));
+    }
+    if let Some(folder) = &req.folder {
+        // A byte string with its terminating NUL, as the portal specifies.
+        use std::os::unix::ffi::OsStrExt;
+        let mut bytes = folder.as_os_str().as_bytes().to_vec();
+        bytes.push(0);
+        o.insert("current_folder", Value::from(bytes));
+    }
+    let wire = |(label, exts): &Filter| (label.clone(), exts.iter().map(|e| (0u32, format!("*.{e}"))).collect::<Vec<_>>());
+    if !req.filters.is_empty() {
+        o.insert("filters", Value::from(req.filters.iter().map(wire).collect::<Vec<_>>()));
+    }
+    if let Some(f) = req.current.and_then(|i| req.filters.get(i)) {
+        o.insert("current_filter", Value::from(wire(f)));
+    }
+    o
+}
+
+/// Reads the portal's `Response`: code 0 with the first `uris` entry. 1 is Cancel, and 2 a dialog
+/// closed some other way, such as with Esc in GNOME's: no file either, and not a reason to show
+/// rfd's dialog instead (it did, so Esc opened a second Save As).
+fn answer(code: u32, results: &HashMap<String, OwnedValue>) -> Result<Option<Saved>, String> {
+    match code {
+        0 => {}
+        1 | 2 => return Ok(None),
+        _ => return Err(format!("the save dialog failed (portal response {code})")),
+    }
+    let uris: Vec<String> = results
+        .get("uris")
+        .ok_or("no file in the portal's answer")?
+        .try_clone()
+        .map_err(|e| e.to_string())?
+        .try_into()
+        .map_err(|e: zbus::zvariant::Error| e.to_string())?;
+    let uri = uris.first().ok_or("no file in the portal's answer")?;
+    let path = file_uri_path(uri).ok_or_else(|| format!("not a local file: {uri}"))?;
+    let filter = results.get("current_filter").and_then(|v| {
+        let (label, _globs): (String, Vec<(u32, String)>) = v.try_clone().ok()?.try_into().ok()?;
+        Some(label)
+    });
+    Ok(Some(Saved { path, filter }))
+}
+
+/// `file:///home/me/A%20b.psd` → `/home/me/A b.psd`; `None` for other schemes.
+fn file_uri_path(uri: &str) -> Option<PathBuf> {
+    let rest = uri.strip_prefix("file://")?;
+    // Only local files: `file:///…` or `file://localhost/…`.
+    let rest = rest.strip_prefix("localhost").unwrap_or(rest);
+    if !rest.starts_with('/') {
+        return None;
+    }
+    let bytes = rest.as_bytes();
+    let mut out = Vec::with_capacity(bytes.len());
+    let mut i = 0;
+    while i < bytes.len() {
+        if bytes[i] == b'%'
+            && let Some(b) = bytes.get(i + 1..i + 3).and_then(|h| std::str::from_utf8(h).ok()).and_then(|h| u8::from_str_radix(h, 16).ok())
+        {
+            out.push(b);
+            i += 3;
+        } else {
+            out.push(bytes[i]);
+            i += 1;
+        }
+    }
+    use std::os::unix::ffi::OsStringExt;
+    Some(PathBuf::from(std::ffi::OsString::from_vec(out)))
+}
+
+/// Save As on Linux: the portal's dialog, with the name given the extension of the file type
+/// picked. When that changes the name to one that already exists, the dialog opens again under
+/// the new name, so the portal asks before replacing it (it asked only about the typed name).
+pub fn save_as(conn: &zbus::blocking::Connection, mut req: SaveRequest) -> Result<Option<PathBuf>, String> {
+    loop {
+        let Some(saved) = save_file(conn, &req)? else { return Ok(None) };
+        let picked = saved.filter.as_deref().and_then(|label| req.filters.iter().position(|(l, _)| l == label));
+        // With one type offered there is nothing to pick, and a typed extension is the user's.
+        let exts: &[String] = match picked {
+            Some(i) if req.filters.len() > 1 => &req.filters[i].1,
+            _ => &[],
+        };
+        let path = crate::services::with_chosen_type(&saved.path, req.suggested.as_deref(), exts);
+        if path == saved.path || !path.exists() {
+            return Ok(Some(path));
+        }
+        req.name = path.file_name().map(|n| n.to_string_lossy().into_owned());
+        req.suggested = req.name.clone();
+        req.folder = path.parent().map(Path::to_path_buf);
+        req.current = picked;
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/apps/photocraft/src/portal_save/tests.rs b/apps/photocraft/src/portal_save/tests.rs
new file mode 100644
index 0000000000..ed44a10d9c
--- /dev/null
+++ b/apps/photocraft/src/portal_save/tests.rs
@@ -0,0 +1,232 @@
+use super::*;
+use std::sync::{Arc, Mutex};
+
+#[test]
+fn file_uris_become_local_paths() {
+    assert_eq!(file_uri_path("file:///home/me/Untitled-1.psd"), Some(PathBuf::from("/home/me/Untitled-1.psd")));
+    assert_eq!(file_uri_path("file:///home/me/A%20b%C3%A9.png"), Some(PathBuf::from("/home/me/A bé.png")));
+    assert_eq!(file_uri_path("file://localhost/tmp/x.png"), Some(PathBuf::from("/tmp/x.png")));
+    assert_eq!(file_uri_path("sftp://host/x.png"), None);
+    assert_eq!(file_uri_path("file://host/x.png"), None);
+}
+
+#[test]
+fn x11_windows_are_named_to_the_portal() {
+    use eframe::wgpu::rwh::{RawWindowHandle, XlibWindowHandle};
+    assert_eq!(parent_id(Some(RawWindowHandle::Xlib(XlibWindowHandle::new(0x3a0000f)))), "x11:3a0000f");
+    assert_eq!(parent_id(None), "");
+}
+
+/// What the mock portal answers to one `SaveFile` call: the response code, and the file and
+/// filter label the user "picked".
+type Script = Vec<(u32, Option<(&'static str, &'static str)>)>;
+
+/// The options of each `SaveFile` call the mock portal received: current_name and the label of
+/// current_filter.
+type Seen = Arc<Mutex<Vec<(Option<String>, Option<String>)>>>;
+
+/// A private session bus (`dbus-daemon`) with a mock `org.freedesktop.portal.FileChooser` that
+/// answers `SaveFile` from `script`. `None` when there is no `dbus-daemon` to run.
+fn mock_portal(script: Script) -> Option<(zbus::blocking::Connection, Seen, std::process::Child)> {
+    mock_portal_with(script, false)
+}
+
+/// [`mock_portal`]; with `own_paths` it is a portal older than 0.9, which ignores `handle_token`,
+/// answers on a request path of its own and returns that from `SaveFile`, as a real dialog does
+/// once the user is done with it (here after 300 ms).
+fn mock_portal_with(script: Script, own_paths: bool) -> Option<(zbus::blocking::Connection, Seen, std::process::Child)> {
+    use std::io::BufRead;
+    let mut daemon =
+        std::process::Command::new("dbus-daemon").args(["--session", "--nofork", "--print-address=1"]).stdout(std::process::Stdio::piped()).spawn().ok()?;
+    let mut address = String::new();
+    std::io::BufReader::new(daemon.stdout.take()?).read_line(&mut address).ok()?;
+    let address = address.trim().to_string();
+    let server = zbus::blocking::connection::Builder::address(address.as_str()).unwrap().name("org.freedesktop.portal.Desktop").unwrap().build().unwrap();
+    let seen: Seen = Arc::default();
+    let log = seen.clone();
+    std::thread::spawn(move || {
+        let mut script = script.into_iter();
+        for msg in zbus::blocking::MessageIterator::from(&server) {
+            let Ok(msg) = msg else { break };
+            let header = msg.header();
+            if header.message_type() != zbus::message::Type::MethodCall || header.member().map(|m| m.as_str()) != Some("SaveFile") {
+                continue;
+            }
+            let (_parent, _title, options): (String, String, HashMap<String, OwnedValue>) = msg.body().deserialize().unwrap();
+            let text = |key: &str| options.get(key).and_then(|v| String::try_from(v.try_clone().ok()?).ok());
+            let filter = options.get("current_filter").and_then(|v| {
+                let (label, _): (String, Vec<(u32, String)>) = v.try_clone().ok()?.try_into().ok()?;
+                Some(label)
+            });
+            log.lock().unwrap().push((text("current_name"), filter));
+            let sender = header.sender().unwrap().as_str().trim_start_matches(':').replace('.', "_");
+            let token = if own_paths { format!("old{}", log.lock().unwrap().len()) } else { text("handle_token").unwrap() };
+            let path = format!("/org/freedesktop/portal/desktop/request/{sender}/{token}");
+            server.reply(&header, &OwnedObjectPath::try_from(path.as_str()).unwrap()).unwrap();
+            if own_paths {
+                std::thread::sleep(std::time::Duration::from_millis(300));
+            }
+            let (code, pick) = script.next().unwrap_or((2, None));
+            let mut results: HashMap<&str, Value<'_>> = HashMap::new();
+            if let Some((uri, label)) = pick {
+                results.insert("uris", Value::from(vec![uri.to_string()]));
+                results.insert("current_filter", Value::from((label.to_string(), vec![(0u32, "*.x".to_string())])));
+            }
+            server
+                .emit_signal(
+                    header.sender().cloned().map(zbus::names::BusName::from),
+                    path.as_str(),
+                    "org.freedesktop.portal.Request",
+                    "Response",
+                    &(code, results),
+                )
+                .unwrap();
+        }
+    });
+    let client = zbus::blocking::connection::Builder::address(address.as_str()).unwrap().build().unwrap();
+    Some((client, seen, daemon))
+}
+
+fn request(name: &str) -> SaveRequest {
+    let filters = [("PSD Document", &["psd", "psb"][..]), ("PNG", &["png"]), ("JPEG", &["jpg"])];
+    SaveRequest {
+        parent: String::new(),
+        name: Some(name.into()),
+        suggested: Some(name.into()),
+        folder: Some(PathBuf::from("/tmp")),
+        filters: filters.iter().map(|(l, e)| (l.to_string(), e.iter().map(|s| s.to_string()).collect())).collect(),
+        current: Some(0),
+    }
+}
+
+/// #6121 end to end through a real D-Bus: the name comes back as typed with the type picked,
+/// and Save As writes it with that type's extension.
+#[test]
+fn save_as_follows_the_file_type_picked_in_the_portal_dialog() {
+    let dir = std::env::temp_dir().join(format!("photocraft-portal-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let typed = format!("file://{}/Untitled-1.psd", dir.display());
+    let typed: &'static str = Box::leak(typed.into_boxed_str());
+    let Some((conn, seen, mut daemon)) = mock_portal(vec![(0, Some((typed, "PNG"))), (1, None), (0, Some((typed, "PSD Document")))]) else {
+        eprintln!("no dbus-daemon: skipped");
+        return;
+    };
+    // PNG picked with `Untitled-1.psd` still in the name: written as Untitled-1.png.
+    assert_eq!(save_as(&conn, request("Untitled-1.psd")).unwrap(), Some(dir.join("Untitled-1.png")));
+    assert_eq!(seen.lock().unwrap()[0], (Some("Untitled-1.psd".into()), Some("PSD Document".into())), "the request carried the name and type");
+    // Cancel.
+    assert_eq!(save_as(&conn, request("Untitled-1.psd")).unwrap(), None);
+    // The type the name already has: unchanged.
+    assert_eq!(save_as(&conn, request("Untitled-1.psd")).unwrap(), Some(dir.join("Untitled-1.psd")));
+    daemon.kill().ok();
+    std::fs::remove_dir_all(&dir).ok();
+}
+
+/// The dialog opens on the bare name (`test`, see `services::dialog_file_name`), so GTK doesn't
+/// ask to replace test.psd when PNG is picked: the type picked gives the extension, and a name
+/// that then exists is asked about under that name.
+#[test]
+fn a_bare_name_takes_the_picked_type_and_an_existing_target_is_asked_about() {
+    let dir = std::env::temp_dir().join(format!("photocraft-portal-bare-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("test.psd"), b"open document").unwrap();
+    let uri = |name: &str| -> &'static str { Box::leak(format!("file://{}/{name}", dir.display()).into_boxed_str()) };
+    let Some((conn, seen, mut daemon)) = mock_portal(vec![
+        (0, Some((uri("test"), "PNG"))),
+        (0, Some((uri("test.psd"), "PNG"))),
+        (0, Some((uri("test"), "PSD Document"))),
+        (0, Some((uri("test.psd"), "PSD Document"))),
+    ]) else {
+        eprintln!("no dbus-daemon: skipped");
+        return;
+    };
+    // As File › Save As opens it: `test` shown, `test.psd` suggested.
+    let opened = || SaveRequest { suggested: Some("test.psd".into()), ..request("test") };
+    // PNG picked: test.png, and nothing was asked about test.psd.
+    assert_eq!(save_as(&conn, opened()).unwrap(), Some(dir.join("test.png")));
+    // The suggested extension back in the name (typed again, or GTK's completion) with PNG
+    // picked: test.png too, not a PSD written over test.psd.
+    assert_eq!(save_as(&conn, opened()).unwrap(), Some(dir.join("test.png")));
+    // The type untouched: test.psd, which exists, so the dialog asks again as test.psd (the
+    // portal's replace prompt is then about the file that is written).
+    assert_eq!(save_as(&conn, opened()).unwrap(), Some(dir.join("test.psd")));
+    let seen = seen.lock().unwrap().clone();
+    let names: Vec<_> = seen.iter().map(|(name, _)| name.as_deref()).collect();
+    assert_eq!(names, [Some("test"), Some("test"), Some("test"), Some("test.psd")], "{seen:?}");
+    assert_eq!(seen[3].1.as_deref(), Some("PSD Document"));
+    daemon.kill().ok();
+    std::fs::remove_dir_all(&dir).ok();
+}
+
+/// GNOME's dialog closed with Esc answers 2 ("ended some other way"): no file, like Cancel, and
+/// no fallback to rfd, which opened a second Save As.
+#[test]
+fn a_dialog_closed_some_other_way_is_a_cancel() {
+    let Some((conn, _seen, mut daemon)) = mock_portal(vec![(2, None)]) else {
+        eprintln!("no dbus-daemon: skipped");
+        return;
+    };
+    assert_eq!(save_as(&conn, request("test")), Ok(None));
+    daemon.kill().ok();
+}
+
+/// An extension the user typed is theirs: `art.png` with the PSD type left as the dialog opened
+/// saves a PNG, as it did before the type was read.
+#[test]
+fn a_typed_extension_wins_over_an_untouched_file_type() {
+    let typed: &'static str = "file:///tmp/photocraft-none/art.png";
+    let Some((conn, _seen, mut daemon)) = mock_portal(vec![(0, Some((typed, "PSD Document")))]) else {
+        eprintln!("no dbus-daemon: skipped");
+        return;
+    };
+    assert_eq!(save_as(&conn, request("Untitled-1.psd")).unwrap(), Some(PathBuf::from("/tmp/photocraft-none/art.png")));
+    daemon.kill().ok();
+}
+
+/// A portal older than 0.9 answers on a request path of its own: the wait follows the handle
+/// `SaveFile` returns, as the Request documentation asks, instead of the predicted path.
+#[test]
+fn the_answer_is_awaited_on_the_handle_the_portal_returns() {
+    let typed: &'static str = "file:///tmp/photocraft-none/Untitled-1.psd";
+    let Some((conn, _seen, mut daemon)) = mock_portal_with(vec![(0, Some((typed, "PNG")))], true) else {
+        eprintln!("no dbus-daemon: skipped");
+        return;
+    };
+    assert_eq!(save_as(&conn, request("Untitled-1.psd")).unwrap(), Some(PathBuf::from("/tmp/photocraft-none/Untitled-1.png")));
+    daemon.kill().ok();
+}
+
+/// When the extension the type gives names a file that exists, the dialog opens again under that
+/// name (so the portal asks before replacing it) instead of overwriting it unasked.
+#[test]
+fn a_renamed_file_that_exists_is_confirmed_in_the_dialog() {
+    let dir = std::env::temp_dir().join(format!("photocraft-portal-exists-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(dir.join("art.png"), b"old").unwrap();
+    let typed: &'static str = Box::leak(format!("file://{}/art.psd", dir.display()).into_boxed_str());
+    let confirmed: &'static str = Box::leak(format!("file://{}/art.png", dir.display()).into_boxed_str());
+    let Some((conn, seen, mut daemon)) = mock_portal(vec![(0, Some((typed, "PNG"))), (0, Some((confirmed, "PNG")))]) else {
+        eprintln!("no dbus-daemon: skipped");
+        return;
+    };
+    assert_eq!(save_as(&conn, request("art.psd")).unwrap(), Some(dir.join("art.png")));
+    let seen = seen.lock().unwrap().clone();
+    assert_eq!(seen.len(), 2, "asked again: {seen:?}");
+    assert_eq!(seen[1], (Some("art.png".into()), Some("PNG".into())), "under the new name, on the picked type");
+    assert_eq!(std::fs::read(dir.join("art.png")).unwrap(), b"old", "nothing written by the dialog");
+    daemon.kill().ok();
+    std::fs::remove_dir_all(&dir).ok();
+}
+
+/// With only one type offered (the Swatches panel's .aco) a typed extension is kept.
+#[test]
+fn a_single_file_type_keeps_the_typed_extension() {
+    let typed: &'static str = "file:///tmp/photocraft-none/Swatches.ase";
+    let Some((conn, _seen, mut daemon)) = mock_portal(vec![(0, Some((typed, "Color Swatches")))]) else {
+        eprintln!("no dbus-daemon: skipped");
+        return;
+    };
+    let req = SaveRequest { filters: vec![("Color Swatches".into(), vec!["aco".into()])], ..request("Swatches.aco") };
+    assert_eq!(save_as(&conn, req).unwrap(), Some(PathBuf::from("/tmp/photocraft-none/Swatches.ase")));
+    daemon.kill().ok();
+}
diff --git a/apps/photocraft/src/presentation.rs b/apps/photocraft/src/presentation.rs
new file mode 100644
index 0000000000..c6f7e4196a
--- /dev/null
+++ b/apps/photocraft/src/presentation.rs
@@ -0,0 +1,121 @@
+//! Launch overrides for how frames reach the display, so testers can compare input-to-pixel
+//! latency without a rebuild (#1343): `PHOTOCRAFT_PRESENT_MODE` (`fifo`, `autovsync`, or `novsync`,
+//! also spelled `immediate`, `mailbox` or `autonovsync`: no vsync, wgpu's Immediate → Mailbox → Fifo
+//! by what the driver offers) and `PHOTOCRAFT_FRAME_LATENCY` (`1` to `3`, frames the swap chain may
+//! queue). Unset, the platform default applies. A value that isn't one of these is ignored with a
+//! warning in the log, never a failed start; a mode the driver may not offer is never requested.
+//! The result is logged at start and shown in the stroke trace.
+
+use eframe::egui_wgpu::SurfaceConfig;
+use eframe::wgpu::PresentMode;
+
+/// The present mode and frame latency this launch asked for (`None`: the default).
+#[derive(Clone, Copy, Debug, Default, PartialEq)]
+pub struct Overrides {
+    pub mode: Option<PresentMode>,
+    pub latency: Option<u32>,
+}
+
+/// Parse the two variables' values. Returns the overrides and a warning per rejected value.
+pub fn parse(mode: Option<&str>, latency: Option<&str>) -> (Overrides, Vec<String>) {
+    let mut warnings = Vec::new();
+    let mode = mode.map(str::trim).filter(|v| !v.is_empty()).and_then(|v| {
+        let m = match v.to_ascii_lowercase().as_str() {
+            // Only modes every surface takes: wgpu crashes on an explicit Immediate, Mailbox or
+            // FifoRelaxed the driver doesn't offer (X11/NVIDIA has no Mailbox, #1343). Without
+            // vsync, wgpu picks Immediate, else Mailbox, else Fifo.
+            "fifo" | "vsync" => PresentMode::Fifo,
+            "autovsync" => PresentMode::AutoVsync,
+            "novsync" | "immediate" | "mailbox" | "autonovsync" => PresentMode::AutoNoVsync,
+            _ => {
+                warnings.push(format!("PHOTOCRAFT_PRESENT_MODE={v:?} isn't fifo, autovsync or novsync (immediate, mailbox); ignored"));
+                return None;
+            }
+        };
+        Some(m)
+    });
+    let latency = latency.map(str::trim).filter(|v| !v.is_empty()).and_then(|v| match v.parse::<u32>() {
+        Ok(n @ 1..=3) => Some(n),
+        _ => {
+            warnings.push(format!("PHOTOCRAFT_FRAME_LATENCY={v:?} isn't 1, 2 or 3; ignored"));
+            None
+        }
+    });
+    (Overrides { mode, latency }, warnings)
+}
+
+impl Overrides {
+    /// `--present-mode` / `--frame-latency` when given, else `PHOTOCRAFT_PRESENT_MODE` /
+    /// `PHOTOCRAFT_FRAME_LATENCY`; rejected values are logged.
+    pub fn from_args_or_env(mode: Option<&str>, latency: Option<&str>) -> Self {
+        let env_mode = std::env::var("PHOTOCRAFT_PRESENT_MODE").ok();
+        let env_latency = std::env::var("PHOTOCRAFT_FRAME_LATENCY").ok();
+        let (o, warnings) = parse(mode.or(env_mode.as_deref()), latency.or(env_latency.as_deref()));
+        for w in warnings {
+            log::warn!("{w}");
+        }
+        o
+    }
+
+    /// `surface` with the overrides applied.
+    pub fn apply(&self, surface: SurfaceConfig) -> SurfaceConfig {
+        SurfaceConfig {
+            present_mode: self.mode.unwrap_or(surface.present_mode),
+            desired_maximum_frame_latency: self.latency.or(surface.desired_maximum_frame_latency),
+        }
+    }
+}
+
+/// How `surface` presents, for the stroke trace and System Info: "fifo, latency 2", with
+/// "(override)" after a value an environment variable set. wgpu's GL backend ignores the latency.
+pub fn describe(surface: &SurfaceConfig, overrides: &Overrides) -> String {
+    let mode = match surface.present_mode {
+        PresentMode::AutoVsync => "autovsync",
+        PresentMode::AutoNoVsync => "autonovsync",
+        PresentMode::Fifo => "fifo",
+        PresentMode::FifoRelaxed => "fiforelaxed",
+        PresentMode::Immediate => "immediate",
+        PresentMode::Mailbox => "mailbox",
+    };
+    let latency = surface.desired_maximum_frame_latency.map_or("default".to_string(), |n| n.to_string());
+    let tag = |set: bool| if set { " (override)" } else { "" };
+    format!("{mode}{}, latency {latency}{}", tag(overrides.mode.is_some()), tag(overrides.latency.is_some()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn values_parse_and_bad_ones_are_ignored_with_a_warning() {
+        assert_eq!(parse(None, None), (Overrides::default(), vec![]));
+        assert_eq!(parse(Some(""), Some(" ")), (Overrides::default(), vec![]));
+        let (o, w) = parse(Some(" Mailbox "), Some("1"));
+        assert_eq!((o.mode, o.latency, w.len()), (Some(PresentMode::AutoNoVsync), Some(1), 0));
+        assert_eq!(parse(Some("vsync"), None).0.mode, Some(PresentMode::Fifo));
+        // Never a mode a driver may lack (wgpu crashes on it): no vsync falls back by support.
+        for v in ["IMMEDIATE", "mailbox", "novsync", "autonovsync"] {
+            assert_eq!(parse(Some(v), None).0.mode, Some(PresentMode::AutoNoVsync), "{v}");
+        }
+        for (mode, latency) in
+            [(Some("fast"), None), (None, Some("0")), (None, Some("4")), (None, Some("-1")), (None, Some("one")), (None, Some("99999999999"))]
+        {
+            let (o, w) = parse(mode, latency);
+            assert_eq!((o, w.len()), (Overrides::default(), 1), "{mode:?} {latency:?}");
+        }
+    }
+
+    #[test]
+    fn overrides_replace_only_what_they_set_and_are_described() {
+        let default = SurfaceConfig::HIGH_THROUGHPUT;
+        assert_eq!(Overrides::default().apply(default), default);
+        let latency_only = Overrides { mode: None, latency: Some(1) };
+        let s = latency_only.apply(default);
+        assert_eq!((s.present_mode, s.desired_maximum_frame_latency), (PresentMode::AutoVsync, Some(1)));
+        assert_eq!(describe(&s, &latency_only), "autovsync, latency 1 (override)");
+        let novsync = Overrides { mode: Some(PresentMode::AutoNoVsync), latency: None };
+        assert_eq!(describe(&novsync.apply(default), &novsync), "autonovsync (override), latency 2");
+        let none = SurfaceConfig { present_mode: PresentMode::Fifo, desired_maximum_frame_latency: None };
+        assert_eq!(describe(&none, &Overrides::default()), "fifo, latency default");
+    }
+}
diff --git a/apps/photocraft/src/print_portal.rs b/apps/photocraft/src/print_portal.rs
new file mode 100644
index 0000000000..0eef02a01c
--- /dev/null
+++ b/apps/photocraft/src/print_portal.rs
@@ -0,0 +1,239 @@
+//! Printing through the XDG Print portal (`org.freedesktop.portal.Print`): the system print
+//! dialog, which a sandboxed app can reach without a CUPS socket. The engine prints over IPP
+//! when it can reach a print server (`photocraft-ipp`); this is its fallback when it cannot, and
+//! the only route with `PHOTOCRAFT_PRINT_PORTAL=1` (`0` disables it). `PreparePrint` shows the
+//! dialog seeded with the job's copies and paper; `Print` hands it the PDF. Both answer through a
+//! `Request` object's `Response` signal, which this module waits for on its own thread so the
+//! window keeps painting while the dialog is open; the outcome goes to the log.
+//! https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.freedesktop.portal.Print.html
+
+#[cfg(target_os = "linux")]
+use photocraft_engine::print_cmds::{PrintJob, Spooler};
+
+/// The spooler to install on the session, unless `PHOTOCRAFT_PRINT_PORTAL=0`. The portal itself
+/// is looked up per job, so a missing one costs nothing at start-up.
+#[cfg(target_os = "linux")]
+pub fn spooler() -> Option<Spooler> {
+    let setting = std::env::var("PHOTOCRAFT_PRINT_PORTAL").ok();
+    if setting.as_deref() == Some("0") {
+        return None;
+    }
+    Some(Spooler { name: "portal", preferred: setting.as_deref() == Some("1"), run: std::sync::Arc::new(print) })
+}
+
+/// Opens the system print dialog for the job and returns as soon as it is up.
+#[cfg(target_os = "linux")]
+fn print(job: &PrintJob) -> Result<String, String> {
+    let conn = zbus::blocking::connection::Builder::session()
+        .and_then(|b| b.method_timeout(std::time::Duration::from_secs(5)).build())
+        .map_err(|e| format!("no session bus for the print portal ({e}); print to PDF instead"))?;
+    let proxy = portal(&conn)?;
+    let version: u32 = proxy.get_property("version").map_err(|e| format!("no print portal on this desktop ({e}); print to PDF instead"))?;
+    // The document goes to a private temporary file (0600, created atomically by `tempfile`),
+    // not a guessable name in a shared /tmp. The guard owns the file: it lives on the portal
+    // thread until the dialog is done, and a failure to start that thread drops it here.
+    let mut file = tempfile::Builder::new().prefix("photocraft-print-").suffix(".pdf").tempfile().map_err(|e| format!("cannot create the print file: {e}"))?;
+    std::io::Write::write_all(&mut file, &job.pdf).map_err(|e| format!("cannot write the print file: {e}"))?;
+    let (title, settings, page_setup) = (job.title.clone(), settings(job), page_setup(job));
+    std::thread::Builder::new()
+        .name("print-portal".into())
+        .spawn(move || {
+            let outcome = dialog(&conn, &title, &settings, &page_setup, file.path());
+            drop(file);
+            match outcome {
+                Ok(what) => log::info!("print portal (v{version}): {what}"),
+                Err(e) => log::warn!("print portal (v{version}): {e}"),
+            }
+        })
+        .map_err(|e| format!("cannot start the print thread: {e}"))?;
+    Ok("the system print dialog".into())
+}
+
+#[cfg(target_os = "linux")]
+fn portal(conn: &zbus::blocking::Connection) -> Result<zbus::blocking::Proxy<'static>, String> {
+    zbus::blocking::Proxy::new(conn, "org.freedesktop.portal.Desktop", "/org/freedesktop/portal/desktop", "org.freedesktop.portal.Print")
+        .map_err(|e| e.to_string())
+}
+
+/// `PreparePrint` then `Print`, each waited for on its request's `Response` signal.
+#[cfg(target_os = "linux")]
+fn dialog(
+    conn: &zbus::blocking::Connection,
+    title: &str,
+    settings: &[(&'static str, Seed)],
+    page_setup: &[(&'static str, Seed)],
+    pdf: &std::path::Path,
+) -> Result<String, String> {
+    use std::collections::HashMap;
+    use zbus::zvariant::{OwnedObjectPath, OwnedValue, Value};
+    type Dict<'a> = HashMap<&'a str, Value<'a>>;
+    fn as_dict(pairs: &[(&'static str, Seed)]) -> Dict<'static> {
+        pairs
+            .iter()
+            .map(|(k, v)| {
+                let value = match v {
+                    Seed::Text(t) => Value::from(t.clone()),
+                    Seed::Mm(mm) => Value::from(*mm),
+                };
+                (*k, value)
+            })
+            .collect()
+    }
+    let proxy = portal(conn)?;
+    let sender = conn.unique_name().map(|n| n.as_str().to_string()).ok_or("the bus connection has no name")?;
+    let wait = |token: &str| -> Result<zbus::blocking::proxy::SignalIterator<'static>, String> {
+        let path = request_path(&sender, token);
+        let request = zbus::blocking::Proxy::new(conn, "org.freedesktop.portal.Desktop", path, "org.freedesktop.portal.Request").map_err(|e| e.to_string())?;
+        request.receive_signal("Response").map_err(|e| e.to_string())
+    };
+    let response = |mut signals: zbus::blocking::proxy::SignalIterator<'static>| -> Result<HashMap<String, OwnedValue>, String> {
+        let message = signals.next().ok_or("the print portal went away")?;
+        let (code, results): (u32, HashMap<String, OwnedValue>) = message.body().deserialize().map_err(|e| format!("odd portal reply: {e}"))?;
+        match code {
+            0 => Ok(results),
+            1 => Err("cancelled in the print dialog".into()),
+            _ => Err("the print dialog failed".into()),
+        }
+    };
+
+    let token = format!("photocraft_prepare_{}", nonce());
+    let signals = wait(&token)?;
+    let mut options: Dict<'_> = HashMap::new();
+    options.insert("handle_token", Value::from(token.as_str()));
+    let _: OwnedObjectPath =
+        proxy.call("PreparePrint", &("", title, as_dict(settings), as_dict(page_setup), options)).map_err(|e| format!("PreparePrint failed: {e}"))?;
+    let results = response(signals)?;
+    let prepared = results.get("token").and_then(|v| u32::try_from(v.clone()).ok()).ok_or("the print dialog gave no token")?;
+
+    let file = std::fs::File::open(pdf).map_err(|e| format!("cannot reopen the print file: {e}"))?;
+    let token = format!("photocraft_print_{}", nonce());
+    let signals = wait(&token)?;
+    let mut options: Dict<'_> = HashMap::new();
+    options.insert("handle_token", Value::from(token.as_str()));
+    options.insert("token", Value::from(prepared));
+    let fd = zbus::zvariant::Fd::from(std::os::fd::AsFd::as_fd(&file));
+    let _: OwnedObjectPath = proxy.call("Print", &("", title, fd, options)).map_err(|e| format!("Print failed: {e}"))?;
+    response(signals)?;
+    Ok("printed through the system print dialog".into())
+}
+
+#[cfg(target_os = "linux")]
+fn nonce() -> u64 {
+    use std::sync::atomic::{AtomicU64, Ordering};
+    static N: AtomicU64 = AtomicU64::new(0);
+    let t = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_nanos() as u64).unwrap_or(0);
+    t ^ N.fetch_add(1, Ordering::Relaxed)
+}
+
+/// The request object the portal answers on: the sender's unique name without its colon and
+/// with dots as underscores, then the handle token.
+fn request_path(unique_name: &str, token: &str) -> String {
+    format!("/org/freedesktop/portal/desktop/request/{}/{token}", unique_name.trim_start_matches(':').replace('.', "_"))
+}
+
+/// A value seeded into the dialog: GtkPrintSettings are strings; a GtkPageSetup's sizes are
+/// doubles in millimetres (`gtk_paper_size_new_from_gvariant` ignores anything else).
+#[derive(Debug, Clone, PartialEq)]
+#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+enum Seed {
+    Text(String),
+    Mm(f64),
+}
+
+fn text(s: &str) -> Seed {
+    Seed::Text(s.to_string())
+}
+
+/// The standard paper sizes, as (PWG name, PPD name, width mm, height mm), portrait. GTK's
+/// print settings take the PWG name; its page setup finds the size by the PPD name.
+const PAPERS: [(&str, &str, f64, f64); 8] = [
+    ("na_letter", "Letter", 215.9, 279.4),
+    ("na_legal", "Legal", 215.9, 355.6),
+    ("na_ledger", "Ledger", 279.4, 431.8),
+    ("iso_a3", "A3", 297.0, 420.0),
+    ("iso_a4", "A4", 210.0, 297.0),
+    ("iso_a5", "A5", 148.0, 210.0),
+    ("na_index-4x6", "4x6", 101.6, 152.4),
+    ("na_5x7", "5x7", 127.0, 177.8),
+];
+
+const MM_PER_PT: f64 = 25.4 / 72.0;
+
+type Paper = (&'static str, &'static str, f64, f64);
+
+/// The job's paper: its row in `PAPERS` when it is a standard size, and the portrait size in
+/// millimetres.
+fn paper(paper_pt: (f64, f64)) -> (Option<&'static Paper>, f64, f64) {
+    let (w, h) = (paper_pt.0.min(paper_pt.1) * MM_PER_PT, paper_pt.0.max(paper_pt.1) * MM_PER_PT);
+    let row = PAPERS.iter().find(|(_, _, pw, ph)| (pw - w).abs() < 1.0 && (ph - h).abs() < 1.0);
+    (row, w, h)
+}
+
+fn orientation(landscape: bool) -> Seed {
+    text(if landscape { "landscape" } else { "portrait" })
+}
+
+/// `PreparePrint`'s settings (GtkPrintSettings keys, string values).
+#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+fn settings_for(copies: u32, paper_pt: (f64, f64), landscape: bool) -> Vec<(&'static str, Seed)> {
+    let (row, w, h) = paper(paper_pt);
+    let mut v = vec![("n-copies", text(&copies.to_string())), ("orientation", orientation(landscape))];
+    match row {
+        Some((pwg, _, _, _)) => v.push(("paper-format", text(pwg))),
+        None => v.extend([("paper-width", text(&format!("{w:.2}"))), ("paper-height", text(&format!("{h:.2}")))]),
+    }
+    v
+}
+
+/// `PreparePrint`'s page setup (GtkPageSetup keys): the size in millimetres, found by its PPD
+/// name when it has one, else a custom size named by its dimensions.
+#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+fn page_setup_for(paper_pt: (f64, f64), landscape: bool) -> Vec<(&'static str, Seed)> {
+    let (row, w, h) = paper(paper_pt);
+    let mut v = vec![("Orientation", orientation(landscape)), ("Width", Seed::Mm(w)), ("Height", Seed::Mm(h))];
+    match row {
+        Some((_, ppd, _, _)) => v.push(("PPDName", text(ppd))),
+        None => v.push(("Name", text(&format!("custom_{w:.0}x{h:.0}mm")))),
+    }
+    v
+}
+
+#[cfg(target_os = "linux")]
+fn settings(job: &PrintJob) -> Vec<(&'static str, Seed)> {
+    settings_for(job.copies, job.paper, job.landscape)
+}
+
+#[cfg(target_os = "linux")]
+fn page_setup(job: &PrintJob) -> Vec<(&'static str, Seed)> {
+    page_setup_for(job.paper, job.landscape)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn request_path_follows_the_portal_rule() {
+        assert_eq!(request_path(":1.42", "photocraft_prepare_7"), "/org/freedesktop/portal/desktop/request/1_42/photocraft_prepare_7");
+    }
+
+    #[test]
+    fn standard_papers_get_their_pwg_and_ppd_names_and_custom_ones_their_size() {
+        // A4 landscape as the engine lays it out: width > height, still A4.
+        let s = settings_for(2, (841.89, 595.28), true);
+        assert_eq!(s, vec![("n-copies", text("2")), ("orientation", text("landscape")), ("paper-format", text("iso_a4"))]);
+        let p = page_setup_for((841.89, 595.28), true);
+        assert_eq!(p[0], ("Orientation", text("landscape")));
+        let Seed::Mm(w) = p[1].1 else { panic!("width is millimetres") };
+        let Seed::Mm(h) = p[2].1 else { panic!("height is millimetres") };
+        assert!((w - 210.0).abs() < 0.01 && (h - 297.0).abs() < 0.01, "{w} x {h}");
+        assert_eq!(p[3], ("PPDName", text("A4")));
+        assert_eq!(settings_for(1, (612.0, 792.0), false)[2], ("paper-format", text("na_letter")));
+        assert_eq!(page_setup_for((612.0, 792.0), false)[3], ("PPDName", text("Letter")));
+        assert_eq!(settings_for(1, (288.0, 432.0), false)[2], ("paper-format", text("na_index-4x6")));
+        // 100 x 200 mm is nobody's standard.
+        let custom = settings_for(1, (283.46, 566.93), false);
+        assert_eq!(&custom[2..], &[("paper-width", text("100.00")), ("paper-height", text("200.00"))]);
+        assert_eq!(page_setup_for((283.46, 566.93), false)[3], ("Name", text("custom_100x200mm")));
+    }
+}
diff --git a/apps/photocraft/src/services.rs b/apps/photocraft/src/services.rs
index 9de1c475ea..d4e7a01553 100644
--- a/apps/photocraft/src/services.rs
+++ b/apps/photocraft/src/services.rs
@@ -95,18 +95,51 @@ fn save_filters(suggested: &str) -> Vec<(String, Vec<String>)> {
     v
 }
 
-/// The name the save dialog starts with. On Windows a visible extension stays put when the user
-/// picks another type (with File name extensions shown, `image.psd` saved as PhotoCraft stayed
-/// `image.psd`, #4394), while a bare name gets the chosen type's extension, so there the dialog
-/// gets the stem and the suggested type (listed first by [`save_filters`]) supplies `.psd`. A
-/// stem that still has a dot (`scan.jpg.psd`: Windows could keep `scan.jpg`) or an upper-case
+/// `path` with the extension of the file type picked in the save dialog (`chosen`), where the
+/// dialog left the name alone (#6121): the format follows the extension, and the GTK file chooser
+/// keeps the typed name when another type is picked. Only a name that still has the extension the
+/// dialog opened with (`opened_with`, `Untitled-1.psd` with PNG picked) or none gets the type's
+/// extension, as PolyMeilex/rfd#341 does. An extension the user typed that PhotoCraft saves
+/// (`art.png` with the PSD type untouched, the way to save a PNG before this) is theirs and stays,
+/// and so does one of the type's own (`.psb` for PSD). One PhotoCraft doesn't save (`scan.2024`)
+/// is part of the name, and the type's extension is added after it.
+#[cfg(any(target_os = "linux", test))]
+pub(crate) fn with_chosen_type(path: &Path, opened_with: Option<&str>, chosen: &[String]) -> PathBuf {
+    let Some(first) = chosen.first() else { return path.to_path_buf() };
+    let ext = path.extension().and_then(|e| e.to_str()).map(str::to_ascii_lowercase);
+    let opened_ext = opened_with.and_then(|n| Path::new(n).extension()).and_then(|e| e.to_str()).map(str::to_ascii_lowercase);
+    match ext {
+        Some(ext) if chosen.contains(&ext) => path.to_path_buf(),
+        Some(ext) if opened_ext.as_ref() == Some(&ext) => path.with_extension(first),
+        Some(ext) if SAVE_FILTERS.iter().chain(OTHER_SAVE_FILTERS).any(|(_, exts)| exts.contains(&ext.as_str())) => path.to_path_buf(),
+        _ => {
+            let mut name = path.as_os_str().to_owned();
+            name.push(".");
+            name.push(first);
+            PathBuf::from(name)
+        }
+    }
+}
+
+/// The name the save dialog starts with. Where the type picked gives a bare name its extension
+/// (`adds_extension`), the dialog gets the stem and the suggested type (listed first by
+/// [`save_filters`]) supplies `.psd`:
+/// - On Windows a visible extension stays put when the user picks another type (with File name
+///   extensions shown, `image.psd` saved as PhotoCraft stayed `image.psd`, #4394).
+/// - On Linux the portal's dialog keeps the name as typed, and before returning asks whether to
+///   replace a file of that name, so `test.psd` with PNG picked asked to replace test.psd, which
+///   the save leaves alone (#6121). From the stem [`with_chosen_type`] gives the picked type's
+///   extension, and a name that then exists is asked about under that name
+///   (`portal_save::save_as`).
+///
+/// A stem that still has a dot (`scan.jpg.psd`: Windows could keep `scan.jpg`) or an upper-case
 /// extension (the user's spelling) keeps the whole name. Elsewhere the whole name is kept: the
-/// macOS panel has no type list, and on Linux rfd doesn't report which type was picked.
-fn dialog_file_name(suggested: &str, windows: bool) -> Option<String> {
+/// macOS panel has no type list, and rfd's Linux dialogs don't say which type was picked.
+fn dialog_file_name(suggested: &str, adds_extension: bool) -> Option<String> {
     let path = Path::new(suggested);
     let name = path.file_name()?.to_string_lossy().into_owned();
     let (Some(stem), Some(ext)) = (path.file_stem(), path.extension().and_then(|e| e.to_str())) else { return Some(name) };
-    let bare = windows && Path::new(stem).extension().is_none() && !ext.is_empty() && ext == ext.to_ascii_lowercase();
+    let bare = adds_extension && Path::new(stem).extension().is_none() && !ext.is_empty() && ext == ext.to_ascii_lowercase();
     Some(if bare { stem.to_string_lossy().into_owned() } else { name })
 }
 
@@ -148,17 +181,52 @@ fn show_file_dialog(request: FileDialogRequest, parent: Option<&eframe::Frame>,
             Box::pin(async move { picked.await.map(|folder| FileDialogAnswer::FolderTo(path_of(&folder))) })
         }
         FileDialogRequest::Save { suggested } => {
-            for (name, exts) in save_filters(&suggested) {
-                dialog = dialog.add_filter(name, &exts);
+            let filters = save_filters(&suggested);
+            let name = dialog_file_name(&suggested, cfg!(windows));
+            let dir = Path::new(&suggested).parent().filter(|p| !p.as_os_str().is_empty()).map(Path::to_path_buf);
+            for (name, exts) in &filters {
+                dialog = dialog.add_filter(name, exts);
             }
-            if let Some(name) = dialog_file_name(&suggested, cfg!(windows)) {
+            if let Some(name) = &name {
                 dialog = dialog.set_file_name(name);
             }
-            if let Some(dir) = Path::new(&suggested).parent().filter(|p| !p.as_os_str().is_empty()) {
+            if let Some(dir) = &dir {
                 dialog = dialog.set_directory(dir);
             }
-            let picked = dialog.save_file();
-            Box::pin(async move { picked.await.map(|file| FileDialogAnswer::SaveTo(path_of(&file))) })
+            // On Linux the portal's own dialog, which reports the file type picked (#6121); rfd if
+            // the portal can't show it.
+            #[cfg(target_os = "linux")]
+            {
+                use eframe::wgpu::rwh::HasWindowHandle;
+                let parent = crate::portal_save::parent_id(parent.and_then(|p| p.window_handle().ok()).map(|h| h.as_raw()));
+                let req = crate::portal_save::SaveRequest {
+                    parent,
+                    name: dialog_file_name(&suggested, true),
+                    suggested: Path::new(&suggested).file_name().map(|n| n.to_string_lossy().into_owned()),
+                    folder: dir,
+                    filters,
+                    current: Some(0),
+                };
+                Box::pin(async move {
+                    let portal = zbus::blocking::connection::Builder::session()
+                        .and_then(|b| b.build())
+                        .map_err(|e| e.to_string())
+                        .and_then(|conn| crate::portal_save::save_as(&conn, req));
+                    match portal {
+                        Ok(path) => path.map(|p| FileDialogAnswer::SaveTo(p.to_string_lossy().into_owned())),
+                        Err(e) => {
+                            log::info!("portal save dialog unavailable ({e}), using rfd");
+                            dialog.save_file().await.map(|file| FileDialogAnswer::SaveTo(path_of(&file)))
+                        }
+                    }
+                })
+            }
+            #[cfg(not(target_os = "linux"))]
+            {
+                let _ = filters;
+                let picked = dialog.save_file();
+                Box::pin(async move { picked.await.map(|file| FileDialogAnswer::SaveTo(path_of(&file))) })
+            }
         }
     };
     // Without the thread the reply is dropped unanswered, which the app takes as Cancel.
@@ -196,8 +264,8 @@ fn block_on<T>(future: impl Future<Output = T>) -> T {
 }
 
 /// Per-user settings directory: `PHOTOCRAFT_CONFIG_DIR`, else `<exe dir>/PhotoCraftData` in
-/// portable mode, else the platform convention. Everything the app persists lives under it; see
-/// [`crate::app_dirs`].
+/// portable mode, else the platform convention. Everything the app persists lives under it
+/// except, on Windows, crash-recovery autosaves; see [`crate::app_dirs`].
 pub fn config_dir() -> Option<PathBuf> {
     crate::app_dirs::config_dir()
 }
@@ -212,8 +280,10 @@ pub fn presets_dir() -> Option<PathBuf> {
     config_dir().map(|d| d.join("Presets"))
 }
 
+/// Crash-recovery autosaves: under the settings directory, except on Windows, where they stay
+/// out of the roaming profile (see [`crate::app_dirs::recovery_dir`]).
 fn recovery_dir() -> Option<PathBuf> {
-    config_dir().map(|d| d.join("Recovery"))
+    crate::app_dirs::recovery_dir()
 }
 
 /// Write `bytes` crash-safely (temp file beside the target, fsync, rename, directory fsync; see
@@ -436,6 +506,11 @@ pub fn native(automation: Option<photocraft_automation::AuthorizedWorkspace>) ->
         save_file: Some(Arc::new(save_file)),
         file_dialog: Some(Box::new(show_file_dialog)),
         write: Some(Box::new(|path: &str, bytes: &[u8]| write_atomic(Path::new(path), bytes))),
+        file_stamp: Some(Box::new(|path: &str| {
+            // Follows a symlink, as Save writes through it to the file it points at.
+            let meta = std::fs::metadata(path).ok()?;
+            Some(photocraft_ui_egui::FileStamp { len: meta.len(), modified: meta.modified().ok() })
+        })),
         automation_read,
         automation_write,
         automation_open_pcraft,
@@ -585,6 +660,41 @@ mod tests {
     use photocraft_ui_egui::{PhotocraftApp, prefs_ui};
     use serde_json::{Value, json};
 
+    /// #6121: the file type picked in the save dialog gives the name its extension where the
+    /// dialog left the one it opened with, and only there.
+    #[test]
+    fn the_picked_file_type_gives_the_name_its_extension() {
+        let exts = |e: &[&str]| e.iter().map(|s| s.to_string()).collect::<Vec<_>>();
+        let (png, psd) = (exts(&["png"]), exts(&["psd", "psb"]));
+        let opened = Some("Untitled-1.psd");
+        let cases = [
+            // PNG picked, the name as the dialog opened (or renamed, its extension kept).
+            ("/pics/Untitled-1.psd", opened, &png, "/pics/Untitled-1.png"),
+            ("/pics/art.psd", opened, &png, "/pics/art.png"),
+            ("/pics/ART.PSD", opened, &png, "/pics/ART.png"),
+            // No extension: the type's. One PhotoCraft doesn't save is part of the name.
+            ("/pics/art", opened, &png, "/pics/art.png"),
+            ("/pics/scan.2024", opened, &png, "/pics/scan.2024.png"),
+            // Typed, an extension PhotoCraft saves is the user's: kept, whatever the type says
+            // (the PSD type untouched, or PNG picked and .jpg typed).
+            ("/pics/art.png", opened, &psd, "/pics/art.png"),
+            ("/pics/art.jpg", opened, &png, "/pics/art.jpg"),
+            ("/pics/art.pcraft", opened, &png, "/pics/art.pcraft"),
+            // Already the type's: kept, including its other extensions.
+            ("/pics/art.png", opened, &png, "/pics/art.png"),
+            ("/pics/art.PNG", opened, &png, "/pics/art.PNG"),
+            ("/pics/big.psb", opened, &psd, "/pics/big.psb"),
+            // The dialog opened on a .pcraft: that is the extension the type replaces.
+            ("/pics/art.pcraft", Some("art.pcraft"), &png, "/pics/art.png"),
+            ("/pics/art.psd", Some("art.pcraft"), &png, "/pics/art.psd"),
+        ];
+        for (typed, opened, chosen, want) in cases {
+            assert_eq!(with_chosen_type(Path::new(typed), opened, chosen), PathBuf::from(want), "{typed} (opened {opened:?})");
+        }
+        // No type picked: the name as typed.
+        assert_eq!(with_chosen_type(Path::new("/pics/art.psd"), opened, &[]), PathBuf::from("/pics/art.psd"));
+    }
+
     #[cfg(all(unix, not(target_os = "macos")))]
     #[test]
     fn open_filters_cover_uppercase_and_mixed_case_extensions() {
diff --git a/apps/photocraft/src/single_instance.rs b/apps/photocraft/src/single_instance.rs
new file mode 100644
index 0000000000..d2cd65c678
--- /dev/null
+++ b/apps/photocraft/src/single_instance.rs
@@ -0,0 +1,648 @@
+//! One PhotoCraft per user on Windows and Linux (#3708): a file opened from Explorer or a file
+//! manager lands as a new tab in the running window, like Photoshop, instead of starting a second
+//! copy of the program.
+//!
+//! The first launch takes an exclusive OS lock on `instance.lock` in the settings directory (the OS
+//! drops it when the process ends, crash included), listens on a loopback port and writes the port
+//! plus a fresh 256-bit token to `instance.json`. A later launch that finds the lock taken sends its
+//! paths there; the primary queues them for the UI as [`OsEvent::Open`], which opens each one and
+//! brings the window forward. Explorer starts one process per file when several are opened at once;
+//! the lock decides the race, so they all end up as tabs in one window.
+//!
+//! The primary answers `ok` only once the UI has taken the paths. A launch that hears anything else
+//! (the primary is still starting, hung, or quitting) keeps retrying the lock, so it becomes the
+//! primary itself as soon as the old one lets go, and when its time runs out it starts a separate
+//! instance: a file is never acknowledged and then dropped. [`Primary::shutdown`] runs when the
+//! event loop ends (and before the CPU-compatibility relaunch), so a closing PhotoCraft refuses new
+//! files and frees the lock.
+//!
+//! Only for the per-user settings folder ([`skip_reason`]): a portable copy's folder beside the
+//! executable, or a `PHOTOCRAFT_CONFIG_DIR`, may be shared between users.
+//! macOS doesn't need this: LaunchServices already sends a running app an open-documents event.
+
+// Only the tests use it on macOS.
+#![cfg_attr(target_os = "macos", allow(dead_code))]
+
+use std::fs::{File, OpenOptions};
+use std::io::{BufReader, Read, Write};
+use std::net::{Ipv4Addr, SocketAddr, TcpListener, TcpStream};
+use std::path::Path;
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use std::sync::mpsc::{SyncSender, sync_channel};
+use std::sync::{Arc, Mutex, PoisonError};
+use std::time::{Duration, Instant};
+
+use photocraft_automation::security::{LineRead, generate_token, read_bounded_line, token_matches};
+use photocraft_ui_egui::{OsEvent, OsEventsFn};
+use serde_json::{Value, json};
+
+const LOCK_FILE: &str = "instance.lock";
+const INFO_FILE: &str = "instance.json";
+/// More paths than this in one request is not a file manager.
+const MAX_PATHS: usize = 4096;
+/// Launches served at once; a stalled client holds only its own slot, never the next launch.
+const MAX_CLIENTS: usize = 8;
+/// Kept out of the hand-off's budget, so the primary answers before the launch gives up on it.
+const REPLY_MARGIN: Duration = Duration::from_millis(500);
+
+/// How long each side waits (shortened in tests).
+#[derive(Clone, Copy, Debug)]
+pub struct Timing {
+    /// A later launch's whole budget for handing its paths over (or taking the lock over).
+    pub handoff: Duration,
+    /// How long the primary waits for its UI to take a launch's paths before refusing them.
+    pub ack: Duration,
+    /// Total time a connection gets to send its request line.
+    pub request: Duration,
+}
+
+/// Generous enough for a primary that is still opening its window.
+pub const TIMING: Timing = Timing { handoff: Duration::from_secs(10), ack: Duration::from_secs(8), request: Duration::from_secs(5) };
+
+/// Outcome of [`claim`].
+pub enum Launch {
+    /// This process is the running instance; keep [`Primary`] alive and attach it to the app.
+    Primary(Primary),
+    /// The running instance took the paths; this process should exit.
+    Forwarded,
+    /// Couldn't do either (reason given): run as an independent instance.
+    Standalone(String),
+}
+
+/// What decides whether a launch takes part (see [`skip_reason`]).
+#[derive(Clone, Copy)]
+pub struct LaunchContext<'a> {
+    /// The settings folder is the platform's per-user one (not portable, not an override).
+    pub per_user_settings: bool,
+    /// `--new-instance`.
+    pub new_instance_flag: bool,
+    /// `PHOTOCRAFT_NEW_INSTANCE`, if set.
+    pub new_instance_env: Option<&'a str>,
+    /// `--control` or `PHOTOCRAFT_CONTROL_PORT`: automation gets its own process.
+    pub control: bool,
+    /// Paths that aren't valid Unicode: this launch reports them.
+    pub unreadable_paths: bool,
+    /// Options that only apply to the process they're given to (`--safe-gpu`, …).
+    pub launch_options: &'a [&'static str],
+}
+
+/// Why this launch runs as its own instance, or `None` to take part in single-instance.
+pub fn skip_reason(c: &LaunchContext) -> Option<String> {
+    if !c.per_user_settings {
+        return Some("the settings folder isn't the per-user one (portable or PHOTOCRAFT_CONFIG_DIR)".into());
+    }
+    if c.new_instance_flag || c.new_instance_env.is_some_and(|v| !v.is_empty() && v != "0") {
+        return Some("--new-instance".into());
+    }
+    if c.control {
+        return Some("automation (--control) runs its own process".into());
+    }
+    if c.unreadable_paths {
+        return Some("some paths aren't valid Unicode".into());
+    }
+    if !c.launch_options.is_empty() {
+        return Some(format!("{} only applies to a new process", c.launch_options.join(", ")));
+    }
+    None
+}
+
+/// The running instance: holds the lock and receives other launches' paths.
+pub struct Primary {
+    lock: Mutex<Option<File>>,
+    shared: Arc<Shared>,
+}
+
+struct Shared {
+    inbox: Mutex<Inbox>,
+    /// Set by [`Primary::shutdown`]: new connections are dropped, waiting ones refused.
+    closed: AtomicBool,
+}
+
+#[derive(Default)]
+struct Inbox {
+    pending: Vec<Pending>,
+    ctx: Option<egui::Context>,
+    next_id: u64,
+}
+
+/// Paths waiting for the UI; `taken` tells the connection that sent them.
+struct Pending {
+    id: u64,
+    paths: Vec<String>,
+    taken: SyncSender<()>,
+}
+
+impl Primary {
+    /// The queue the UI drains (see `Services::os_events`); a later launch wakes `ctx`.
+    pub fn connect(&self, ctx: &egui::Context) -> OsEventsFn {
+        let mut inbox = self.shared.inbox.lock().unwrap_or_else(PoisonError::into_inner);
+        if !inbox.pending.is_empty() {
+            ctx.request_repaint();
+        }
+        inbox.ctx = Some(ctx.clone());
+        drop(inbox);
+        let shared = Arc::clone(&self.shared);
+        Box::new(move || shared.take())
+    }
+
+    /// Stop taking files and release the lock: launches waiting on this one are refused and take
+    /// the lock over themselves. Call when the event loop has ended, and before relaunching.
+    pub fn shutdown(&self) {
+        self.shared.closed.store(true, Ordering::Release);
+        // Dropping the senders refuses every connection still waiting for the UI.
+        self.shared.inbox.lock().unwrap_or_else(PoisonError::into_inner).pending.clear();
+        drop(self.lock.lock().unwrap_or_else(PoisonError::into_inner).take());
+    }
+}
+
+impl Drop for Primary {
+    fn drop(&mut self) {
+        self.shutdown();
+    }
+}
+
+impl Shared {
+    /// Everything queued, acknowledged to the senders while the inbox is locked (see `hand_over`).
+    fn take(&self) -> Vec<OsEvent> {
+        let mut inbox = self.inbox.lock().unwrap_or_else(PoisonError::into_inner);
+        inbox
+            .pending
+            .drain(..)
+            .map(|p| {
+                let _ = p.taken.try_send(());
+                OsEvent::Open(p.paths)
+            })
+            .collect()
+    }
+
+    /// Queue `paths` for the UI and wait up to `wait` for it to take them. False (and nothing left
+    /// queued) when it didn't: the sender then retries or starts its own instance.
+    fn hand_over(&self, paths: Vec<String>, wait: Duration) -> bool {
+        let (taken, rx) = sync_channel(1);
+        let id = {
+            let mut inbox = self.inbox.lock().unwrap_or_else(PoisonError::into_inner);
+            if self.closed.load(Ordering::Acquire) {
+                return false;
+            }
+            let id = inbox.next_id;
+            inbox.next_id = id.wrapping_add(1);
+            inbox.pending.push(Pending { id, paths, taken });
+            if let Some(ctx) = &inbox.ctx {
+                ctx.request_repaint();
+            }
+            id
+        };
+        if rx.recv_timeout(wait).is_ok() {
+            return true;
+        }
+        // Timed out or refused: withdraw, unless the UI took them in the meantime (it acknowledges
+        // while holding the lock, so the answer is settled here).
+        let mut inbox = self.inbox.lock().unwrap_or_else(PoisonError::into_inner);
+        if rx.try_recv().is_ok() {
+            return true;
+        }
+        inbox.pending.retain(|p| p.id != id);
+        false
+    }
+}
+
+/// Become the running instance under `dir` or hand `paths` (absolute) to the one that is.
+pub fn claim(dir: &Path, paths: &[String]) -> Launch {
+    claim_with(dir, paths, TIMING)
+}
+
+/// [`claim`] with explicit timeouts. Until `timing.handoff` runs out, each round tries the lock
+/// (free once a quitting or crashed primary is gone) and then the running primary.
+pub fn claim_with(dir: &Path, paths: &[String], timing: Timing) -> Launch {
+    if let Err(e) = std::fs::create_dir_all(dir) {
+        return Launch::Standalone(format!("{}: {e}", dir.display()));
+    }
+    let lock_path = dir.join(LOCK_FILE);
+    let lock = match OpenOptions::new().read(true).write(true).create(true).truncate(false).open(&lock_path) {
+        Ok(lock) => lock,
+        Err(e) => return Launch::Standalone(format!("{}: {e}", lock_path.display())),
+    };
+    let deadline = Instant::now() + timing.handoff;
+    let mut last = "no instance.json".to_string();
+    loop {
+        match lock.try_lock() {
+            Ok(()) => {
+                return match serve(dir, lock, timing) {
+                    Ok(primary) => Launch::Primary(primary),
+                    Err(e) => Launch::Standalone(e),
+                };
+            }
+            Err(std::fs::TryLockError::WouldBlock) => {}
+            Err(std::fs::TryLockError::Error(e)) => return Launch::Standalone(format!("{}: {e}", lock_path.display())),
+        }
+        if let Some((port, token)) = read_info(dir) {
+            match send(port, &token, paths, deadline) {
+                Ok(()) => return Launch::Forwarded,
+                Err(e) => last = e,
+            }
+        }
+        if Instant::now() >= deadline {
+            return Launch::Standalone(format!("the running PhotoCraft didn't take the files ({last})"));
+        }
+        std::thread::sleep(Duration::from_millis(100));
+    }
+}
+
+fn serve(dir: &Path, lock: File, timing: Timing) -> Result<Primary, String> {
+    let listener = TcpListener::bind((Ipv4Addr::LOCALHOST, 0)).map_err(|e| format!("loopback listener: {e}"))?;
+    let port = listener.local_addr().map_err(|e| format!("loopback listener: {e}"))?.port();
+    let token = generate_token().map_err(|e| e.to_string())?;
+    write_info(dir, port, &token)?;
+    let shared = Arc::new(Shared { inbox: Mutex::default(), closed: AtomicBool::new(false) });
+    let listening = Arc::clone(&shared);
+    let spawned = std::thread::Builder::new().name("single-instance".into()).spawn(move || {
+        let token = Arc::new(token);
+        let clients = Arc::new(AtomicUsize::new(0));
+        loop {
+            let stream = match listener.accept() {
+                Ok((stream, _)) => stream,
+                // Back off instead of spinning when accept keeps failing (e.g. out of descriptors).
+                Err(_) => {
+                    std::thread::sleep(Duration::from_millis(100));
+                    continue;
+                }
+            };
+            // Closing: the sender sees the connection drop and takes the lock over.
+            if listening.closed.load(Ordering::Acquire) {
+                continue;
+            }
+            // Each launch on its own thread, so one that connects and stalls doesn't hold the
+            // ones after it; past the cap a connection is dropped and that launch retries.
+            if clients.fetch_add(1, Ordering::AcqRel) >= MAX_CLIENTS {
+                clients.fetch_sub(1, Ordering::AcqRel);
+                continue;
+            }
+            let (token, shared, slot) = (Arc::clone(&token), Arc::clone(&listening), Arc::clone(&clients));
+            let spawned = std::thread::Builder::new().name("single-instance-client".into()).spawn(move || {
+                serve_client(stream, &token, &shared, timing);
+                slot.fetch_sub(1, Ordering::AcqRel);
+            });
+            if spawned.is_err() {
+                clients.fetch_sub(1, Ordering::AcqRel);
+            }
+        }
+    });
+    spawned.map_err(|e| format!("single-instance listener thread: {e}"))?;
+    Ok(Primary { lock: Mutex::new(Some(lock)), shared })
+}
+
+/// Read one request, hand its paths to the UI and answer `ok` only if the UI took them.
+fn serve_client(stream: TcpStream, token: &str, shared: &Shared, timing: Timing) {
+    let taken = match read_request(&stream, timing.request) {
+        Some(line) => match parse_request(&line, token) {
+            Some((paths, wait)) => shared.hand_over(paths, wait.min(timing.ack)),
+            None => false,
+        },
+        None => return,
+    };
+    let reply = if taken { json!({"ok": true}) } else { json!({"ok": false, "error": "not taken"}) };
+    let mut out = stream;
+    let _ = out.set_write_timeout(Some(timing.request));
+    let _ = writeln!(out, "{reply}").and_then(|()| out.flush());
+}
+
+/// A reader that fails once `until` passes, however slowly the bytes trickle in.
+struct Deadline<'a> {
+    stream: &'a TcpStream,
+    until: Instant,
+}
+
+impl Read for Deadline<'_> {
+    fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
+        let left = self.until.checked_duration_since(Instant::now()).filter(|d| !d.is_zero());
+        let left = left.ok_or_else(|| std::io::Error::new(std::io::ErrorKind::TimedOut, "request deadline passed"))?;
+        self.stream.set_read_timeout(Some(left))?;
+        let mut stream = self.stream;
+        stream.read(buf)
+    }
+}
+
+/// The request line, if it arrives complete within `total`.
+fn read_request(stream: &TcpStream, total: Duration) -> Option<String> {
+    let mut reader = BufReader::new(Deadline { stream, until: Instant::now() + total });
+    let mut line = String::new();
+    matches!(read_bounded_line(&mut reader, &mut line), Ok(LineRead::Line)).then_some(line)
+}
+
+/// Port and token, written to a temporary file and renamed so a reader never sees half of it.
+/// On Unix the file is the user's alone (0600): another local user who read the token could make
+/// this app open any path. (Windows keeps the per-user ACL of the settings folder.)
+fn write_info(dir: &Path, port: u16, token: &str) -> Result<(), String> {
+    let path = dir.join(INFO_FILE);
+    let tmp = dir.join(format!("{INFO_FILE}.{}.tmp", std::process::id()));
+    let body = json!({"port": port, "token": token, "pid": std::process::id()}).to_string();
+    // A leftover from a crash could carry wider permissions; the mode applies only on create.
+    let _ = std::fs::remove_file(&tmp);
+    let mut options = OpenOptions::new();
+    options.write(true).create_new(true);
+    #[cfg(unix)]
+    std::os::unix::fs::OpenOptionsExt::mode(&mut options, 0o600);
+    let written = options.open(&tmp).and_then(|mut f| f.write_all(body.as_bytes())).and_then(|()| std::fs::rename(&tmp, &path));
+    written.map_err(|e| {
+        let _ = std::fs::remove_file(&tmp);
+        format!("{}: {e}", path.display())
+    })
+}
+
+fn read_info(dir: &Path) -> Option<(u16, String)> {
+    let v: Value = serde_json::from_slice(&std::fs::read(dir.join(INFO_FILE)).ok()?).ok()?;
+    let port = u16::try_from(v.get("port")?.as_u64()?).ok()?;
+    Some((port, v.get("token")?.as_str()?.to_string()))
+}
+
+/// `{"token":…,"open":[…],"wait_ms":…}`: the paths, and how long the sender will wait for the UI.
+fn parse_request(line: &str, token: &str) -> Option<(Vec<String>, Duration)> {
+    let v: Value = serde_json::from_str(line).ok()?;
+    if !token_matches(token, v.get("token")?.as_str()?) {
+        return None;
+    }
+    let open = v.get("open")?.as_array()?;
+    if open.len() > MAX_PATHS {
+        return None;
+    }
+    let paths = open.iter().map(|p| p.as_str().map(str::to_string)).collect::<Option<Vec<_>>>()?;
+    let wait = Duration::from_millis(v.get("wait_ms").and_then(Value::as_u64).unwrap_or(0));
+    Some((paths, wait))
+}
+
+/// Offer `paths` to the primary on `port`; `Ok` once its UI has taken them.
+fn send(port: u16, token: &str, paths: &[String], deadline: Instant) -> Result<(), String> {
+    let left = deadline.checked_duration_since(Instant::now()).filter(|d| !d.is_zero()).ok_or("out of time")?;
+    let addr = SocketAddr::from((Ipv4Addr::LOCALHOST, port));
+    let mut stream = TcpStream::connect_timeout(&addr, left).map_err(|e| e.to_string())?;
+    // The primary must answer before our deadline, so it waits a little less than we do.
+    let wait_ms = u64::try_from(left.saturating_sub(REPLY_MARGIN).as_millis()).unwrap_or(u64::MAX);
+    let request = json!({"token": token, "open": paths, "wait_ms": wait_ms});
+    stream.set_write_timeout(Some(left)).map_err(|e| e.to_string())?;
+    writeln!(stream, "{request}").and_then(|()| stream.flush()).map_err(|e| e.to_string())?;
+    let mut reader = BufReader::new(Deadline { stream: &stream, until: deadline });
+    let mut line = String::new();
+    match read_bounded_line(&mut reader, &mut line) {
+        Ok(LineRead::Line) => {}
+        Ok(_) => return Err("no reply".into()),
+        Err(e) => return Err(e.to_string()),
+    }
+    let ok = serde_json::from_str::<Value>(&line).ok().and_then(|v| v.get("ok")?.as_bool()) == Some(true);
+    if ok { Ok(()) } else { Err("not taken".into()) }
+}
+
+/// Absolute form of a command-line path, so the running instance (another working directory)
+/// opens the same file.
+pub fn absolute(path: &str) -> String {
+    std::path::absolute(path).map(|p| p.to_string_lossy().into_owned()).unwrap_or_else(|_| path.to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+    use std::sync::mpsc::channel;
+
+    const FAST: Timing = Timing { handoff: Duration::from_millis(1500), ack: Duration::from_millis(500), request: Duration::from_millis(800) };
+
+    fn temp_dir(name: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!("photocraft-single-instance-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        dir
+    }
+
+    /// Launch with `paths` on another thread (it blocks until the primary's UI takes them).
+    fn launch(dir: &Path, paths: &[&str], timing: Timing) -> std::thread::JoinHandle<Launch> {
+        let (dir, paths): (PathBuf, Vec<String>) = (dir.to_path_buf(), paths.iter().map(|p| p.to_string()).collect());
+        std::thread::spawn(move || claim_with(&dir, &paths, timing))
+    }
+
+    /// Play the UI: drain until `n` events arrived (or 5 s passed).
+    fn drain(ui: &mut OsEventsFn, n: usize) -> Vec<OsEvent> {
+        let mut got = Vec::new();
+        let deadline = Instant::now() + Duration::from_secs(5);
+        while got.len() < n && Instant::now() < deadline {
+            got.extend(ui());
+            std::thread::sleep(Duration::from_millis(10));
+        }
+        got
+    }
+
+    fn primary(dir: &Path) -> Primary {
+        match claim_with(dir, &[], FAST) {
+            Launch::Primary(p) => p,
+            _ => panic!("first launch should be primary"),
+        }
+    }
+
+    #[test]
+    fn second_launch_hands_its_paths_to_the_first() {
+        let dir = temp_dir("handoff");
+        let primary = primary(&dir);
+        let mut ui = primary.connect(&egui::Context::default());
+        let paths = ["C:\\art\\one.psd", "/home/a/two é.png"];
+        let second = launch(&dir, &paths, TIMING);
+        assert_eq!(drain(&mut ui, 1), vec![OsEvent::Open(paths.iter().map(|p| p.to_string()).collect())]);
+        assert!(matches!(second.join().unwrap(), Launch::Forwarded));
+        // A plain second start (no files) just brings the window forward.
+        let third = launch(&dir, &[], TIMING);
+        assert_eq!(drain(&mut ui, 1), vec![OsEvent::Open(Vec::new())]);
+        assert!(matches!(third.join().unwrap(), Launch::Forwarded));
+        drop(primary);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn simultaneous_launches_all_land_in_one_instance() {
+        let dir = temp_dir("race");
+        let (tx, rx) = channel();
+        for i in 0..6 {
+            let (dir, tx) = (dir.clone(), tx.clone());
+            std::thread::spawn(move || {
+                let _ = tx.send(claim(&dir, &[format!("file{i}.psd")]));
+            });
+        }
+        drop(tx);
+        let (mut primaries, mut forwarded, mut events) = (Vec::new(), 0, Vec::new());
+        let mut ui: Option<OsEventsFn> = None;
+        let deadline = Instant::now() + Duration::from_secs(10);
+        while primaries.len() + forwarded < 6 && Instant::now() < deadline {
+            while let Ok(launch) = rx.try_recv() {
+                match launch {
+                    Launch::Primary(p) => primaries.push(p),
+                    Launch::Forwarded => forwarded += 1,
+                    Launch::Standalone(reason) => panic!("standalone: {reason}"),
+                }
+            }
+            if ui.is_none()
+                && let Some(p) = primaries.first()
+            {
+                ui = Some(p.connect(&egui::Context::default()));
+            }
+            if let Some(ui) = ui.as_mut() {
+                events.extend(ui());
+            }
+            std::thread::sleep(Duration::from_millis(10));
+        }
+        assert_eq!((primaries.len(), forwarded, events.len()), (1, 5, 5));
+        drop(primaries);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn a_crashed_instance_leaves_nothing_in_the_way() {
+        let dir = temp_dir("stale");
+        std::fs::create_dir_all(&dir).unwrap();
+        // instance.json from a process that is gone; the lock is free.
+        std::fs::write(dir.join(INFO_FILE), r#"{"port":1,"token":"x","pid":1}"#).unwrap();
+        let primary = primary(&dir);
+        assert!(read_info(&dir).is_some_and(|(port, _)| port != 1));
+        drop(primary);
+        // Released with the handle, as on process exit.
+        assert!(matches!(claim_with(&dir, &[], FAST), Launch::Primary(_)));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// Review of #3755, point 1 (and the quitting half of point 3): a launch waiting on a primary
+    /// that shuts down (closing, or about to relaunch itself in CPU mode) isn't told `ok`; it takes
+    /// the lock over and opens the file itself.
+    #[test]
+    fn a_launch_waiting_on_a_closing_instance_takes_over() {
+        let dir = temp_dir("closing");
+        let primary = primary(&dir);
+        // The UI never drains (it is shutting down, or never came up).
+        let waiting = launch(&dir, &["a.psd"], FAST);
+        std::thread::sleep(Duration::from_millis(200));
+        primary.shutdown();
+        assert!(matches!(waiting.join().unwrap(), Launch::Primary(_)), "the waiting launch becomes the primary");
+        // After shutdown new connections are refused too.
+        let (port, token) = read_info(&dir).unwrap();
+        drop(primary);
+        let short = Instant::now() + Duration::from_millis(300);
+        assert!(send(port, &token, &["b.psd".into()], short).is_err());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// Review of #3755, point 3: a primary whose UI never takes the paths (hung) doesn't
+    /// acknowledge them, and doesn't keep them queued to open later as well.
+    #[test]
+    fn a_hung_instance_never_swallows_a_file() {
+        let dir = temp_dir("hung-ui");
+        let primary = primary(&dir);
+        let mut ui = primary.connect(&egui::Context::default());
+        let started = Instant::now();
+        assert!(matches!(claim_with(&dir, &["a.psd".into()], FAST), Launch::Standalone(_)));
+        assert!(started.elapsed() < FAST.handoff + Duration::from_secs(1), "{:?}", started.elapsed());
+        assert!(ui().is_empty(), "withdrawn, not opened later");
+        drop(primary);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn requests_without_the_token_or_malformed_are_rejected() {
+        let token = generate_token().unwrap();
+        let ok = parse_request(&json!({"token": token, "open": ["a"], "wait_ms": 250}).to_string(), &token);
+        assert_eq!(ok, Some((vec!["a".to_string()], Duration::from_millis(250))));
+        let wrong = generate_token().unwrap();
+        assert_eq!(parse_request(&json!({"token": wrong, "open": ["a"]}).to_string(), &token), None);
+        for bad in ["", "not json", "{}", r#"{"token":5}"#, &json!({"token": token}).to_string(), &json!({"token": token, "open": [1]}).to_string()] {
+            assert_eq!(parse_request(bad, &token), None, "{bad:?}");
+        }
+        let many: Vec<String> = (0..=MAX_PATHS).map(|i| i.to_string()).collect();
+        assert_eq!(parse_request(&json!({"token": token, "open": many}).to_string(), &token), None);
+    }
+
+    #[test]
+    fn a_stalled_client_does_not_hold_up_the_next_launch() {
+        let dir = temp_dir("stalled");
+        let primary = primary(&dir);
+        let mut ui = primary.connect(&egui::Context::default());
+        let (port, _) = read_info(&dir).unwrap();
+        // Connects and never sends a line (each would otherwise hold the listener).
+        let stalled: Vec<TcpStream> = (0..3).map(|_| TcpStream::connect((Ipv4Addr::LOCALHOST, port)).unwrap()).collect();
+        let started = Instant::now();
+        let next = launch(&dir, &["b.psd"], FAST);
+        assert_eq!(drain(&mut ui, 1), vec![OsEvent::Open(vec!["b.psd".into()])]);
+        assert!(matches!(next.join().unwrap(), Launch::Forwarded));
+        assert!(started.elapsed() < FAST.request, "took {:?}", started.elapsed());
+        drop(stalled);
+        drop(primary);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// A client that trickles a byte at a time can't keep its slot past the request deadline.
+    #[test]
+    fn a_trickling_client_is_cut_off_at_the_request_deadline() {
+        let dir = temp_dir("trickle");
+        let primary = primary(&dir);
+        let (port, _) = read_info(&dir).unwrap();
+        let mut slow = TcpStream::connect((Ipv4Addr::LOCALHOST, port)).unwrap();
+        let started = Instant::now();
+        let mut cut_off = false;
+        while started.elapsed() < FAST.request * 4 {
+            if slow.write_all(b"{").is_err() {
+                cut_off = true;
+                break;
+            }
+            std::thread::sleep(Duration::from_millis(100));
+        }
+        assert!(cut_off, "still connected after {:?}", started.elapsed());
+        assert!(started.elapsed() < FAST.request * 3, "{:?}", started.elapsed());
+        drop(primary);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn the_token_file_is_private_to_the_user() {
+        use std::os::unix::fs::PermissionsExt;
+        let dir = temp_dir("mode");
+        std::fs::create_dir_all(&dir).unwrap();
+        // A wide leftover temporary file from a crashed start doesn't widen the new one.
+        let tmp = dir.join(format!("{INFO_FILE}.{}.tmp", std::process::id()));
+        std::fs::write(&tmp, "{}").unwrap();
+        std::fs::set_permissions(&tmp, std::fs::Permissions::from_mode(0o644)).unwrap();
+        write_info(&dir, 1, &generate_token().unwrap()).unwrap();
+        let mode = std::fs::metadata(dir.join(INFO_FILE)).unwrap().permissions().mode() & 0o777;
+        assert_eq!(mode, 0o600);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn an_unreachable_instance_falls_back_to_a_standalone_launch() {
+        let dir = temp_dir("unreachable");
+        std::fs::create_dir_all(&dir).unwrap();
+        // Someone holds the lock but nothing listens on the advertised port.
+        let held = File::create(dir.join(LOCK_FILE)).unwrap();
+        held.lock().unwrap();
+        let closed = TcpListener::bind((Ipv4Addr::LOCALHOST, 0)).unwrap().local_addr().unwrap().port();
+        write_info(&dir, closed, &generate_token().unwrap()).unwrap();
+        assert!(matches!(claim_with(&dir, &["a.psd".into()], FAST), Launch::Standalone(_)));
+        drop(held);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// Review of #3755, point 2 and the smaller points: who takes part in single-instance.
+    #[test]
+    fn only_per_user_launches_without_process_options_take_part() {
+        let base = LaunchContext {
+            per_user_settings: true,
+            new_instance_flag: false,
+            new_instance_env: None,
+            control: false,
+            unreadable_paths: false,
+            launch_options: &[],
+        };
+        assert_eq!(skip_reason(&base), None);
+        // A portable copy's folder or a PHOTOCRAFT_CONFIG_DIR may be shared between users.
+        assert!(skip_reason(&LaunchContext { per_user_settings: false, ..base }).is_some());
+        assert!(skip_reason(&LaunchContext { new_instance_flag: true, ..base }).is_some());
+        assert!(skip_reason(&LaunchContext { new_instance_env: Some("1"), ..base }).is_some());
+        assert_eq!(skip_reason(&LaunchContext { new_instance_env: Some("0"), ..base }), None);
+        assert_eq!(skip_reason(&LaunchContext { new_instance_env: Some(""), ..base }), None);
+        assert!(skip_reason(&LaunchContext { control: true, ..base }).is_some());
+        assert!(skip_reason(&LaunchContext { unreadable_paths: true, ..base }).is_some());
+        let reason = skip_reason(&LaunchContext { launch_options: &["--safe-gpu"], ..base });
+        assert!(reason.is_some_and(|r| r.contains("--safe-gpu")));
+    }
+}
diff --git a/apps/photocraft/tests/command_line_usage.rs b/apps/photocraft/tests/command_line_usage.rs
new file mode 100644
index 0000000000..c4c745ea9a
--- /dev/null
+++ b/apps/photocraft/tests/command_line_usage.rs
@@ -0,0 +1,95 @@
+//! `photocraft --help` and unknown options must not open the window (#6431): before the fix,
+//! any argument the loop didn't know was taken as a file, so `--help` or a typo such as
+//! `--safegpu` launched the GUI and logged "Couldn't open --help".
+//!
+//! These run the real binary, and every case must exit before the window opens: Windows and
+//! macOS runners have a desktop, so a launch that gets that far hangs until the test times out.
+//! Cases whose arguments are valid add a bad `--control` value, which fails the launch with the
+//! other usage errors, so stderr shows whether those arguments were taken as unknown options.
+
+/// Run `photocraft` with `args` in an isolated config dir; return the exit
+/// status, stdout and stderr.
+fn run_photocraft(args: &[&str]) -> (std::process::ExitStatus, String, String) {
+    static NEXT: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+    let n = NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    let dir = std::env::temp_dir().join(format!("photocraft-usage-{}-{n}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let output = std::process::Command::new(env!("CARGO_BIN_EXE_photocraft"))
+        .args(args)
+        .env("PHOTOCRAFT_CONFIG_DIR", &dir)
+        .env_remove("PHOTOCRAFT_CONTROL_PORT")
+        .env_remove("DISPLAY")
+        .env_remove("WAYLAND_DISPLAY")
+        .env_remove("WAYLAND_SOCKET")
+        .output()
+        .expect("failed to run photocraft binary");
+    std::fs::remove_dir_all(&dir).ok();
+    (output.status, String::from_utf8_lossy(&output.stdout).into_owned(), String::from_utf8_lossy(&output.stderr).into_owned())
+}
+
+#[test]
+fn help_prints_usage_and_exits_0() {
+    for flag in ["--help", "-h"] {
+        let (status, stdout, stderr) = run_photocraft(&[flag]);
+        assert_eq!(status.code(), Some(0), "{flag} must exit 0, stderr: {stderr}");
+        assert!(stdout.starts_with("Usage: photocraft"), "{flag} stdout: {stdout}");
+        for option in ["--safe-gpu", "--new-instance", "--control <port>", "--version", "--"] {
+            assert!(stdout.contains(option), "{flag} usage must list {option}: {stdout}");
+        }
+        assert!(!stderr.contains("Couldn't open"), "{flag} was taken as a file: {stderr}");
+    }
+}
+
+#[test]
+fn help_wins_over_later_arguments() {
+    let (status, stdout, _) = run_photocraft(&["--help", "picture.psd", "--safegpu"]);
+    assert_eq!(status.code(), Some(0));
+    assert!(stdout.starts_with("Usage: photocraft"), "stdout: {stdout}");
+}
+
+#[test]
+fn unknown_options_exit_2_naming_them() {
+    for flag in ["--safegpu", "-x", "--help=yes"] {
+        let (status, stdout, stderr) = run_photocraft(&[flag]);
+        assert_eq!(status.code(), Some(2), "{flag} must be a usage error, stderr: {stderr}");
+        assert!(stderr.contains(&format!("unknown option `{flag}`")), "stderr: {stderr}");
+        assert!(stderr.contains("photocraft --help"), "stderr should point at --help: {stderr}");
+        assert!(stdout.is_empty(), "stdout: {stdout}");
+    }
+}
+
+#[test]
+fn unknown_option_errors_are_reported_with_control_port_errors() {
+    let (status, _, stderr) = run_photocraft(&["--control", "nope", "--safegpu"]);
+    assert_eq!(status.code(), Some(2), "stderr: {stderr}");
+    assert!(stderr.contains("`nope` is not a valid port"), "stderr: {stderr}");
+    assert!(stderr.contains("unknown option `--safegpu`"), "stderr: {stderr}");
+}
+
+#[test]
+fn arguments_after_double_dash_are_files() {
+    // `--` ends the options: `--help` and `-x` after it are file names, so neither prints usage
+    // nor is an unknown option; only the bad port is reported.
+    let (status, stdout, stderr) = run_photocraft(&["--control", "nope", "--", "--help", "-x"]);
+    assert_eq!(status.code(), Some(2), "stderr: {stderr}");
+    assert!(stderr.contains("`nope` is not a valid port"), "stderr: {stderr}");
+    assert!(!stdout.contains("Usage:"), "stdout: {stdout}");
+    assert!(!stderr.contains("unknown option"), "stderr: {stderr}");
+}
+
+#[test]
+fn macos_process_serial_number_is_still_ignored() {
+    // Old macOS passes `-psn_<n>` when launching from Finder; it is neither a file nor an error.
+    let (status, _, stderr) = run_photocraft(&["--control", "nope", "-psn_0_12345"]);
+    assert_eq!(status.code(), Some(2), "stderr: {stderr}");
+    assert!(stderr.contains("`nope` is not a valid port"), "stderr: {stderr}");
+    assert!(!stderr.contains("unknown option"), "stderr: {stderr}");
+}
+
+#[test]
+fn new_instance_is_a_known_option() {
+    let (status, _, stderr) = run_photocraft(&["--control", "nope", "--new-instance"]);
+    assert_eq!(status.code(), Some(2), "stderr: {stderr}");
+    assert!(stderr.contains("`nope` is not a valid port"), "stderr: {stderr}");
+    assert!(!stderr.contains("unknown option"), "stderr: {stderr}");
+}
diff --git a/apps/photocraft/tests/mac_menu_appkit.rs b/apps/photocraft/tests/mac_menu_appkit.rs
index feacb4bd3b..db55015943 100644
--- a/apps/photocraft/tests/mac_menu_appkit.rs
+++ b/apps/photocraft/tests/mac_menu_appkit.rs
@@ -22,6 +22,18 @@ fn main() {
     use photocraft_ui_egui::native_menu;
     use serde_json::json;
 
+    // Without a harness nothing answers cargo-nextest's `--list`, so it ran the whole test as its
+    // listing and failed on the output. List the one test, as libtest's terse format would, and
+    // nothing for `--ignored` (nextest asks twice). Running it passes `<name> --exact`, which falls
+    // through to the test below.
+    let args: Vec<String> = std::env::args().collect();
+    if args.iter().any(|a| a == "--list") {
+        if !args.iter().any(|a| a == "--ignored") {
+            println!("mac_menu_appkit: test");
+        }
+        return;
+    }
+
     let mtm = MainThreadMarker::new().expect("harness = false runs on the main thread");
     let nsapp = NSApplication::sharedApplication(mtm);
     nsapp.finishLaunching();
diff --git a/assets/icons/ellipse-dashed.svg b/assets/icons/ellipse-dashed.svg
new file mode 100644
index 0000000000..f852dcf3a7
--- /dev/null
+++ b/assets/icons/ellipse-dashed.svg
@@ -0,0 +1,13 @@
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <ellipse cx="12" cy="12" rx="10" ry="7" stroke-dasharray="3.5 3.23" />
+</svg>
diff --git a/assets/icons/quick-selection.svg b/assets/icons/quick-selection.svg
index 454b38bae6..7e63dc66b9 100644
--- a/assets/icons/quick-selection.svg
+++ b/assets/icons/quick-selection.svg
@@ -9,8 +9,8 @@
   stroke-linecap="round"
   stroke-linejoin="round"
 >
-  <path d="m11 10 3 3" />
-  <path d="M6.5 21A3.5 3.5 0 1 0 3 17.5a2.62 2.62 0 0 1-.708 1.792A1 1 0 0 0 3 21z" />
-  <path d="M9.969 17.031 21.378 5.624a1 1 0 0 0-3.002-3.002L6.967 14.031" />
-  <path d="M6.5 12a5.5 5.5 0 1 0 5.5 5.5" stroke-dasharray="2 3" />
+  <path d="M14 3H7a4 4 0 0 0-4 4v10a4 4 0 0 0 4 4h7" stroke-dasharray="2 3" />
+  <path d="m14 10 2.1 2.1" />
+  <path d="M10.85 17.7A2.45 2.45 0 1 0 8.4 15.25a1.834 1.834 0 0 1-.496 1.254A.7 .7 0 0 0 8.4 17.7z" />
+  <path d="M13.278 14.922 21.265 6.937a.7 .7 0 0 0-2.101-2.101L11.177 12.822" />
 </svg>
diff --git a/contributors/people.toml b/contributors/people.toml
index 8694c72698..3948e2992b 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -162,3 +162,10 @@ sync_github_name = true
 [people.sidney]
 real_name = "Sidney Markowitz"
 sync_github_name = true
+
+[people.1Git2Clone]
+sync_github_name = true
+
+[people.Silvertree2010]
+display_name = "Netter"
+sync_github_name = false
diff --git a/crates/affinity/Cargo.toml b/crates/affinity/Cargo.toml
index e686e737ef..49d859c2f8 100644
--- a/crates/affinity/Cargo.toml
+++ b/crates/affinity/Cargo.toml
@@ -16,7 +16,7 @@ synth = []
 [dependencies]
 crc32fast = "1.5"
 flate2 = { workspace = true }
-ruzstd = "0.9"
+ruzstd = "0.9.1"
 
 [dev-dependencies]
 proptest = { workspace = true }
diff --git a/crates/affinity/src/preview.rs b/crates/affinity/src/preview.rs
index f50cb8c3e9..d3341eeb1c 100644
--- a/crates/affinity/src/preview.rs
+++ b/crates/affinity/src/preview.rs
@@ -94,11 +94,8 @@ pub fn preview(bytes: &[u8]) -> Result<Preview<'_>, Error> {
                 }
                 image_data = true;
             }
-            b"IEND" => {
-                if !image_data {
-                    return Err(Error::Malformed("PNG has no image data"));
-                }
-            }
+            b"IEND" if !image_data => return Err(Error::Malformed("PNG has no image data")),
+            b"IEND" => {}
             _ if kind.first().is_some_and(u8::is_ascii_uppercase) => {
                 return Err(Error::Unsupported("unknown critical PNG chunk"));
             }
diff --git a/crates/algo/data/LICENSE-libfacedetection.txt b/crates/algo/data/LICENSE-libfacedetection.txt
new file mode 100644
index 0000000000..33abd64f06
--- /dev/null
+++ b/crates/algo/data/LICENSE-libfacedetection.txt
@@ -0,0 +1,35 @@
+By downloading, copying, installing or using the software you agree to this license.
+If you do not agree to this license, do not download, install,
+copy or use the software.
+
+
+                  License Agreement For libfacedetection
+                     (3-clause BSD License)
+
+Copyright (c) 2015-2019, Shiqi Yu, all rights reserved.
+shiqi.yu@gmail.com
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+  * Redistributions of source code must retain the above copyright notice,
+    this list of conditions and the following disclaimer.
+
+  * Redistributions in binary form must reproduce the above copyright notice,
+    this list of conditions and the following disclaimer in the documentation
+    and/or other materials provided with the distribution.
+
+  * Neither the names of the copyright holders nor the names of the contributors
+    may be used to endorse or promote products derived from this software
+    without specific prior written permission.
+
+This software is provided by the copyright holders and contributors "as is" and
+any express or implied warranties, including, but not limited to, the implied
+warranties of merchantability and fitness for a particular purpose are disclaimed.
+In no event shall copyright holders or contributors be liable for any direct,
+indirect, incidental, special, exemplary, or consequential damages
+(including, but not limited to, procurement of substitute goods or services;
+loss of use, data, or profits; or business interruption) however caused
+and on any theory of liability, whether in contract, strict liability,
+or tort (including negligence or otherwise) arising in any way out of
+the use of this software, even if advised of the possibility of such damage.
\ No newline at end of file
diff --git a/crates/algo/data/libfacedetection.bin b/crates/algo/data/libfacedetection.bin
new file mode 100644
index 0000000000..0941c4f689
Binary files /dev/null and b/crates/algo/data/libfacedetection.bin differ
diff --git a/crates/algo/src/camera_raw/local_tone.rs b/crates/algo/src/camera_raw/local_tone.rs
index 7844f8d74b..e1305c5d49 100644
--- a/crates/algo/src/camera_raw/local_tone.rs
+++ b/crates/algo/src/camera_raw/local_tone.rs
@@ -79,23 +79,48 @@ fn mirror(i: isize, n: usize) -> usize {
 
 const TAPS: [f32; 5] = [1.0 / 16.0, 4.0 / 16.0, 6.0 / 16.0, 4.0 / 16.0, 1.0 / 16.0];
 
+/// Planes smaller than this run their rows on one thread: the filter builds a whole pyramid per
+/// reference (up to 96), and splitting its small levels into one-row tasks cost more in rayon's
+/// scheduling than the rows themselves (a fifth of a Shadows render on 36 MP, measured).
+const PAR_MIN: usize = 1 << 15;
+
+/// [`par_rows`] for a plane, on one thread when it is small (see [`PAR_MIN`]).
+fn rows(buf: &mut [f32], w: usize, f: impl Fn(usize, &mut [f32]) + Sync + Send) {
+    if buf.len() < PAR_MIN {
+        buf.chunks_mut(w.max(1)).enumerate().for_each(|(y, row)| f(y, row));
+    } else {
+        par_rows(buf, w, 1, f);
+    }
+}
+
 /// The binomial 5-tap blur, sampled every `step` pixels from 0 (1 = full resolution).
 fn blur_step(p: &Plane, step: usize) -> Plane {
     let (w2, h2) = (p.w.div_ceil(step), p.h.div_ceil(step));
-    // Columns first at the kept rows, then rows at the kept columns.
+    // Columns first at the kept rows, then rows at the kept columns. Each sum adds the same terms
+    // in the same order as a `mirror` per tap would, so the result is bit for bit the same; the
+    // source rows are found once per row and the columns mirrored only near the edges.
     let mut tmp = vec![0.0f32; p.w * h2];
-    par_rows(&mut tmp, p.w, 1, |y2, row| {
+    rows(&mut tmp, p.w, |y2, row| {
         let y = (y2 * step) as isize;
+        let src: [&[f32]; 5] = std::array::from_fn(|k| {
+            let r = mirror(y + k as isize - 2, p.h);
+            &p.v[r * p.w..(r + 1) * p.w]
+        });
         for (x, o) in row.iter_mut().enumerate() {
-            *o = (0..5).map(|k| TAPS[k] * p.v[mirror(y + k as isize - 2, p.h) * p.w + x]).sum();
+            *o = (0..5).map(|k| TAPS[k] * src[k][x]).sum();
         }
     });
     let mut out = vec![0.0f32; w2 * h2];
-    par_rows(&mut out, w2, 1, |y2, row| {
+    rows(&mut out, w2, |y2, row| {
         let src = &tmp[y2 * p.w..(y2 + 1) * p.w];
         for (x2, o) in row.iter_mut().enumerate() {
-            let x = (x2 * step) as isize;
-            *o = (0..5).map(|k| TAPS[k] * src[mirror(x + k as isize - 2, p.w)]).sum();
+            let x = x2 * step;
+            *o = if x >= 2 && x + 2 < p.w {
+                let s = &src[x - 2..x + 3];
+                (0..5).map(|k| TAPS[k] * s[k]).sum()
+            } else {
+                (0..5).map(|k| TAPS[k] * src[mirror(x as isize + k as isize - 2, p.w)]).sum()
+            };
         }
     });
     Plane { w: w2, h: h2, v: out }
@@ -107,14 +132,45 @@ fn down(p: &Plane) -> Plane {
 }
 
 /// `p` brought up to `w × h`: zeros between samples, then the blur times four.
+///
+/// Three samples in four are zero, so their taps are skipped instead of blurring a zero-filled
+/// plane: the nonzero terms are added in the same order (skipping `+0.0` terms changes at most the
+/// sign of a zero, and the filter only adds and exponentiates these values).
 fn up(p: &Plane, w: usize, h: usize) -> Plane {
-    let mut z = Plane { w, h, v: vec![0.0; w * h] };
-    for y in 0..p.h.min(h.div_ceil(2)) {
-        for x in 0..p.w.min(w.div_ceil(2)) {
-            z.v[2 * y * w + 2 * x] = p.v[y * p.w + x] * 4.0;
-        }
+    let (lh, lw) = (p.h.min(h.div_ceil(2)), p.w.min(w.div_ceil(2)));
+    // The source sample behind index `i` of a zero-stuffed axis of length `n` holding `lim` samples.
+    let src = |i: isize, n: usize, lim: usize| {
+        let m = mirror(i, n);
+        (m.is_multiple_of(2) && m / 2 < lim).then_some(m / 2)
+    };
+    // Columns first, only at the even columns (the odd ones are all zero).
+    let mut tmp = vec![0.0f32; lw * h];
+    if lw > 0 {
+        rows(&mut tmp, lw, |y, row| {
+            let taps: [Option<&[f32]>; 5] = std::array::from_fn(|k| src(y as isize + k as isize - 2, h, lh).map(|r| &p.v[r * p.w..r * p.w + lw]));
+            for (j, o) in row.iter_mut().enumerate() {
+                *o = (0..5).filter_map(|k| taps[k].map(|s| TAPS[k] * (s[j] * 4.0))).sum();
+            }
+        });
     }
-    blur_step(&z, 1)
+    let mut out = vec![0.0f32; w * h];
+    rows(&mut out, w, |y, row| {
+        let t = &tmp[y * lw..(y + 1) * lw];
+        for (x, o) in row.iter_mut().enumerate() {
+            *o = if x >= 2 && x + 2 < w {
+                // Away from the edges no tap mirrors.
+                (0..5)
+                    .filter_map(|k| {
+                        let i = x + k - 2;
+                        (i.is_multiple_of(2) && i / 2 < lw).then(|| TAPS[k] * t[i / 2])
+                    })
+                    .sum()
+            } else {
+                (0..5).filter_map(|k| src(x as isize + k as isize - 2, w, lw).map(|j| TAPS[k] * t[j])).sum()
+            };
+        }
+    });
+    Plane { w, h, v: out }
 }
 
 /// Levels down to about 2 pixels on the short side.
@@ -154,7 +210,7 @@ fn llf(u: &Plane, remap: impl Fn(f32, f32) -> f32 + Sync) -> Plane {
     for k in 0..refs {
         let r = lo + step * k as f32;
         let mut m = Plane { w: u.w, h: u.h, v: u.v.clone() };
-        par_rows(&mut m.v, u.w, 1, |_, row| {
+        rows(&mut m.v, u.w, |_, row| {
             for v in row.iter_mut() {
                 *v = remap(*v, r);
             }
@@ -163,7 +219,7 @@ fn llf(u: &Plane, remap: impl Fn(f32, f32) -> f32 + Sync) -> Plane {
         for l in 0..n - 1 {
             let coarse = up(&gr[l + 1], gr[l].w, gr[l].h);
             let (gl, fine, lw) = (&g[l].v, &gr[l].v, g[l].w);
-            par_rows(&mut lap[l], lw, 1, |y, row| {
+            rows(&mut lap[l], lw, |y, row| {
                 for (x, o) in row.iter_mut().enumerate() {
                     let i = y * lw + x;
                     let wgt = (1.0 - (gl[i].clamp(lo, hi) - r).abs() / step).max(0.0);
@@ -337,6 +393,62 @@ mod tests {
 
     const SRGB: Encoding = Encoding(0.0);
 
+    /// The plain blur: a `mirror` per tap over the whole plane, the reference for [`blur_step`].
+    fn blur_step_reference(p: &Plane, step: usize) -> Plane {
+        let (w2, h2) = (p.w.div_ceil(step), p.h.div_ceil(step));
+        let mut tmp = vec![0.0f32; p.w * h2];
+        for y2 in 0..h2 {
+            for x in 0..p.w {
+                tmp[y2 * p.w + x] = (0..5).map(|k| TAPS[k] * p.v[mirror((y2 * step) as isize + k as isize - 2, p.h) * p.w + x]).sum();
+            }
+        }
+        let mut out = vec![0.0f32; w2 * h2];
+        for y2 in 0..h2 {
+            for x2 in 0..w2 {
+                out[y2 * w2 + x2] = (0..5).map(|k| TAPS[k] * tmp[y2 * p.w + mirror((x2 * step) as isize + k as isize - 2, p.w)]).sum();
+            }
+        }
+        Plane { w: w2, h: h2, v: out }
+    }
+
+    /// The plain upsampling: a zero-stuffed plane blurred whole, the reference for [`up`].
+    fn up_reference(p: &Plane, w: usize, h: usize) -> Plane {
+        let mut z = Plane { w, h, v: vec![0.0; w * h] };
+        for y in 0..p.h.min(h.div_ceil(2)) {
+            for x in 0..p.w.min(w.div_ceil(2)) {
+                z.v[2 * y * w + 2 * x] = p.v[y * p.w + x] * 4.0;
+            }
+        }
+        blur_step_reference(&z, 1)
+    }
+
+    fn noise_plane(w: usize, h: usize, seed: u32) -> Plane {
+        let mut s = seed.wrapping_mul(2_654_435_761).max(1);
+        let v = (0..w * h)
+            .map(|_| {
+                s ^= s << 13;
+                s ^= s >> 17;
+                s ^= s << 5;
+                (s % 20_000) as f32 / 1000.0 - 16.0
+            })
+            .collect();
+        Plane { w, h, v }
+    }
+
+    #[test]
+    fn the_fast_pyramid_matches_the_plain_one_exactly() {
+        // Odd, even, tiny and large-enough-to-run-in-parallel sizes, as the pyramid's levels are.
+        for (i, (w, h)) in [(1, 1), (1, 7), (2, 2), (3, 5), (5, 3), (8, 6), (37, 23), (64, 64), (301, 211)].into_iter().enumerate() {
+            let p = noise_plane(w, h, i as u32 + 1);
+            for step in [1, 2] {
+                assert_eq!(blur_step(&p, step).v, blur_step_reference(&p, step).v, "blur {w}×{h} step {step}");
+            }
+            for (uw, uh) in [(w * 2, h * 2), (w * 2 - 1, h * 2 - 1), (w * 2, h * 2 - 1), (w.max(2) * 2 - 3, h * 2)] {
+                assert_eq!(up(&p, uw, uh).v, up_reference(&p, uw, uh).v, "up {w}×{h} → {uw}×{uh}");
+            }
+        }
+    }
+
     fn grey(w: usize, h: usize, f: impl Fn(usize, usize) -> f32) -> Vec<[f32; 4]> {
         (0..w * h).map(|i| f(i % w, i / w)).map(|v| [v, v, v, 1.0]).collect()
     }
diff --git a/crates/algo/src/content_aware.rs b/crates/algo/src/content_aware.rs
index 76880cd5ad..981e854cc5 100644
--- a/crates/algo/src/content_aware.rs
+++ b/crates/algo/src/content_aware.rs
@@ -566,6 +566,133 @@ pub fn level_transform(ch: usize, from: &[f32], to: &[f32], a: Adapt) -> Vec<(f3
         .collect()
 }
 
+/// One stroke of the Content-Aware Fill workspace's Sampling Brush: a hard round brush of
+/// diameter `size` along `points` (document px), adding to the sampling area or taking from it.
+#[derive(Clone, Debug, PartialEq)]
+pub struct SamplingStroke {
+    pub add: bool,
+    pub size: f64,
+    pub points: Vec<[f64; 2]>,
+}
+
+impl SamplingStroke {
+    /// Bounds of the pixels the stroke covers.
+    pub fn bounds(&self) -> Rect {
+        let r = (self.size / 2.0).max(0.5);
+        self.points.iter().fold(Rect::EMPTY, |acc, p| {
+            let b = Rect::new(
+                (p[0] - r).floor() as i32,
+                (p[1] - r).floor() as i32,
+                ((p[0] + r).ceil() as i32).saturating_add(1),
+                ((p[1] + r).ceil() as i32).saturating_add(1),
+            );
+            if acc.is_empty() { b } else { acc.union(&b) }
+        })
+    }
+}
+
+/// Squared distance from `p` to the segment `a`–`b`.
+fn seg_dist2(p: [f64; 2], a: [f64; 2], b: [f64; 2]) -> f64 {
+    let (dx, dy) = (b[0] - a[0], b[1] - a[1]);
+    let l2 = dx * dx + dy * dy;
+    let t = if l2 > 0.0 { (((p[0] - a[0]) * dx + (p[1] - a[1]) * dy) / l2).clamp(0.0, 1.0) } else { 0.0 };
+    let (qx, qy) = (a[0] + t * dx - p[0], a[1] + t * dy - p[1]);
+    qx * qx + qy * qy
+}
+
+/// Paint `strokes` in order into `mask` (row-major over `area`): a pixel whose centre lies within
+/// half the brush size of a stroke's path is set (adding) or cleared (subtracting). A mask that
+/// does not cover `area` exactly is left as it is.
+pub fn paint_strokes(mask: &mut [bool], area: Rect, strokes: &[SamplingStroke]) {
+    let w = area.width() as usize;
+    if mask.len() != w * area.height() as usize {
+        return;
+    }
+    for s in strokes {
+        let r = (s.size / 2.0).max(0.5);
+        let r2 = r.powi(2);
+        let segs: Vec<([f64; 2], [f64; 2])> = match s.points.as_slice() {
+            [] => continue,
+            [p] => vec![(*p, *p)],
+            pts => pts.windows(2).map(|p| (p[0], p[1])).collect(),
+        };
+        // A stroke covers the union of its segments' pixels: each segment only looks at its own
+        // bounds.
+        for (a, b) in segs {
+            let bounds = Rect::new(
+                (a[0].min(b[0]) - r).floor() as i32,
+                (a[1].min(b[1]) - r).floor() as i32,
+                ((a[0].max(b[0]) + r).ceil() as i32).saturating_add(1),
+                ((a[1].max(b[1]) + r).ceil() as i32).saturating_add(1),
+            )
+            .intersect(&area);
+            for y in bounds.y0..bounds.y1 {
+                for x in bounds.x0..bounds.x1 {
+                    let c = [f64::from(x) + 0.5, f64::from(y) + 0.5];
+                    if seg_dist2(c, a, b) <= r2
+                        && let Some(m) = mask.get_mut((y - area.y0) as usize * w + (x - area.x0) as usize)
+                    {
+                        *m = s.add;
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// The pixels of `area` (row-major) whose centres lie inside the polygon `pts` (even-odd rule):
+/// what a lasso outlines.
+pub fn polygon_mask(area: Rect, pts: &[[f64; 2]]) -> Vec<bool> {
+    let (w, h) = (area.width() as usize, area.height() as usize);
+    let mut out = vec![false; w * h];
+    if pts.len() < 3 {
+        return out;
+    }
+    let mut xs: Vec<f64> = Vec::new();
+    for row in 0..h {
+        let cy = f64::from(area.y0) + row as f64 + 0.5;
+        xs.clear();
+        for i in 0..pts.len() {
+            let (a, b) = (pts[i], pts[(i + 1) % pts.len()]);
+            if (a[1] <= cy) != (b[1] <= cy) {
+                xs.push(a[0] + (cy - a[1]) / (b[1] - a[1]) * (b[0] - a[0]));
+            }
+        }
+        xs.sort_by(f64::total_cmp);
+        for pair in xs.as_chunks::<2>().0 {
+            // Pixel centres x + 0.5 within [pair0, pair1).
+            let x0 = ((pair[0] - 0.5).ceil() as i64 - i64::from(area.x0)).clamp(0, w as i64) as usize;
+            let x1 = ((pair[1] - 0.5).ceil() as i64 - i64::from(area.x0)).clamp(0, w as i64) as usize;
+            out[row * w + x0..row * w + x1.max(x0)].iter_mut().for_each(|v| *v = true);
+        }
+    }
+    out
+}
+
+/// Grow (`by` > 0) or shrink (`by` < 0) a mask by `|by|` pixels (Euclidean): the lasso's Expand
+/// and Contract.
+pub fn grow_mask(mask: &[bool], w: usize, h: usize, by: i32) -> Vec<bool> {
+    if by == 0 || w == 0 || h == 0 {
+        return mask.to_vec();
+    }
+    let r = f32::from(u16::try_from(by.unsigned_abs()).unwrap_or(u16::MAX));
+    if by > 0 {
+        let d = crate::selection::edt(mask, w, h);
+        d.iter().map(|v| *v <= r).collect()
+    } else {
+        let outside: Vec<bool> = mask.iter().map(|v| !v).collect();
+        let d = crate::selection::edt(&outside, w, h);
+        d.iter().map(|v| *v > r).collect()
+    }
+}
+
+/// The Sampling Brush's starting size for a selection with bounds `hole`: a tenth of the sampling
+/// window's side, as Photoshop opens the workspace (20 px for a 50 px selection, 40 for 100).
+pub fn default_brush_size(hole: Rect) -> f64 {
+    let (w, h) = (f64::from(hole.width().max(50)), f64::from(hole.height().max(50)));
+    (0.4 * (w * h).sqrt()).round()
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -577,6 +704,43 @@ mod tests {
         (img, hole)
     }
 
+    #[test]
+    fn strokes_paint_their_path_and_leave_a_mismatched_mask_alone() {
+        let area = Rect::new(10, 20, 50, 40);
+        let (w, h) = (40, 20);
+        let strokes = [
+            SamplingStroke { add: true, size: 6.0, points: vec![[12.0, 25.0], [40.0, 25.0], [45.0, 35.0]] },
+            SamplingStroke { add: false, size: 3.0, points: vec![[30.0, 25.0]] },
+            SamplingStroke { add: true, size: 2.0, points: Vec::new() },
+        ];
+        let mut mask = vec![false; w * h];
+        paint_strokes(&mut mask, area, &strokes);
+        // The same pixels as testing every pixel against every segment of each stroke in turn.
+        let mut want = vec![false; w * h];
+        for s in &strokes {
+            let r2 = (s.size / 2.0).max(0.5).powi(2);
+            let segs: Vec<_> = if s.points.len() == 1 { vec![(s.points[0], s.points[0])] } else { s.points.windows(2).map(|p| (p[0], p[1])).collect() };
+            for (i, m) in want.iter_mut().enumerate() {
+                let c = [f64::from(area.x0) + (i % w) as f64 + 0.5, f64::from(area.y0) + (i / w) as f64 + 0.5];
+                if segs.iter().any(|(a, b)| seg_dist2(c, *a, *b) <= r2) {
+                    *m = s.add;
+                }
+            }
+        }
+        assert_eq!(mask, want);
+        assert!(mask[5 * w + 10] && !mask[5 * w + 20], "added along the path, cleared under the subtracting dab");
+        // A mask shorter or longer than the area is not touched (and nothing panics).
+        for len in [0, 7, w * h - 1, w * h + 3] {
+            let mut short = vec![false; len];
+            paint_strokes(&mut short, area, &strokes);
+            assert!(short.iter().all(|v| !v), "len {len}");
+        }
+        // Hostile coordinates stay inside the area.
+        let mut m = vec![false; w * h];
+        let wild = [SamplingStroke { add: true, size: 5000.0, points: vec![[f64::MAX, -1e300], [f64::NAN, 1e7]] }];
+        paint_strokes(&mut m, area, &wild);
+    }
+
     #[test]
     fn cancelled_fill_stops_and_progress_reaches_one() {
         use std::sync::atomic::{AtomicU32, Ordering};
diff --git a/crates/algo/src/distort.rs b/crates/algo/src/distort.rs
index 664169afa4..fb6e3e69c3 100644
--- a/crates/algo/src/distort.rs
+++ b/crates/algo/src/distort.rs
@@ -28,32 +28,47 @@ pub(crate) fn centre(b: Rect) -> (f32, f32, f32) {
     (b.x0 as f32 + w / 2.0, b.y0 as f32 + h / 2.0, w.min(h) / 2.0)
 }
 
+/// The bounds' centre and half width and height: Twirl, Pinch and Spherize act inside the ellipse
+/// inscribed in the bounds, as Photoshop's do, so on a wide or tall image the effect reaches all
+/// four edges instead of stopping at a circle fitted to the shorter side (#5643). A point maps to
+/// unit-circle coordinates `(u, v)` and back.
+fn ellipse(b: Rect) -> (f32, f32, f32, f32) {
+    let (w, h) = (b.width() as f32, b.height() as f32);
+    (b.x0 as f32 + w / 2.0, b.y0 as f32 + h / 2.0, w / 2.0, h / 2.0)
+}
+
 pub(crate) fn twirl(src: &Image, out: Rect, ctx: &Ctx, angle: f32) -> Vec<f32> {
-    let (cx, cy, rr) = centre(ctx.bounds);
+    let (cx, cy, hx, hy) = ellipse(ctx.bounds);
     let a = angle.to_radians();
     remap(src, out, ctx, Edge::Repeat, |x, y| {
-        let (dx, dy) = (x - cx, y - cy);
-        let r = (dx * dx + dy * dy).sqrt();
-        if r >= rr || rr <= 0.0 {
+        if hx <= 0.0 || hy <= 0.0 {
             return (x, y);
         }
-        let t = a * (1.0 - r / rr);
+        let (u, v) = ((x - cx) / hx, (y - cy) / hy);
+        let r = (u * u + v * v).sqrt();
+        if r >= 1.0 {
+            return (x, y);
+        }
+        let t = a * (1.0 - r);
         let (s, c) = t.sin_cos();
-        (cx + dx * c - dy * s, cy + dx * s + dy * c)
+        (cx + (u * c - v * s) * hx, cy + (u * s + v * c) * hy)
     })
 }
 
 pub(crate) fn pinch(src: &Image, out: Rect, ctx: &Ctx, amount: f32) -> Vec<f32> {
-    let (cx, cy, rr) = centre(ctx.bounds);
+    let (cx, cy, hx, hy) = ellipse(ctx.bounds);
     let a = (amount / 100.0).clamp(-1.0, 1.0);
     remap(src, out, ctx, Edge::Repeat, |x, y| {
-        let (dx, dy) = (x - cx, y - cy);
-        let r = (dx * dx + dy * dy).sqrt();
-        if r >= rr || r <= 0.0 {
+        if hx <= 0.0 || hy <= 0.0 {
             return (x, y);
         }
-        let rs = rr * (r / rr).powf(1.0 - a * 0.5);
-        (cx + dx * rs / r, cy + dy * rs / r)
+        let (u, v) = ((x - cx) / hx, (y - cy) / hy);
+        let r = (u * u + v * v).sqrt();
+        if r >= 1.0 || r <= 0.0 {
+            return (x, y);
+        }
+        let k = r.powf(1.0 - a * 0.5) / r;
+        (cx + u * k * hx, cy + v * k * hy)
     })
 }
 
@@ -64,20 +79,22 @@ fn sphere_1d(rn: f32, a: f32) -> f32 {
 }
 
 pub(crate) fn spherize(src: &Image, out: Rect, ctx: &Ctx, amount: f32, mode: SpherizeMode) -> Vec<f32> {
-    let b = ctx.bounds;
-    let (cx, cy, rr) = centre(b);
-    let (hx, hy) = (b.width() as f32 / 2.0, b.height() as f32 / 2.0);
+    let (cx, cy, hx, hy) = ellipse(ctx.bounds);
     let a = (amount / 100.0).clamp(-1.0, 1.0);
     remap(src, out, ctx, Edge::Repeat, |x, y| {
         let (dx, dy) = (x - cx, y - cy);
         match mode {
             SpherizeMode::Normal => {
-                let r = (dx * dx + dy * dy).sqrt();
-                if r >= rr || r <= 0.0 {
+                if hx <= 0.0 || hy <= 0.0 {
                     return (x, y);
                 }
-                let rs = rr * sphere_1d(r / rr, a);
-                (cx + dx * rs / r, cy + dy * rs / r)
+                let (u, v) = (dx / hx, dy / hy);
+                let r = (u * u + v * v).sqrt();
+                if r >= 1.0 || r <= 0.0 {
+                    return (x, y);
+                }
+                let k = sphere_1d(r, a) / r;
+                (cx + u * k * hx, cy + v * k * hy)
             }
             SpherizeMode::HorizontalOnly => {
                 if dx.abs() >= hx {
diff --git a/crates/algo/src/faces.rs b/crates/algo/src/faces.rs
new file mode 100644
index 0000000000..aa246fcaf8
--- /dev/null
+++ b/crates/algo/src/faces.rs
@@ -0,0 +1,90 @@
+//! Face detection: a port of libfacedetection's CNN (Shiqi Yu, BSD-3; `data/LICENSE-libfacedetection.txt`).
+//!
+//! The network is the YuNet design: a backbone of 1×1 pointwise and 3×3 depthwise convolutions with
+//! 2×2 max pooling, a feature pyramid at strides 8, 16 and 32, and per-cell heads for the face score,
+//! the box and five landmarks (eyes, nose tip, mouth corners). The weights (`data/libfacedetection.bin`,
+//! converted to half precision from the library's `facedetectcnn-data.cpp`) are about 100 KB, and
+//! inference is plain Rust: no runtime, so it works offline.
+//!
+//! [`detect`] takes straight RGBA in `0..=1` and returns faces in pixel coordinates of that image.
+//!
+//! The browser build (wasm32) leaves the network and its weights out, as `photocraft-raw` does with
+//! its JPEG XL decoder: they would push the wasm over the per-file cap of static hosts
+//! (packaging/web/package.sh). There [`AVAILABLE`] is false and [`detect`] finds nothing.
+
+#[cfg(not(target_arch = "wasm32"))]
+mod cnn;
+
+/// Whether this build can detect faces (not the browser build: see the module docs).
+pub const AVAILABLE: bool = cfg!(not(target_arch = "wasm32"));
+
+/// Longest side the network looks at; larger images are scaled down first (faces smaller than
+/// about 10 px at this scale are missed).
+pub const MAX_SIDE: usize = 1280;
+
+/// One detected face, in pixels of the image passed to [`detect`].
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Face {
+    /// Confidence `0..=1` (the library reports faces above 0.5 as reliable).
+    pub score: f32,
+    /// Left, top, width and height.
+    pub rect: [f32; 4],
+    /// Right eye, left eye (as seen in the image: the first is on the image's left), nose tip,
+    /// right mouth corner, left mouth corner.
+    pub landmarks: [[f32; 2]; 5],
+}
+
+/// Faces in `px` (straight RGBA `0..=1`, `w × h`, row-major) scoring at least `min_score`, best
+/// first. Transparent pixels count as white. `None` when `px` doesn't match the size.
+#[cfg(not(target_arch = "wasm32"))]
+pub fn detect(px: &[[f32; 4]], w: usize, h: usize, min_score: f32) -> Option<Vec<Face>> {
+    if w == 0 || h == 0 || px.len() != w.checked_mul(h)? {
+        return None;
+    }
+    // Scale down (box filter) so the longer side is at most MAX_SIDE.
+    let step = w.max(h).div_ceil(MAX_SIDE).max(1);
+    let (sw, sh) = (w.div_ceil(step), h.div_ceil(step));
+    let mut bgr = vec![[0.0f32; 3]; sw * sh];
+    for y in 0..sh {
+        for x in 0..sw {
+            let (mut acc, mut n) = ([0.0f32; 3], 0.0f32);
+            for yy in y * step..((y + 1) * step).min(h) {
+                for xx in x * step..((x + 1) * step).min(w) {
+                    let [r, g, b, a] = px[yy * w + xx];
+                    let a = a.clamp(0.0, 1.0);
+                    for (k, v) in [b, g, r].into_iter().enumerate() {
+                        acc[k] += v.clamp(0.0, 1.0) * a + (1.0 - a);
+                    }
+                    n += 1.0;
+                }
+            }
+            bgr[y * sw + x] = acc.map(|v| (v / n.max(1.0) * 255.0).round());
+        }
+    }
+    let s = step as f32;
+    let faces = cnn::network(&bgr, sw, sh)?
+        .into_iter()
+        .filter(|f| f.score >= min_score)
+        .map(|f| Face { score: f.score, rect: f.rect.map(|v| v * s), landmarks: f.landmarks.map(|[x, y]| [x * s, y * s]) })
+        .collect();
+    Some(faces)
+}
+
+/// The browser build has no detector (see the module docs): always `None`.
+#[cfg(target_arch = "wasm32")]
+pub fn detect(_px: &[[f32; 4]], _w: usize, _h: usize, _min_score: f32) -> Option<Vec<Face>> {
+    None
+}
+
+#[cfg(all(test, not(target_arch = "wasm32")))]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn no_faces_in_flat_or_tiny_images_and_bad_sizes_are_refused() {
+        assert_eq!(detect(&vec![[0.5, 0.5, 0.5, 1.0]; 64 * 48], 64, 48, 0.5), Some(vec![]));
+        assert_eq!(detect(&[[1.0, 1.0, 1.0, 1.0]], 1, 1, 0.5), Some(vec![]));
+        assert_eq!(detect(&[[1.0; 4]; 3], 2, 2, 0.5), None);
+        assert_eq!(detect(&[], 0, 0, 0.5), None);
+    }
+}
diff --git a/crates/algo/src/faces/cnn.rs b/crates/algo/src/faces/cnn.rs
new file mode 100644
index 0000000000..b86cac7eb2
--- /dev/null
+++ b/crates/algo/src/faces/cnn.rs
@@ -0,0 +1,323 @@
+//! The network itself (native builds only: see the parent module's docs).
+
+use super::Face;
+use crate::par;
+
+/// The weights: `PCFACE1\0`, the layer count (u16), then per layer its input channels (u16), filters
+/// (u16) and kind (u8: 0 pointwise, 1 depthwise), the weights and the biases, all little-endian f16.
+static WEIGHTS: &[u8] = include_bytes!("../../data/libfacedetection.bin");
+
+const MAGIC: &[u8] = b"PCFACE1\0";
+const LAYERS: usize = 53;
+/// Faces whose boxes overlap more than this (intersection over union) are one face.
+const NMS_OVERLAP: f32 = 0.45;
+/// Candidates kept before non-maximum suppression, as the library does.
+const TOP_K: usize = 1000;
+
+struct Layer {
+    channels: usize,
+    filters: usize,
+    depthwise: bool,
+    weights: Vec<f32>,
+    biases: Vec<f32>,
+}
+
+/// A feature map: `rows × cols` cells of `channels` values each.
+#[derive(Clone)]
+struct Blob {
+    rows: usize,
+    cols: usize,
+    channels: usize,
+    data: Vec<f32>,
+}
+
+impl Blob {
+    fn new(rows: usize, cols: usize, channels: usize) -> Self {
+        Blob { rows, cols, channels, data: vec![0.0; rows * cols * channels] }
+    }
+}
+
+fn f16_to_f32(h: u16) -> f32 {
+    let sign = if h & 0x8000 != 0 { -1.0 } else { 1.0 };
+    let exp = i32::from((h >> 10) & 0x1f);
+    let frac = f32::from(h & 0x3ff);
+    match exp {
+        0 => sign * frac * (2.0f32).powi(-24),
+        31 => {
+            if frac == 0.0 {
+                sign * f32::INFINITY
+            } else {
+                f32::NAN
+            }
+        }
+        _ => sign * (1.0 + frac / 1024.0) * (2.0f32).powi(exp - 15),
+    }
+}
+
+fn parse(bytes: &[u8]) -> Option<Vec<Layer>> {
+    let rest = bytes.strip_prefix(MAGIC)?;
+    let mut at = 0usize;
+    let u16_at = |n: &mut usize| -> Option<u16> {
+        let b = rest.get(*n..*n + 2)?;
+        *n += 2;
+        Some(u16::from_le_bytes([b[0], b[1]]))
+    };
+    let count = usize::from(u16_at(&mut at)?);
+    if count != LAYERS {
+        return None;
+    }
+    let mut layers = Vec::with_capacity(count);
+    for _ in 0..count {
+        let channels = usize::from(u16_at(&mut at)?);
+        let filters = usize::from(u16_at(&mut at)?);
+        let depthwise = *rest.get(at)? == 1;
+        at += 1;
+        let nw = if depthwise { 9 * channels } else { filters * channels };
+        let mut read = |n: usize| -> Option<Vec<f32>> { (0..n).map(|_| u16_at(&mut at).map(f16_to_f32)).collect() };
+        let weights = read(nw)?;
+        let biases = read(filters)?;
+        if depthwise && filters != channels {
+            return None;
+        }
+        layers.push(Layer { channels, filters, depthwise, weights, biases });
+    }
+    (at == rest.len()).then_some(layers)
+}
+
+/// A 1×1 or 3×3 depthwise convolution with bias, then ReLU when `relu`.
+fn conv(x: &Blob, l: &Layer, relu: bool) -> Option<Blob> {
+    if x.channels != l.channels {
+        return None;
+    }
+    let mut out = Blob::new(x.rows, x.cols, l.filters);
+    let (rows, cols, cin, cout) = (x.rows, x.cols, x.channels, l.filters);
+    par::chunks_mut(&mut out.data, cols * cout, rows * cols * cout > 1 << 16, |row, line| {
+        for col in 0..cols {
+            let o = &mut line[col * cout..(col + 1) * cout];
+            if l.depthwise {
+                o.copy_from_slice(&l.biases);
+                for r in row.saturating_sub(1)..(row + 2).min(rows) {
+                    for c in col.saturating_sub(1)..(col + 2).min(cols) {
+                        let k = (r + 1 - row) * 3 + (c + 1 - col);
+                        let input = &x.data[(r * cols + c) * cin..(r * cols + c + 1) * cin];
+                        let w = &l.weights[k * cin..(k + 1) * cin];
+                        for ((o, i), w) in o.iter_mut().zip(input).zip(w) {
+                            *o += i * w;
+                        }
+                    }
+                }
+            } else {
+                let input = &x.data[(row * cols + col) * cin..(row * cols + col + 1) * cin];
+                for (f, o) in o.iter_mut().enumerate() {
+                    let w = &l.weights[f * cin..(f + 1) * cin];
+                    *o = l.biases[f] + input.iter().zip(w).map(|(i, w)| i * w).sum::<f32>();
+                }
+            }
+            if relu {
+                for v in o.iter_mut() {
+                    *v = v.max(0.0);
+                }
+            }
+        }
+    });
+    Some(out)
+}
+
+/// Pointwise then depthwise (ReLU after the depthwise one when `relu`).
+fn conv_dp(x: &Blob, p: &Layer, d: &Layer, relu: bool) -> Option<Blob> {
+    conv(&conv(x, p, false)?, d, relu)
+}
+
+fn unit(x: &Blob, l: &[Layer]) -> Option<Blob> {
+    let [p1, d1, p2, d2] = l else { return None };
+    conv_dp(&conv_dp(x, p1, d1, true)?, p2, d2, true)
+}
+
+fn max_pool(x: &Blob) -> Blob {
+    let rows = x.rows.saturating_sub(3).div_ceil(2) + 1;
+    let cols = x.cols.saturating_sub(3).div_ceil(2) + 1;
+    let mut out = Blob::new(rows, cols, x.channels);
+    for r in 0..rows {
+        for c in 0..cols {
+            let o = (r * cols + c) * x.channels;
+            for ch in 0..x.channels {
+                let mut m = f32::NEG_INFINITY;
+                for rr in r * 2..(r * 2 + 2).min(x.rows) {
+                    for cc in c * 2..(c * 2 + 2).min(x.cols) {
+                        m = m.max(x.data[(rr * x.cols + cc) * x.channels + ch]);
+                    }
+                }
+                out.data[o + ch] = m;
+            }
+        }
+    }
+    out
+}
+
+/// `small` upsampled ×2 (nearest) plus `big`.
+fn up_add(small: &Blob, big: &Blob) -> Option<Blob> {
+    if small.rows * 2 != big.rows || small.cols * 2 != big.cols || small.channels != big.channels {
+        return None;
+    }
+    let mut out = big.clone();
+    let ch = big.channels;
+    for r in 0..big.rows {
+        for c in 0..big.cols {
+            let s = ((r / 2) * small.cols + c / 2) * ch;
+            let o = (r * big.cols + c) * ch;
+            for k in 0..ch {
+                out.data[o + k] += small.data[s + k];
+            }
+        }
+    }
+    Some(out)
+}
+
+/// The network's input: each cell holds the 3×3 neighbourhood (stride 2) of BGR values `0..=255`,
+/// so the first, 3×3 stride-2 convolution is a pointwise one. The size is padded to 32.
+fn input(bgr: &[[f32; 3]], w: usize, h: usize) -> Blob {
+    let rows = h.div_ceil(32) * 16;
+    let cols = w.div_ceil(32) * 16;
+    let mut b = Blob::new(rows, cols, 32);
+    for r in 0..rows {
+        for c in 0..cols {
+            let cell = (r * cols + c) * 32;
+            for fy in 0..3 {
+                let Some(y) = (r * 2 + fy).checked_sub(1).filter(|&y| y < h) else { continue };
+                for fx in 0..3 {
+                    let Some(x) = (c * 2 + fx).checked_sub(1).filter(|&x| x < w) else { continue };
+                    let o = cell + (fy * 3 + fx) * 3;
+                    b.data[o..o + 3].copy_from_slice(&bgr[y * w + x]);
+                }
+            }
+        }
+    }
+    b
+}
+
+/// The heads of one pyramid level, decoded to candidate faces (in network pixels).
+fn candidates(feat: &Blob, l: &[Layer], heads: [usize; 4], stride: f32, out: &mut Vec<Face>) -> Option<()> {
+    let head = |i: usize| conv_dp(feat, l.get(i)?, l.get(i + 1)?, false);
+    let (cls, reg, obj, kps) = (head(heads[0])?, head(heads[1])?, head(heads[2])?, head(heads[3])?);
+    if cls.channels != 1 || obj.channels != 1 || reg.channels != 4 || kps.channels != 10 {
+        return None;
+    }
+    let sigmoid = |v: f32| 1.0 / (1.0 + (-v.clamp(-88.0, 88.0)).exp());
+    for r in 0..feat.rows {
+        for c in 0..feat.cols {
+            let i = r * feat.cols + c;
+            let score = (sigmoid(cls.data[i]) * sigmoid(obj.data[i])).sqrt();
+            if score < 0.2 {
+                continue;
+            }
+            let (px, py) = (c as f32 * stride, r as f32 * stride);
+            let b = &reg.data[i * 4..i * 4 + 4];
+            let (cx, cy) = (b[0] * stride + px, b[1] * stride + py);
+            let (bw, bh) = (b[2].exp() * stride, b[3].exp() * stride);
+            let k = &kps.data[i * 10..i * 10 + 10];
+            let mut landmarks = [[0.0; 2]; 5];
+            for (n, lm) in landmarks.iter_mut().enumerate() {
+                *lm = [k[2 * n] * stride + px, k[2 * n + 1] * stride + py];
+            }
+            out.push(Face { score, rect: [cx - bw / 2.0, cy - bh / 2.0, bw, bh], landmarks });
+        }
+    }
+    Some(())
+}
+
+fn iou(a: &[f32; 4], b: &[f32; 4]) -> f32 {
+    let w = ((a[0] + a[2]).min(b[0] + b[2]) - a[0].max(b[0])).max(0.0);
+    let h = ((a[1] + a[3]).min(b[1] + b[3]) - a[1].max(b[1])).max(0.0);
+    let i = w * h;
+    if i <= 0.0 { 0.0 } else { i / (a[2] * a[3] + b[2] * b[3] - i) }
+}
+
+/// The heads (cls, reg, obj, kps: their first layer) of the stride 8, 16 and 32 levels.
+const HEADS: [[usize; 4]; 3] = [[29, 35, 41, 47], [31, 37, 43, 49], [33, 39, 45, 51]];
+
+/// The backbone and feature pyramid: the stride 8, 16 and 32 feature maps the heads read.
+fn features(bgr: &[[f32; 3]], w: usize, h: usize, l: &[Layer]) -> Option<[Blob; 3]> {
+    let x = conv(&input(bgr, w, h), l.first()?, true)?;
+    let x = max_pool(&conv_dp(&x, l.get(1)?, l.get(2)?, true)?);
+    let x = unit(&unit(&x, l.get(3..7)?)?, l.get(7..11)?)?;
+    let f8 = unit(&max_pool(&x), l.get(11..15)?)?;
+    let f16 = unit(&max_pool(&f8), l.get(15..19)?)?;
+    let f32_ = unit(&max_pool(&f16), l.get(19..23)?)?;
+    let f32_ = conv_dp(&f32_, l.get(27)?, l.get(28)?, true)?;
+    let f16 = conv_dp(&up_add(&f32_, &f16)?, l.get(25)?, l.get(26)?, true)?;
+    let f8 = conv_dp(&up_add(&f16, &f8)?, l.get(23)?, l.get(24)?, true)?;
+    Some([f8, f16, f32_])
+}
+
+pub(super) fn network(bgr: &[[f32; 3]], w: usize, h: usize) -> Option<Vec<Face>> {
+    let l = parse(WEIGHTS)?;
+    let levels = features(bgr, w, h, &l)?;
+    let mut faces = Vec::new();
+    // Heads (cls, reg, obj, kps) per level, as in the library's model.
+    for ((feat, heads), stride) in levels.iter().zip(HEADS).zip([8.0, 16.0, 32.0]) {
+        candidates(feat, &l, heads, stride, &mut faces)?;
+    }
+    faces.sort_by(|a, b| b.score.total_cmp(&a.score));
+    faces.truncate(TOP_K);
+    let mut kept: Vec<Face> = Vec::new();
+    for f in faces {
+        if kept.iter().all(|k| iou(&k.rect, &f.rect) <= NMS_OVERLAP) {
+            kept.push(f);
+        }
+    }
+    Some(kept)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn weights_parse() {
+        let l = parse(WEIGHTS).expect("bundled weights");
+        assert_eq!(l.len(), LAYERS);
+        assert_eq!((l[0].channels, l[0].filters, l[0].depthwise), (32, 16, false));
+        assert_eq!((l[2].channels, l[2].filters, l[2].depthwise), (16, 16, true));
+        assert!(l.iter().all(|l| l.weights.iter().chain(&l.biases).all(|v| v.is_finite())));
+        // Damaged weights are refused, not read past their end.
+        assert!(parse(&WEIGHTS[..WEIGHTS.len() - 1]).is_none());
+        assert!(parse(b"nope").is_none());
+    }
+
+    /// The sum of every head's raw output on a fixed test image matches libfacedetection's own C++
+    /// (computed with its f32 weights; ours are f16, hence the tolerance).
+    #[test]
+    fn heads_match_the_reference_implementation() {
+        let (w, h) = (96usize, 72usize);
+        let bgr: Vec<[f32; 3]> = (0..w * h)
+            .map(|i| {
+                let (x, y) = (i % w, i / w);
+                let (r, g, b) = ((x * 7 + y * 3) % 256, (x * x + y * 5) % 256, (x * y * 3 + 11) % 256);
+                [b as f32, g as f32, r as f32]
+            })
+            .collect();
+        let l = parse(WEIGHTS).unwrap();
+        let levels = features(&bgr, w, h, &l).unwrap();
+        let reference =
+            [27.647039, 549.579923, -1645.299678, 914.784787, -6.149318, 35.705980, -454.742148, 163.847111, 1.267630, 28.415509, -85.662257, 62.294208];
+        let mut got = Vec::new();
+        for (feat, heads) in levels.iter().zip(HEADS) {
+            for first in heads {
+                let o = conv_dp(feat, &l[first], &l[first + 1], false).unwrap();
+                got.push(o.data.iter().map(|&v| f64::from(v)).sum::<f64>());
+            }
+        }
+        for (g, r) in got.iter().zip(reference) {
+            assert!((g - r).abs() <= 0.01 * r.abs().max(10.0), "{got:?}");
+        }
+    }
+
+    #[test]
+    fn f16_decoding() {
+        assert_eq!(f16_to_f32(0x3c00), 1.0);
+        assert_eq!(f16_to_f32(0xc000), -2.0);
+        assert_eq!(f16_to_f32(0x0000), 0.0);
+        assert_eq!(f16_to_f32(0x3555), 0.333_251_95);
+        assert_eq!(f16_to_f32(0x0001), 2.0f32.powi(-24));
+    }
+}
diff --git a/crates/algo/src/features.rs b/crates/algo/src/features.rs
index ab98de757e..ec74891074 100644
--- a/crates/algo/src/features.rs
+++ b/crates/algo/src/features.rs
@@ -60,25 +60,98 @@ impl Rng {
     }
 }
 
+/// Columns per band of the vertical blur pass: 64 f32 = 256 bytes = four cache lines per row, so
+/// walking down a band touches whole lines, and the band's working set stays in cache.
+const BLUR_BAND: usize = 64;
+
+/// Box blur of radius `r` (edges clamped): a running f32 sum along rows, then along columns.
+///
+/// Both passes are parallel and give bit for bit what the one-line-at-a-time version gave: every
+/// output sums its window in the same order. Rows are independent. For the column pass, the
+/// image is cut into bands of columns; each column keeps its own f32 running sum, started from
+/// its first window summed in order and updated in the same order, so only the loop nest changes
+/// (the inner loop runs across a band's columns and vectorises), never any column's arithmetic.
 fn blur(w: usize, h: usize, v: &[f32], r: usize) -> Vec<f32> {
-    let pass = |src: &[f32], horizontal: bool| -> Vec<f32> {
-        let mut dst = vec![0.0f32; src.len()];
-        let (n, m) = if horizontal { (h, w) } else { (w, h) };
-        for line in 0..n {
-            let at = |k: i64| {
-                let k = k.clamp(0, m as i64 - 1) as usize;
-                if horizontal { src[line * w + k] } else { src[k * w + line] }
-            };
-            let mut acc: f32 = (-(r as i64)..=r as i64).map(at).sum();
-            for k in 0..m {
-                let i = if horizontal { line * w + k } else { k * w + line };
-                dst[i] = acc / (2 * r + 1) as f32;
-                acc += at(k as i64 + r as i64 + 1) - at(k as i64 - r as i64);
+    if w == 0 || h == 0 {
+        return Vec::new();
+    }
+    let den = (2 * r + 1) as f32;
+    let mut tmp = vec![0.0f32; w * h];
+    par_rows(&mut tmp, w, |line, dst| {
+        let src = &v[line * w..(line + 1) * w];
+        let at = |k: i64| src[k.clamp(0, w as i64 - 1) as usize];
+        let mut acc: f32 = (-(r as i64)..=r as i64).map(at).sum();
+        for (k, o) in dst.iter_mut().enumerate() {
+            *o = acc / den;
+            acc += at(k as i64 + r as i64 + 1) - at(k as i64 - r as i64);
+        }
+    });
+    let mut dst = vec![0.0f32; w * h];
+    // One list of row segments per band, each segment a `&mut` slice of `dst`: no `unsafe`.
+    let mut bands: Vec<Vec<&mut [f32]>> = (0..w.div_ceil(BLUR_BAND)).map(|_| Vec::with_capacity(h)).collect();
+    for row in dst.chunks_exact_mut(w) {
+        for (band, seg) in bands.iter_mut().zip(row.chunks_mut(BLUR_BAND)) {
+            band.push(seg);
+        }
+    }
+    let src = &tmp;
+    let run = |bi: usize, segs: &mut [&mut [f32]], acc: &mut Vec<f32>| {
+        let (x0, bw) = (bi * BLUR_BAND, segs.first().map_or(0, |s| s.len()));
+        let row = |k: i64| {
+            let o = (k.clamp(0, h as i64 - 1) as usize) * w + x0;
+            &src[o..o + bw]
+        };
+        // The first window, summed in order from the same start as `Iterator::sum` uses.
+        acc.clear();
+        acc.resize(bw, std::iter::empty::<f32>().sum());
+        for k in -(r as i64)..=r as i64 {
+            for (t, &x) in acc.iter_mut().zip(row(k)) {
+                *t += x;
+            }
+        }
+        for (k, seg) in segs.iter_mut().enumerate() {
+            let (add, sub) = (row(k as i64 + r as i64 + 1), row(k as i64 - r as i64));
+            for (((o, t), &p), &m) in seg.iter_mut().zip(acc.iter_mut()).zip(add).zip(sub) {
+                *o = *t / den;
+                *t += p - m;
             }
         }
-        dst
     };
-    pass(&pass(v, true), false)
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        use rayon::prelude::*;
+        bands.into_par_iter().enumerate().for_each_init(Vec::new, |acc, (bi, mut segs)| run(bi, &mut segs, acc));
+    }
+    #[cfg(target_arch = "wasm32")]
+    {
+        let mut acc = Vec::new();
+        for (bi, mut segs) in bands.into_iter().enumerate() {
+            run(bi, &mut segs, &mut acc);
+        }
+    }
+    dst
+}
+
+/// Runs `f(y, row)` over the `w`-wide rows of `buf`, in parallel on native targets.
+fn par_rows(buf: &mut [f32], w: usize, f: impl Fn(usize, &mut [f32]) + Sync + Send) {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        use rayon::prelude::*;
+        buf.par_chunks_mut(w).enumerate().for_each(|(y, row)| f(y, row));
+    }
+    #[cfg(target_arch = "wasm32")]
+    buf.chunks_mut(w).enumerate().for_each(|(y, row)| f(y, row));
+}
+
+/// [`par_rows`] over three row-aligned buffers in lockstep.
+fn par_rows3(a: &mut [f32], b: &mut [f32], c: &mut [f32], w: usize, f: impl Fn(usize, &mut [f32], &mut [f32], &mut [f32]) + Sync + Send) {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        use rayon::prelude::*;
+        a.par_chunks_mut(w).zip(b.par_chunks_mut(w)).zip(c.par_chunks_mut(w)).enumerate().for_each(|(y, ((a, b), c))| f(y, a, b, c));
+    }
+    #[cfg(target_arch = "wasm32")]
+    a.chunks_mut(w).zip(b.chunks_mut(w)).zip(c.chunks_mut(w)).enumerate().for_each(|(y, ((a, b), c))| f(y, a, b, c));
 }
 
 /// Harris corners: at most `max` corners at least `min_dist` pixels apart, strongest first,
@@ -88,28 +161,40 @@ pub fn harris(w: usize, h: usize, img: &[f32], max: usize, min_dist: f32, valid:
         return Vec::new();
     }
     let (mut xx, mut yy, mut xy) = (vec![0.0f32; w * h], vec![0.0f32; w * h], vec![0.0f32; w * h]);
-    for y in 1..h - 1 {
+    // Rows are independent (each output pixel reads only `img`), so they run in parallel.
+    par_rows3(&mut xx, &mut yy, &mut xy, w, |y, xxr, yyr, xyr| {
+        if y == 0 || y + 1 == h {
+            return;
+        }
         for x in 1..w - 1 {
             let p = |dx: i64, dy: i64| img[((y as i64 + dy) as usize) * w + (x as i64 + dx) as usize];
             // Sobel.
             let gx = (p(1, -1) + 2.0 * p(1, 0) + p(1, 1)) - (p(-1, -1) + 2.0 * p(-1, 0) + p(-1, 1));
             let gy = (p(-1, 1) + 2.0 * p(0, 1) + p(1, 1)) - (p(-1, -1) + 2.0 * p(0, -1) + p(1, -1));
-            let i = y * w + x;
-            xx[i] = gx * gx;
-            yy[i] = gy * gy;
-            xy[i] = gx * gy;
+            xxr[x] = gx * gx;
+            yyr[x] = gy * gy;
+            xyr[x] = gx * gy;
         }
-    }
+    });
     // Two box passes approximate the Gaussian window.
     let (xx, yy, xy) = (blur(w, h, &blur(w, h, &xx, 1), 1), blur(w, h, &blur(w, h, &yy, 1), 1), blur(w, h, &blur(w, h, &xy, 1), 1));
-    let r: Vec<f32> = (0..w * h).map(|i| xx[i] * yy[i] - xy[i] * xy[i] - 0.04 * (xx[i] + yy[i]).powi(2)).collect();
+    let mut r = vec![0.0f32; w * h];
+    par_rows(&mut r, w, |y, row| {
+        for (x, o) in row.iter_mut().enumerate() {
+            let i = y * w + x;
+            *o = xx[i] * yy[i] - xy[i] * xy[i] - 0.04 * (xx[i] + yy[i]).powi(2);
+        }
+    });
     let peak = r.iter().copied().fold(0.0f32, f32::max);
     if peak <= 0.0 {
         return Vec::new();
     }
     let m = PATCH_RADIUS + 1;
-    let mut cand: Vec<Corner> = Vec::new();
-    for y in m..h - m {
+    // Rows are scanned in parallel and joined in row order; the sort below fully orders the
+    // candidates anyway (score, then y, then x), so the order they arrive in cannot matter.
+    let rows = par_map((h - m).saturating_sub(m), |i| {
+        let y = m + i;
+        let mut found: Vec<Corner> = Vec::new();
         for x in m..w - m {
             let v = r[y * w + x];
             if v < peak * 0.01 {
@@ -125,9 +210,11 @@ pub fn harris(w: usize, h: usize, img: &[f32], max: usize, min_dist: f32, valid:
                     continue;
                 }
             }
-            cand.push(Corner { x: x as f32, y: y as f32, score: v });
+            found.push(Corner { x: x as f32, y: y as f32, score: v });
         }
-    }
+        found
+    });
+    let mut cand: Vec<Corner> = rows.into_iter().flatten().collect();
     cand.sort_by(|a, b| b.score.total_cmp(&a.score).then(a.y.total_cmp(&b.y)).then(a.x.total_cmp(&b.x)));
     // Minimum spacing via a coarse occupancy grid.
     let cell = min_dist.max(1.0);
@@ -176,37 +263,37 @@ pub fn describe(w: usize, h: usize, img: &[f32], corners: &[Corner], upright: bo
         let (xi, yi) = ((x.round() as i64).clamp(0, w as i64 - 1) as usize, (y.round() as i64).clamp(0, h as i64 - 1) as usize);
         smooth[yi * w + xi]
     };
-    corners
-        .iter()
-        .map(|c| {
-            let (s, co) = if upright {
-                (0.0, 1.0)
-            } else {
-                let (mut m10, mut m01) = (0.0f32, 0.0f32);
-                let r = PATCH_RADIUS as i64;
-                for dy in -r..=r {
-                    for dx in -r..=r {
-                        if dx * dx + dy * dy <= r * r {
-                            let v = at(c.x + dx as f32, c.y + dy as f32);
-                            m10 += dx as f32 * v;
-                            m01 += dy as f32 * v;
-                        }
+    // Every descriptor depends only on its own corner and the smoothed image: computed in
+    // parallel, kept in corner order.
+    par_map(corners.len(), |ci| {
+        let c = &corners[ci];
+        let (s, co) = if upright {
+            (0.0, 1.0)
+        } else {
+            let (mut m10, mut m01) = (0.0f32, 0.0f32);
+            let r = PATCH_RADIUS as i64;
+            for dy in -r..=r {
+                for dx in -r..=r {
+                    if dx * dx + dy * dy <= r * r {
+                        let v = at(c.x + dx as f32, c.y + dy as f32);
+                        m10 += dx as f32 * v;
+                        m01 += dy as f32 * v;
                     }
                 }
-                m01.atan2(m10).sin_cos()
-            };
-            let mut d = [0u64; 4];
-            for (i, p) in pairs().iter().enumerate() {
-                let rot = |x: f32, y: f32| (c.x + x * co - y * s, c.y + x * s + y * co);
-                let (ax, ay) = rot(p[0], p[1]);
-                let (bx, by) = rot(p[2], p[3]);
-                if at(ax, ay) < at(bx, by) {
-                    d[i / 64] |= 1 << (i % 64);
-                }
             }
-            d
-        })
-        .collect()
+            m01.atan2(m10).sin_cos()
+        };
+        let mut d = [0u64; 4];
+        for (i, p) in pairs().iter().enumerate() {
+            let rot = |x: f32, y: f32| (c.x + x * co - y * s, c.y + x * s + y * co);
+            let (ax, ay) = rot(p[0], p[1]);
+            let (bx, by) = rot(p[2], p[3]);
+            if at(ax, ay) < at(bx, by) {
+                d[i / 64] |= 1 << (i % 64);
+            }
+        }
+        d
+    })
 }
 
 pub fn hamming(a: &Descriptor, b: &Descriptor) -> u32 {
@@ -560,3 +647,124 @@ mod tests {
         assert_eq!(hamming(&[0, 0, 0, 0], &[1, 3, 0, u64::MAX]), 67);
     }
 }
+
+/// The row / column-band parallel `blur`, `harris` and `describe` against the serial code they
+/// replaced. Every output must stay bit for bit the same.
+#[cfg(test)]
+mod parallel_tests {
+    use super::*;
+
+    /// The serial blur exactly as it was before the parallelisation.
+    fn ref_blur(w: usize, h: usize, v: &[f32], r: usize) -> Vec<f32> {
+        let pass = |src: &[f32], horizontal: bool| -> Vec<f32> {
+            let mut dst = vec![0.0f32; src.len()];
+            let (n, m) = if horizontal { (h, w) } else { (w, h) };
+            for line in 0..n {
+                let at = |k: i64| {
+                    let k = k.clamp(0, m as i64 - 1) as usize;
+                    if horizontal { src[line * w + k] } else { src[k * w + line] }
+                };
+                let mut acc: f32 = (-(r as i64)..=r as i64).map(at).sum();
+                for k in 0..m {
+                    let i = if horizontal { line * w + k } else { k * w + line };
+                    dst[i] = acc / (2 * r + 1) as f32;
+                    acc += at(k as i64 + r as i64 + 1) - at(k as i64 - r as i64);
+                }
+            }
+            dst
+        };
+        pass(&pass(v, true), false)
+    }
+
+    fn mix(mut z: u64) -> u64 {
+        z = z.wrapping_add(0x9E37_79B9_7F4A_7C15);
+        z = (z ^ (z >> 30)).wrapping_mul(0xBF58_476D_1CE4_E5B9);
+        z = (z ^ (z >> 27)).wrapping_mul(0x94D0_49BB_1331_11EB);
+        z ^ (z >> 31)
+    }
+
+    /// Integer-only data with negatives, signed zeros and large values, so a different order of
+    /// additions cannot hide.
+    fn noise(len: usize, seed: u64) -> Vec<f32> {
+        (0..len as u64)
+            .map(|i| {
+                let z = mix(seed.wrapping_mul(0x1234_5678_9ABC).wrapping_add(i));
+                let v = (z >> 40) as f32 / 16_777_216.0;
+                match z & 31 {
+                    0 => -v,
+                    1 => -0.0,
+                    2 => v * 1000.0,
+                    _ => v,
+                }
+            })
+            .collect()
+    }
+
+    /// Blocks of random brightness: lots of strong corners, no libm in the making. Only the
+    /// recorded-hash test below uses it, and that one is Linux x86_64 only.
+    #[cfg(all(target_os = "linux", target_arch = "x86_64"))]
+    fn blocks(w: usize, h: usize, seed: u64) -> Vec<f32> {
+        (0..w * h).map(|i| (mix(seed + ((i % w) / 8) as u64 * 4096 + ((i / w) / 8) as u64) >> 40) as f32 / 16_777_216.0).collect()
+    }
+
+    #[cfg(all(target_os = "linux", target_arch = "x86_64"))]
+    fn fnv(parts: &[u64]) -> u64 {
+        let mut h = 0xcbf2_9ce4_8422_2325u64;
+        for p in parts {
+            h ^= p;
+            h = h.wrapping_mul(0x0000_0100_0000_01b3);
+        }
+        h
+    }
+
+    #[test]
+    fn blur_matches_the_serial_code() {
+        // Widths around the 64-column band (1 band, band + 1, several bands, a ragged last one),
+        // 1-wide and 1-high images, and radii 0, 1, 2, larger than the image.
+        let widths = [1usize, 2, 3, 31, 63, 64, 65, 127, 128, 129, 200];
+        let heights = [1usize, 2, 3, 5, 17, 40];
+        for (a, &w) in widths.iter().enumerate() {
+            for (b, &h) in heights.iter().enumerate() {
+                let v = noise(w * h, (a * 10 + b) as u64);
+                for r in [0usize, 1, 2, 3, 7, 50] {
+                    let (got, want) = (blur(w, h, &v, r), ref_blur(w, h, &v, r));
+                    let (g, e): (Vec<u32>, Vec<u32>) = (got.iter().map(|x| x.to_bits()).collect(), want.iter().map(|x| x.to_bits()).collect());
+                    assert_eq!(g, e, "blur {w}x{h} r={r}");
+                }
+            }
+        }
+        assert!(blur(0, 0, &[], 1).is_empty());
+    }
+
+    // `harris` and `describe` go through the platform's hypot / ln / cos / atan2 / sin_cos, so the
+    // hashes recorded from the old code only hold where those are the same functions.
+    #[cfg(all(target_os = "linux", target_arch = "x86_64"))]
+    #[test]
+    fn harris_and_describe_hashes_recorded_from_the_serial_code() {
+        // Sizes: a whole number of 64-column bands and a ragged one; with and without a validity mask.
+        for (w, h, max, md, want_corners, want_desc) in
+            [(211usize, 157usize, 300usize, 6.0f32, 0xeccc6928d3ae3b8cu64, 0xd1e6caae4d68f253u64), (128, 97, 60, 3.0, 0xe3f6615117fa7da7, 0x818ae7e965ecf88f)]
+        {
+            let img = blocks(w, h, 7);
+            let valid: Vec<bool> = (0..w * h).map(|i| !((i % w) > w / 2 && (i / w) < h / 3)).collect();
+            let mut parts = Vec::new();
+            for v in [None, Some(valid.as_slice())] {
+                let c = harris(w, h, &img, max, md, v);
+                for k in &c {
+                    parts.extend([k.x.to_bits() as u64, k.y.to_bits() as u64, k.score.to_bits() as u64]);
+                }
+                parts.push(c.len() as u64);
+            }
+            assert_eq!(fnv(&parts), want_corners, "harris {w}x{h}");
+            let c = harris(w, h, &img, max, md, None);
+            assert!(c.len() > 10, "{} corners", c.len());
+            let mut parts = Vec::new();
+            for upright in [false, true] {
+                for d in describe(w, h, &img, &c, upright) {
+                    parts.extend(d);
+                }
+            }
+            assert_eq!(fnv(&parts), want_desc, "describe {w}x{h}");
+        }
+    }
+}
diff --git a/crates/algo/src/lib.rs b/crates/algo/src/lib.rs
index 49ab15871c..c2ff6d2e6c 100644
--- a/crates/algo/src/lib.rs
+++ b/crates/algo/src/lib.rs
@@ -32,6 +32,7 @@ mod distort;
 mod distort2;
 pub mod erase;
 pub mod exif;
+pub mod faces;
 pub mod features;
 mod fxutil;
 mod gallery;
diff --git a/crates/algo/src/other2.rs b/crates/algo/src/other2.rs
index b5a16f06ea..61ccfc0038 100644
--- a/crates/algo/src/other2.rs
+++ b/crates/algo/src/other2.rs
@@ -8,7 +8,8 @@ use crate::image::Image;
 use crate::{Ctx, HsbModel};
 
 /// Custom: `Σ kernel·pixel / scale + offset/255` per colour channel (alpha
-/// kept). Kernels shorter than 25 entries are zero-padded.
+/// kept). Kernels shorter than 25 entries are zero-padded. CMYK samples are
+/// ink, so there it runs on `1 - ink` and a positive offset brightens.
 pub(crate) fn custom(src: &Image, out: Rect, ctx: &Ctx, kernel: &[f32], scale: f32, offset: f32) -> Vec<f32> {
     let n = src.ch;
     let cc = ncol(ctx, n);
@@ -16,6 +17,7 @@ pub(crate) fn custom(src: &Image, out: Rect, ctx: &Ctx, kernel: &[f32], scale: f
         (0..25).filter_map(|i| kernel.get(i).copied().filter(|v| *v != 0.0).map(|v| (i as i32 % 5 - 2, i as i32 / 5 - 2, v))).collect();
     let s = if scale == 0.0 { 1.0 } else { scale };
     let off = offset / 255.0;
+    let sub = crate::fxutil::subtractive(ctx);
     let mut res = src.crop(out);
     if k.is_empty() {
         return res;
@@ -23,8 +25,10 @@ pub(crate) fn custom(src: &Image, out: Rect, ctx: &Ctx, kernel: &[f32], scale: f
     for (i, px) in res.chunks_exact_mut(n).enumerate() {
         let (x, y) = xy(out, i);
         for (c, v) in px.iter_mut().enumerate().take(cc) {
-            let sum: f32 = k.iter().map(|&(dx, dy, w)| src.get(x + dx, y + dy, c) * w).sum();
-            *v = sum / s + off;
+            // CMYK: convolve brightness (1 - ink), then back to ink.
+            let lum = |v: f32| if sub { 1.0 - v } else { v };
+            let sum: f32 = k.iter().map(|&(dx, dy, w)| lum(src.get(x + dx, y + dy, c)) * w).sum();
+            *v = lum(sum / s + off);
         }
     }
     res
diff --git a/crates/algo/src/panorama.rs b/crates/algo/src/panorama.rs
index fd7ccbc591..abe17db395 100644
--- a/crates/algo/src/panorama.rs
+++ b/crates/algo/src/panorama.rs
@@ -35,7 +35,7 @@
 #![allow(clippy::needless_range_loop)] // index loops mirror the maths (pixels × channels)
 
 use crate::features::{self, Descriptor, Model};
-use crate::photo_util::{Normal, Rng, par_map, solve_dense};
+use crate::photo_util::{Normal, Rng, par_map, par_rows, solve_dense};
 use crate::transform::Homography;
 
 /// Photomerge layouts.
@@ -996,58 +996,99 @@ pub fn blend_levels(w: usize, h: usize) -> usize {
     n
 }
 
+/// `a[i] ⊕ b[i]` for every `i` (the shorter length wins, like `zip`), in parallel on native
+/// targets. Purely elementwise, so the result is the serial result bit for bit.
+fn par_zip(a: &[f32], b: &[f32], f: impl Fn(f32, f32) -> f32 + Sync + Send) -> Vec<f32> {
+    const CHUNK: usize = 1 << 14;
+    let mut out = vec![0.0f32; a.len().min(b.len())];
+    let fill = |o: &mut [f32], a: &[f32], b: &[f32]| {
+        for ((o, &a), &b) in o.iter_mut().zip(a).zip(b) {
+            *o = f(a, b);
+        }
+    };
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        use rayon::prelude::*;
+        out.par_chunks_mut(CHUNK).zip(a.par_chunks(CHUNK)).zip(b.par_chunks(CHUNK)).for_each(|((o, a), b)| fill(o, a, b));
+    }
+    #[cfg(target_arch = "wasm32")]
+    out.chunks_mut(CHUNK).zip(a.chunks(CHUNK)).zip(b.chunks(CHUNK)).for_each(|((o, a), b)| fill(o, a, b));
+    out
+}
+
+/// `f(a[i])` for every `i`, in parallel on native targets (elementwise, so bit for bit serial).
+fn par_map1(a: &[f32], f: impl Fn(f32) -> f32 + Sync + Send) -> Vec<f32> {
+    par_zip(a, a, |x, _| f(x))
+}
+
+// `reduce`, `expand` and `push_pull` run one pyramid level for one image at a time, and the
+// images themselves only fill part of a many-core machine, so each of them also runs its rows
+// in parallel. Every output element is computed by the same expression, in the same order, as
+// the one-thread loops they replace (rows never read each other's output), so the result is
+// bit for bit unchanged.
+
 fn reduce(w: usize, h: usize, ch: usize, src: &[f32]) -> (usize, usize, Vec<f32>) {
     let (nw, nh) = (w.div_ceil(2), h.div_ceil(2));
     let k = [1.0f32, 4.0, 6.0, 4.0, 1.0];
     // Separable 5-tap binomial, then decimate.
     let mut tmp = vec![0.0f32; nw * h * ch];
-    for y in 0..h {
+    par_rows(&mut tmp, nw, ch, |y, row| {
+        let line = &src[y * w * ch..(y + 1) * w * ch];
         for x in 0..nw {
+            // The clamped source column of each tap is the same for every channel.
+            let xs: [usize; 5] = std::array::from_fn(|t| (2 * x as i64 + t as i64 - 2).clamp(0, w as i64 - 1) as usize * ch);
             for c in 0..ch {
                 let mut s = 0.0;
-                for (t, kv) in k.iter().enumerate() {
-                    let xx = (2 * x as i64 + t as i64 - 2).clamp(0, w as i64 - 1) as usize;
-                    s += kv * src[(y * w + xx) * ch + c];
+                for (kv, xx) in k.iter().zip(xs) {
+                    s += kv * line[xx + c];
                 }
-                tmp[(y * nw + x) * ch + c] = s / 16.0;
+                row[x * ch + c] = s / 16.0;
             }
         }
-    }
+    });
     let mut out = vec![0.0f32; nw * nh * ch];
-    for y in 0..nh {
-        for x in 0..nw {
-            for c in 0..ch {
-                let mut s = 0.0;
-                for (t, kv) in k.iter().enumerate() {
-                    let yy = (2 * y as i64 + t as i64 - 2).clamp(0, h as i64 - 1) as usize;
-                    s += kv * tmp[(yy * nw + x) * ch + c];
-                }
-                out[(y * nw + x) * ch + c] = s / 16.0;
+    par_rows(&mut out, nw, ch, |y, row| {
+        // Each output row is five source rows added in tap order: the same sum per element as
+        // before (`0 + k0·a + k1·b + …`), but over whole rows so it vectorises.
+        for (t, kv) in k.iter().enumerate() {
+            let yy = (2 * y as i64 + t as i64 - 2).clamp(0, h as i64 - 1) as usize;
+            for (o, &v) in row.iter_mut().zip(&tmp[yy * nw * ch..(yy + 1) * nw * ch]) {
+                *o += kv * v;
             }
         }
-    }
+        for o in row.iter_mut() {
+            *o /= 16.0;
+        }
+    });
     (nw, nh, out)
 }
 
 fn expand(sw: usize, sh: usize, ch: usize, src: &[f32], w: usize, h: usize) -> Vec<f32> {
     // Bilinear upsampling at half-pixel-aligned positions.
     let mut out = vec![0.0f32; w * h * ch];
-    for y in 0..h {
-        let fy = ((y as f32 + 0.5) / 2.0 - 0.5).clamp(0.0, (sh - 1) as f32);
-        let (y0, ty) = (fy.floor() as usize, fy - fy.floor());
-        let y1 = (y0 + 1).min(sh - 1);
-        for x in 0..w {
+    // Source columns and weights depend on x only: worked out once instead of for every row.
+    // The clamped position is never negative, so truncating is `floor` (and spares the libm call).
+    let cols: Vec<(usize, usize, f32)> = (0..w)
+        .map(|x| {
             let fx = ((x as f32 + 0.5) / 2.0 - 0.5).clamp(0.0, (sw - 1) as f32);
-            let (x0, tx) = (fx.floor() as usize, fx - fx.floor());
-            let x1 = (x0 + 1).min(sw - 1);
-            for c in 0..ch {
-                let p = |xx: usize, yy: usize| src[(yy * sw + xx) * ch + c];
-                let top = p(x0, y0) + (p(x1, y0) - p(x0, y0)) * tx;
-                let bot = p(x0, y1) + (p(x1, y1) - p(x0, y1)) * tx;
-                out[(y * w + x) * ch + c] = top + (bot - top) * ty;
+            let x0 = fx as usize;
+            (x0 * ch, (x0 + 1).min(sw - 1) * ch, fx - x0 as f32)
+        })
+        .collect();
+    par_rows(&mut out, w, ch, |y, row| {
+        let fy = ((y as f32 + 0.5) / 2.0 - 0.5).clamp(0.0, (sh - 1) as f32);
+        let y0 = fy as usize;
+        let ty = fy - y0 as f32;
+        let y1 = (y0 + 1).min(sh - 1);
+        let (r0, r1) = (&src[y0 * sw * ch..(y0 + 1) * sw * ch], &src[y1 * sw * ch..(y1 + 1) * sw * ch]);
+        for (px, &(x0, x1, tx)) in row.chunks_exact_mut(ch.max(1)).zip(&cols) {
+            for (c, o) in px.iter_mut().enumerate() {
+                let top = r0[x0 + c] + (r0[x1 + c] - r0[x0 + c]) * tx;
+                let bot = r1[x0 + c] + (r1[x1 + c] - r1[x0 + c]) * tx;
+                *o = top + (bot - top) * ty;
             }
         }
-    }
+    });
     out
 }
 
@@ -1058,41 +1099,75 @@ fn push_pull(w: usize, h: usize, ch: usize, px: &mut [f32], wt: &[f32]) {
         return;
     }
     let (nw, nh) = (w.div_ceil(2), h.div_ceil(2));
+    // Coarse sums. A coarse row is fed by two fine rows; walking them in raster order adds each
+    // coarse cell's (up to) four fine pixels in the order the serial scatter-add did, from zero.
     let mut cpx = vec![0.0f32; nw * nh * ch];
     let mut cw = vec![0.0f32; nw * nh];
-    for y in 0..h {
-        for x in 0..w {
-            let (i, j) = (y * w + x, (y / 2) * nw + x / 2);
-            let a = wt[i];
-            cw[j] += a;
-            for c in 0..ch {
-                cpx[j * ch + c] += a * px[i * ch + c];
+    par_rows(&mut cw, nw, 1, |cy, row| {
+        for y in 2 * cy..(2 * cy + 2).min(h) {
+            for (x, &a) in wt[y * w..(y + 1) * w].iter().enumerate() {
+                row[x / 2] += a;
             }
         }
-    }
-    for j in 0..nw * nh {
-        if cw[j] > 0.0 {
-            for c in 0..ch {
-                cpx[j * ch + c] /= cw[j];
+    });
+    let px_in: &[f32] = px;
+    par_rows(&mut cpx, nw, ch, |cy, row| {
+        for y in 2 * cy..(2 * cy + 2).min(h) {
+            for x in 0..w {
+                let (i, j) = (y * w + x, x / 2);
+                let a = wt[i];
+                for c in 0..ch {
+                    row[j * ch + c] += a * px_in[i * ch + c];
+                }
             }
-            cw[j] = 1.0;
+        }
+    });
+    // Normalise by the weight (this reads `cw` before it is reset to 0 / 1 below).
+    par_rows(&mut cpx, nw, ch, |cy, row| {
+        for cx in 0..nw {
+            let wj = cw[cy * nw + cx];
+            if wj > 0.0 {
+                for c in 0..ch {
+                    row[cx * ch + c] /= wj;
+                }
+            }
+        }
+    });
+    for v in cw.iter_mut() {
+        if *v > 0.0 {
+            *v = 1.0;
         }
     }
     if cw.contains(&0.0) && cw.iter().any(|v| *v > 0.0) {
         push_pull(nw, nh, ch, &mut cpx, &cw);
     }
-    for y in 0..h {
+    par_rows(px, w, ch, |y, row| {
         for x in 0..w {
             let i = y * w + x;
             if wt[i] < 1.0 {
                 let j = (y / 2) * nw + x / 2;
                 let a = wt[i];
                 for c in 0..ch {
-                    px[i * ch + c] = a * px[i * ch + c] + (1.0 - a) * cpx[j * ch + c];
+                    row[x * ch + c] = a * row[x * ch + c] + (1.0 - a) * cpx[j * ch + c];
                 }
             }
         }
-    }
+    });
+}
+
+/// One image's pyramid in [`multiband`]: the grid origin `(gx0, gy0)` at level 0, the Laplacian
+/// levels `(w, h, colours)` and the Gaussian weight levels.
+type PyramidBand = (i32, i32, Vec<(usize, usize, Vec<f32>)>, Vec<Vec<f32>>);
+
+/// The part of `band` on panorama row `py` of level `l`: the panorama column its first pixel
+/// lands on, its width, its weight row and its colour row. `None` when it misses the row.
+fn band_row(band: &PyramidBand, l: usize, ch: usize, py: usize) -> Option<(usize, usize, &[f32], &[f32])> {
+    let (ox, oy) = ((band.0 >> l) as usize, (band.1 >> l) as usize);
+    let (lw, lh, colours) = &band.2[l];
+    (py >= oy && py - oy < *lh).then(|| {
+        let y = py - oy;
+        (ox, *lw, &band.3[l][y * lw..(y + 1) * lw], &colours[y * lw * ch..(y + 1) * lw * ch])
+    })
 }
 
 /// Multi-band blend of `imgs` into a `w × h` panorama (origin 0,0) with one weight map per image
@@ -1119,22 +1194,37 @@ pub fn multiband(w: usize, h: usize, imgs: &[RoiImage], weights: &[Vec<f32>], le
         let gx1 = (im.x0 + im.w as i32 + margin).min(w as i32);
         let gy1 = (im.y0 + im.h as i32 + margin).min(h as i32);
         let (gw, gh) = ((gx1 - gx0).max(1) as usize, (gy1 - gy0).max(1) as usize);
+        // Each grid pixel takes the image pixel that lands on it (every image pixel lands on at
+        // most one), so rows of the grid are independent and fill in parallel.
+        let src_of = |gx: usize, gy: usize| -> Option<usize> {
+            let (x, y) = (gx as i64 + gx0 as i64 - im.x0 as i64, gy as i64 + gy0 as i64 - im.y0 as i64);
+            (x >= 0 && y >= 0 && (x as usize) < im.w && (y as usize) < im.h).then(|| y as usize * im.w + x as usize)
+        };
         let mut px = vec![0.0f32; gw * gh * ch];
-        let mut cov = vec![0.0f32; gw * gh];
-        let mut wt = vec![0.0f32; gw * gh];
-        for y in 0..im.h {
-            for x in 0..im.w {
-                let (gx, gy) = (im.x0 + x as i32 - gx0, im.y0 + y as i32 - gy0);
-                if gx < 0 || gy < 0 || gx as usize >= gw || gy as usize >= gh {
-                    continue;
+        par_rows(&mut px, gw, ch, |gy, row| {
+            for gx in 0..gw {
+                if let Some(i) = src_of(gx, gy) {
+                    row[gx * ch..(gx + 1) * ch].copy_from_slice(&im.px[i * ch..(i + 1) * ch]);
                 }
-                let (i, g) = (y * im.w + x, gy as usize * gw + gx as usize);
-                cov[g] = im.alpha[i];
-                wt[g] = weights[k][i] * im.alpha[i].min(1.0);
-                px[g * ch..(g + 1) * ch].copy_from_slice(&im.px[i * ch..(i + 1) * ch]);
             }
-        }
-        let bin: Vec<f32> = cov.iter().map(|a| if *a > 0.5 { 1.0 } else { 0.0 }).collect();
+        });
+        let mut cov = vec![0.0f32; gw * gh];
+        par_rows(&mut cov, gw, 1, |gy, row| {
+            for (gx, o) in row.iter_mut().enumerate() {
+                if let Some(i) = src_of(gx, gy) {
+                    *o = im.alpha[i];
+                }
+            }
+        });
+        let mut wt = vec![0.0f32; gw * gh];
+        par_rows(&mut wt, gw, 1, |gy, row| {
+            for (gx, o) in row.iter_mut().enumerate() {
+                if let Some(i) = src_of(gx, gy) {
+                    *o = weights[k][i] * im.alpha[i].min(1.0);
+                }
+            }
+        });
+        let bin: Vec<f32> = par_map1(&cov, |a| if a > 0.5 { 1.0 } else { 0.0 });
         push_pull(gw, gh, ch, &mut px, &bin);
         // Laplacian of the colours, Gaussian of the weights.
         let mut lap: Vec<(usize, usize, Vec<f32>)> = Vec::new();
@@ -1148,7 +1238,7 @@ pub fn multiband(w: usize, h: usize, imgs: &[RoiImage], weights: &[Vec<f32>], le
             }
             let (nw, nh, down) = reduce(cw, chh, ch, &cur);
             let up = expand(nw, nh, ch, &down, cw, chh);
-            lap.push((cw, chh, cur.iter().zip(&up).map(|(a, b)| a - b).collect()));
+            lap.push((cw, chh, par_zip(&cur, &up, |a, b| a - b)));
             gau.push(cwt.clone());
             let (_, _, wdown) = reduce(cw, chh, 1, &cwt);
             cw = nw;
@@ -1158,41 +1248,57 @@ pub fn multiband(w: usize, h: usize, imgs: &[RoiImage], weights: &[Vec<f32>], le
         }
         (gx0, gy0, lap, gau)
     });
-    for (gx0, gy0, lap, gau) in &bands {
-        for (l, ((lw, lh, band), g)) in lap.iter().zip(gau).enumerate() {
-            let (ox, oy) = ((gx0 >> l) as usize, (gy0 >> l) as usize);
-            let (pw, ph) = sizes[l];
-            for y in 0..*lh {
-                let py = oy + y;
-                if py >= ph {
-                    break;
-                }
-                for x in 0..*lw {
+    // Accumulate the bands. Each pixel adds the bands in the same order as the serial loop (per
+    // level, bands one after another), but rows of a level are independent, so they run in
+    // parallel: every row walks the bands itself.
+    for l in 0..levels {
+        let pw = sizes[l].0;
+        par_rows(&mut wsum[l], pw, 1, |py, row| {
+            for b in &bands {
+                let Some((ox, lw, g, _)) = band_row(b, l, ch, py) else { continue };
+                for x in 0..lw {
                     let px = ox + x;
                     if px >= pw {
                         break;
                     }
-                    let (i, p) = (y * lw + x, py * pw + px);
-                    let k = g[i];
+                    let k = g[x];
+                    if k <= 0.0 {
+                        continue;
+                    }
+                    row[px] += k;
+                }
+            }
+        });
+        par_rows(&mut acc[l], pw, ch, |py, row| {
+            for b in &bands {
+                let Some((ox, lw, g, band)) = band_row(b, l, ch, py) else { continue };
+                for x in 0..lw {
+                    let px = ox + x;
+                    if px >= pw {
+                        break;
+                    }
+                    let k = g[x];
                     if k <= 0.0 {
                         continue;
                     }
-                    wsum[l][p] += k;
                     for c in 0..ch {
-                        acc[l][p * ch + c] += k * band[i * ch + c];
+                        row[px * ch + c] += k * band[x * ch + c];
                     }
                 }
             }
-        }
+        });
     }
     for l in 0..levels {
-        let (pw, ph) = sizes[l];
-        for p in 0..pw * ph {
-            let k = wsum[l][p];
-            for c in 0..ch {
-                acc[l][p * ch + c] = if k > 1e-8 { acc[l][p * ch + c] / k } else { 0.0 };
+        let pw = sizes[l].0;
+        let ws = &wsum[l];
+        par_rows(&mut acc[l], pw, ch, |py, row| {
+            for x in 0..pw {
+                let k = ws[py * pw + x];
+                for c in 0..ch {
+                    row[x * ch + c] = if k > 1e-8 { row[x * ch + c] / k } else { 0.0 };
+                }
             }
-        }
+        });
     }
     // Collapse.
     // `levels ≥ 1`, so there is always a coarsest level.
@@ -1201,22 +1307,27 @@ pub fn multiband(w: usize, h: usize, imgs: &[RoiImage], weights: &[Vec<f32>], le
         let (pw, ph) = sizes[l];
         let (sw, sh) = sizes[l + 1];
         let up = expand(sw, sh, ch, &cur, pw, ph);
-        cur = acc[l].iter().zip(&up).map(|(a, b)| a + b).collect();
+        cur = par_zip(&acc[l], &up, |a, b| a + b);
     }
-    // Coverage: union of the images.
+    // Coverage: union of the images. Rows are independent; each walks the images in order, so a
+    // pixel sees the same sequence of `max` calls as in the serial loop.
     let mut cov = vec![0.0f32; w * h];
-    for im in imgs {
-        for y in 0..im.h {
+    par_rows(&mut cov, w, 1, |py, row| {
+        for im in imgs {
+            let y = py as i64 - im.y0 as i64;
+            if y < 0 || y as usize >= im.h {
+                continue;
+            }
             for x in 0..im.w {
-                let (px, py) = (im.x0 + x as i32, im.y0 + y as i32);
-                if px < 0 || py < 0 || px as usize >= w || py as usize >= h {
+                let px = im.x0 + x as i32;
+                if px < 0 || px as usize >= w {
                     continue;
                 }
-                let p = py as usize * w + px as usize;
-                cov[p] = cov[p].max(im.alpha[y * im.w + x]);
+                let p = px as usize;
+                row[p] = row[p].max(im.alpha[y as usize * im.w + x]);
             }
         }
-    }
+    });
     (cur, cov)
 }
 
@@ -1431,3 +1542,389 @@ mod tests {
         assert!(cov.iter().all(|c| *c == 1.0));
     }
 }
+
+/// The row-parallel `reduce` / `expand` / `push_pull` / `multiband` against the serial code they
+/// replaced, kept below verbatim as the reference. Every output must stay bit for bit the same.
+#[cfg(test)]
+mod parallel_tests {
+    use super::*;
+
+    fn mix(mut z: u64) -> u64 {
+        z = z.wrapping_add(0x9E37_79B9_7F4A_7C15);
+        z = (z ^ (z >> 30)).wrapping_mul(0xBF58_476D_1CE4_E5B9);
+        z = (z ^ (z >> 27)).wrapping_mul(0x94D0_49BB_1331_11EB);
+        z ^ (z >> 31)
+    }
+
+    /// Deterministic data from integer arithmetic only (no libm): mostly `0..1`, with negatives,
+    /// signed zeros and large values so a different order of operations cannot hide.
+    fn noise(len: usize, seed: u64) -> Vec<f32> {
+        (0..len as u64)
+            .map(|i| {
+                let z = mix(seed.wrapping_mul(0x1234_5678_9ABC).wrapping_add(i));
+                let v = (z >> 40) as f32 / 16_777_216.0;
+                match z & 31 {
+                    0 => -v,
+                    1 => -0.0,
+                    2 => v * 1000.0,
+                    3 => 0.0,
+                    _ => v,
+                }
+            })
+            .collect()
+    }
+
+    /// Weights with exact zeros, exact ones and partial values, in blobs and noise.
+    fn weights(w: usize, h: usize, seed: u64) -> Vec<f32> {
+        (0..w * h)
+            .map(|i| {
+                let (x, y) = (i % w, i / w);
+                let z = mix(seed + i as u64);
+                if (x / 5 + y / 3) % 3 == 0 {
+                    0.0
+                } else if z.is_multiple_of(7) {
+                    ((z >> 20) % 100) as f32 / 100.0
+                } else {
+                    1.0
+                }
+            })
+            .collect()
+    }
+
+    fn bits(v: &[f32]) -> Vec<u32> {
+        v.iter().map(|x| x.to_bits()).collect()
+    }
+
+    fn fnv(parts: &[&[f32]]) -> u64 {
+        let mut h = 0xcbf2_9ce4_8422_2325u64;
+        for p in parts {
+            for x in *p {
+                h ^= x.to_bits() as u64;
+                h = h.wrapping_mul(0x0000_0100_0000_01b3);
+            }
+        }
+        h
+    }
+
+    /// Sizes that cross the odd / even and tiny cases (1 wide, 1 high, 1×1, odd, power of two + 1).
+    const SIZES: [(usize, usize); 12] = [(1, 1), (1, 9), (9, 1), (2, 2), (3, 5), (4, 4), (17, 13), (64, 40), (65, 41), (97, 61), (130, 7), (7, 130)];
+
+    fn ref_reduce(w: usize, h: usize, ch: usize, src: &[f32]) -> (usize, usize, Vec<f32>) {
+        let (nw, nh) = (w.div_ceil(2), h.div_ceil(2));
+        let k = [1.0f32, 4.0, 6.0, 4.0, 1.0];
+        // Separable 5-tap binomial, then decimate.
+        let mut tmp = vec![0.0f32; nw * h * ch];
+        for y in 0..h {
+            for x in 0..nw {
+                for c in 0..ch {
+                    let mut s = 0.0;
+                    for (t, kv) in k.iter().enumerate() {
+                        let xx = (2 * x as i64 + t as i64 - 2).clamp(0, w as i64 - 1) as usize;
+                        s += kv * src[(y * w + xx) * ch + c];
+                    }
+                    tmp[(y * nw + x) * ch + c] = s / 16.0;
+                }
+            }
+        }
+        let mut out = vec![0.0f32; nw * nh * ch];
+        for y in 0..nh {
+            for x in 0..nw {
+                for c in 0..ch {
+                    let mut s = 0.0;
+                    for (t, kv) in k.iter().enumerate() {
+                        let yy = (2 * y as i64 + t as i64 - 2).clamp(0, h as i64 - 1) as usize;
+                        s += kv * tmp[(yy * nw + x) * ch + c];
+                    }
+                    out[(y * nw + x) * ch + c] = s / 16.0;
+                }
+            }
+        }
+        (nw, nh, out)
+    }
+
+    fn ref_expand(sw: usize, sh: usize, ch: usize, src: &[f32], w: usize, h: usize) -> Vec<f32> {
+        // Bilinear upsampling at half-pixel-aligned positions.
+        let mut out = vec![0.0f32; w * h * ch];
+        for y in 0..h {
+            let fy = ((y as f32 + 0.5) / 2.0 - 0.5).clamp(0.0, (sh - 1) as f32);
+            let (y0, ty) = (fy.floor() as usize, fy - fy.floor());
+            let y1 = (y0 + 1).min(sh - 1);
+            for x in 0..w {
+                let fx = ((x as f32 + 0.5) / 2.0 - 0.5).clamp(0.0, (sw - 1) as f32);
+                let (x0, tx) = (fx.floor() as usize, fx - fx.floor());
+                let x1 = (x0 + 1).min(sw - 1);
+                for c in 0..ch {
+                    let p = |xx: usize, yy: usize| src[(yy * sw + xx) * ch + c];
+                    let top = p(x0, y0) + (p(x1, y0) - p(x0, y0)) * tx;
+                    let bot = p(x0, y1) + (p(x1, y1) - p(x0, y1)) * tx;
+                    out[(y * w + x) * ch + c] = top + (bot - top) * ty;
+                }
+            }
+        }
+        out
+    }
+
+    fn ref_push_pull(w: usize, h: usize, ch: usize, px: &mut [f32], wt: &[f32]) {
+        if w <= 1 && h <= 1 {
+            return;
+        }
+        let (nw, nh) = (w.div_ceil(2), h.div_ceil(2));
+        let mut cpx = vec![0.0f32; nw * nh * ch];
+        let mut cw = vec![0.0f32; nw * nh];
+        for y in 0..h {
+            for x in 0..w {
+                let (i, j) = (y * w + x, (y / 2) * nw + x / 2);
+                let a = wt[i];
+                cw[j] += a;
+                for c in 0..ch {
+                    cpx[j * ch + c] += a * px[i * ch + c];
+                }
+            }
+        }
+        for j in 0..nw * nh {
+            if cw[j] > 0.0 {
+                for c in 0..ch {
+                    cpx[j * ch + c] /= cw[j];
+                }
+                cw[j] = 1.0;
+            }
+        }
+        if cw.contains(&0.0) && cw.iter().any(|v| *v > 0.0) {
+            ref_push_pull(nw, nh, ch, &mut cpx, &cw);
+        }
+        for y in 0..h {
+            for x in 0..w {
+                let i = y * w + x;
+                if wt[i] < 1.0 {
+                    let j = (y / 2) * nw + x / 2;
+                    let a = wt[i];
+                    for c in 0..ch {
+                        px[i * ch + c] = a * px[i * ch + c] + (1.0 - a) * cpx[j * ch + c];
+                    }
+                }
+            }
+        }
+    }
+
+    fn ref_multiband(w: usize, h: usize, imgs: &[RoiImage], weights: &[Vec<f32>], levels: usize) -> (Vec<f32>, Vec<f32>) {
+        let ch = imgs.first().map_or(1, |i| i.ch);
+        let levels = levels.max(1);
+        let align = 1i32 << (levels - 1);
+        // Level sizes of the panorama.
+        let mut sizes = vec![(w, h)];
+        for _ in 1..levels {
+            let Some(&(pw, ph)) = sizes.last() else { break };
+            sizes.push((pw.div_ceil(2), ph.div_ceil(2)));
+        }
+        let mut acc: Vec<Vec<f32>> = sizes.iter().map(|&(lw, lh)| vec![0.0; lw * lh * ch]).collect();
+        let mut wsum: Vec<Vec<f32>> = sizes.iter().map(|&(lw, lh)| vec![0.0; lw * lh]).collect();
+        let margin = align * 4;
+        // Each image on its ROI grown by a margin and aligned to the coarsest level's grid.
+        let bands = par_map(imgs.len(), |k| {
+            let im = &imgs[k];
+            let gx0 = ((im.x0 - margin).max(0) / align) * align;
+            let gy0 = ((im.y0 - margin).max(0) / align) * align;
+            let gx1 = (im.x0 + im.w as i32 + margin).min(w as i32);
+            let gy1 = (im.y0 + im.h as i32 + margin).min(h as i32);
+            let (gw, gh) = ((gx1 - gx0).max(1) as usize, (gy1 - gy0).max(1) as usize);
+            let mut px = vec![0.0f32; gw * gh * ch];
+            let mut cov = vec![0.0f32; gw * gh];
+            let mut wt = vec![0.0f32; gw * gh];
+            for y in 0..im.h {
+                for x in 0..im.w {
+                    let (gx, gy) = (im.x0 + x as i32 - gx0, im.y0 + y as i32 - gy0);
+                    if gx < 0 || gy < 0 || gx as usize >= gw || gy as usize >= gh {
+                        continue;
+                    }
+                    let (i, g) = (y * im.w + x, gy as usize * gw + gx as usize);
+                    cov[g] = im.alpha[i];
+                    wt[g] = weights[k][i] * im.alpha[i].min(1.0);
+                    px[g * ch..(g + 1) * ch].copy_from_slice(&im.px[i * ch..(i + 1) * ch]);
+                }
+            }
+            let bin: Vec<f32> = cov.iter().map(|a| if *a > 0.5 { 1.0 } else { 0.0 }).collect();
+            ref_push_pull(gw, gh, ch, &mut px, &bin);
+            // Laplacian of the colours, Gaussian of the weights.
+            let mut lap: Vec<(usize, usize, Vec<f32>)> = Vec::new();
+            let mut gau: Vec<Vec<f32>> = Vec::new();
+            let (mut cw, mut chh, mut cur, mut cwt) = (gw, gh, px, wt);
+            for l in 0..levels {
+                if l + 1 == levels {
+                    lap.push((cw, chh, cur.clone()));
+                    gau.push(cwt.clone());
+                    break;
+                }
+                let (nw, nh, down) = ref_reduce(cw, chh, ch, &cur);
+                let up = ref_expand(nw, nh, ch, &down, cw, chh);
+                lap.push((cw, chh, cur.iter().zip(&up).map(|(a, b)| a - b).collect()));
+                gau.push(cwt.clone());
+                let (_, _, wdown) = ref_reduce(cw, chh, 1, &cwt);
+                cw = nw;
+                chh = nh;
+                cur = down;
+                cwt = wdown;
+            }
+            (gx0, gy0, lap, gau)
+        });
+        for (gx0, gy0, lap, gau) in &bands {
+            for (l, ((lw, lh, band), g)) in lap.iter().zip(gau).enumerate() {
+                let (ox, oy) = ((gx0 >> l) as usize, (gy0 >> l) as usize);
+                let (pw, ph) = sizes[l];
+                for y in 0..*lh {
+                    let py = oy + y;
+                    if py >= ph {
+                        break;
+                    }
+                    for x in 0..*lw {
+                        let px = ox + x;
+                        if px >= pw {
+                            break;
+                        }
+                        let (i, p) = (y * lw + x, py * pw + px);
+                        let k = g[i];
+                        if k <= 0.0 {
+                            continue;
+                        }
+                        wsum[l][p] += k;
+                        for c in 0..ch {
+                            acc[l][p * ch + c] += k * band[i * ch + c];
+                        }
+                    }
+                }
+            }
+        }
+        for l in 0..levels {
+            let (pw, ph) = sizes[l];
+            for p in 0..pw * ph {
+                let k = wsum[l][p];
+                for c in 0..ch {
+                    acc[l][p * ch + c] = if k > 1e-8 { acc[l][p * ch + c] / k } else { 0.0 };
+                }
+            }
+        }
+        // Collapse.
+        // `levels ≥ 1`, so there is always a coarsest level.
+        let Some(mut cur) = acc.pop() else { return (vec![0.0; w * h * ch], vec![0.0; w * h]) };
+        for l in (0..levels - 1).rev() {
+            let (pw, ph) = sizes[l];
+            let (sw, sh) = sizes[l + 1];
+            let up = ref_expand(sw, sh, ch, &cur, pw, ph);
+            cur = acc[l].iter().zip(&up).map(|(a, b)| a + b).collect();
+        }
+        // Coverage: union of the images.
+        let mut cov = vec![0.0f32; w * h];
+        for im in imgs {
+            for y in 0..im.h {
+                for x in 0..im.w {
+                    let (px, py) = (im.x0 + x as i32, im.y0 + y as i32);
+                    if px < 0 || py < 0 || px as usize >= w || py as usize >= h {
+                        continue;
+                    }
+                    let p = py as usize * w + px as usize;
+                    cov[p] = cov[p].max(im.alpha[y * im.w + x]);
+                }
+            }
+        }
+        (cur, cov)
+    }
+
+    #[test]
+    fn reduce_and_expand_match_the_serial_code() {
+        for (n, &(w, h)) in SIZES.iter().enumerate() {
+            for ch in [1usize, 3, 4] {
+                let src = noise(w * h * ch, n as u64 * 7 + ch as u64);
+                let (nw, nh, got) = reduce(w, h, ch, &src);
+                let (rw, rh, want) = ref_reduce(w, h, ch, &src);
+                assert_eq!((nw, nh), (rw, rh));
+                assert_eq!(bits(&got), bits(&want), "reduce {w}x{h}x{ch}");
+                // Expand back to the original size and to sizes that are not twice the source's.
+                for (ew, eh) in [(w, h), (2 * nw, 2 * nh), (2 * nw - 1, 2 * nh + 1), (w + 3, h + 5)] {
+                    let got = expand(nw, nh, ch, &want, ew, eh);
+                    let want_up = ref_expand(nw, nh, ch, &want, ew, eh);
+                    assert_eq!(bits(&got), bits(&want_up), "expand {nw}x{nh}x{ch} to {ew}x{eh}");
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn push_pull_matches_the_serial_code() {
+        for (n, &(w, h)) in SIZES.iter().enumerate() {
+            for ch in [1usize, 3] {
+                for variant in 0..3u64 {
+                    let wt = match variant {
+                        0 => weights(w, h, n as u64),
+                        1 => vec![1.0; w * h],
+                        // A single covered pixel: every level of the recursion has to fill from it.
+                        _ => (0..w * h).map(|i| if i == (w * h) / 3 { 1.0 } else { 0.0 }).collect(),
+                    };
+                    let px = noise(w * h * ch, 100 + n as u64);
+                    let (mut got, mut want) = (px.clone(), px);
+                    push_pull(w, h, ch, &mut got, &wt);
+                    ref_push_pull(w, h, ch, &mut want, &wt);
+                    assert_eq!(bits(&got), bits(&want), "push_pull {w}x{h}x{ch} variant {variant}");
+                }
+            }
+        }
+    }
+
+    /// ROIs of assorted sizes and offsets (some sticking out of the canvas), with holes in the alpha.
+    fn rois(w: usize, h: usize, ch: usize, seed: u64) -> (Vec<RoiImage>, Vec<Vec<f32>>) {
+        let specs =
+            [(0i32, 0i32, w * 2 / 3, h), (w as i32 / 3, -(h as i32) / 5, w * 2 / 3 + 1, h * 3 / 4 + 1), (-(w as i32) / 4, h as i32 / 2, w / 2 + 1, h / 2 + 3)];
+        let imgs: Vec<RoiImage> = specs
+            .iter()
+            .enumerate()
+            .map(|(k, &(x0, y0, iw, ih))| {
+                let (iw, ih) = (iw.max(1), ih.max(1));
+                let mut alpha = vec![1.0f32; iw * ih];
+                for (i, a) in alpha.iter_mut().enumerate() {
+                    let z = mix(seed + k as u64 * 1000 + i as u64);
+                    if (i % iw) / 4 % 5 == 2 && (i / iw) % 6 < 3 {
+                        *a = 0.0;
+                    } else if z.is_multiple_of(11) {
+                        *a = 0.3;
+                    }
+                }
+                RoiImage { x0, y0, w: iw, h: ih, ch, px: noise(iw * ih * ch, seed + k as u64), alpha }
+            })
+            .collect();
+        let wts = imgs.iter().enumerate().map(|(k, r)| weights(r.w, r.h, seed + 50 + k as u64)).collect();
+        (imgs, wts)
+    }
+
+    #[test]
+    fn multiband_matches_the_serial_code() {
+        for (n, &(w, h)) in [(1usize, 1usize), (5, 3), (40, 30), (97, 61), (130, 70), (64, 64), (201, 129)].iter().enumerate() {
+            for ch in [1usize, 3] {
+                let (imgs, wts) = rois(w, h, ch, n as u64 * 31 + ch as u64);
+                for levels in [1usize, 2, 3, 5, 7] {
+                    let got = multiband(w, h, &imgs, &wts, levels);
+                    let want = ref_multiband(w, h, &imgs, &wts, levels);
+                    assert_eq!(bits(&got.0), bits(&want.0), "colours {w}x{h}x{ch} levels {levels}");
+                    assert_eq!(bits(&got.1), bits(&want.1), "coverage {w}x{h}x{ch} levels {levels}");
+                }
+            }
+        }
+        // No images at all, and zero levels.
+        assert_eq!(multiband(9, 7, &[], &[], 3).0.len(), ref_multiband(9, 7, &[], &[], 3).0.len());
+    }
+
+    /// Hashes recorded from the code before it was made parallel (plain f32 arithmetic only, so
+    /// they hold on every platform).
+    #[test]
+    fn multiband_hashes_recorded_from_the_serial_code() {
+        let (imgs, wts) = rois(97, 61, 3, 5);
+        let (px, cov) = multiband(97, 61, &imgs, &wts, 5);
+        assert_eq!(fnv(&[&px, &cov]), 0xf89a5726082ebb6c, "97x61 rgb, 5 levels");
+        let (imgs, wts) = rois(130, 70, 1, 9);
+        let (px, cov) = multiband(130, 70, &imgs, &wts, 7);
+        assert_eq!(fnv(&[&px, &cov]), 0xb7d7ddc59d201730, "130x70 grey, 7 levels");
+        let wt = weights(65, 41, 3);
+        let mut px = noise(65 * 41 * 3, 4);
+        push_pull(65, 41, 3, &mut px, &wt);
+        assert_eq!(fnv(&[&px]), 0x50ea36a84ca9a68f, "push_pull 65x41 rgb");
+        let (nw, nh, r) = reduce(65, 41, 3, &px);
+        assert_eq!(fnv(&[&r, &expand(nw, nh, 3, &r, 65, 41)]), 0x51823acfb4206dd8, "reduce + expand 65x41 rgb");
+    }
+}
diff --git a/crates/algo/src/render.rs b/crates/algo/src/render.rs
index baba88f93e..d40ff9cda8 100644
--- a/crates/algo/src/render.rs
+++ b/crates/algo/src/render.rs
@@ -146,8 +146,9 @@ pub(crate) fn lens_flare(src: &Image, out: Rect, ctx: &Ctx, brightness: f32, cen
         let mut c = rgba(ctx, px);
         for k in 0..3 {
             let a = (f[k] * bright).max(0.0);
-            // Screen keeps highlights below white for display-referred values.
-            c[k] = 1.0 - (1.0 - c[k]) * (1.0 - a.min(1.0));
+            // Screen (c + a·(1 − c)) keeps display-referred values below white; a 32-bit
+            // value already above white is left as is rather than pulled down towards it.
+            c[k] += a.min(1.0) * (1.0 - c[k]).max(0.0);
         }
         set_rgba(ctx, px, c);
     }
diff --git a/crates/algo/src/stack.rs b/crates/algo/src/stack.rs
index 2eec57e598..dbb5b22e65 100644
--- a/crates/algo/src/stack.rs
+++ b/crates/algo/src/stack.rs
@@ -23,85 +23,184 @@ pub enum Stat {
     Variance,
 }
 
-fn stat(v: &mut [f32], s: Stat) -> f32 {
+/// Reusable per-chunk scratch for [`Stat::Entropy`]: an 8-bit histogram plus the list of bins the
+/// current pixel touched. Allocated once per parallel chunk instead of one `HashMap` per channel
+/// per pixel (the old cost: ~4.6 s for 3 × 24 MP).
+struct EntropyScratch {
+    counts: [u32; 256],
+    touched: Vec<u8>,
+}
+
+impl EntropyScratch {
+    fn new() -> Self {
+        Self { counts: [0; 256], touched: Vec::new() }
+    }
+}
+
+/// Shannon entropy (bits) of the 8-bit values in `v`, over log2(N). `v.len() >= 2`.
+fn entropy(v: &[f32], scratch: &mut EntropyScratch) -> f32 {
+    let n = v.len() as f32;
+    for x in v {
+        let bin = (x.clamp(0.0, 1.0) * 255.0).round() as u8;
+        let c = &mut scratch.counts[usize::from(bin)];
+        if *c == 0 {
+            scratch.touched.push(bin);
+        }
+        *c += 1;
+    }
+    // Sum the bins in ascending order. The old HashMap summed in its (randomly seeded) iteration
+    // order, and float addition is not associative, so the old result could differ in the last
+    // bit from run to run; a fixed order makes it deterministic. Sorting only the few touched
+    // bins keeps this O(samples), not O(256), per pixel.
+    scratch.touched.sort_unstable();
+    let h: f32 = scratch
+        .touched
+        .iter()
+        .map(|&bin| {
+            let p = scratch.counts[usize::from(bin)] as f32 / n;
+            -p * p.log2()
+        })
+        .sum();
+    // Reset only the bins used, so the 256-entry array is never cleared wholesale.
+    for &bin in &scratch.touched {
+        scratch.counts[usize::from(bin)] = 0;
+    }
+    scratch.touched.clear();
+    h / n.log2()
+}
+
+/// `x` to the power `k` by repeated squaring. Every step is one IEEE 754 multiplication, so the
+/// result has the same bits on every target. On Windows (MSVC), `f32::powi` with an exponent the
+/// compiler cannot see as a constant calls the C runtime's `powf`, which rounds differently.
+fn ipow(x: f32, k: u32) -> f32 {
+    let (mut base, mut k, mut acc) = (x, k, 1.0f32);
+    loop {
+        if k & 1 != 0 {
+            acc *= base;
+        }
+        k >>= 1;
+        if k == 0 {
+            return acc;
+        }
+        base *= base;
+    }
+}
+
+fn stat(v: &mut [f32], s: Stat, scratch: &mut EntropyScratch) -> f32 {
     let n = v.len() as f32;
     if v.is_empty() {
         return 0.0;
     }
+    // Modes that need neither the mean nor the moments return before computing them (the old code
+    // computed the mean for every mode and threw it away; skipping it changes no result).
+    match s {
+        Stat::Summation => return v.iter().sum::<f32>(),
+        Stat::Minimum => return v.iter().copied().fold(f32::MAX, f32::min),
+        Stat::Maximum => return v.iter().copied().fold(f32::MIN, f32::max),
+        Stat::Range => return v.iter().copied().fold(f32::MIN, f32::max) - v.iter().copied().fold(f32::MAX, f32::min),
+        Stat::Median => {
+            // `total_cmp` is a total order whose ties are bit-identical values, so an unstable
+            // sort gives exactly the stable sort's result.
+            v.sort_unstable_by(f32::total_cmp);
+            let k = v.len();
+            return if k % 2 == 1 { v[k / 2] } else { (v[k / 2 - 1] + v[k / 2]) / 2.0 };
+        }
+        Stat::Entropy => {
+            if v.len() < 2 {
+                return 0.0;
+            }
+            return entropy(v, scratch);
+        }
+        _ => {}
+    }
     let mean = v.iter().sum::<f32>() / n;
-    let m = |k: i32| v.iter().map(|x| (x - mean).powi(k)).sum::<f32>() / n;
+    let m = |k: u32| v.iter().map(|x| ipow(x - mean, k)).sum::<f32>() / n;
     match s {
         Stat::Mean => mean,
-        Stat::Summation => v.iter().sum::<f32>(),
-        Stat::Minimum => v.iter().copied().fold(f32::MAX, f32::min),
-        Stat::Maximum => v.iter().copied().fold(f32::MIN, f32::max),
-        Stat::Range => v.iter().copied().fold(f32::MIN, f32::max) - v.iter().copied().fold(f32::MAX, f32::min),
-        Stat::Median => {
-            v.sort_by(f32::total_cmp);
-            let k = v.len();
-            if k % 2 == 1 { v[k / 2] } else { (v[k / 2 - 1] + v[k / 2]) / 2.0 }
-        }
         Stat::Variance => m(2),
         Stat::StandardDeviation => m(2).sqrt(),
         Stat::Skewness => {
             let sd = m(2).sqrt();
             // Map −2..2 to 0..1 (0.5 = symmetric).
-            if sd < 1e-6 { 0.5 } else { (m(3) / sd.powi(3) / 4.0 + 0.5).clamp(0.0, 1.0) }
+            if sd < 1e-6 { 0.5 } else { (m(3) / ipow(sd, 3) / 4.0 + 0.5).clamp(0.0, 1.0) }
         }
         Stat::Kurtosis => {
             let var = m(2);
             // 0..10 → 0..1.
             if var < 1e-12 { 0.0 } else { (m(4) / (var * var) / 10.0).clamp(0.0, 1.0) }
         }
-        Stat::Entropy => {
-            if v.len() < 2 {
-                return 0.0;
-            }
-            let mut counts: std::collections::HashMap<u8, u32> = std::collections::HashMap::new();
-            for x in v.iter() {
-                *counts.entry((x.clamp(0.0, 1.0) * 255.0).round() as u8).or_default() += 1;
-            }
-            let h: f32 = counts
-                .values()
-                .map(|&c| {
-                    let p = c as f32 / n;
-                    -p * p.log2()
-                })
-                .sum();
-            h / n.log2()
-        }
+        // Handled above; a no-op keeps the match exhaustive without a panic path.
+        Stat::Summation | Stat::Minimum | Stat::Maximum | Stat::Range | Stat::Median | Stat::Entropy => 0.0,
     }
 }
 
+/// Output pixels per parallel task: big enough to amortise the per-task scratch buffers and
+/// rayon's scheduling, small enough (6000 tasks for 24 MP) to balance across many cores.
+const CHUNK: usize = 4096;
+
 /// Combines `layers` (each `len` pixels) with statistic `s`. Colour results retain their float
 /// range; quantisation/clipping belongs to the destination surface, not the statistic.
 pub fn combine(layers: &[Vec<[f32; 4]>], s: Stat) -> Vec<[f32; 4]> {
+    // Pick the statistic once, outside the pixel loop: each arm passes `stat` a constant mode, so
+    // the compiler builds one loop per statistic with the `match` folded away. Matching on `s`
+    // three times per pixel inside one shared loop made one thread 5–15% slower than the old
+    // serial loop (Mean, Variance, StdDev, Skewness, Kurtosis); this alone cuts Mean's
+    // instructions by a fifth.
+    match s {
+        Stat::Entropy => combine_with(layers, |v, sc| stat(v, Stat::Entropy, sc)),
+        Stat::Kurtosis => combine_with(layers, |v, sc| stat(v, Stat::Kurtosis, sc)),
+        Stat::Maximum => combine_with(layers, |v, sc| stat(v, Stat::Maximum, sc)),
+        Stat::Mean => combine_with(layers, |v, sc| stat(v, Stat::Mean, sc)),
+        Stat::Median => combine_with(layers, |v, sc| stat(v, Stat::Median, sc)),
+        Stat::Minimum => combine_with(layers, |v, sc| stat(v, Stat::Minimum, sc)),
+        Stat::Range => combine_with(layers, |v, sc| stat(v, Stat::Range, sc)),
+        Stat::Skewness => combine_with(layers, |v, sc| stat(v, Stat::Skewness, sc)),
+        Stat::StandardDeviation => combine_with(layers, |v, sc| stat(v, Stat::StandardDeviation, sc)),
+        Stat::Summation => combine_with(layers, |v, sc| stat(v, Stat::Summation, sc)),
+        Stat::Variance => combine_with(layers, |v, sc| stat(v, Stat::Variance, sc)),
+    }
+}
+
+fn combine_with(layers: &[Vec<[f32; 4]>], f: impl Fn(&mut [f32], &mut EntropyScratch) -> f32 + Sync + Send) -> Vec<[f32; 4]> {
     let len = layers.iter().map(Vec::len).max().unwrap_or(0);
     let mut out = vec![[0.0f32; 4]; len];
-    let mut samples: [Vec<f32>; 3] = Default::default();
-    for (i, o) in out.iter_mut().enumerate() {
-        for v in samples.iter_mut() {
-            v.clear();
-        }
-        let mut alpha = 0.0f32;
-        for l in layers {
-            if let Some(p) = l.get(i)
-                && p[3] > 0.0
-            {
-                for c in 0..3 {
-                    samples[c].push(p[c]);
+    // Every output pixel depends only on the input pixels at the same index, so chunks of the
+    // output are independent: `par_rows` over a `CHUNK`-wide "row" with one channel (it runs
+    // serially on wasm). The per-pixel arithmetic is unchanged, hence the result is bit-identical
+    // to the serial loop for every mode (Entropy: see [`entropy`]).
+    crate::photo_util::par_rows(&mut out, CHUNK, 1, |chunk, outs| {
+        // Scratch is per chunk, not per pixel: the old loop's three `Vec`s were already reused
+        // across pixels, so keep that, and give each task its own set.
+        // Sized to the layer count up front and filled by index (`k` samples per pixel): a
+        // `push` per sample re-checked the capacity and stored the length every time; indexing
+        // cuts the loop's instructions by another third.
+        let mut samples: [Vec<f32>; 3] = [0, 1, 2].map(|_| vec![0.0; layers.len()]);
+        let mut scratch = EntropyScratch::new();
+        let base = chunk * CHUNK;
+        for (j, o) in outs.iter_mut().enumerate() {
+            let i = base + j;
+            let mut k = 0;
+            let mut alpha = 0.0f32;
+            for l in layers {
+                if let Some(p) = l.get(i)
+                    && p[3] > 0.0
+                {
+                    for c in 0..3 {
+                        samples[c][k] = p[c];
+                    }
+                    k += 1;
+                    alpha = alpha.max(p[3]);
                 }
-                alpha = alpha.max(p[3]);
             }
+            if alpha <= 0.0 {
+                continue;
+            }
+            for c in 0..3 {
+                o[c] = f(&mut samples[c][..k], &mut scratch);
+            }
+            o[3] = alpha;
         }
-        if alpha <= 0.0 {
-            continue;
-        }
-        for c in 0..3 {
-            o[c] = stat(&mut samples[c], s);
-        }
-        o[3] = alpha;
-    }
+    });
     out
 }
 
@@ -168,4 +267,246 @@ mod tests {
         let layers = vec![px(0.5), px(0.5), px(1.0)];
         assert_eq!(combine(&layers, Stat::Median)[0][0], 0.5);
     }
+
+    /// Five layers over six pixels (the last layer is short). Covers opaque, partly transparent,
+    /// fully transparent, HDR / negative, single-sample and tied-value pixels.
+    fn fixture() -> Vec<Vec<[f32; 4]>> {
+        vec![
+            vec![[0.10, 0.20, 0.30, 1.0], [0.5, 0.5, 0.5, 1.0], [0.9, 0.9, 0.9, 0.0], [-2.0, 4.0, 0.0, 1.0], [0.7, 0.2, 0.1, 0.5], [0.25, 0.25, 0.25, 1.0]],
+            vec![[0.90, 0.60, 0.30, 1.0], [0.0, 0.0, 0.0, 0.0], [0.8, 0.8, 0.8, 0.0], [3.0, -1.0, 0.5, 0.75], [0.0, 0.0, 0.0, 0.0], [0.25, 0.75, 0.25, 1.0]],
+            vec![[0.20, 0.90, 0.30, 0.5], [0.1, 0.2, 0.3, 1.0], [0.7, 0.7, 0.7, 0.0], [0.5, 0.5, 0.5, 1.0], [0.0, 0.0, 0.0, 0.0], [0.5, 0.75, 0.25, 0.25]],
+            vec![[0.30, 0.05, 0.30, 0.25], [0.3, 0.4, 0.5, 0.5], [0.6, 0.6, 0.6, 0.0], [1.5, 1.5, 1.5, 1.0], [0.0, 0.0, 0.0, 0.0], [0.25, 0.75, 0.5, 1.0]],
+            vec![[0.10, 0.70, 0.99, 1.0], [0.9, 0.1, 0.2, 1.0], [0.5, 0.5, 0.5, 0.0], [0.0, 0.0, 0.0, 1.0]],
+        ]
+    }
+
+    fn bits(px: &[[f32; 4]]) -> Vec<[u32; 4]> {
+        px.iter().map(|p| p.map(f32::to_bits)).collect()
+    }
+
+    /// Every mode except Entropy is bit-for-bit what the old serial loop produced. The expected
+    /// bit patterns were recorded by running the unmodified `combine` on [`fixture`].
+    #[test]
+    fn statistics_are_bit_identical_to_the_serial_implementation() {
+        let layers = fixture();
+        let expected: Vec<(Stat, Vec<[u32; 4]>)> = vec![
+            (
+                Stat::Kurtosis,
+                [
+                    [0x3e96956b, 0x3e182e3f, 0x3ea66664, 0x3f800000],
+                    [0x3e3d004c, 0x3e0b4396, 0x3e030e1f, 0x3f800000],
+                    [0x00000000, 0x00000000, 0x00000000, 0x00000000],
+                    [0x3e594eb2, 0x3e6ef420, 0x3e7ffffe, 0x3f800000],
+                    [0x00000000, 0x00000000, 0x00000000, 0x3f000000],
+                    [0x3e6eeeee, 0x3e6eeeee, 0x3e6eeeee, 0x3f800000],
+                ]
+                .to_vec(),
+            ),
+            (
+                Stat::Maximum,
+                [
+                    [0x3f666666, 0x3f666666, 0x3f7d70a4, 0x3f800000],
+                    [0x3f666666, 0x3f000000, 0x3f000000, 0x3f800000],
+                    [0x00000000, 0x00000000, 0x00000000, 0x00000000],
+                    [0x40400000, 0x40800000, 0x3fc00000, 0x3f800000],
+                    [0x3f333333, 0x3e4ccccd, 0x3dcccccd, 0x3f000000],
+                    [0x3f000000, 0x3f400000, 0x3f000000, 0x3f800000],
+                ]
+                .to_vec(),
+            ),
+            (
+                Stat::Mean,
+                [
+                    [0x3ea3d70a, 0x3efae148, 0x3ee0418a, 0x3f800000],
+                    [0x3ee66666, 0x3e99999a, 0x3ec00000, 0x3f800000],
+                    [0x00000000, 0x00000000, 0x00000000, 0x00000000],
+                    [0x3f19999a, 0x3f800000, 0x3f000000, 0x3f800000],
+                    [0x3f333333, 0x3e4ccccd, 0x3dcccccd, 0x3f000000],
+                    [0x3ea00000, 0x3f200000, 0x3ea00000, 0x3f800000],
+                ]
+                .to_vec(),
+            ),
+            (
+                Stat::Median,
+                [
+                    [0x3e4ccccd, 0x3f19999a, 0x3e99999a, 0x3f800000],
+                    [0x3ecccccd, 0x3e99999a, 0x3ecccccd, 0x3f800000],
+                    [0x00000000, 0x00000000, 0x00000000, 0x00000000],
+                    [0x3f000000, 0x3f000000, 0x3f000000, 0x3f800000],
+                    [0x3f333333, 0x3e4ccccd, 0x3dcccccd, 0x3f000000],
+                    [0x3e800000, 0x3f400000, 0x3e800000, 0x3f800000],
+                ]
+                .to_vec(),
+            ),
+            (
+                Stat::Minimum,
+                [
+                    [0x3dcccccd, 0x3d4ccccd, 0x3e99999a, 0x3f800000],
+                    [0x3dcccccd, 0x3dcccccd, 0x3e4ccccd, 0x3f800000],
+                    [0x00000000, 0x00000000, 0x00000000, 0x00000000],
+                    [0xc0000000, 0xbf800000, 0x00000000, 0x3f800000],
+                    [0x3f333333, 0x3e4ccccd, 0x3dcccccd, 0x3f000000],
+                    [0x3e800000, 0x3e800000, 0x3e800000, 0x3f800000],
+                ]
+                .to_vec(),
+            ),
+            (
+                Stat::Range,
+                [
+                    [0x3f4ccccc, 0x3f599999, 0x3f30a3d7, 0x3f800000],
+                    [0x3f4ccccc, 0x3ecccccd, 0x3e99999a, 0x3f800000],
+                    [0x00000000, 0x00000000, 0x00000000, 0x00000000],
+                    [0x40a00000, 0x40a00000, 0x3fc00000, 0x3f800000],
+                    [0x00000000, 0x00000000, 0x00000000, 0x3f000000],
+                    [0x3e800000, 0x3f000000, 0x3e800000, 0x3f800000],
+                ]
+                .to_vec(),
+            ),
+            (
+                Stat::Skewness,
+                [
+                    [0x3f522026, 0x3ee7cf76, 0x3f600000, 0x3f800000],
+                    [0x3f1bd152, 0x3efffffe, 0x3ee4a11b, 0x3f800000],
+                    [0x00000000, 0x00000000, 0x00000000, 0x00000000],
+                    [0x3eedb65a, 0x3f2ea754, 0x3f3a6c7a, 0x3f800000],
+                    [0x3f000000, 0x3f000000, 0x3f000000, 0x3f000000],
+                    [0x3f49e69e, 0x3e58658a, 0x3f49e69e, 0x3f800000],
+                ]
+                .to_vec(),
+            ),
+            (
+                Stat::StandardDeviation,
+                [
+                    [0x3e99421e, 0x3ea23b6b, 0x3e8d4fdf, 0x3f800000],
+                    [0x3e97739e, 0x3e21e89b, 0x3e050581, 0x3f800000],
+                    [0x00000000, 0x00000000, 0x00000000, 0x00000000],
+                    [0x3fd3e0b1, 0x3fd9f9e5, 0x3f0c378c, 0x3f800000],
+                    [0x00000000, 0x00000000, 0x00000000, 0x3f000000],
+                    [0x3dddb3d7, 0x3e5db3d7, 0x3dddb3d7, 0x3f800000],
+                ]
+                .to_vec(),
+            ),
+            (
+                Stat::Summation,
+                [
+                    [0x3fcccccd, 0x401ccccd, 0x400c28f6, 0x3f800000],
+                    [0x3fe66666, 0x3f99999a, 0x3fc00000, 0x3f800000],
+                    [0x00000000, 0x00000000, 0x00000000, 0x00000000],
+                    [0x40400000, 0x40a00000, 0x40200000, 0x3f800000],
+                    [0x3f333333, 0x3e4ccccd, 0x3dcccccd, 0x3f000000],
+                    [0x3fa00000, 0x40200000, 0x3fa00000, 0x3f800000],
+                ]
+                .to_vec(),
+            ),
+            (
+                Stat::Variance,
+                [
+                    [0x3db78033, 0x3dcd9e83, 0x3d9c022a, 0x3f800000],
+                    [0x3db33332, 0x3ccccccd, 0x3c8a3d70, 0x3f800000],
+                    [0x00000000, 0x00000000, 0x00000000, 0x00000000],
+                    [0x402f5c29, 0x4039999a, 0x3e99999a, 0x3f800000],
+                    [0x00000000, 0x00000000, 0x00000000, 0x3f000000],
+                    [0x3c400000, 0x3d400000, 0x3c400000, 0x3f800000],
+                ]
+                .to_vec(),
+            ),
+        ];
+        for (mode, want) in expected {
+            assert_eq!(bits(&combine(&layers, mode)), want, "{mode:?}");
+        }
+    }
+
+    /// Entropy against values worked out by hand (bits of the 8-bit histogram, over log2(N)).
+    #[test]
+    fn entropy_matches_hand_computed_values() {
+        let out = combine(&fixture(), Stat::Entropy);
+        let h = |ps: &[f64]| -> f64 {
+            let n: f64 = ps.iter().sum();
+            ps.iter().map(|c| -(c / n) * (c / n).log2()).sum::<f64>() / n.log2()
+        };
+        // Pixel 1: four distinct values -> 2 bits / log2(4) = exactly 1.
+        assert_eq!(out[1][0], 1.0);
+        // Pixel 2: every sample transparent -> untouched.
+        assert_eq!(out[2], [0.0; 4]);
+        // Pixel 3, red: -2 and 0 land in bin 0, 3 and 1.5 clamp into bin 255, 0.5 is alone.
+        assert!((f64::from(out[3][0]) - h(&[2.0, 2.0, 1.0])).abs() < 1e-6, "{}", out[3][0]);
+        // Pixel 4: a single contributing sample has no entropy.
+        assert_eq!(out[4], [0.0, 0.0, 0.0, 0.5]);
+        // Pixel 5: three samples share a bin, one is alone, in every channel.
+        for (c, v) in out[5].iter().take(3).enumerate() {
+            assert!((f64::from(*v) - h(&[3.0, 1.0])).abs() < 1e-6, "channel {c}: {v}");
+        }
+    }
+
+    /// The old HashMap summed in a random order, so Entropy could differ by an ulp between runs.
+    /// Now the bins are summed in ascending order: repeated runs (and any thread count) agree.
+    #[test]
+    fn entropy_is_deterministic() {
+        let layers: Vec<Vec<[f32; 4]>> = (0..7)
+            .map(|k| {
+                (0..3 * CHUNK + 17).map(|i| [((i * 7 + k * 13) % 11) as f32 / 10.0, ((i + k) % 5) as f32 / 4.0, ((i * k) % 9) as f32 / 8.0, 1.0]).collect()
+            })
+            .collect();
+        let first = bits(&combine(&layers, Stat::Entropy));
+        for _ in 0..8 {
+            assert_eq!(bits(&combine(&layers, Stat::Entropy)), first);
+        }
+    }
+
+    /// Chunking is invisible: a multi-chunk image (with a ragged last chunk and layers of unequal
+    /// length) gives, pixel by pixel, what combining that pixel on its own gives.
+    #[test]
+    fn chunked_result_equals_per_pixel_result() {
+        let len = 2 * CHUNK + 5;
+        let layer = |k: usize, n: usize| -> Vec<[f32; 4]> {
+            (0..n)
+                .map(|i| {
+                    [
+                        ((i * 31 + k * 7) % 101) as f32 / 100.0,
+                        ((i * 17 + k) % 53) as f32 / 52.0 - 0.2,
+                        ((i + 3 * k) % 29) as f32 / 28.0,
+                        if (i + k).is_multiple_of(4) { 0.0 } else { 0.5 + ((i + k) % 3) as f32 / 4.0 },
+                    ]
+                })
+                .collect()
+        };
+        let layers = vec![layer(1, len), layer(2, CHUNK + 3), layer(3, len - 1), layer(4, 0), layer(5, len)];
+        for mode in [
+            Stat::Entropy,
+            Stat::Kurtosis,
+            Stat::Maximum,
+            Stat::Mean,
+            Stat::Median,
+            Stat::Minimum,
+            Stat::Range,
+            Stat::Skewness,
+            Stat::StandardDeviation,
+            Stat::Summation,
+            Stat::Variance,
+        ] {
+            let whole = combine(&layers, mode);
+            assert_eq!(whole.len(), len);
+            for i in (0..len).step_by(97).chain([CHUNK - 1, CHUNK, CHUNK + 1, 2 * CHUNK - 1, 2 * CHUNK, len - 1]) {
+                let one: Vec<Vec<[f32; 4]>> = layers.iter().map(|l| l.get(i).map(|p| vec![*p]).unwrap_or_default()).collect();
+                assert_eq!(whole[i].map(f32::to_bits), combine(&one, mode)[0].map(f32::to_bits), "{mode:?} pixel {i}");
+            }
+        }
+    }
+
+    #[test]
+    fn no_layers_gives_an_empty_result() {
+        assert!(combine(&[], Stat::Median).is_empty());
+    }
+
+    /// [`ipow`] multiplies in the order `x·x²` for the cube and `x²·x²` for the fourth power.
+    #[test]
+    fn ipow_squares_and_multiplies() {
+        for x in [0.58f32, -0.12, -2.6, 2.4, -0.6, 1.0e-3, 0.0] {
+            assert_eq!(ipow(x, 0).to_bits(), 1.0f32.to_bits());
+            assert_eq!(ipow(x, 1).to_bits(), x.to_bits());
+            assert_eq!(ipow(x, 2).to_bits(), (x * x).to_bits());
+            assert_eq!(ipow(x, 3).to_bits(), (x * (x * x)).to_bits());
+            assert_eq!(ipow(x, 4).to_bits(), ((x * x) * (x * x)).to_bits());
+        }
+    }
 }
diff --git a/crates/algo/src/tests.rs b/crates/algo/src/tests.rs
index 31def5f99d..148a0723ec 100644
--- a/crates/algo/src/tests.rs
+++ b/crates/algo/src/tests.rs
@@ -414,6 +414,24 @@ fn twirl_keeps_centre_and_outside() {
     assert_ne!(out.pixel(20, 12), s.pixel(20, 12));
 }
 
+/// #5643: on a wide image Twirl, Pinch and Spherize fill the ellipse inscribed in the bounds, as
+/// Photoshop's do, not just a circle fitted to the height: a point near the left and right edges
+/// on the middle row changes, the corners don't, and a square still uses its inscribed circle.
+#[test]
+fn round_distortions_fill_the_inscribed_ellipse() {
+    let b = Rect::new(0, 0, 80, 40);
+    let s = pattern(SampleType::F32, b);
+    for p in [FilterParams::Twirl { angle: 180.0 }, FilterParams::Pinch { amount: 80.0 }, FilterParams::Spherize { amount: 80.0, mode: SpherizeMode::Normal }] {
+        let out = apply(&s, &p, b, b, None);
+        // 30 px left of centre on the middle row: outside the old 20 px circle, inside the ellipse.
+        assert_ne!(out.pixel(10, 21), s.pixel(10, 21), "{p:?}");
+        assert_ne!(out.pixel(69, 18), s.pixel(69, 18), "{p:?}");
+        for (x, y) in [(0, 0), (79, 0), (0, 39), (79, 39)] {
+            assert_eq!(out.pixel(x, y), s.pixel(x, y), "{p:?}: corner ({x}, {y}) is outside the ellipse");
+        }
+    }
+}
+
 #[test]
 fn motion_blur_spreads_along_angle_only() {
     let mut s = flat(SampleType::F32, R, [0.0, 0.0, 0.0, 1.0]);
diff --git a/crates/algo/src/tests_ext.rs b/crates/algo/src/tests_ext.rs
index fd35f2742a..7c28485f1f 100644
--- a/crates/algo/src/tests_ext.rs
+++ b/crates/algo/src/tests_ext.rs
@@ -435,6 +435,35 @@ fn lens_flare_is_brightest_at_its_centre() {
     assert!(out.pixel(38, 2)[0] >= 0.2 - 1e-6, "screen never darkens");
 }
 
+#[test]
+fn lens_flare_never_darkens_32_bit_values_above_one() {
+    // #5785: the screen formula turned 2.0 into 1.5 (and 1.0 at the core).
+    let p = FilterParams::LensFlare { brightness: 150.0, center_x: 0.25, center_y: 0.5, lens: LensType::Zoom };
+    let out = run(&flat(SampleType::F32, R, [2.0, 2.0, 2.0, 1.0]), &p);
+    for px in out.read_region(R).as_chunks::<4>().0 {
+        assert!(px[..3].iter().all(|&v| v >= 2.0), "{px:?}");
+    }
+}
+
+#[test]
+fn lens_flare_8_bit_result_is_the_screen_blend() {
+    // The flare amount per pixel, read from a black 32-bit image (screen over 0 is the amount).
+    let p = FilterParams::LensFlare { brightness: 150.0, center_x: 0.25, center_y: 0.5, lens: LensType::Zoom };
+    let amount = run(&flat(SampleType::F32, R, [0.0, 0.0, 0.0, 1.0]), &p).read_region(R);
+    let src = pattern(SampleType::U8, R);
+    let base = src.read_region(R);
+    let expected: Vec<f32> = base
+        .as_chunks::<4>()
+        .0
+        .iter()
+        .zip(amount.as_chunks::<4>().0)
+        .flat_map(|(c, a)| [0, 1, 2].map(|k| 1.0 - (1.0 - c[k]) * (1.0 - a[k].min(1.0))).into_iter().chain([c[3]]))
+        .collect();
+    let mut want = Surface::new(fmt(SampleType::U8));
+    want.write_region(R, &expected);
+    assert_eq!(run(&src, &p).read_region(R), want.read_region(R));
+}
+
 #[test]
 fn lighting_point_light_falls_off() {
     let s = flat(SampleType::F32, R, [0.8, 0.8, 0.8, 1.0]);
@@ -608,6 +637,28 @@ fn custom_kernel_shifts_and_offsets() {
     assert!((off.pixel(5, 5)[0] - 0.4).abs() < 1e-5);
 }
 
+/// CMYK samples are ink: Custom's positive offset brightens (removes ink), as in Photoshop
+/// (identity, scale 1, offset +50: white stays white, C=100% becomes C≈80%). Alpha is untouched.
+/// Photoshop's CMYK depths; float is unclamped on both polarities (RGB white + offset exceeds 1).
+#[test]
+fn custom_offset_brightens_cmyk() {
+    let mut id = vec![0.0; 25];
+    id[12] = 1.0;
+    let p = FilterParams::Custom { kernel: id, scale: 1.0, offset: 50.0 };
+    for depth in [SampleType::U8, SampleType::U16] {
+        let f = PixelFormat::new(ColorMode::Cmyk, depth, true);
+        let mut s = Surface::new(f);
+        s.fill_rect(R, &[0.0, 0.0, 0.0, 0.0, 0.6]);
+        let w = run(&s, &p).pixel(5, 5);
+        assert!(w[..4].iter().all(|v| v.abs() < 1e-6) && (w[4] - 0.6).abs() < 0.01, "{depth:?} white: {w:?}");
+        let mut s = Surface::new(f);
+        s.fill_rect(R, &[1.0, 0.5, 0.0, 0.0, 1.0]);
+        let c = run(&s, &p).pixel(5, 5);
+        let want = [1.0 - 50.0 / 255.0, 0.5 - 50.0 / 255.0, 0.0, 0.0, 1.0];
+        assert!(c.iter().zip(want).all(|(a, b)| (a - b).abs() < 0.01), "{depth:?} C100: {c:?}");
+    }
+}
+
 #[test]
 fn hsb_filter_encodes_and_decodes() {
     let s = flat(SampleType::F32, R, [1.0, 0.0, 0.0, 1.0]);
diff --git a/crates/algo/src/transform.rs b/crates/algo/src/transform.rs
index 050d08c322..3e67f1cdee 100644
--- a/crates/algo/src/transform.rs
+++ b/crates/algo/src/transform.rs
@@ -231,14 +231,37 @@ pub fn quad_to_rect(q: &[[f64; 2]; 4], w: f64, h: f64) -> Option<Homography> {
 
 /// The destination rectangle [`warp_surface`] fills for `src_rect` under `h`: the warped corners
 /// plus a pixel for filter support, each side clamped to ±2²⁰. `None` when a corner maps to
-/// infinity (the result is then empty). Lets a caller price a warp before allocating it.
+/// infinity (the result is then empty). Use [`warp_output_size`] to price the full result before
+/// admitting a transform: clipping these bounds must not hide an excessive scale.
 pub fn warp_output_bounds(src_rect: Rect, h: &Homography) -> Option<Rect> {
+    corner_bounds(&warp_corners(src_rect, h)?)
+}
+
+/// Unclipped output dimensions, including the same filter support as [`warp_output_bounds`].
+/// Position does not affect the price, so translating a small layer far away stays cheap.
+/// Unrepresentable or non-finite dimensions saturate at `u64::MAX`, allowing a caller to refuse
+/// the warp with a saturating pixel-budget comparison. Empty and singular inputs have no output.
+pub fn warp_output_size(src_rect: Rect, h: &Homography) -> Option<(u64, u64)> {
+    let corners = warp_corners(src_rect, h)?;
+    if !corners.iter().all(|(x, y)| x.is_finite() && y.is_finite()) {
+        return Some((u64::MAX, u64::MAX));
+    }
+    let x0 = corners.iter().map(|c| c.0).fold(f64::MAX, f64::min).floor();
+    let y0 = corners.iter().map(|c| c.1).fold(f64::MAX, f64::min).floor();
+    let x1 = corners.iter().map(|c| c.0).fold(f64::MIN, f64::max).ceil();
+    let y1 = corners.iter().map(|c| c.1).fold(f64::MIN, f64::max).ceil();
+    // Float-to-integer casts saturate, including when the finite endpoints' difference overflows.
+    Some((((x1 - x0) as u64).saturating_add(2), ((y1 - y0) as u64).saturating_add(2)))
+}
+
+fn warp_corners(src_rect: Rect, h: &Homography) -> Option<[(f64, f64); 4]> {
     if src_rect.is_empty() || h.inverse().is_none() {
         return None;
     }
-    let corners = [(src_rect.x0, src_rect.y0), (src_rect.x1, src_rect.y0), (src_rect.x1, src_rect.y1), (src_rect.x0, src_rect.y1)]
-        .map(|(x, y)| h.apply(x as f64, y as f64));
-    corner_bounds(&corners)
+    Some(
+        [(src_rect.x0, src_rect.y0), (src_rect.x1, src_rect.y0), (src_rect.x1, src_rect.y1), (src_rect.x0, src_rect.y1)]
+            .map(|(x, y)| h.apply(x as f64, y as f64)),
+    )
 }
 
 fn corner_bounds(corners: &[(f64, f64); 4]) -> Option<Rect> {
@@ -510,6 +533,31 @@ fn warp(
 mod tests {
     use super::*;
 
+    #[test]
+    fn output_size_prices_the_unclipped_extent_independently_of_position() {
+        let src = Rect::new(0, 0, 24, 16);
+        for dx in [0.0, 900_000.0, 10_000_000.0] {
+            let h = Homography([1.0, 0.0, dx, 0.0, 1.0, -dx, 0.0, 0.0, 1.0]);
+            assert_eq!(warp_output_size(src, &h), Some((26, 18)));
+        }
+        for sx in [1e7, -1e7] {
+            let h = Homography([sx, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0]);
+            assert_eq!(warp_output_size(src, &h), Some((240_000_002, 18)));
+        }
+    }
+
+    #[test]
+    fn output_size_saturates_overflows_and_preserves_filter_support() {
+        let src = Rect::new(0, 0, 24, 16);
+        let fractional = Homography([0.5, 0.0, 0.25, 0.0, 1.0, 0.75, 0.0, 0.0, 1.0]);
+        let bounds = warp_output_bounds(src, &fractional).unwrap();
+        assert_eq!(warp_output_size(src, &fractional), Some((u64::from(bounds.width()), u64::from(bounds.height()))));
+        let huge = Homography([1e308, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0]);
+        assert_eq!(warp_output_size(src, &huge), Some((u64::MAX, u64::MAX)));
+        assert_eq!(warp_output_size(Rect::EMPTY, &Homography::IDENTITY), None);
+        assert_eq!(warp_output_size(src, &Homography([0.0; 9])), None);
+    }
+
     #[test]
     fn the_interruptible_warp_reports_progress_and_stops_when_cancelled() {
         let mut s = Surface::new(PixelFormat::RGBA8);
diff --git a/crates/automation/Cargo.toml b/crates/automation/Cargo.toml
index 0738140a41..fb718e5668 100644
--- a/crates/automation/Cargo.toml
+++ b/crates/automation/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "photocraft-automation"
-description = "MCP server (rmcp) over the Photocraft engine, plus a bridge to a running GUI"
+description = "MCP server (rmcp) over the PhotoCraft engine, plus a bridge to a running GUI"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
diff --git a/crates/automation/src/rpc.rs b/crates/automation/src/rpc.rs
index dc01f0f2b4..15a0e24e30 100644
--- a/crates/automation/src/rpc.rs
+++ b/crates/automation/src/rpc.rs
@@ -29,8 +29,8 @@ use serde_json::{Value, json};
 
 use crate::budgets::{BatchReplyBudget, write_reply};
 use crate::security::{
-    ConnectionLimiter, LineRead, MAX_BATCH_STEPS, MAX_CONNECTIONS, MAX_REQUEST_BYTES, authentication_reply, configure_stream, discard_rest_of_line,
-    read_bounded_line, repeat_auth_reply,
+    AUTH_DEADLINE, AuthDeadlineStream, ConnectionLimiter, LineRead, MAX_BATCH_STEPS, MAX_CONNECTIONS, MAX_REQUEST_BYTES, authentication_reply,
+    configure_stream, discard_rest_of_line, read_bounded_line, repeat_auth_reply,
 };
 use crate::{AutomationError, Headless};
 
@@ -262,10 +262,12 @@ pub fn serve_lines(h: &Mutex<Headless>, mut r: impl BufRead, mut w: impl Write)
     }
 }
 
-fn serve_tcp_connection(h: &Mutex<Headless>, stream: std::net::TcpStream, token: &str) -> std::io::Result<()> {
+/// Serve one connection. It must complete `auth` within `auth_deadline` of connecting, however
+/// much it sends meanwhile (#4965); after that only the idle timeout applies.
+fn serve_tcp_connection(h: &Mutex<Headless>, stream: std::net::TcpStream, token: &str, auth_deadline: std::time::Duration) -> std::io::Result<()> {
     configure_stream(&stream)?;
     let read = stream.try_clone()?;
-    let mut reader = std::io::BufReader::new(read);
+    let mut reader = std::io::BufReader::new(AuthDeadlineStream::new(read, auth_deadline));
     let mut out = stream;
     let mut line = String::new();
     let mut authenticated = false;
@@ -290,6 +292,9 @@ fn serve_tcp_connection(h: &Mutex<Headless>, stream: std::net::TcpStream, token:
         } else {
             let (reply, ok) = authentication_reply(&line, token);
             authenticated = ok;
+            if ok {
+                reader.get_mut().authenticated()?;
+            }
             reply
         };
         write_reply(&mut out, &reply)?;
@@ -322,7 +327,7 @@ pub fn serve_tcp(addr: &str, h: Arc<Mutex<Headless>>, token: String, ready: impl
         let token = Arc::clone(&token);
         std::thread::spawn(move || {
             let _permit = permit;
-            let _ = serve_tcp_connection(&h, stream, &token);
+            let _ = serve_tcp_connection(&h, stream, &token, AUTH_DEADLINE);
         });
     }
     Ok(())
@@ -814,6 +819,60 @@ mod tests {
         assert!(v["result"].as_array().unwrap().iter().any(|m| m == "batch"));
     }
 
+    /// #4965: a connection that keeps sending without authenticating is closed at the deadline,
+    /// and one that authenticated in time keeps being served after it.
+    #[test]
+    fn tcp_connections_must_authenticate_before_the_deadline_whatever_they_send() {
+        use std::io::{BufReader, Write as _};
+        use std::time::{Duration, Instant};
+        const TOKEN: &str = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        let server = std::thread::spawn(move || {
+            let h = Mutex::new(Headless::new());
+            let mut results = Vec::new();
+            for _ in 0..2 {
+                let (stream, _) = listener.accept().unwrap();
+                let started = Instant::now();
+                let r = serve_tcp_connection(&h, stream, TOKEN, Duration::from_millis(300));
+                results.push((r.map_err(|e| e.kind()), started.elapsed()));
+            }
+            results
+        });
+
+        // Never a newline, a byte every 20 ms: each read succeeds long before the idle timeout.
+        let mut slow = std::net::TcpStream::connect(addr).unwrap();
+        for _ in 0..150 {
+            if slow.write_all(b" ").is_err() {
+                break;
+            }
+            std::thread::sleep(Duration::from_millis(20));
+        }
+        drop(slow);
+
+        // Authenticates at once, then asks again 300 ms after the deadline.
+        let mut s = std::net::TcpStream::connect(addr).unwrap();
+        s.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
+        writeln!(s, r#"{{"id":"auth","method":"auth","params":{{"token":"{TOKEN}"}}}}"#).unwrap();
+        let mut reader = BufReader::new(s.try_clone().unwrap());
+        let mut line = String::new();
+        reader.read_line(&mut line).unwrap();
+        assert_eq!(serde_json::from_str::<Value>(&line).unwrap()["result"]["authenticated"], true);
+        std::thread::sleep(Duration::from_millis(600));
+        writeln!(s, r#"{{"id":"a","method":"methods"}}"#).unwrap();
+        line.clear();
+        reader.read_line(&mut line).unwrap();
+        assert_eq!(serde_json::from_str::<Value>(&line).unwrap()["id"], "a");
+        drop(reader);
+        drop(s);
+
+        let results = server.join().unwrap();
+        let (slow_result, slow_time) = &results[0];
+        assert!(matches!(slow_result, Err(std::io::ErrorKind::TimedOut | std::io::ErrorKind::WouldBlock)), "{slow_result:?}");
+        assert!(*slow_time < Duration::from_secs(3), "the trickle did not extend the deadline: {slow_time:?}");
+        assert_eq!(results[1].0, Ok(()), "the authenticated connection ended with its client");
+    }
+
     #[test]
     fn tcp_repeat_auth_reports_already_authenticated_and_keeps_serving() {
         use std::io::{BufReader, Write as _};
diff --git a/crates/automation/src/security.rs b/crates/automation/src/security.rs
index 4659a3ff17..6198f22851 100644
--- a/crates/automation/src/security.rs
+++ b/crates/automation/src/security.rs
@@ -1,11 +1,11 @@
 //! Shared security primitives for the loopback JSON control transports.
 
 use std::fs::OpenOptions;
-use std::io::{BufRead, Write};
+use std::io::{BufRead, Read, Write};
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 use std::sync::atomic::{AtomicUsize, Ordering};
-use std::time::Duration;
+use std::time::{Duration, Instant};
 
 use serde_json::{Value, json};
 
@@ -21,6 +21,10 @@ pub const MAX_CONNECTIONS: usize = 16;
 pub const MAX_BATCH_STEPS: usize = 256;
 /// Idle/read and write timeout for loopback TCP connections.
 pub const IO_TIMEOUT: Duration = Duration::from_secs(30);
+/// How long a new TCP connection has to authenticate, however active it is. [`IO_TIMEOUT`] starts
+/// again with every read, so a client that kept sending without ever completing `auth` held one
+/// of the [`MAX_CONNECTIONS`] permits for as long as it liked (#4965).
+pub const AUTH_DEADLINE: Duration = Duration::from_secs(10);
 
 const TOKEN_BYTES: usize = 32;
 const TOKEN_HEX_LEN: usize = TOKEN_BYTES * 2;
@@ -131,7 +135,27 @@ pub fn repeat_auth_reply(line: &str) -> Option<Value> {
 }
 
 fn read_token_file(path: &Path) -> Result<String, AutomationError> {
-    let token = std::fs::read_to_string(path).map_err(|e| AutomationError::Io(format!("{}: {e}", path.display())))?;
+    // Validate what we actually opened, not just the name: an existing control-token file must be
+    // a regular file that no other local principal can read. A freshly created one is 0600
+    // (`create_token_file`); an operator-supplied one is checked here so a group- or world-readable
+    // token is refused rather than trusted as the control credential (#4966).
+    let mut file = std::fs::File::open(path).map_err(|e| AutomationError::Io(format!("{}: {e}", path.display())))?;
+    let meta = file.metadata().map_err(|e| AutomationError::Io(format!("{}: {e}", path.display())))?;
+    if !meta.is_file() {
+        return Err(AutomationError::Io(format!("{}: control token file is not a regular file", path.display())));
+    }
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::MetadataExt;
+        if meta.mode() & 0o077 != 0 {
+            return Err(AutomationError::Io(format!(
+                "{}: control token file is readable by group or others (mode {:o}); restrict it to its owner (e.g. chmod 600)",
+                path.display(),
+                meta.mode() & 0o777
+            )));
+        }
+    }
+    let token = std::io::read_to_string(&mut file).map_err(|e| AutomationError::Io(format!("{}: {e}", path.display())))?;
     let token = token.trim().to_owned();
     validate_token(&token)?;
     Ok(token)
@@ -242,6 +266,44 @@ pub fn configure_stream(stream: &std::net::TcpStream) -> std::io::Result<()> {
     stream.set_write_timeout(Some(IO_TIMEOUT))
 }
 
+/// The read half of a control connection. Until [`Self::authenticated`] is called, reads fail
+/// with `TimedOut` once the authentication deadline has passed, whatever arrived in the meantime;
+/// the caller then drops the connection and its [`ConnectionPermit`].
+pub struct AuthDeadlineStream {
+    stream: std::net::TcpStream,
+    /// `None` once authenticated.
+    deadline: Option<Instant>,
+}
+
+impl AuthDeadlineStream {
+    /// `stream` must authenticate within `limit` from now (normally [`AUTH_DEADLINE`]).
+    pub fn new(stream: std::net::TcpStream, limit: Duration) -> Self {
+        // A limit too large to represent expires at once rather than never.
+        let now = Instant::now();
+        Self { stream, deadline: Some(now.checked_add(limit).unwrap_or(now)) }
+    }
+
+    /// The connection authenticated: only the idle timeout applies from here on.
+    pub fn authenticated(&mut self) -> std::io::Result<()> {
+        self.deadline = None;
+        self.stream.set_read_timeout(Some(IO_TIMEOUT))
+    }
+}
+
+impl Read for AuthDeadlineStream {
+    fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
+        if let Some(deadline) = self.deadline {
+            let left = deadline.saturating_duration_since(Instant::now());
+            if left.is_zero() {
+                return Err(std::io::Error::new(std::io::ErrorKind::TimedOut, "not authenticated in time"));
+            }
+            // Wait no longer than what is left, so a silent client is dropped at the deadline too.
+            self.stream.set_read_timeout(Some(left.min(IO_TIMEOUT)))?;
+        }
+        self.stream.read(buf)
+    }
+}
+
 /// Environment-aware token inputs shared by the desktop app and CLI.
 pub fn token_inputs(supplied: Option<String>, token_file: Option<PathBuf>) -> (Option<String>, Option<PathBuf>) {
     let supplied = supplied.or_else(|| std::env::var("PHOTOCRAFT_CONTROL_TOKEN").ok());
@@ -327,6 +389,91 @@ mod tests {
         std::fs::remove_file(path).unwrap();
     }
 
+    /// A connected loopback pair: the accepted (server) end and the client end.
+    fn tcp_pair() -> (std::net::TcpStream, std::net::TcpStream) {
+        let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+        let client = std::net::TcpStream::connect(listener.local_addr().unwrap()).unwrap();
+        let (server, _) = listener.accept().unwrap();
+        configure_stream(&server).unwrap();
+        (server, client)
+    }
+
+    /// #4965: activity must not extend the time a connection may stay unauthenticated.
+    #[test]
+    fn an_active_connection_is_dropped_at_the_authentication_deadline() {
+        let (server, mut client) = tcp_pair();
+        // A byte every 20 ms and never a newline: each read succeeds long before the idle timeout.
+        let trickle = std::thread::spawn(move || {
+            for _ in 0..150 {
+                if client.write_all(b"x").is_err() {
+                    break;
+                }
+                std::thread::sleep(Duration::from_millis(20));
+            }
+        });
+        let mut reader = std::io::BufReader::new(AuthDeadlineStream::new(server, Duration::from_millis(300)));
+        let mut line = String::new();
+        let started = Instant::now();
+        let err = read_bounded_line(&mut reader, &mut line).unwrap_err();
+        assert!(matches!(err.kind(), std::io::ErrorKind::TimedOut | std::io::ErrorKind::WouldBlock), "{err}");
+        assert!(started.elapsed() >= Duration::from_millis(250), "not before the deadline: {:?}", started.elapsed());
+        assert!(started.elapsed() < Duration::from_secs(3), "the trickle did not extend it: {:?}", started.elapsed());
+        // It stays expired.
+        assert!(read_bounded_line(&mut reader, &mut line).is_err());
+        drop(reader);
+        trickle.join().unwrap();
+    }
+
+    #[test]
+    fn a_silent_connection_is_dropped_at_the_authentication_deadline() {
+        let (server, _client) = tcp_pair();
+        let mut reader = std::io::BufReader::new(AuthDeadlineStream::new(server, Duration::from_millis(200)));
+        let mut line = String::new();
+        let started = Instant::now();
+        assert!(read_bounded_line(&mut reader, &mut line).is_err());
+        assert!(started.elapsed() < Duration::from_secs(3), "{:?}", started.elapsed());
+    }
+
+    #[test]
+    fn an_authenticated_connection_outlives_the_authentication_deadline() {
+        let (server, mut client) = tcp_pair();
+        let sender = std::thread::spawn(move || {
+            client.write_all(b"one\n").unwrap();
+            std::thread::sleep(Duration::from_millis(500));
+            client.write_all(b"two\n").unwrap();
+        });
+        let mut reader = std::io::BufReader::new(AuthDeadlineStream::new(server, Duration::from_millis(200)));
+        let mut line = String::new();
+        assert_eq!(read_bounded_line(&mut reader, &mut line).unwrap(), LineRead::Line);
+        assert_eq!(line, "one\n");
+        reader.get_mut().authenticated().unwrap();
+        // Sent 300 ms after the deadline: only the idle timeout applies now.
+        assert_eq!(read_bounded_line(&mut reader, &mut line).unwrap(), LineRead::Line);
+        assert_eq!(line, "two\n");
+        sender.join().unwrap();
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn an_existing_token_file_must_be_owner_only() {
+        use std::os::unix::fs::PermissionsExt;
+        let dir = std::env::temp_dir().join(format!("photocraft-token-perm-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("token.txt");
+        let token = "0123456789abcdef".repeat(4); // 64 hex chars, passes validate_token
+        std::fs::write(&path, &token).unwrap();
+
+        // A group- or world-readable token is refused: the control credential must not be shared (#4966).
+        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o644)).unwrap();
+        assert!(read_token_file(&path).is_err(), "a 0644 token file must be refused");
+
+        // Owner-only is opened, read and validated.
+        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600)).unwrap();
+        assert_eq!(read_token_file(&path).unwrap(), token, "a 0600 token file must be read");
+
+        std::fs::remove_dir_all(&dir).ok();
+    }
+
     #[test]
     fn connection_limiter_releases_capacity() {
         let limiter = ConnectionLimiter::new(1);
diff --git a/crates/automation/src/server.rs b/crates/automation/src/server.rs
index f223bc5109..f52376a9c5 100644
--- a/crates/automation/src/server.rs
+++ b/crates/automation/src/server.rs
@@ -325,10 +325,11 @@ pub struct UiSetParams {
     /// dashes, dashOffset and opacity; null disables the stroke). Shape stroke fields use
     /// `shape.edit` names and units; colour comes from `tools.setColors`. camTransformOnDrop (bool,
     /// the Content-Aware Move tool's Transform On Drop). tileGrid (bool, a developer overlay of the
-    /// active layer's storage tiles). layerFilter (an object patching the Layers panel filter:
-    /// by: kind/name/mode; kinds: a list of pixel/adjustment/type/shape/smart; name: a string;
-    /// mode: a blend mode name such as Multiply or Pass Through). Omitted filter fields keep
-    /// their current values. Other fields are an error.
+    /// active layer's storage tiles). layerFilter (an object patching by ("kind", "name" or
+    /// "mode"), kinds (a list of layer kinds), name (matches part of the layer name) and mode (a
+    /// blend mode name) for the Layers panel filter). strokeTrace (true, false, "stderr" or "off":
+    /// the stroke latency trace at runtime; a CSV file is set at launch with --stroke-trace, not
+    /// over this channel). Other fields are an error.
     pub fields: Value,
 }
 
diff --git a/crates/automation/src/workspace.rs b/crates/automation/src/workspace.rs
index 23b64ae30e..f73a702385 100644
--- a/crates/automation/src/workspace.rs
+++ b/crates/automation/src/workspace.rs
@@ -369,6 +369,10 @@ fn command_uses_ambient_path(id: &str, params: &Value) -> bool {
         }
         // With a `path` the file is written there; without one the bytes come back as `data`.
         "actions.save" | "swatches.export" => params.get("path").is_some(),
+        // Shortcut sets: a .kys read or written by path, or a Summarize page written by path.
+        "edit.keyboardShortcuts" => {
+            params.get("path").is_some() || ["importKys", "exportKys", "summarize"].iter().any(|k| params.get(*k).and_then(|v| v.get("path")).is_some())
+        }
         "plugin.reload" => true,
         _ => false,
     }
@@ -712,6 +716,12 @@ mod tests {
         assert!(authorize_desktop_engine_command("image.mode.cmyk", &serde_json::json!({})).is_err());
         assert!(authorize_engine_command("image.mode.rgb", &serde_json::json!({"profile": "/outside/profile.icc"})).is_err());
         assert!(authorize_engine_command("image.mode.rgb", &serde_json::json!({"profile": "srgb"})).is_ok());
+        // Shortcut sets: text in and out is fine; a path reads or writes the filesystem.
+        let ks = |p: serde_json::Value| authorize_engine_command("edit.keyboardShortcuts", &p);
+        assert!(ks(serde_json::json!({"exportKys": true, "summarize": true, "importKys": "<photoshop-keyboard-shortcuts/>"})).is_ok());
+        for key in ["importKys", "exportKys", "summarize"] {
+            assert!(ks(serde_json::json!({ key: {"path": "/outside/set.kys"} })).is_err(), "{key}");
+        }
         assert!(authorize_engine_command("filter.distort.displace", &serde_json::json!({"mapPath": "outside.png"})).is_err());
         assert!(authorize_engine_command("layer.setAdjustment", &serde_json::json!({"file": "outside.cube"})).is_err());
         assert!(authorize_engine_command("prefs.set", &serde_json::json!({"path": "colorSettings.workingRgb", "value": "outside.icc"})).is_err());
diff --git a/crates/automation/tests/krita.rs b/crates/automation/tests/krita.rs
index 85bde4f5fc..44de53ff2a 100644
--- a/crates/automation/tests/krita.rs
+++ b/crates/automation/tests/krita.rs
@@ -4,14 +4,15 @@
 use photocraft_automation::Headless;
 use serde_json::json;
 
-/// A tiled pixel file with one raw 64x64 tile of `bgra` at (0, 0).
+/// A tiled pixel file with one raw 64x64 tile of `bgra` at (0, 0). Krita writes a raw tile
+/// (flag 0) as plain interleaved pixels; only LZF tiles are split into byte planes.
 fn tiles(bgra: [u8; 4]) -> Vec<u8> {
     let n = 64 * 64;
     let mut out = b"VERSION 2\nTILEWIDTH 64\nTILEHEIGHT 64\nPIXELSIZE 4\nDATA 1\n".to_vec();
     out.extend(format!("0,0,LZF,{}\n", 1 + n * 4).into_bytes());
     out.push(0);
-    for b in bgra {
-        out.extend(std::iter::repeat_n(b, n));
+    for _ in 0..n {
+        out.extend(bgra);
     }
     out
 }
diff --git a/crates/automation/tests/smart_filter_authorization.rs b/crates/automation/tests/smart_filter_authorization.rs
new file mode 100644
index 0000000000..30f17b795b
--- /dev/null
+++ b/crates/automation/tests/smart_filter_authorization.rs
@@ -0,0 +1,259 @@
+//! Stored smart-filter parameters must not grant automation ambient filesystem access.
+use std::path::{Path, PathBuf};
+use std::sync::{
+    Arc,
+    atomic::{AtomicU64, Ordering},
+};
+
+use photocraft_automation::{AuthorizedWorkspace, Headless, workspace::authorize_desktop_engine_step};
+use photocraft_doc::{Document, LayerContent, LayerId};
+use photocraft_engine::{Session, actions_cmds::Action, jobs::Started, smart_cmds};
+use serde_json::{Value, json};
+
+struct Fixture(PathBuf);
+
+impl Fixture {
+    fn new() -> Self {
+        static NEXT: AtomicU64 = AtomicU64::new(0);
+        let stamp = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+        let base = std::env::temp_dir().join(format!("pc-filter-auth-{}-{stamp}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir(&base).unwrap();
+        std::fs::create_dir(base.join("workspace")).unwrap();
+        std::fs::create_dir(base.join("outside")).unwrap();
+        let f = Self(base);
+        std::fs::write(f.root().join("stripes.png"), png(|x| if (x / 2) % 2 == 0 { 0 } else { 255 })).unwrap();
+        std::fs::write(f.outside("black.png"), png(|_| 0)).unwrap();
+        std::fs::write(f.outside("white.png"), png(|_| 255)).unwrap();
+        std::fs::write(f.outside("black.cube"), cube(0)).unwrap();
+        std::fs::write(f.outside("white.cube"), cube(1)).unwrap();
+        f
+    }
+
+    fn root(&self) -> PathBuf {
+        self.0.join("workspace")
+    }
+    fn outside(&self, name: &str) -> PathBuf {
+        self.0.join("outside").join(name)
+    }
+    fn headless(&self) -> Headless {
+        Headless::with_workspace(AuthorizedWorkspace::new(Some(&self.root()), Some(&self.root())).unwrap())
+    }
+    fn setup(&self, lookup: bool) -> (Headless, LayerId) {
+        let mut h = self.headless();
+        h.handle("doc.new", json!({"width": 32, "height": 32, "background": "#808080"})).unwrap();
+        h.handle("doc.new", json!({"width": 32, "height": 32})).unwrap();
+        let layer = LayerId(h.handle("doc.place", json!({"path": "stripes.png"})).unwrap()["layer"].as_u64().unwrap());
+        let (id, params) = if lookup {
+            ("image.adjustments.colorLookup", json!({"layer": layer.0, "lut": "none"}))
+        } else {
+            ("filter.distort.displace", json!({"layer": layer.0, "mapDocument": 0, "horizontal": 50, "vertical": 0}))
+        };
+        h.session.execute(id, params).unwrap();
+        (h, layer)
+    }
+    fn saved_filter(&self, lookup: bool) -> (Document, LayerId) {
+        let (h, layer) = self.setup(lookup);
+        let mut doc = (*h.session.active().unwrap().doc).clone();
+        let LayerContent::Smart(sm) = &mut doc.layer_mut(layer).unwrap().content else { panic!("smart object") };
+        sm.smart_filters[0].params = path_params(lookup, &self.outside(if lookup { "white.cube" } else { "white.png" }));
+        let bytes = photocraft_format::save_to_bytes(&doc, &Default::default()).unwrap();
+        std::fs::write(self.root().join("stored.pcraft"), bytes).unwrap();
+        (doc, layer)
+    }
+}
+impl Drop for Fixture {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn png(value: impl Fn(u32) -> u8) -> Vec<u8> {
+    let mut pixels = Vec::new();
+    for _ in 0..32 {
+        for x in 0..32 {
+            pixels.extend([value(x); 3]);
+        }
+    }
+    let image = photocraft_codecs::Image::from_u8(32, 32, photocraft_codecs::ChannelLayout::Rgb, pixels).unwrap();
+    photocraft_codecs::encode(&image, photocraft_codecs::Format::Png, &Default::default()).unwrap()
+}
+fn cube(value: u8) -> String {
+    format!("LUT_3D_SIZE 2\n{}", format!("{value} {value} {value}\n").repeat(8))
+}
+fn path_params(lookup: bool, path: &Path) -> Value {
+    if lookup { json!({"file": path}) } else { json!({"mapPath": path, "mapDocument": null}) }
+}
+fn assert_denied<T: std::fmt::Debug>(result: Result<T, impl std::fmt::Display>) {
+    match result {
+        Err(error) => assert!(error.to_string().contains("ambient filesystem"), "{error}"),
+        Ok(value) => panic!("ambient file access was accepted: {value:?}"),
+    }
+}
+
+#[test]
+fn parameter_edits_reject_outside_images_and_luts_without_changing_the_document() {
+    for lookup in [false, true] {
+        let f = Fixture::new();
+        let (mut h, layer) = f.setup(lookup);
+        let before = h.render_png(None, 64).unwrap();
+        let doc = h.session.active().unwrap().doc.clone();
+        let journal = h.session.journal.len();
+        for name in if lookup { ["black.cube", "white.cube"] } else { ["black.png", "white.png"] } {
+            let params = path_params(lookup, &f.outside(name));
+            let id = if lookup { "image.adjustments.colorLookup" } else { "filter.distort.displace" };
+            assert_denied(h.session.execute(id, params.clone()));
+            assert_denied(h.handle("engine.execute", json!({"command": "layer.smartFilter.setParams", "params": {"layer": layer.0, "params": params}})));
+            assert!(Arc::ptr_eq(&doc, &h.session.active().unwrap().doc));
+            assert_eq!(h.session.journal.len(), journal);
+            assert_eq!(h.render_png(None, 64).unwrap(), before);
+        }
+        // Safe numeric and embedded-data edits remain usable.
+        let safe = if lookup { json!({"data": cube(0), "fileName": "embedded.cube"}) } else { json!({"horizontal": 10}) };
+        h.session.execute("layer.smartFilter.setParams", json!({"layer": layer.0, "params": safe})).unwrap();
+    }
+}
+
+#[test]
+fn action_playback_cannot_hide_a_smart_filter_path_edit() {
+    let f = Fixture::new();
+    let (mut h, layer) = f.setup(false);
+    let doc = h.session.active().unwrap().doc.clone();
+    h.session.actions.list.push(Action::new(
+        "edit filter",
+        vec![("layer.smartFilter.setParams".into(), json!({"layer": layer.0, "params": path_params(false, &f.outside("white.png"))}))],
+    ));
+    let result = h.session.execute("actions.play", json!({"action": "edit filter"})).unwrap();
+    assert!(result["failed"]["error"].as_str().unwrap().contains("ambient filesystem"), "{result}");
+    assert!(Arc::ptr_eq(&doc, &h.session.active().unwrap().doc));
+}
+
+#[test]
+fn loaded_filters_are_checked_after_merging_even_when_the_edit_contains_no_path() {
+    for lookup in [false, true] {
+        let f = Fixture::new();
+        let (_, layer) = f.saved_filter(lookup);
+        let mut h = f.headless();
+        h.open(Path::new("stored.pcraft")).unwrap();
+        let doc = h.session.active().unwrap().doc.clone();
+        assert_denied(h.session.execute("layer.smartFilter.setParams", json!({"layer": layer.0, "params": {"horizontal": 10, "dither": false}})));
+        assert!(Arc::ptr_eq(&doc, &h.session.active().unwrap().doc));
+        // Removing an ambient input makes the filter usable again.
+        let safe = if lookup { json!({"file": "", "lut": "none"}) } else { json!({"mapPath": ""}) };
+        h.session.execute("layer.smartFilter.setParams", json!({"layer": layer.0, "params": safe})).unwrap();
+    }
+}
+
+#[test]
+fn loaded_filters_cannot_read_on_rerender_or_reuse_a_trusted_cached_stage() {
+    for lookup in [false, true] {
+        let f = Fixture::new();
+        let (doc, layer) = f.saved_filter(lookup);
+        for warm_cache in [false, true] {
+            if warm_cache {
+                let mut trusted = doc.clone();
+                assert!(smart_cmds::refresh(&mut trusted, layer).unwrap());
+            }
+            let mut h = f.headless();
+            h.open(Path::new("stored.pcraft")).unwrap();
+            let before = h.session.active().unwrap().doc.clone();
+            assert_denied(h.session.execute("layer.smartFilter.setVisible", json!({"layer": layer.0, "visible": true})));
+            assert!(Arc::ptr_eq(&before, &h.session.active().unwrap().doc));
+        }
+    }
+}
+
+#[test]
+fn background_rerender_keeps_the_desktop_request_authority() {
+    for lookup in [false, true] {
+        let f = Fixture::new();
+        let (doc, layer) = f.saved_filter(lookup);
+        let mut s = Session::new();
+        s.add_document(doc, None);
+        s.authorize = Some(authorize_desktop_engine_step);
+        let before = s.active().unwrap().doc.clone();
+        let started = s.start("layer.smartFilter.setVisible", json!({"layer": layer.0, "visible": true})).unwrap();
+        // The desktop restores UI authority as soon as the automation request returns.
+        s.authorize = None;
+        let Started::Job(job) = started else { panic!("expected a background render") };
+        assert_denied(s.wait_job(job));
+        assert!(Arc::ptr_eq(&before, &s.active().unwrap().doc));
+        // The worker's restriction must not leak into subsequent trusted UI work.
+        s.execute("layer.smartFilter.setVisible", json!({"layer": layer.0, "visible": true})).unwrap();
+    }
+}
+
+#[test]
+fn transferring_stored_filters_cannot_read_outside_files() {
+    for lookup in [false, true] {
+        let f = Fixture::new();
+        let (_, from) = f.saved_filter(lookup);
+        let mut h = f.headless();
+        h.open(Path::new("stored.pcraft")).unwrap();
+        let to = h.handle("doc.place", json!({"path": "stripes.png"})).unwrap()["layer"].as_u64().unwrap();
+        let before = h.session.active().unwrap().doc.clone();
+        for copy in [false, true] {
+            assert_denied(h.session.execute("layer.smartFilter.transfer", json!({"from": from.0, "to": to, "copy": copy})));
+            assert!(Arc::ptr_eq(&before, &h.session.active().unwrap().doc));
+        }
+    }
+}
+
+#[test]
+fn trusted_parameter_edits_still_read_maps_and_luts_after_a_denied_request() {
+    for lookup in [false, true] {
+        let f = Fixture::new();
+        let (mut h, layer) = f.setup(lookup);
+        let edit = |path: &Path| json!({"layer": layer.0, "params": path_params(lookup, path)});
+        assert_denied(h.session.execute("layer.smartFilter.setParams", edit(&f.outside("white.png"))));
+        let mut trusted = Headless::trusted_local();
+        trusted.session.add_document((*h.session.active().unwrap().doc).clone(), None);
+        let mut renders = Vec::new();
+        for name in if lookup { ["black.cube", "white.cube", "black.cube"] } else { ["black.png", "white.png", "black.png"] } {
+            trusted.session.execute("layer.smartFilter.setParams", edit(&f.outside(name))).unwrap();
+            renders.push(trusted.render_png(None, 64).unwrap());
+        }
+        assert_ne!(renders[0], renders[1], "trusted path-based filter still works");
+        assert_eq!(renders[0], renders[2], "trusted rendering remains deterministic");
+    }
+}
+
+#[test]
+fn a_refresh_outside_command_execution_surfaces_the_denial_instead_of_rendering_unfiltered() {
+    // link-watch and transform paths re-render through Session::edit, not Session::execute or
+    // jobs::run; the gate must reach them and the denial must not silently pass pixels through
+    // into the process-wide stack cache.
+    for lookup in [false, true] {
+        let f = Fixture::new();
+        let (doc, layer) = f.saved_filter(lookup);
+        let mut h = f.headless();
+        h.open(Path::new("stored.pcraft")).unwrap();
+        let before = h.session.active().unwrap().doc.clone();
+        // Session::edit is the outside-execute mutation path (an edit closure the UI or a
+        // linked-file change runs); the stored filter must be denied there too.
+        assert_denied(h.session.edit("Re-render", |d, _| match smart_cmds::refresh(d, layer) {
+            Ok(_) => Ok(()),
+            Err(e) => Err(e),
+        }));
+        assert!(Arc::ptr_eq(&before, &h.session.active().unwrap().doc));
+        // A trusted session (no gate) still renders the same document.
+        let mut trusted = Session::new();
+        trusted.add_document(doc, None);
+        let mut d = (*trusted.active().unwrap().doc).clone();
+        assert!(smart_cmds::refresh(&mut d, layer).is_ok());
+    }
+}
+
+#[test]
+fn an_ambient_map_or_lut_never_renders_unfiltered_pixels_into_the_stack_cache() {
+    // The denial path must fail the render before any stage is cached process-wide.
+    for lookup in [false, true] {
+        let f = Fixture::new();
+        let (doc, layer) = f.saved_filter(lookup);
+        let mut s = Session::new();
+        s.add_document(doc, None);
+        s.authorize = Some(authorize_desktop_engine_step);
+        let bytes = smart_cmds::stack_cache_bytes();
+        assert_denied(s.execute("layer.smartFilter.setVisible", json!({"layer": layer.0, "visible": true})));
+        assert_eq!(bytes, smart_cmds::stack_cache_bytes(), "a denied render cached no stage");
+    }
+}
diff --git a/crates/cms/src/lib.rs b/crates/cms/src/lib.rs
index d6911ccd24..f93b00372b 100644
--- a/crates/cms/src/lib.rs
+++ b/crates/cms/src/lib.rs
@@ -1,4 +1,4 @@
-//! Photocraft colour management: a pure-Rust ICC v2/v4 colour management module.
+//! PhotoCraft colour management: a pure-Rust ICC v2/v4 colour management module.
 //!
 //! * [`Profile`] parses ICC profiles (matrix/TRC RGB, gray TRC, `mft1`/`mft2`/`mAB `/`mBA `
 //!   LUT profiles incl. CMYK↔Lab, `curv`/`para` curves) and writes ICC v4 profiles.
diff --git a/crates/cms/src/lutfile.rs b/crates/cms/src/lutfile.rs
index 0a68ef8bce..47ff164fda 100644
--- a/crates/cms/src/lutfile.rs
+++ b/crates/cms/src/lutfile.rs
@@ -245,7 +245,7 @@ fn smooth(x: f32) -> f32 {
     x * x * (3.0 - 2.0 * x)
 }
 
-/// Generated looks shipped with Photocraft (procedural, CC0): `(id, label)`.
+/// Generated looks shipped with PhotoCraft (procedural, CC0): `(id, label)`.
 pub const BUILTIN: [(&str, &str); 8] = [
     ("warm", "Warm Filter"),
     ("cool", "Cool Filter"),
diff --git a/crates/cms/src/synth.rs b/crates/cms/src/synth.rs
index 96a23dbfce..390e509dce 100644
--- a/crates/cms/src/synth.rs
+++ b/crates/cms/src/synth.rs
@@ -2,7 +2,7 @@
 //!
 //! Adobe's CMYK profiles (U.S. Web Coated SWOP, Coated FOGRA39 …) are proprietary, and the
 //! freely downloadable characterisation-based profiles come with redistribution conditions, so
-//! Photocraft ships a CMYK profile it generates itself from a documented printer model:
+//! PhotoCraft ships a CMYK profile it generates itself from a documented printer model:
 //!
 //! * **Forward model** (CMYK → XYZ): Yule–Nielsen modified Neugebauer (n = 2) over the 16
 //!   ink overprints, with Demichel coverage weights and a parabolic tone value increase (dot
diff --git a/crates/codecs/README.md b/crates/codecs/README.md
index d4f7094894..46baf50f82 100644
--- a/crates/codecs/README.md
+++ b/crates/codecs/README.md
@@ -38,7 +38,7 @@ let out = encode(&img, Format::Tiff, &EncodeOptions::default())?;
 | WebP | yes | yes | U8 | RGB, RGBA | yes | yes | yes | yes | no | no | yes (VP8, when `webp_lossless` is off) | `image-webp` / built-in VP8 |
 | GIF | yes | yes | U8 | RGBA | 1-bit | no | no | no | no | no | yes (256-colour palette) | `image` |
 | BMP | yes | yes | U8 | RGB, RGBA | yes | no | no | no | no | no | no | `image` |
-| TGA | yes | yes | U8 | Gray, GrayA, RGB, RGBA | yes | no | no | no | no | no | no | `image` |
+| TGA | yes | yes | U8 | Gray, GrayA, RGB, RGBA | yes | no | no | no | no | no | no | `image` (read) / built in (RLE write, one scanline per packet) |
 | ICO | yes | yes | U8 | RGBA (at most 256×256) | yes | no | no | no | no | no | no | `image` |
 | DDS | yes | **no** | U8 | Gray, GrayA, RGB, RGBA | yes | no | no | no | no | no | n/a | built in |
 | Netpbm (PBM/PGM/PPM/PAM/PFM) | yes | yes | U8, U16, F32 (float: PFM gray/RGB only) | all six (PAM `CMYK`/`CMYK_ALPHA`) | yes (PAM) | no | no | no | no | no | no | built in |
diff --git a/crates/codecs/src/codecs/deep_exr.rs b/crates/codecs/src/codecs/deep_exr.rs
index 0726228be5..29f3762ebc 100644
--- a/crates/codecs/src/codecs/deep_exr.rs
+++ b/crates/codecs/src/codecs/deep_exr.rs
@@ -23,7 +23,7 @@ use half::f16;
 use crate::Format;
 use crate::error::CodecError;
 use crate::image::{ChannelLayout, DecodeWarning, DeepChannel, DeepImage, Image, SampleType};
-use crate::options::Limits;
+use crate::options::{Limits, alloc_zeroed};
 
 const F: Format = Format::OpenExr;
 
@@ -39,9 +39,15 @@ fn unsup(reason: impl Into<String>) -> CodecError {
 // Every length and offset comes from the file, so every read is bounds-checked and a short
 // read is a malformed file, never a panic.
 
-fn read_exact(cur: &mut Cursor<&[u8]>, n: usize, what: &str) -> Result<Vec<u8>, CodecError> {
-    let mut v = vec![0u8; n];
-    cur.read_exact(&mut v).map_err(|_| err(format!("truncated file while reading {what}")))?;
+fn read_exact<'a>(cur: &mut Cursor<&'a [u8]>, n: usize, what: &str) -> Result<&'a [u8], CodecError> {
+    // Borrow packed payloads from the input. Copying them here allocates before count-table
+    // admission and needlessly duplicates the table even when the second pass just skips it.
+    let truncated = || err(format!("truncated file while reading {what}"));
+    let start = usize::try_from(cur.position()).map_err(|_| truncated())?;
+    let end = start.checked_add(n).ok_or_else(truncated)?;
+    let bytes = *cur.get_ref();
+    let v = bytes.get(start..end).ok_or_else(truncated)?;
+    cur.set_position(end as u64);
     Ok(v)
 }
 
@@ -81,10 +87,11 @@ fn differences_to_samples(buf: &mut [u8]) {
 }
 
 /// Undo the ZIP half-split: the stream is `[first half][second half]` with the second half
-/// holding every second byte of the original; weave them back together.
-fn interleave_byte_blocks(buf: &mut [u8]) {
+/// holding every second byte of the original; weave them back together. The scratch copy is
+/// allocated fallibly, so a buffer that passed `max_alloc` but not the allocator is an error.
+fn interleave_byte_blocks(buf: &mut [u8]) -> Result<(), CodecError> {
     let half = buf.len().div_ceil(2);
-    let mut out = vec![0u8; buf.len()];
+    let mut out = alloc_zeroed::<u8>(buf.len())?;
     let mut k = 0usize;
     for i in 0..buf.len() / 2 {
         let (a, b) = (buf.get(i).copied(), buf.get(half + i).copied());
@@ -105,12 +112,29 @@ fn interleave_byte_blocks(buf: &mut [u8]) {
         }
     }
     buf.copy_from_slice(&out);
+    Ok(())
+}
+
+/// Make room in `out` for `extra` more bytes, `limit` in all. Grows by doubling like `Vec`,
+/// but never reserves past `limit`: callers admit exactly that size against `max_alloc`, and
+/// plain doubling reserved up to twice as much. Fallible, so a failed allocation is an error.
+fn reserve_up_to(out: &mut Vec<u8>, extra: usize, limit: usize, what: &str) -> Result<(), CodecError> {
+    let need = out.len().saturating_add(extra);
+    if need > limit {
+        return Err(err(format!("{what}: data expands past {limit} bytes")));
+    }
+    if need > out.capacity() {
+        let target = out.capacity().saturating_mul(2).max(need).min(limit);
+        out.try_reserve_exact(target.saturating_sub(out.len())).map_err(|_| CodecError::LimitExceeded(format!("cannot allocate {target} bytes for {what}")))?;
+    }
+    Ok(())
 }
 
 /// OpenEXR RLE tokens: a negative byte `n` means `-n` literal bytes follow, a non-negative
 /// byte `n` means the next byte repeats `n + 1` times (as `ImfRle.cpp` and the `exr` crate).
 fn rle_decode(src: &[u8], expected: usize, what: &str) -> Result<Vec<u8>, CodecError> {
-    let mut out = Vec::with_capacity(expected.min(1 << 20));
+    let mut out = Vec::new();
+    reserve_up_to(&mut out, expected.min(1 << 20), expected, what)?;
     let mut i = 0;
     while i < src.len() {
         let count = src[i] as i8;
@@ -119,6 +143,7 @@ fn rle_decode(src: &[u8], expected: usize, what: &str) -> Result<Vec<u8>, CodecE
         if out.len().saturating_add(n) > expected {
             return Err(err(format!("{what}: RLE data expands past {expected} bytes")));
         }
+        reserve_up_to(&mut out, n, expected, what)?;
         if count < 0 {
             let end = i.saturating_add(n);
             let run = src.get(i..end.min(src.len())).ok_or_else(|| err(format!("{what}: RLE run points past the compressed data")))?;
@@ -143,7 +168,10 @@ fn rle_decode(src: &[u8], expected: usize, what: &str) -> Result<Vec<u8>, CodecE
 /// has the uncompressed length is stored raw whatever the declared compression.
 fn decompress(compression: Compression, packed: &[u8], expected: usize, what: &str) -> Result<Vec<u8>, CodecError> {
     if packed.len() == expected {
-        return Ok(packed.to_vec());
+        let mut out = Vec::new();
+        reserve_up_to(&mut out, expected, expected, what)?;
+        out.extend_from_slice(packed);
+        return Ok(out);
     }
     match compression {
         Compression::Uncompressed => Err(err(format!("{what}: expected {expected} uncompressed bytes, found {}", packed.len()))),
@@ -151,20 +179,38 @@ fn decompress(compression: Compression, packed: &[u8], expected: usize, what: &s
             // Like ZIPS, RLE runs over the predicted, byte-split stream.
             let mut out = rle_decode(packed, expected, what)?;
             differences_to_samples(&mut out);
-            interleave_byte_blocks(&mut out);
+            interleave_byte_blocks(&mut out)?;
             Ok(out)
         }
         Compression::ZIP1 => {
-            let mut out = Vec::with_capacity(expected.min(1 << 20));
-            flate2::read::ZlibDecoder::new(packed)
-                .take(expected as u64 + 1)
-                .read_to_end(&mut out)
-                .map_err(|_| err(format!("{what}: zlib data is malformed")))?;
+            // Inflate straight into `out`, grown with `reserve_up_to` rather than by
+            // `read_to_end`, whose doubling reserves past `expected`. Once `expected` bytes are
+            // in, a one-byte read checks that the stream ends there.
+            let malformed = || err(format!("{what}: zlib data is malformed"));
+            let mut zlib = flate2::read::ZlibDecoder::new(packed);
+            let mut out = Vec::new();
+            let mut filled = 0;
+            while filled < expected {
+                if filled == out.len() {
+                    let grow = out.len().max(1 << 13).min(expected - filled);
+                    reserve_up_to(&mut out, grow, expected, what)?;
+                    out.resize(filled + grow, 0);
+                }
+                let n = zlib.read(out.get_mut(filled..).unwrap_or_default()).map_err(|_| malformed())?;
+                if n == 0 {
+                    break;
+                }
+                filled += n;
+            }
+            out.truncate(filled);
+            if filled == expected && zlib.read(&mut [0u8; 1]).map_err(|_| malformed())? != 0 {
+                return Err(err(format!("{what}: zlib data expands past {expected} bytes")));
+            }
             if out.len() != expected {
                 return Err(err(format!("{what}: zlib data expands to {} bytes, expected {expected}", out.len())));
             }
             differences_to_samples(&mut out);
-            interleave_byte_blocks(&mut out);
+            interleave_byte_blocks(&mut out)?;
             Ok(out)
         }
         other => Err(unsup(format!("deep data with {other:?} compression (NONE, RLE and ZIPS are supported)"))),
@@ -340,13 +386,41 @@ pub(crate) fn decode_deep(meta: &MetaData, bytes: &[u8], limits: &Limits) -> Res
         if packed_table > remaining || packed_data > remaining.saturating_sub(packed_table) {
             return Err(err("deep chunk sizes point past the end of the file"));
         }
-        let table_bytes = read_exact(&mut cur, packed_table as usize, "the sample-count table")?;
+        let what = "the sample-count table";
+        let table_bytes = read_exact(&mut cur, packed_table as usize, what)?;
         let expected_table = block_pixels.len().checked_mul(4).ok_or_else(|| err("count table overflows"))?;
+        // A compressed clipped table also needs its scratch copy. The data-window check only
+        // budgets four bytes per channel per pixel, insufficient for a one-channel image.
+        // An equal-sized payload takes decompress's raw path, which allocates no scratch.
+        let buffers = if table_bytes.len() == expected_table { 1 } else { 2 };
+        let clipped_need = (expected_table as u64).saturating_mul(buffers);
+        if clipped_need > limits.max_alloc {
+            return Err(CodecError::LimitExceeded(format!(
+                "{what} needs {clipped_need} bytes including decompression scratch, exceeding max_alloc {}",
+                limits.max_alloc
+            )));
+        }
         // An edge tile's table may still be stored at the full tile size (its pixels first, in
         // rows of the clipped width, then unused entries), as the OpenEXR library writes it.
-        let full_table = tile_w.saturating_mul(tile_h).saturating_mul(4).max(expected_table);
-        let raw = decompress(compression, &table_bytes, full_table, "the sample-count table")
-            .or_else(|_| decompress(compression, &table_bytes, expected_table, "the sample-count table"))?;
+        // That size comes from the header's tile size alone, which nothing ties to the data
+        // window, so it is tried only when `max_alloc` has room for the table and for the copy
+        // that undoes its byte split. Otherwise only the clipped size is read.
+        let full_table = tile_w.checked_mul(tile_h).and_then(|n| n.checked_mul(4));
+        let raw = match full_table {
+            // Scan lines and interior tiles: the full size is the clipped size.
+            Some(full) if full <= expected_table => decompress(compression, table_bytes, expected_table, what)?,
+            Some(full) if (full as u64).saturating_mul(2) <= limits.max_alloc => {
+                decompress(compression, table_bytes, full, what).or_else(|_| decompress(compression, table_bytes, expected_table, what))?
+            }
+            _ => decompress(compression, table_bytes, expected_table, what).map_err(|_| {
+                // Four bytes per pixel of the tile, twice: the table and its scratch copy.
+                let need = (tile_w as u64).saturating_mul(tile_h as u64).saturating_mul(8);
+                CodecError::LimitExceeded(format!(
+                    "{what} of a {tile_w}x{tile_h} deep tile does not decode at the clipped size, and at the full tile size it needs {need} bytes with its scratch copy, exceeding max_alloc {}",
+                    limits.max_alloc
+                ))
+            })?,
+        };
 
         // The table is cumulative within each row of the block (a tile restarts at every row);
         // `prefix` is cumulative over the whole block, and each pixel's own count is the difference.
@@ -423,7 +497,7 @@ pub(crate) fn decode_deep(meta: &MetaData, bytes: &[u8], limits: &Limits) -> Res
         // The count table sits between the sizes and the sample data; skip its bytes.
         read_exact(&mut cur, packed_table as usize, "the sample-count table")?;
         let data_bytes = read_exact(&mut cur, chunk.packed_data as usize, "the deep sample data")?;
-        let raw = decompress(compression, &data_bytes, chunk.unpacked_data as usize, "the deep sample data")?;
+        let raw = decompress(compression, data_bytes, chunk.unpacked_data as usize, "the deep sample data")?;
         // Row by row (a scan line block is one row), and within a row channel by channel, as
         // flat tiles are laid out: each pixel's samples are contiguous within its channel.
         let mut in_off = 0usize;
@@ -611,3 +685,82 @@ pub(crate) fn flatten(deep: &DeepImage) -> Result<Image, CodecError> {
     img.warnings.push(DecodeWarning::DeepFlattened { format: F, max_samples_per_pixel: max_samples });
     Ok(img)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write as _;
+
+    #[test]
+    fn packed_reads_borrow_input_and_reject_bad_sizes_before_allocation() {
+        let bytes = [1u8, 2, 3, 4];
+        let mut cur = Cursor::new(bytes.as_slice());
+        let prefix = read_exact(&mut cur, 3, "x").expect("three input bytes");
+        assert_eq!(prefix, &[1, 2, 3]);
+        assert_eq!(prefix.as_ptr(), bytes.as_ptr());
+        assert_eq!(cur.position(), 3);
+        assert!(matches!(read_exact(&mut cur, usize::MAX, "x"), Err(CodecError::Malformed { .. })));
+        assert_eq!(cur.position(), 3);
+        assert_eq!(read_exact(&mut cur, 1, "x").expect("last byte"), &[4]);
+        assert!(matches!(read_exact(&mut cur, 1, "x"), Err(CodecError::Malformed { .. })));
+        cur.set_position(u64::MAX);
+        assert!(matches!(read_exact(&mut cur, 1, "x"), Err(CodecError::Malformed { .. })));
+    }
+
+    /// What the writer stores before compressing: the byte split, then the +128 predictor.
+    fn predicted(raw: &[u8]) -> Vec<u8> {
+        let half = raw.len().div_ceil(2);
+        let mut out = vec![0u8; raw.len()];
+        for (i, &v) in raw.iter().enumerate() {
+            out[if i % 2 == 0 { i / 2 } else { half + i / 2 }] = v;
+        }
+        let mut prev = 0i16;
+        for (i, b) in out.iter_mut().enumerate() {
+            let v = i16::from(*b);
+            if i > 0 {
+                *b = (v - prev + 128) as u8;
+            }
+            prev = v;
+        }
+        out
+    }
+
+    /// #4958: callers admit `expected` bytes for a decompressed buffer (twice that for a count
+    /// table, with the copy that undoes its byte split), so decompression must not reserve
+    /// more. `Vec`'s doubling gave a 4 MiB ZIPS table 8 MiB of capacity and a 3 MiB RLE table
+    /// 4 MiB, so the "admitted" table and its copy took up to three times the table size.
+    #[test]
+    fn decompressed_buffers_reserve_no_more_than_expected() {
+        for n in [1usize << 20, 2 << 20, (3 << 20) + 1, 4 << 20, 5 << 20] {
+            let raw = vec![0u8; n];
+            let p = predicted(&raw);
+            let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::fast());
+            z.write_all(&p).expect("write to a Vec");
+            let zips = z.finish().expect("finish a Vec");
+            // RLE: the first byte as a literal, then runs of up to 128 copies of the next.
+            let mut rle = vec![0xFF, p[0]];
+            for run in p[1..].chunks(128) {
+                rle.extend_from_slice(&[(run.len() - 1) as u8, run[0]]);
+            }
+            for (compression, packed) in [(Compression::ZIP1, &zips), (Compression::RLE, &rle)] {
+                let out = decompress(compression, packed, n, "the table").expect("decompresses");
+                assert_eq!(out, raw, "{compression:?}, {n} bytes");
+                assert!(out.capacity() <= n, "{compression:?}: a {n} byte buffer reserved {} bytes", out.capacity());
+            }
+            // One byte short, the same data expands past the expected size and is refused.
+            for (compression, packed) in [(Compression::ZIP1, &zips), (Compression::RLE, &rle)] {
+                assert!(decompress(compression, packed, n - 1, "the table").is_err(), "{compression:?}, {n} bytes");
+            }
+        }
+    }
+
+    /// A size past the limit is malformed data, and a reservation the allocator refuses is an
+    /// error rather than an abort.
+    #[test]
+    fn reservations_past_the_limit_or_the_allocator_are_errors() {
+        let mut v = Vec::new();
+        assert!(matches!(reserve_up_to(&mut v, 2, 1, "x"), Err(CodecError::Malformed { .. })));
+        assert!(matches!(reserve_up_to(&mut v, isize::MAX as usize + 1, usize::MAX, "x"), Err(CodecError::LimitExceeded(_))));
+        assert_eq!(v.capacity(), 0);
+    }
+}
diff --git a/crates/codecs/src/codecs/exr.rs b/crates/codecs/src/codecs/exr.rs
index a55810b4b8..1b268ac559 100644
--- a/crates/codecs/src/codecs/exr.rs
+++ b/crates/codecs/src/codecs/exr.rs
@@ -15,7 +15,7 @@ use half::f16;
 use crate::Format;
 use crate::error::CodecError;
 use crate::fidelity::Plan;
-use crate::image::{ChannelLayout, DecodeWarning, ExrChannelInfo, ExrPartInfo, Image, SampleType, base_channel_name};
+use crate::image::{ChannelLayout, DecodeWarning, ExrChannelInfo, ExrPartInfo, Image, SampleType, base_channel_name, exr_color_channels};
 use crate::options::{EncodeOptions, ExrCompression, Limits};
 
 const F: Format = Format::OpenExr;
@@ -123,20 +123,9 @@ pub(super) fn read_layer(bytes: &[u8], index: usize) -> Result<Layer<AnyChannels
 fn layer_to_image(layer: &Layer<AnyChannels<FlatSamples>>) -> Result<Image, CodecError> {
     let (w, h) = (layer.size.0, layer.size.1);
     let channels = &layer.channel_data.list;
-    let find = |n: &str| channels.iter().find(|c| base_channel_name(&c.name.to_string()) == n);
-    let (color, layout): (Vec<_>, ChannelLayout) = if let (Some(r), Some(g), Some(b)) = (find("R"), find("G"), find("B")) {
-        match find("A") {
-            Some(a) => (vec![r, g, b, a], ChannelLayout::Rgba),
-            None => (vec![r, g, b], ChannelLayout::Rgb),
-        }
-    } else if let Some(y) = find("Y").or_else(|| (channels.len() == 1).then(|| &channels[0])) {
-        match find("A") {
-            Some(a) => (vec![y, a], ChannelLayout::GrayA),
-            None => (vec![y], ChannelLayout::Gray),
-        }
-    } else {
-        return Err(CodecError::unsupported(F, "no R/G/B or Y channels"));
-    };
+    let names: Vec<_> = channels.iter().map(|c| c.name.to_string()).collect();
+    let (layout, selected) = exr_color_channels(names.iter().map(String::as_str)).ok_or_else(|| CodecError::unsupported(F, "no R/G/B or Y channels"))?;
+    let color: Vec<_> = selected.iter().map(|i| channels.get(*i).ok_or_else(|| err("selected channel is missing"))).collect::<Result<_, _>>()?;
     let all_f16 = color.iter().all(|c| matches!(c.sample_data, FlatSamples::F16(_)));
     let sample = if all_f16 { SampleType::F16 } else { SampleType::F32 };
     let npx = w * h;
diff --git a/crates/codecs/src/codecs/mod.rs b/crates/codecs/src/codecs/mod.rs
index afb7f96791..32e68b336a 100644
--- a/crates/codecs/src/codecs/mod.rs
+++ b/crates/codecs/src/codecs/mod.rs
@@ -10,6 +10,7 @@ pub(crate) mod jpeg;
 pub(crate) mod pcx;
 pub(crate) mod png;
 pub(crate) mod pnm;
+pub(crate) mod tga;
 pub(crate) mod tiff;
 pub(crate) mod tiff_exif;
 pub(crate) mod tiff_ifd;
diff --git a/crates/codecs/src/codecs/pnm.rs b/crates/codecs/src/codecs/pnm.rs
index ca36db8109..c16cccfd02 100644
--- a/crates/codecs/src/codecs/pnm.rs
+++ b/crates/codecs/src/codecs/pnm.rs
@@ -66,6 +66,21 @@ impl<'a> Reader<'a> {
         }
     }
 
+    /// PAM ends its header with an LF-terminated line, unlike P4–P6's single separator.
+    fn pam_endhdr(&mut self) -> Result<(), CodecError> {
+        while let Some(&c) = self.b.get(self.pos) {
+            self.pos += 1;
+            if c == b'\n' {
+                // Stop at the first LF: whitespace and '#' after it are raster bytes.
+                return Ok(());
+            }
+            if !c.is_ascii_whitespace() {
+                return Err(err("unexpected data after PAM ENDHDR"));
+            }
+        }
+        Err(err("unterminated PAM ENDHDR line"))
+    }
+
     fn rest(&self) -> &'a [u8] {
         &self.b[self.pos.min(self.b.len())..]
     }
@@ -269,7 +284,7 @@ fn decode_pam(r: &mut Reader<'_>, limits: &Limits) -> Result<Image, CodecError>
             _ => return Err(err("unknown PAM header field")),
         }
     }
-    r.single_ws()?;
+    r.pam_endhdr()?;
     let (w, h, depth, maxval) = match (w, h, depth, maxval) {
         (Some(a), Some(b), Some(c), Some(d)) => (a, b, c, d),
         _ => return Err(err("incomplete PAM header")),
diff --git a/crates/codecs/src/codecs/tga.rs b/crates/codecs/src/codecs/tga.rs
new file mode 100644
index 0000000000..7b52533d7b
--- /dev/null
+++ b/crates/codecs/src/codecs/tga.rs
@@ -0,0 +1,90 @@
+//! Targa writer. The `image` crate still reads Targa ([`super::via_image`]); writing is ours
+//! because its run-length packets ran on from the end of one row into the next. TGA 2.0 says a
+//! packet must not cross a scanline, and readers that decode a row at a time (Pillow, texture
+//! converters, game engines) misread such files (#6382).
+//!
+//! Like Photoshop's Targa: RLE (types 10 and 11), rows stored bottom-up (the bottom-left origin
+//! every reader assumes, also those that ignore the origin bits), alpha bits in the descriptor,
+//! and the TGA 2.0 footer.
+
+use crate::Format;
+use crate::error::CodecError;
+use crate::image::{ChannelLayout, Image, SampleType};
+
+/// Most pixels one packet holds (a 7-bit count, plus one).
+const MAX_PACKET: usize = 128;
+
+/// The TGA 2.0 footer: no extension or developer area, then the signature.
+const FOOTER: &[u8; 26] = b"\0\0\0\0\0\0\0\0TRUEVISION-XFILE.\0";
+
+/// Encodes an 8-bit Gray, Gray+alpha, RGB or RGBA image as a run-length encoded Targa.
+pub(crate) fn encode(img: &Image) -> Result<Vec<u8>, CodecError> {
+    let (w, h) = img.dimensions();
+    if img.sample_type() != SampleType::U8 {
+        return Err(CodecError::encode(Format::Tga, format!("{:?} samples (Targa stores 8 bits)", img.sample_type())));
+    }
+    let (bpp, image_type, alpha_bits) = match img.layout() {
+        ChannelLayout::Gray => (1, 11, 0),
+        ChannelLayout::GrayA => (2, 11, 8),
+        ChannelLayout::Rgb => (3, 10, 0),
+        ChannelLayout::Rgba => (4, 10, 8),
+        l => return Err(CodecError::encode(Format::Tga, format!("no Targa layout for {l:?}"))),
+    };
+    let (Ok(w16), Ok(h16)) = (u16::try_from(w), u16::try_from(h)) else {
+        return Err(CodecError::encode(Format::Tga, format!("dimensions exceed 65535x65535: {w}x{h}")));
+    };
+    let row = w as usize * bpp;
+    let data = img.data();
+    if data.len() != row * h as usize {
+        return Err(CodecError::InvalidImage("buffer size mismatch".into()));
+    }
+    let mut out = Vec::with_capacity(18 + data.len() + data.len() / MAX_PACKET + FOOTER.len());
+    out.extend_from_slice(&[0, 0, image_type, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
+    out.extend_from_slice(&w16.to_le_bytes());
+    out.extend_from_slice(&h16.to_le_bytes());
+    // Bits per pixel; the descriptor holds the alpha bits, origin bits 0 (bottom-left).
+    out.extend_from_slice(&[(bpp * 8) as u8, alpha_bits]);
+    let mut px = vec![0u8; row];
+    for y in (0..h as usize).rev() {
+        px.copy_from_slice(&data[y * row..(y + 1) * row]);
+        // Targa stores colour as BGR.
+        if bpp >= 3 {
+            for p in px.chunks_exact_mut(bpp) {
+                p.swap(0, 2);
+            }
+        }
+        rle_row(&px, bpp, &mut out);
+    }
+    out.extend_from_slice(FOOTER);
+    Ok(out)
+}
+
+/// One scanline as run-length packets that end with it: a run of two or more equal pixels is a
+/// run packet, anything else goes out in raw packets.
+fn rle_row(row: &[u8], bpp: usize, out: &mut Vec<u8>) {
+    let px: Vec<&[u8]> = row.chunks_exact(bpp).collect();
+    let n = px.len();
+    let mut i = 0;
+    while i < n {
+        let mut run = 1;
+        while i + run < n && run < MAX_PACKET && px[i + run] == px[i] {
+            run += 1;
+        }
+        if run >= 2 {
+            out.push(0x80 | (run - 1) as u8);
+            out.extend_from_slice(px[i]);
+            i += run;
+            continue;
+        }
+        // Raw until two equal pixels start a run, the packet is full or the row ends. The first
+        // pixel always goes in: it differs from the one after it, or it is the row's last.
+        let start = i;
+        while i < n && i - start < MAX_PACKET && !(i > start && i + 1 < n && px[i] == px[i + 1]) {
+            i += 1;
+        }
+        out.push((i - start - 1) as u8);
+        for p in &px[start..i] {
+            out.extend_from_slice(p);
+        }
+    }
+}
diff --git a/crates/codecs/src/codecs/via_image.rs b/crates/codecs/src/codecs/via_image.rs
index 7e7eb76b2f..fd45f6a173 100644
--- a/crates/codecs/src/codecs/via_image.rs
+++ b/crates/codecs/src/codecs/via_image.rs
@@ -1,5 +1,6 @@
 //! Formats delegated to the `image` crate (pure-Rust features only):
-//! GIF, BMP, TGA, ICO, QOI, Radiance HDR, and AVIF encode (feature `avif`).
+//! GIF, BMP, TGA, ICO, QOI, Radiance HDR, and AVIF encode (feature `avif`). Targa is written by
+//! [`super::tga`] and only read here.
 
 use std::io::Cursor;
 
@@ -163,6 +164,10 @@ pub(crate) fn encode(f: Format, src: &Image, plan: Plan, opts: &EncodeOptions) -
         return Err(CodecError::encode(f, format!("dimensions exceed {mw}x{mh}")));
     }
     let img = src.converted(plan.layout, plan.sample);
+    // Targa is written by our encoder: the image crate's RLE packets cross scanlines (#6382).
+    if f == Format::Tga {
+        return super::tga::encode(&img);
+    }
     let dynimg = to_dynamic(&img)?;
     let mut cursor = Cursor::new(Vec::new());
     match f {
diff --git a/crates/codecs/src/image.rs b/crates/codecs/src/image.rs
index 98168d59d3..5a03e7d283 100644
--- a/crates/codecs/src/image.rs
+++ b/crates/codecs/src/image.rs
@@ -321,20 +321,75 @@ pub struct ExrPartInfo {
 
 impl ExrPartInfo {
     /// How much this part looks like a colour image the plain [`Image`] decode can show:
-    /// 4 RGBA, 3 RGB, 2 YA, 1 any-single-channel, 0 anything else (e.g. `Z` beside `A`).
+    /// 4 RGBA, 3 RGB, 2 YA, 1 Y or any-single-channel, 0 anything else (e.g. `Z` beside `A`).
+    /// The colour and alpha channels must share a complete layer prefix. The highest-ranked
+    /// group wins; equal groups prefer unprefixed channels, then the first prefix alphabetically.
     /// The auto-pick takes the highest rank; ties go to the earlier part.
     pub fn color_rank(&self) -> u8 {
-        let has = |n: &str| self.channels.iter().any(|c| base_channel_name(&c.name) == n);
-        if has("R") && has("G") && has("B") {
-            return if has("A") { 4 } else { 3 };
-        }
-        if has("Y") {
-            return if has("A") { 2 } else { 1 };
-        }
-        u8::from(self.channels.len() == 1)
+        exr_color_channels(self.channels.iter().map(|c| c.name.as_str())).map_or(0, |(layout, _)| layout.channels() as u8)
     }
 }
 
+/// One selection policy for header ranking/probing and flat decoding: never synthesize
+/// RGB(A) or YA from separate layers. OpenEXR layers use the full prefix before the last
+/// dot, including nested layers; a leading or trailing dot alone does not name a layer.
+pub(crate) fn exr_color_channels<'a>(names: impl IntoIterator<Item = &'a str>) -> Option<(ChannelLayout, Vec<usize>)> {
+    #[derive(Default)]
+    struct Group {
+        r: Option<usize>,
+        g: Option<usize>,
+        b: Option<usize>,
+        a: Option<usize>,
+        y: Option<usize>,
+    }
+
+    // Sorted prefixes make rank ties deterministic independently of channel order, with
+    // the empty (unprefixed) group first. Unsupported channels cannot complete a group.
+    let mut groups = std::collections::BTreeMap::<&str, Group>::new();
+    let mut count = 0usize;
+    for (index, name) in names.into_iter().enumerate() {
+        count = count.saturating_add(1);
+        let (prefix, base) = name.rsplit_once('.').filter(|(prefix, base)| !prefix.is_empty() && !base.is_empty()).unwrap_or(("", name));
+        if !matches!(base, "R" | "G" | "B" | "A" | "Y") {
+            continue;
+        }
+        let group = groups.entry(prefix).or_default();
+        let component = match base {
+            "R" => &mut group.r,
+            "G" => &mut group.g,
+            "B" => &mut group.b,
+            "A" => &mut group.a,
+            "Y" => &mut group.y,
+            _ => continue,
+        };
+        component.get_or_insert(index);
+    }
+
+    let mut best = None;
+    let mut best_rank = 0;
+    for group in groups.values() {
+        let candidate = if let (Some(r), Some(g), Some(b)) = (group.r, group.g, group.b) {
+            match group.a {
+                Some(a) => (ChannelLayout::Rgba, vec![r, g, b, a]),
+                None => (ChannelLayout::Rgb, vec![r, g, b]),
+            }
+        } else if let Some(y) = group.y {
+            match group.a {
+                Some(a) => (ChannelLayout::GrayA, vec![y, a]),
+                None => (ChannelLayout::Gray, vec![y]),
+            }
+        } else {
+            continue;
+        };
+        let rank = candidate.0.channels();
+        if rank > best_rank {
+            best = Some(candidate);
+            best_rank = rank;
+        }
+    }
+    best.or_else(|| (count == 1).then(|| (ChannelLayout::Gray, vec![0])))
+}
+
 /// Strip an optional `layer.` prefix from a channel name (`diffuse.R` → `R`).
 pub(crate) fn base_channel_name(name: &str) -> &str {
     name.rsplit('.').next().unwrap_or(name)
diff --git a/crates/codecs/tests/deep_exr.rs b/crates/codecs/tests/deep_exr.rs
index 5a6d6ae75e..f80a42f17b 100644
--- a/crates/codecs/tests/deep_exr.rs
+++ b/crates/codecs/tests/deep_exr.rs
@@ -118,6 +118,23 @@ fn gen_deep(
     tile: Option<(usize, usize)>,
     counts: &[u32],
     sample: &dyn Fn(usize, usize) -> Vec<f32>,
+) -> Vec<u8> {
+    gen_deep_tables(w, h, channels, compression, tile, counts, sample, false)
+}
+
+/// [`gen_deep`]; with `full_tile_tables` every tile's count table is stored at the full tile
+/// size, as the OpenEXR library writes edge tiles: the block's entries first (in rows of its
+/// clipped width), then zeros.
+#[allow(clippy::too_many_arguments)]
+fn gen_deep_tables(
+    w: usize,
+    h: usize,
+    channels: &[Chan],
+    compression: u8,
+    tile: Option<(usize, usize)>,
+    counts: &[u32],
+    sample: &dyn Fn(usize, usize) -> Vec<f32>,
+    full_tile_tables: bool,
 ) -> Vec<u8> {
     let mut out = Vec::new();
     out.extend_from_slice(&0x0131_2f76u32.to_le_bytes());
@@ -216,6 +233,10 @@ fn gen_deep(
                 table.extend_from_slice(&acc.to_le_bytes());
             }
         }
+        assert_eq!(table.len(), table_len(b));
+        if let (true, Some((tw, th))) = (full_tile_tables, tile) {
+            table.resize(tw * th * 4, 0);
+        }
         let mut data = Vec::new();
         for row in b.pixels.chunks(b.row_w) {
             for (ci, ch) in channels.iter().enumerate() {
@@ -237,7 +258,6 @@ fn gen_deep(
         c.extend_from_slice(&(data.len() as u64).to_le_bytes());
         c.extend_from_slice(&ct);
         c.extend_from_slice(&cd);
-        assert_eq!(table.len(), table_len(b));
         assert_eq!(data.len(), data_len(b));
         chunks.push((bi, c));
     }
@@ -608,6 +628,136 @@ fn hostile_sizes_and_offsets_error() {
     assert!(matches!(decode_deep_exr(&far, &Limits::none()), Err(CodecError::Malformed { .. })));
 }
 
+/// #4958: a deep tile's count table may be stored at the full tile size, and that size comes
+/// from the header alone: nothing ties it to the data window. One 1024×1024 tile over a 4×4
+/// image, its table stored at that size, makes a compressed file of tens of KB whose table
+/// inflates to 4 MiB, plus as much again for the copy that undoes the byte split. Under a
+/// budget smaller than both the table must be refused before it is allocated; with room for
+/// both it decodes. Tables stored at the clipped size, and the full-size edge tables of
+/// ordinary tiles, still decode under a small budget.
+#[test]
+fn deep_tile_count_table_is_admitted_against_max_alloc() {
+    let budget = |max_alloc: u64| Limits { max_alloc, ..Limits::none() };
+    let tight = budget(1 << 20);
+    let table: u64 = 1024 * 1024 * 4; // the full tile's count table, in bytes
+    let scan = decode_deep_exr(&gen_deep(4, 4, &RGBAZ, 0, None, COUNTS_ONE, &sample_rgba), &Limits::none()).expect("scan lines");
+    for compression in [0u8, 1, 2] {
+        let big = gen_deep_tables(4, 4, &RGBAZ, compression, Some((1024, 1024)), COUNTS_ONE, &sample_rgba, true);
+        assert_eq!(decode_deep_exr(&big, &Limits::none()).expect("full-size table, no limits"), scan, "compression {compression}");
+        let got = decode_deep_exr(&big, &tight);
+        assert!(
+            matches!(got, Err(CodecError::LimitExceeded(_))),
+            "compression {compression}: a 4 MiB count table under a 1 MiB budget gave {:?}",
+            got.map(|d| d.total_samples())
+        );
+        let flat = photocraft_codecs::decode_with(&big, &photocraft_codecs::DecodeOptions { limits: tight, ..Default::default() });
+        assert!(matches!(flat, Err(CodecError::LimitExceeded(_))), "compression {compression}: the flat decode gave {:?}", flat.map(|i| i.width()));
+        // The same tile with its table stored at the clipped size fits the small budget.
+        let clipped = gen_deep(4, 4, &RGBAZ, compression, Some((1024, 1024)), COUNTS_ONE, &sample_rgba);
+        assert_eq!(decode_deep_exr(&clipped, &tight).expect("clipped table, 1 MiB budget"), scan, "compression {compression}");
+        if compression != 0 {
+            assert!(big.len() < 1 << 20, "compression {compression}: the file is {} bytes", big.len());
+        }
+        // The table and its scratch copy are admitted together: 8 MiB.
+        assert_eq!(decode_deep_exr(&big, &budget(2 * table)).expect("room for the table and its copy"), scan, "compression {compression}");
+        let got = decode_deep_exr(&big, &budget(2 * table - 1));
+        assert!(matches!(got, Err(CodecError::LimitExceeded(_))), "compression {compression}: one byte short gave {:?}", got.map(|d| d.total_samples()));
+    }
+    // Ordinary tiles: full-size edge tables decode under the small budget, like clipped ones.
+    let counts: Vec<u32> = (0..35).map(|p| (p * 3) % 4).collect();
+    let sample = |p: usize, ci: usize| -> Vec<f32> { (0..counts[p]).map(|k| [0.5, 0.25, 0.125 * k as f32, 1.0, 10.0 - k as f32][ci]).collect() };
+    for compression in [0u8, 1, 2] {
+        let full = gen_deep_tables(7, 5, &RGBAZ, compression, Some((3, 2)), &counts, &sample, true);
+        let clipped = gen_deep(7, 5, &RGBAZ, compression, Some((3, 2)), &counts, &sample);
+        assert_eq!(
+            decode_deep_exr(&full, &tight).expect("full-size edge tables"),
+            decode_deep_exr(&clipped, &tight).expect("clipped edge tables"),
+            "compression {compression}"
+        );
+    }
+}
+
+/// #4958, the edges of that admission. A tile of the largest size exr accepts (2^30 - 2 a side,
+/// a 2^62 byte count table) decodes from a clipped table under every budget, including no limits,
+/// where its full size passes the check and is only tried as the data arrives. Each tile is
+/// admitted on its own, because its table is freed before the next chunk: three 16×16 tiles over
+/// a 48×1 image are all edge tiles, so every full-size table reaches the check (an interior tile's
+/// full size equals its clipped size, so it uses the clipped check). They need 2 KiB each for
+/// the table and its copy, 6 KiB in all, and decode under a budget of 4096 bytes. Half and uint
+/// channels decode after full-size tables like float ones.
+#[test]
+fn deep_tile_table_admission_edges() {
+    let budget = |max_alloc: u64| Limits { max_alloc, ..Limits::none() };
+    let scan = decode_deep_exr(&gen_deep(4, 4, &RGBAZ, 0, None, COUNTS_ONE, &sample_rgba), &Limits::none()).expect("scan lines");
+    let side = (1 << 30) - 2;
+    for compression in [0u8, 1, 2] {
+        let bytes = gen_deep(4, 4, &RGBAZ, compression, Some((side, side)), COUNTS_ONE, &sample_rgba);
+        for limits in [Limits::none(), Limits::default(), budget(1 << 20)] {
+            assert_eq!(decode_deep_exr(&bytes, &limits).expect("the largest tile, clipped table"), scan, "compression {compression}, {limits:?}");
+        }
+    }
+    let counts: Vec<u32> = (0..48).map(|p| (p % 3) as u32).collect();
+    let half: [Chan; 5] = RGBAZ.map(|c| Chan { ty: 1, ..c });
+    let [a, b, g, r, z] = RGBAZ;
+    let with_id = [a, b, g, r, z, Chan { name: "id", ty: 0 }];
+    for channels in [&RGBAZ[..], &half[..], &with_id[..]] {
+        let sample = |p: usize, ci: usize| -> Vec<f32> { (0..counts[p]).map(|k| [0.5, 0.25, 0.125, 1.0, 2.0 + k as f32, 7.0][ci]).collect() };
+        for compression in [0u8, 1, 2] {
+            let full = gen_deep_tables(48, 1, channels, compression, Some((16, 16)), &counts, &sample, true);
+            let clipped = gen_deep(48, 1, channels, compression, Some((16, 16)), &counts, &sample);
+            let what = format!("{} channels, compression {compression}", channels.len());
+            let want = decode_deep_exr(&clipped, &Limits::none()).expect("clipped tables");
+            assert_eq!(decode_deep_exr(&full, &budget(4096)).expect("full-size tables, admitted one at a time"), want, "{what}");
+        }
+    }
+}
+
+/// A one-channel data-window check admits only four bytes per pixel, but a compressed count
+/// table and its scratch copy need eight. Cover scanlines, interior tiles and the clipped fallback;
+/// the existing multichannel cases have enough pixel allowance to hide this gap.
+#[test]
+fn clipped_count_tables_include_scratch_in_the_budget() {
+    let channels = [Chan { name: "Y", ty: 2 }];
+    let counts = vec![0u32; 64];
+    let sample = |_: usize, _: usize| Vec::new();
+    let budget = |max_alloc: u64| Limits { max_alloc, ..Limits::none() };
+    for tile in [None, Some((64, 1)), Some((128, 2))] {
+        for compression in [0u8, 1, 2] {
+            let bytes = gen_deep(64, 1, &channels, compression, tile, &counts, &sample);
+            let what = format!("tile {tile:?}, compression {compression}");
+            let want = decode_deep_exr(&bytes, &Limits::none()).expect("unlimited decode");
+            let required = if compression == 0 { 256 } else { 512 };
+            assert_eq!(decode_deep_exr(&bytes, &budget(required)).expect("table and any scratch fit exactly"), want, "{what}");
+            assert!(matches!(decode_deep_exr(&bytes, &budget(required - 1)), Err(CodecError::LimitExceeded(_))), "{what}");
+            let flat = photocraft_codecs::decode_with(&bytes, &photocraft_codecs::DecodeOptions { limits: budget(required - 1), ..Default::default() });
+            assert!(matches!(flat, Err(CodecError::LimitExceeded(_))), "{what}");
+            if compression == 0 {
+                assert_eq!(decode_deep_exr(&bytes, &budget(511)).expect("raw table needs no scratch"), want, "{what}");
+            }
+        }
+    }
+}
+
+/// RLE and ZIPS store incompressible tables raw too. Their actual payload, not the header's
+/// compression tag, decides whether a scratch buffer is needed.
+#[test]
+fn raw_count_tables_need_no_scratch_even_with_compression() {
+    let channels = [Chan { name: "Y", ty: 2 }];
+    let limits = Limits { max_alloc: 4, ..Limits::none() };
+    for tile in [None, Some((1, 1)), Some((2, 2))] {
+        for compression in [0u8, 1, 2] {
+            let bytes = gen_deep(1, 1, &channels, compression, tile, &[0], &|_, _| Vec::new());
+            let header_end = header_end_of(&bytes);
+            let chunk = u64::from_le_bytes(bytes[header_end..header_end + 8].try_into().expect("chunk offset")) as usize;
+            let table_size = chunk + if tile.is_some() { 16 } else { 4 };
+            let packed = u64::from_le_bytes(bytes[table_size..table_size + 8].try_into().expect("table size"));
+            assert_eq!(packed, 4, "the four-byte count table is stored raw");
+            let want = decode_deep_exr(&bytes, &Limits::none()).expect("unlimited decode");
+            assert_eq!(decode_deep_exr(&bytes, &limits).expect("raw table fits"), want, "tile {tile:?}, compression {compression}");
+        }
+    }
+}
+
 /// Walk the attributes like the format prescribes: the offset table starts after the
 /// header's terminating zero byte.
 fn header_end_of(bytes: &[u8]) -> usize {
diff --git a/crates/codecs/tests/exr_multipart.rs b/crates/codecs/tests/exr_multipart.rs
index f106d37791..421d494710 100644
--- a/crates/codecs/tests/exr_multipart.rs
+++ b/crates/codecs/tests/exr_multipart.rs
@@ -8,7 +8,9 @@ use exr::prelude::{
     WritableImage,
 };
 use photocraft_codecs::f16;
-use photocraft_codecs::{ChannelLayout, DecodeOptions, DecodeWarning, Format, Limits, SampleType, decode, decode_as_with, decode_exr_part, exr_info};
+use photocraft_codecs::{
+    ChannelLayout, DecodeOptions, DecodeWarning, Format, Limits, SampleType, decode, decode_as_with, decode_exr_part, exr_info, probe_size,
+};
 
 fn layer_f32(name: &str, comp: Compression, chans: &[(&str, Vec<f32>)]) -> Layer<AnyChannels<FlatSamples>> {
     let n = chans.iter().find(|(_, v)| !v.is_empty()).map_or(0, |(_, v)| v.len());
@@ -226,3 +228,107 @@ fn decoding_one_part_does_not_decode_the_others() {
     assert_eq!((img.width(), img.height()), (4, 4));
     assert!(img.to_normalized().iter().all(|v| near(*v, 0.75)), "wrong pixels");
 }
+
+fn channel_group_file(channels: &[(&str, f32)]) -> Vec<u8> {
+    let channels: Vec<_> = channels.iter().map(|(name, value)| (*name, vec![*value; 4])).collect();
+    write_image(vec![layer_f32("groups", Compression::ZIP1, &channels)])
+}
+
+fn assert_channel_group(bytes: &[u8], layout: ChannelLayout, expected: &[f32]) {
+    assert_eq!(exr_info(bytes, &Limits::default()).unwrap()[0].color_rank(), expected.len() as u8);
+    assert_eq!(probe_size(bytes).unwrap(), (2, 2));
+    for img in [decode(bytes).unwrap(), decode_exr_part(bytes, 0, &DecodeOptions::default()).unwrap()] {
+        assert_eq!(img.layout(), layout);
+        assert_eq!(img.to_normalized(), expected.repeat(4));
+    }
+}
+
+#[test]
+fn flat_decode_keeps_rgb_channels_in_one_group() {
+    // A partial group sorts before the nested beauty layer, but cannot donate its R.
+    let bytes = channel_group_file(&[("aaa.R", 9.0), ("beauty.diffuse.R", 0.25), ("beauty.diffuse.G", 0.5), ("beauty.diffuse.B", 2.0)]);
+    assert_channel_group(&bytes, ChannelLayout::Rgb, &[0.25, 0.5, 2.0]);
+}
+
+#[test]
+fn flat_decode_does_not_borrow_another_groups_alpha() {
+    for alpha in ["A", "aaa.A", "beauty.other.A"] {
+        let bytes = channel_group_file(&[(alpha, 0.125), ("beauty.R", 0.25), ("beauty.G", 0.5), ("beauty.B", 2.0)]);
+        assert_channel_group(&bytes, ChannelLayout::Rgb, &[0.25, 0.5, 2.0]);
+        let bytes = channel_group_file(&[(alpha, 0.125), ("beauty.Y", 0.5)]);
+        assert_channel_group(&bytes, ChannelLayout::Gray, &[0.5]);
+    }
+}
+
+#[test]
+fn flat_decode_rejects_rgb_split_between_groups() {
+    for channels in [
+        [("aaa.R", 0.25), ("bbb.G", 0.5), ("ccc.B", 2.0)],
+        [("beauty.R", 0.25), ("beauty.diffuse.G", 0.5), ("beauty.diffuse.B", 2.0)],
+        [(".R", 0.25), ("G", 0.5), ("B", 2.0)],
+    ] {
+        let bytes = channel_group_file(&channels);
+        assert_eq!(exr_info(&bytes, &Limits::default()).unwrap()[0].color_rank(), 0);
+        assert!(probe_size(&bytes).is_err());
+        assert!(decode(&bytes).is_err());
+        assert!(decode_exr_part(&bytes, 0, &DecodeOptions::default()).is_err());
+    }
+}
+
+#[test]
+fn auto_pick_and_probe_skip_incoherent_rgb_parts() {
+    let bytes = write_image(vec![
+        layer_f32("split", Compression::ZIP1, &[("aaa.R", vec![9.0; 4]), ("bbb.G", vec![8.0; 4]), ("ccc.B", vec![7.0; 4])]),
+        layer_f32("luminance", Compression::ZIP1, &[("Y", vec![0.5; 16]), ("A", vec![0.75; 16])]),
+    ]);
+    let parts = exr_info(&bytes, &Limits::default()).unwrap();
+    assert_eq!(parts.iter().map(|part| part.color_rank()).collect::<Vec<_>>(), [0, 2]);
+    assert_eq!(probe_size(&bytes).unwrap(), (4, 4));
+    let img = decode(&bytes).unwrap();
+    assert_eq!((img.width(), img.height(), img.layout()), (4, 4, ChannelLayout::GrayA));
+    assert_eq!(img.to_f32_samples().unwrap(), [0.5, 0.75].repeat(16));
+}
+
+#[test]
+fn flat_decode_prefers_the_highest_ranked_complete_group() {
+    let bytes =
+        channel_group_file(&[("aaa.R", 9.0), ("aaa.G", 8.0), ("aaa.B", 7.0), ("beauty.R", 0.25), ("beauty.G", 0.5), ("beauty.B", 2.0), ("beauty.A", 0.75)]);
+    assert_channel_group(&bytes, ChannelLayout::Rgba, &[0.25, 0.5, 2.0, 0.75]);
+    let bytes = channel_group_file(&[("aaa.Y", 9.0), ("beauty.Y", 0.5), ("beauty.A", 0.75)]);
+    assert_channel_group(&bytes, ChannelLayout::GrayA, &[0.5, 0.75]);
+}
+
+#[test]
+fn flat_decode_breaks_group_ties_by_prefix() {
+    let bytes = channel_group_file(&[("z.R", 9.0), ("z.G", 8.0), ("z.B", 7.0), ("beauty.R", 0.25), ("beauty.G", 0.5), ("beauty.B", 2.0)]);
+    assert_channel_group(&bytes, ChannelLayout::Rgb, &[0.25, 0.5, 2.0]);
+    // Even a prefix that sorts before the unprefixed channel names loses a rank tie.
+    let bytes = channel_group_file(&[("0.R", 9.0), ("0.G", 8.0), ("0.B", 7.0), ("R", 0.25), ("G", 0.5), ("B", 2.0)]);
+    assert_channel_group(&bytes, ChannelLayout::Rgb, &[0.25, 0.5, 2.0]);
+}
+
+#[test]
+fn flat_decode_preserves_luminance_and_lone_channel_fallbacks() {
+    for prefix in ["", "beauty."] {
+        let y = format!("{prefix}Y");
+        let a = format!("{prefix}A");
+        assert_channel_group(&channel_group_file(&[(&y, 2.0), (&a, 0.75)]), ChannelLayout::GrayA, &[2.0, 0.75]);
+        assert_channel_group(&channel_group_file(&[(&y, 2.0)]), ChannelLayout::Gray, &[2.0]);
+    }
+    for name in ["depth.Z", "A", "beauty.A"] {
+        // A lone alpha is one grayscale channel, not the same samples duplicated as YA.
+        assert_channel_group(&channel_group_file(&[(name, 9.0)]), ChannelLayout::Gray, &[9.0]);
+    }
+}
+
+#[test]
+fn half_float_group_does_not_use_unrelated_float_channels() {
+    let mut layer = layer_f32("mixed", Compression::ZIP1, &[("aaa.R", vec![9.0; 4]), ("aaa.A", vec![0.125; 4])]);
+    for (name, value) in [("beauty.R", 0.25), ("beauty.G", 0.5), ("beauty.B", 2.0), ("beauty.A", 0.75)] {
+        layer.channel_data.list.push(AnyChannel::new(name, FlatSamples::F16(vec![f16::from_f32(value); 4])));
+    }
+    layer.channel_data = AnyChannels::sort(layer.channel_data.list);
+    let bytes = write_image(vec![layer]);
+    assert_channel_group(&bytes, ChannelLayout::Rgba, &[0.25, 0.5, 2.0, 0.75]);
+    assert_eq!(decode(&bytes).unwrap().sample_type(), SampleType::F16);
+}
diff --git a/crates/codecs/tests/pnm_headers.rs b/crates/codecs/tests/pnm_headers.rs
new file mode 100644
index 0000000000..b6d9c076f5
--- /dev/null
+++ b/crates/codecs/tests/pnm_headers.rs
@@ -0,0 +1,82 @@
+use photocraft_codecs::{ChannelLayout, CodecError, Format, SampleType, decode, decode_as};
+
+const PAM_GRAY: &[u8] = b"P7\nWIDTH 1\nHEIGHT 1\nDEPTH 1\nMAXVAL 255\nENDHDR";
+const ENDINGS: &[&[u8]] = &[b"\n", b" \n", b"\t \n", b"\r\n", b" \t\r\n"];
+
+#[test]
+fn pam_consumes_the_complete_endhdr_line() {
+    for ending in ENDINGS {
+        let mut bytes = PAM_GRAY.to_vec();
+        bytes.extend_from_slice(ending);
+        bytes.push(0x80);
+        let img = decode(&bytes).unwrap();
+        assert_eq!(img.dimensions(), (1, 1));
+        assert_eq!(img.layout(), ChannelLayout::Gray);
+        assert_eq!(img.data(), &[0x80], "ENDHDR ending {ending:?}");
+    }
+}
+
+#[test]
+fn pam_preserves_every_possible_first_raster_byte() {
+    // In particular, LF, CR, space, tab and '#' must not be skipped as header syntax.
+    for ending in ENDINGS {
+        for first in 0..=255u8 {
+            let mut bytes = PAM_GRAY.to_vec();
+            bytes.extend_from_slice(ending);
+            bytes.push(first);
+            assert_eq!(decode(&bytes).unwrap().data(), &[first], "ENDHDR ending {ending:?}, raster byte {first}");
+        }
+    }
+}
+
+#[test]
+fn pam_crlf_header_preserves_u16_samples_and_alpha() {
+    for ending in ENDINGS {
+        let mut bytes = b"P7\r\nWIDTH 1\r\nHEIGHT 1\r\nDEPTH 2\r\nMAXVAL 65535\r\nTUPLTYPE GRAYSCALE_ALPHA\r\nENDHDR".to_vec();
+        bytes.extend_from_slice(ending);
+        bytes.extend_from_slice(b" \n#\r");
+        let img = decode(&bytes).unwrap();
+        assert_eq!(img.layout(), ChannelLayout::GrayA);
+        assert_eq!(img.sample_type(), SampleType::U16);
+        assert_eq!(img.to_u16_samples().unwrap(), vec![0x200a, 0x230d], "ENDHDR ending {ending:?}");
+    }
+}
+
+#[test]
+fn pam_rejects_unterminated_or_invalid_endhdr_lines() {
+    for suffix in [b"".as_slice(), b" ", b"\r", b" \t\r", b" \x80", b" \x80\n\x7f", b"#comment\n\x7f"] {
+        let mut bytes = PAM_GRAY.to_vec();
+        bytes.extend_from_slice(suffix);
+        assert!(matches!(decode_as(Format::Pnm, &bytes), Err(CodecError::Malformed { .. })), "ENDHDR suffix {suffix:?}");
+    }
+}
+
+#[test]
+fn pam_truncation_never_uses_header_whitespace_as_pixels() {
+    for ending in ENDINGS {
+        let mut bytes = PAM_GRAY.to_vec();
+        bytes.extend_from_slice(ending);
+        bytes.push(0x80);
+        for cut in 0..bytes.len() {
+            assert!(decode_as(Format::Pnm, &bytes[..cut]).is_err(), "ENDHDR ending {ending:?}, truncated at {cut}");
+        }
+    }
+}
+
+#[test]
+fn binary_pnm_keeps_its_single_whitespace_separator() {
+    for separator in *b" \t\r\n" {
+        for first in *b" \t\r\n#" {
+            for (header, channels) in [(b"P5\n1 1\n255".as_slice(), 1), (b"P6\n1 1\n255", 3)] {
+                let mut bytes = header.to_vec();
+                bytes.push(separator);
+                bytes.extend(std::iter::repeat_n(first, channels));
+                assert_eq!(decode(&bytes).unwrap().data(), vec![first; channels]);
+            }
+            let mut bytes = b"P4\n8 1".to_vec();
+            bytes.extend_from_slice(&[separator, first]);
+            let expected: Vec<u8> = (0..8).map(|bit| if first & (0x80 >> bit) == 0 { 255 } else { 0 }).collect();
+            assert_eq!(decode(&bytes).unwrap().data(), expected);
+        }
+    }
+}
diff --git a/crates/codecs/tests/tga.rs b/crates/codecs/tests/tga.rs
new file mode 100644
index 0000000000..279aa47f8b
--- /dev/null
+++ b/crates/codecs/tests/tga.rs
@@ -0,0 +1,91 @@
+//! Targa writing (#6382): run-length packets end with their scanline, rows are stored bottom-up,
+//! and the file reads back exactly.
+
+use photocraft_codecs::{ChannelLayout, EncodeOptions, Format, Image, decode_as, encode};
+
+/// The packets of a run-length encoded Targa body, as (pixels, is a run), from just after the
+/// 18-byte header (no image ID or colour map) up to `pixels` pixels.
+fn packets(file: &[u8], bpp: usize, pixels: usize) -> Vec<(usize, bool)> {
+    let mut at = 18;
+    let mut seen = 0;
+    let mut out = Vec::new();
+    while seen < pixels {
+        let head = file[at];
+        let count = usize::from(head & 0x7f) + 1;
+        let run = head & 0x80 != 0;
+        at += 1 + if run { bpp } else { count * bpp };
+        seen += count;
+        out.push((count, run));
+    }
+    out
+}
+
+/// A `w`×`h` image whose rows mix long runs (wider than a packet), short ones and noise, and
+/// whose last pixel equals the next row's first, so a packet would run on if it could.
+fn sample(w: u32, h: u32, layout: ChannelLayout) -> Image {
+    let n = layout.channels();
+    let mut data = Vec::new();
+    for y in 0..h {
+        for x in 0..w {
+            let v = match x {
+                _ if x < 150 => 40,
+                _ if x % 3 == 0 => (x * 7 + y * 13) as u8,
+                _ => 200,
+            };
+            let px = [v, v.wrapping_add(y as u8), v ^ 0x5a, 255 - v];
+            data.extend_from_slice(&px[..n]);
+        }
+    }
+    Image::from_u8(w, h, layout, data).unwrap()
+}
+
+#[test]
+fn rle_packets_end_with_their_scanline() {
+    for layout in [ChannelLayout::Gray, ChannelLayout::GrayA, ChannelLayout::Rgb, ChannelLayout::Rgba] {
+        let (w, h) = (300u32, 4u32);
+        let file = encode(&sample(w, h, layout), Format::Tga, &EncodeOptions::default()).unwrap();
+        let bpp = layout.channels();
+        let mut col = 0;
+        for (count, _) in packets(&file, bpp, (w * h) as usize) {
+            assert!(count <= 128, "{layout:?}: a packet holds at most 128 pixels");
+            assert!(col + count <= w as usize, "{layout:?}: a packet runs from column {col} past the row's end");
+            col = (col + count) % w as usize;
+        }
+        // A solid image is one run per row (three packets of 128, 128 and 44), not one long run.
+        let solid = Image::from_u8(w, h, layout, vec![90; (w * h) as usize * bpp]).unwrap();
+        let file = encode(&solid, Format::Tga, &EncodeOptions::default()).unwrap();
+        let p = packets(&file, bpp, (w * h) as usize);
+        assert_eq!(p.len(), 3 * h as usize, "{layout:?}");
+        assert!(p.iter().all(|&(_, run)| run));
+    }
+}
+
+#[test]
+fn the_file_is_bottom_up_rle_with_its_alpha_bits_and_the_tga2_footer() {
+    let mut data = vec![0u8; 2 * 2 * 4];
+    // Top row red, bottom row blue, opaque.
+    for (i, px) in data.as_chunks_mut::<4>().0.iter_mut().enumerate() {
+        *px = if i < 2 { [255, 0, 0, 255] } else { [0, 0, 255, 255] };
+    }
+    let file = encode(&Image::from_u8(2, 2, ChannelLayout::Rgba, data).unwrap(), Format::Tga, &EncodeOptions::default()).unwrap();
+    assert_eq!(file[2], 10, "run-length true colour");
+    assert_eq!((file[16], file[17]), (32, 8), "32 bits per pixel, 8 alpha bits, bottom-left origin");
+    // The first stored row is the bottom one: a run of two blue pixels, in BGRA.
+    assert_eq!(&file[18..23], &[0x81, 255, 0, 0, 255]);
+    assert!(file.ends_with(b"TRUEVISION-XFILE.\0"));
+    let gray = encode(&Image::from_u8(2, 1, ChannelLayout::Gray, vec![1, 2]).unwrap(), Format::Tga, &EncodeOptions::default()).unwrap();
+    assert_eq!((gray[2], gray[16], gray[17]), (11, 8, 0), "run-length grayscale, no alpha bits");
+}
+
+#[test]
+fn every_layout_reads_back_exactly() {
+    for layout in [ChannelLayout::Gray, ChannelLayout::GrayA, ChannelLayout::Rgb, ChannelLayout::Rgba] {
+        for (w, h) in [(1, 1), (300, 4), (129, 3), (5, 130)] {
+            let img = sample(w, h, layout);
+            let file = encode(&img, Format::Tga, &EncodeOptions::default()).unwrap();
+            let back = decode_as(Format::Tga, &file).unwrap();
+            assert_eq!((back.dimensions(), back.layout()), ((w, h), layout), "{layout:?} {w}x{h}");
+            assert_eq!(back.data(), img.data(), "{layout:?} {w}x{h}");
+        }
+    }
+}
diff --git a/crates/compose/src/lib.rs b/crates/compose/src/lib.rs
index f688ffedb3..3cf2f1dc19 100644
--- a/crates/compose/src/lib.rs
+++ b/crates/compose/src/lib.rs
@@ -563,14 +563,14 @@ impl LayerKeys {
     fn identity(&self, layer: &Layer, doc: Option<&Document>) -> u64 {
         let addr = std::ptr::from_ref(layer) as usize;
         let in_doc = doc.is_some_and(|d| self.in_doc.get_or_init(|| doc_layer_addresses(d)).contains(&addr));
-        if in_doc && let Some(id) = self.ids.lock().unwrap_or_else(|e| e.into_inner()).get(&addr) {
-            return *id;
-        }
-        let id = self.compute(layer);
         if in_doc {
-            self.ids.lock().unwrap_or_else(|e| e.into_inner()).insert(addr, id);
+            let mut ids = self.ids.lock().unwrap_or_else(|e| e.into_inner());
+            // Computing an identity only hashes immutable layer data; it does not run Rayon
+            // work or re-enter this memo. Keep the miss and insertion atomic across callers.
+            *ids.entry(addr).or_insert_with(|| self.compute(layer))
+        } else {
+            self.compute(layer)
         }
-        id
     }
 
     fn compute(&self, layer: &Layer) -> u64 {
diff --git a/crates/compose/src/tests.rs b/crates/compose/src/tests.rs
index eb4b250728..ddd4871548 100644
--- a/crates/compose/src/tests.rs
+++ b/crates/compose/src/tests.rs
@@ -3190,3 +3190,27 @@ fn effect_cache_keeps_no_pixels_of_a_dropped_layer() {
     assert_eq!(std::sync::Arc::strong_count(&own), 1);
     assert_eq!(std::sync::Arc::strong_count(&child), 1);
 }
+
+// Concurrent callers share one memoized effect identity.
+#[test]
+fn concurrent_effect_identity_misses_compute_once() {
+    let mut doc = identity_doc(SampleType::U8);
+    // Make the existing pure identity hash long enough to expose overlapping misses.
+    doc.layers[1].effects.items = vec![Effect::DropShadow(shadow(4.0, 120.0)); 512];
+    let layer = &doc.layers[1];
+    let keys = LayerKeys::default();
+    let start = std::sync::Barrier::new(8);
+    std::thread::scope(|scope| {
+        let handles: Vec<_> = (0..8)
+            .map(|_| {
+                scope.spawn(|| {
+                    start.wait();
+                    keys.identity(layer, Some(&doc))
+                })
+            })
+            .collect();
+        let ids: Vec<_> = handles.into_iter().map(|h| h.join().unwrap()).collect();
+        assert!(ids.iter().all(|id| *id == ids[0]));
+    });
+    assert_eq!(keys.built.load(std::sync::atomic::Ordering::Relaxed), 1, "concurrent cache misses must compute one memoized identity");
+}
diff --git a/crates/doc/src/analysis.rs b/crates/doc/src/analysis.rs
index 840bf54990..9b1d8efdb0 100644
--- a/crates/doc/src/analysis.rs
+++ b/crates/doc/src/analysis.rs
@@ -30,14 +30,12 @@ impl MeasurementScale {
     }
     /// Photoshop's "Scale" column text, e.g. `1 pixels = 1.0000 pixels`.
     pub fn describe(&self) -> String {
-        format!("{} pixels = {:.4} {}", trim(self.pixel_length), self.logical_length, self.units)
+        // f64 Display already drops a whole number's `.0` (`5`, `0.5`) and, unlike an i64 cast,
+        // prints lengths past i64::MAX in full.
+        format!("{} pixels = {:.4} {}", self.pixel_length, self.logical_length, self.units)
     }
 }
 
-fn trim(v: f64) -> String {
-    if v.fract() == 0.0 { format!("{}", v as i64) } else { format!("{v}") }
-}
-
 /// One Count tool group: its numbered markers (document pixel coordinates, in click order).
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(default)]
@@ -133,6 +131,17 @@ mod tests {
         assert_eq!(MeasurementScale { pixel_length: 0.0, ..Default::default() }.factor(), 1.0);
     }
 
+    #[test]
+    fn scale_text_prints_large_and_fractional_pixel_lengths() {
+        let big = MeasurementScale { pixel_length: 1e20, logical_length: 1.0, units: "mm".into() };
+        assert_eq!(big.describe(), "100000000000000000000 pixels = 1.0000 mm");
+        assert_eq!(MeasurementScale::default().describe(), "1 pixels = 1.0000 pixels");
+        let s = |p: f64| MeasurementScale { pixel_length: p, ..Default::default() }.describe();
+        assert_eq!(s(5.0), "5 pixels = 1.0000 pixels");
+        assert_eq!(s(0.5), "0.5 pixels = 1.0000 pixels");
+        assert_eq!(s(12.25), "12.25 pixels = 1.0000 pixels");
+    }
+
     #[test]
     fn serde_defaults_fill_missing_fields() {
         let m: Measurement = serde_json::from_str("{}").unwrap();
diff --git a/crates/doc/src/lib.rs b/crates/doc/src/lib.rs
index c4f7f523d1..a1214e7938 100644
--- a/crates/doc/src/lib.rs
+++ b/crates/doc/src/lib.rs
@@ -1,4 +1,4 @@
-//! The Photocraft document model: pure data, no rendering, no UI.
+//! The PhotoCraft document model: pure data, no rendering, no UI.
 //!
 //! Layer order: inside every group (and the root), `children[0]` is the **bottom** layer, matching
 //! compositing order and the PSD file order. UIs display the list reversed.
diff --git a/crates/doc/src/mode.rs b/crates/doc/src/mode.rs
index 96e129cbee..9722ce5b15 100644
--- a/crates/doc/src/mode.rs
+++ b/crates/doc/src/mode.rs
@@ -74,7 +74,7 @@ impl Duotone {
         let density = 1.0 - gray.clamp(0.0, 1.0);
         let mut out = [1.0f32; 3];
         for ink in &self.inks {
-            let d = curve_eval(&ink.curve, density);
+            let d = ink.density(density);
             for (o, c) in out.iter_mut().zip(ink.color) {
                 // Each ink filters light: full density transmits the ink colour.
                 *o *= 1.0 - d * (1.0 - c);
@@ -209,6 +209,22 @@ mod tests {
         assert!(c[0] > c[2], "{c:?}");
     }
 
+    #[test]
+    fn duotone_render_clamps_ink_density_like_multichannel() {
+        // Curves above 100 % (accepted by `image.mode.duotone`) must not push the print out of
+        // gamut: red + blue at full density is black, not green.
+        let over = |name: &str, color| {
+            let mut ink = DuotoneInk::new(name, color);
+            ink.curve = vec![CurvePoint { input: 0.0, output: 0.0 }, CurvePoint { input: 1.0, output: 2.0 }];
+            ink
+        };
+        let d = Duotone { inks: vec![over("Red", [1.0, 0.0, 0.0]), over("Blue", [0.0, 0.0, 1.0])], psd_raw: None };
+        assert_eq!(d.render(0.0), [0.0, 0.0, 0.0]);
+        for g in [0.0, 0.25, 0.5, 1.0] {
+            assert!(d.render(g).iter().all(|c| (0.0..=1.0).contains(c)), "{g}: {:?}", d.render(g));
+        }
+    }
+
     #[test]
     fn stack_mode_ids_roundtrip() {
         for m in StackMode::ALL {
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index 741d927a3f..65dd1e16e0 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -43,6 +43,10 @@ roxmltree = "0.20"
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 tempfile = "3"
 
+# Printing on Unix: an IPP client for CUPS (pure Rust); the web build cannot print.
+[target.'cfg(all(not(target_arch = "wasm32"), not(target_os = "windows")))'.dependencies]
+photocraft-ipp = { workspace = true }
+
 [dev-dependencies]
 photocraft-affinity = { workspace = true, features = ["synth"] }
 # Synthetic camera raw files for the open tests.
diff --git a/crates/engine/src/adjust_cmds.rs b/crates/engine/src/adjust_cmds.rs
index c1393bb94c..b9bcd437aa 100644
--- a/crates/engine/src/adjust_cmds.rs
+++ b/crates/engine/src/adjust_cmds.rs
@@ -296,6 +296,18 @@ fn has_doc(s: &Session) -> std::result::Result<(), String> {
 /// Image › Adjustments run as a smart filter (`image.adjustments.<kind>` recorded on a smart
 /// object): the adjustment applied to a copy of `surf`. `None` for kinds or params it can't run.
 pub(crate) fn adjust_as_filter(kind: &str, p: &Value, surf: &Surface) -> Option<Surface> {
+    // A Color Lookup filter re-reads its LUT `file`, a path stored in the document: followed only
+    // as `doc_path` allows, else the filter can't run (like a missing file).
+    let resolved;
+    let p = match p.get("file").and_then(Value::as_str).filter(|f| kind == "colorLookup" && !f.is_empty()) {
+        Some(file) => {
+            let mut q = p.clone();
+            q["file"] = json!(crate::doc_path::resolve(file).ok()?.to_str()?);
+            resolved = q;
+            &resolved
+        }
+        None => p,
+    };
     let mut out = surf.clone();
     if kind == "shadowsHighlights" {
         let sh = shadows_highlights_params(p);
diff --git a/crates/engine/src/adjust_cmds/tests.rs b/crates/engine/src/adjust_cmds/tests.rs
index 80e97b9f34..d831fbf448 100644
--- a/crates/engine/src/adjust_cmds/tests.rs
+++ b/crates/engine/src/adjust_cmds/tests.rs
@@ -661,3 +661,53 @@ fn replace_color_localized_clusters_only_change_the_colour_near_the_sample() {
     let err = s.execute("image.adjustments.replaceColor", json!({"points": [[1]]})).unwrap_err();
     assert!(err.to_string().contains("bad point"), "{err}");
 }
+
+/// #6095: ⌘I in Quick Mask inverts the whole mask, not only where it was white, so leaving Quick
+/// Mask selects everything but the original rectangle, whichever way the colour reads. With
+/// Color Indicates Selected Areas and nothing selected, it selects everything. A black alpha
+/// channel inverts to white.
+#[test]
+fn invert_turns_the_black_of_quick_mask_and_alpha_channels_white() {
+    for depth in DEPTHS {
+        let mut s = session(depth, "rgb");
+        let pixels = rgba(&s, 2, 2);
+        s.execute("select.rect", json!({"x": 10, "y": 8, "width": 20, "height": 10})).unwrap();
+        s.execute("select.editInQuickMaskMode", json!({"on": true})).unwrap();
+        s.execute("image.adjustments.invert", json!({"target": "quickMask"})).unwrap();
+        let q = &doc(&s).quick_mask.as_ref().unwrap().surface;
+        let (inside, outside) = (q.sample_channel(15, 12, 0), q.sample_channel(2, 2, 0));
+        assert!(inside < 0.01 && outside > 0.99, "{depth}-bit Quick Mask inverted: inside {inside}, outside {outside}");
+        s.execute("select.editInQuickMaskMode", json!({"on": false})).unwrap();
+        let sel = doc(&s).selection.as_ref().expect("an inverse selection after Quick Mask");
+        let (inside, outside) = (sel.sample_channel(15, 12, 0), sel.sample_channel(2, 2, 0));
+        assert!(inside < 0.01 && outside > 0.99, "{depth}-bit selection: inside {inside}, outside {outside}");
+        assert_eq!(rgba(&s, 2, 2), pixels, "{depth}-bit: the layer is untouched");
+
+        s.execute("select.deselect", json!({})).unwrap();
+        s.execute("channel.new", json!({"name": "Black", "fill": "black"})).unwrap();
+        s.execute("image.adjustments.invert", json!({"target": {"channel": 0}})).unwrap();
+        let a = doc(&s).channels[0].surface.sample_channel(40, 30, 0);
+        assert!(a > 0.99, "{depth}-bit black alpha channel inverts to white ({a})");
+        s.undo();
+        assert!(doc(&s).channels[0].surface.sample_channel(40, 30, 0) < 0.01, "{depth}-bit: undo restores the black");
+
+        // Color Indicates Selected Areas: a rectangle comes back inverted, and nothing selected
+        // comes back as everything selected.
+        for (start, inside, outside) in [("rectangle", 0.0, 1.0), ("nothing", 1.0, 1.0)] {
+            let mut s = session(depth, "rgb");
+            s.execute("channel.options", json!({"channel": "quickMask", "indicates": "selected"})).unwrap();
+            if start == "rectangle" {
+                s.execute("select.rect", json!({"x": 10, "y": 8, "width": 20, "height": 10})).unwrap();
+            }
+            s.execute("select.editInQuickMaskMode", json!({"on": true})).unwrap();
+            s.execute("image.adjustments.invert", json!({"target": "quickMask"})).unwrap();
+            s.execute("select.editInQuickMaskMode", json!({"on": false})).unwrap();
+            let sel = doc(&s).selection.as_ref().unwrap_or_else(|| panic!("{depth}-bit Selected Areas, {start}: a selection after Quick Mask"));
+            let got = (sel.sample_channel(15, 12, 0), sel.sample_channel(2, 2, 0));
+            assert!(
+                (got.0 - inside).abs() < 0.01 && (got.1 - outside).abs() < 0.01,
+                "{depth}-bit Selected Areas, {start}: selection (inside, outside) {got:?}"
+            );
+        }
+    }
+}
diff --git a/crates/engine/src/analysis_cmds.rs b/crates/engine/src/analysis_cmds.rs
index 85a6be4513..ae16b7e4e4 100644
--- a/crates/engine/src/analysis_cmds.rs
+++ b/crates/engine/src/analysis_cmds.rs
@@ -1121,8 +1121,12 @@ fn place_scale_marker(s: &mut Session, p: &Value) -> Result<Value> {
     };
     // Bottom-left with a margin; the text sits under (or over) the bar.
     let margin = (w.min(h) * 0.03).round().max(2.0);
-    let bar_h = (font_size / 4.0).round().clamp(2.0, h / 4.0);
-    let text_h = if show_text { font_size * 1.25 } else { 0.0 };
+    // `fontSize` is in points; `type.create` renders it at resolution/72 px per point, so lay out
+    // the bar and label in those pixels (at 300 ppi, 12 pt is 50 px) (#5754).
+    let dpi = f64::from(d.resolution_dpi);
+    let font_px = font_size * if dpi.is_finite() && dpi > 0.0 { dpi / 72.0 } else { 1.0 };
+    let bar_h = (font_px / 4.0).round().clamp(2.0, h / 4.0);
+    let text_h = if show_text { font_px * 1.25 } else { 0.0 };
     // Keep the bar on the canvas when the text under it doesn't fit; the label is clipped instead (#932).
     let bar_y = if text_top { h - margin - bar_h } else { h - margin - bar_h - text_h }.max(0.0);
     // Likewise pull a bar nearly as wide as the image in from the right edge (#932).
@@ -1143,7 +1147,7 @@ fn place_scale_marker(s: &mut Session, p: &Value) -> Result<Value> {
         })?;
         let mut text_layer = Value::Null;
         if show_text {
-            let baseline = if text_top { f64::from(bar.y0) - font_size * 0.3 } else { f64::from(bar.y1) + font_size };
+            let baseline = if text_top { f64::from(bar.y0) - font_px * 0.3 } else { f64::from(bar.y1) + font_px };
             let mut tp = json!({"x": bar.x0, "y": baseline, "text": label, "size": font_size, "color": [rgb[0], rgb[1], rgb[2], 1.0], "name": label});
             if let Some(f) = &font {
                 tp["font"] = json!(f);
diff --git a/crates/engine/src/analysis_cmds/tests.rs b/crates/engine/src/analysis_cmds/tests.rs
index 124f9abf1e..388d5dac97 100644
--- a/crates/engine/src/analysis_cmds/tests.rs
+++ b/crates/engine/src/analysis_cmds/tests.rs
@@ -1,5 +1,5 @@
 use super::*;
-use photocraft_doc::ColorMode;
+use photocraft_doc::{ColorMode, LayerContent, LayerId};
 
 fn session(w: u32, h: u32, depth: u32) -> Session {
     let mut s = Session::new();
@@ -355,6 +355,27 @@ fn place_scale_marker_builds_one_group_in_one_step() {
     assert!(d(&s).layers.iter().all(|l| l.name != "Measurement Scale Marker"));
 }
 
+#[test]
+fn place_scale_marker_lays_out_its_label_in_points_at_high_resolution() {
+    // `fontSize` is in points and `type.create` renders it at resolution/72 px per point, but the
+    // layout treated it as pixels: at 300 ppi a 12 pt label (50 px) overlapped the bar.
+    for res in [72.0, 300.0] {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 1200, "height": 900, "resolution": res, "background": "white"})).unwrap();
+        let r = s.execute("image.analysis.placeScaleMarker", json!({"fontSize": 12, "textPosition": "bottom"})).unwrap();
+        let bar_bottom = r["barRect"][3].as_f64().unwrap();
+        let doc = d(&s);
+        let Some(LayerContent::Text(t)) = doc.layer(LayerId(r["text"].as_u64().unwrap())).map(|l| &l.content) else { panic!("a type layer: {r}") };
+        assert_eq!(t.size_pt, 12.0, "{res} ppi: type.create still gets points");
+        let layout = photocraft_text::shared().lock().unwrap().layout(t, doc.resolution_dpi);
+        let b = layout.bounds().expect("the label has a line");
+        let ty = t.transform.m[5];
+        let (top, bottom) = (f64::from(b[1]) + ty, f64::from(b[3]) + ty);
+        assert!(top >= bar_bottom - 0.5, "{res} ppi: label top {top} overlaps the bar ending at {bar_bottom}: {r}");
+        assert!(bottom <= 900.5, "{res} ppi: label bottom {bottom} stays on the canvas: {r}");
+    }
+}
+
 #[test]
 fn place_scale_marker_on_a_short_document_errors_without_panicking() {
     // A document under 8 px tall inverted the bar-height clamp and panicked (#932). Call `run`
diff --git a/crates/engine/src/artboard_cmds.rs b/crates/engine/src/artboard_cmds.rs
index 5cebe86aa9..c3e3e079f7 100644
--- a/crates/engine/src/artboard_cmds.rs
+++ b/crates/engine/src/artboard_cmds.rs
@@ -528,7 +528,7 @@ fn chosen_artboards(doc: &Document, p: &Value) -> Vec<LayerId> {
     }
 }
 
-/// File › Export › Artboards to Files: `<prefix>_<artboard name>.<format>` per board.
+/// File › Export › Artboards to Files: `<prefix>_<index:04>_<artboard name>.<format>` per board.
 fn artboards_to_files(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "file.export.artboardsToFiles";
     let dir = str_param(p, "dir", cmd).or_else(|_| str_param(p, "output", cmd))?.to_string();
@@ -538,8 +538,9 @@ fn artboards_to_files(s: &mut Session, p: &Value) -> Result<Value> {
     let prefix = p.get("prefix").and_then(Value::as_str).map(str::to_string).unwrap_or_else(|| stem(&d.doc.name));
     let doc = d.doc.clone();
     let mut files = Vec::new();
-    for one in chosen_documents(&doc, p)? {
-        let name = if prefix.is_empty() { sanitize(&one.name) } else { format!("{}_{}", sanitize(&prefix), sanitize(&one.name)) };
+    for (i, one) in chosen_documents(&doc, p)?.into_iter().enumerate() {
+        // Names may be identical, or collide after sanitizing or filesystem case folding.
+        let name = if prefix.is_empty() { format!("{i:04}_{}", sanitize(&one.name)) } else { format!("{}_{i:04}_{}", sanitize(&prefix), sanitize(&one.name)) };
         let path = join(&dir, &format!("{name}.{format}"));
         save_doc(&one, &path, save)?;
         files.push(path);
diff --git a/crates/engine/src/artboard_cmds/tests.rs b/crates/engine/src/artboard_cmds/tests.rs
index 1faf4cb75d..c7695f228e 100644
--- a/crates/engine/src/artboard_cmds/tests.rs
+++ b/crates/engine/src/artboard_cmds/tests.rs
@@ -146,8 +146,8 @@ fn export_to_files_and_pdf() {
     let r = s.execute("file.export.artboardsToFiles", json!({"dir": d, "prefix": "site"})).unwrap();
     let files: Vec<String> = r["files"].as_array().unwrap().iter().map(|v| v.as_str().unwrap().to_string()).collect();
     assert_eq!(files.len(), 2);
-    assert!(files[0].ends_with("site_Empty_One.png"), "{files:?}");
-    assert!(files[1].ends_with("site_Red Board.png"), "{files:?}");
+    assert!(files[0].ends_with("site_0000_Empty_One.png"), "{files:?}");
+    assert!(files[1].ends_with("site_0001_Red Board.png"), "{files:?}");
     let img = photocraft_io::import("x.png", &std::fs::read(&files[1]).unwrap()).unwrap().document;
     assert_eq!((img.size.width, img.size.height), (10, 10));
     let img2 = photocraft_io::import("x.png", &std::fs::read(&files[0]).unwrap()).unwrap().document;
diff --git a/crates/engine/src/atn_cmds.rs b/crates/engine/src/atn_cmds.rs
index ebeda48687..fa86e292f3 100644
--- a/crates/engine/src/atn_cmds.rs
+++ b/crates/engine/src/atn_cmds.rs
@@ -1986,6 +1986,10 @@ fn fill_from(d: &Descriptor) -> Mapped {
         match get_enum(d, "Usng").as_deref() {
             Some("FrgC") | None => {}
             Some("Pttn") => p["contents"] = json!("pattern"),
+            Some("Clr") => match get_obj(d, "Clr ").and_then(color_hex) {
+                Some(c) => p["color"] = json!(c),
+                None => return Mapped::Unsupported { harmless: false },
+            },
             Some(_) => return Mapped::Unsupported { harmless: false },
         }
         if let Some(t) = get_num(d, "Tlrn") {
@@ -2032,7 +2036,16 @@ fn fill_to(id: &str, p: &Value) -> Option<Descriptor> {
     if id == "paint.bucket" {
         let mut d = desc("null").with("From", D::Descriptor(desc("Pnt ").with("Hrzn", px(jnum(p, "x")?)).with("Vrtc", px(jnum(p, "y")?))));
         d = d.with("Tlrn", long(jnum(p, "tolerance").unwrap_or(32.0))).with("AntA", D::Boolean(jbool(p, "antiAlias").unwrap_or(true)));
-        d = d.with("Usng", enm("FlCn", if jstr(p, "contents") == Some("pattern") { "Pttn" } else { "FrgC" }));
+        // `source` is the command's older name for `contents`.
+        d = if p.get("contents").or_else(|| p.get("source")).and_then(Value::as_str) == Some("pattern") {
+            d.with("Usng", enm("FlCn", "Pttn"))
+        } else {
+            // An explicit colour overrides the foreground (#7199): it travels as Fill's `Clr `.
+            match bucket_color(p.get("color"))? {
+                Some(c) => d.with("Usng", enm("FlCn", "Clr ")).with("Clr ", D::Descriptor(c)),
+                None => d.with("Usng", enm("FlCn", "FrgC")),
+            }
+        };
         if let Some(o) = jnum(p, "opacity") {
             d = d.with("Opct", pct(o));
         }
@@ -2054,6 +2067,29 @@ fn fill_to(id: &str, p: &Value) -> Option<Descriptor> {
     Some(d)
 }
 
+/// The Paint Bucket's `color` as `paint.bucket` reads it (`[r, g, b(, a)]` in 0..=1 or
+/// `#rrggbb(aa)`): `Some(None)` when it fills with the foreground (no colour, or a string the
+/// command doesn't read), `None` when the colour can't be written (not opaque, or outside 0..=1).
+fn bucket_color(v: Option<&Value>) -> Option<Option<Descriptor>> {
+    let rgba = match v {
+        Some(Value::Array(a)) if a.len() >= 3 => {
+            let c: Vec<f64> = a.iter().map(|x| x.as_f64().unwrap_or(0.0)).collect();
+            [*c.first()?, *c.get(1)?, *c.get(2)?, c.get(3).copied().unwrap_or(1.0)]
+        }
+        Some(Value::String(h)) => {
+            let h = h.trim_start_matches('#');
+            let c = |i: usize| h.get(i..i + 2).and_then(|x| u8::from_str_radix(x, 16).ok()).map(|v| f64::from(v) / 255.0);
+            let (Some(r), Some(g), Some(b)) = (c(0), c(2), c(4)) else { return Some(None) };
+            [r, g, b, c(6).unwrap_or(1.0)]
+        }
+        _ => return Some(None),
+    };
+    if rgba[3] != 1.0 || !rgba.iter().all(|v| (0.0..=1.0).contains(v)) {
+        return None;
+    }
+    Some(Some(desc("RGBC").with("Rd  ", D::Double(rgba[0] * 255.0)).with("Grn ", D::Double(rgba[1] * 255.0)).with("Bl  ", D::Double(rgba[2] * 255.0))))
+}
+
 const STROKE: &[F] = &[
     F("Wdth", "width", Kind::Long),
     F("Lctn", "location", Kind::Enum("StrL", STROKE_LOCATION)),
diff --git a/crates/engine/src/atn_cmds/tests.rs b/crates/engine/src/atn_cmds/tests.rs
index 871300372c..980d5eb9e2 100644
--- a/crates/engine/src/atn_cmds/tests.rs
+++ b/crates/engine/src/atn_cmds/tests.rs
@@ -432,6 +432,55 @@ fn every_mapped_command_exports_and_imports_back() {
     }
 }
 
+/// `paint.bucket` exported to .atn and imported back → its params, or None when it doesn't export.
+fn bucket_round_trip(params: Value) -> Option<Value> {
+    let item = export_item("paint.bucket", &params, "S")?;
+    let e = event_for(&item.event)?;
+    match (e.from)(item.descriptor.as_ref()?) {
+        Mapped::Steps(steps) => steps.first().map(|(id, p)| {
+            assert_eq!(id, "paint.bucket");
+            p.clone()
+        }),
+        _ => None,
+    }
+}
+
+/// A Paint Bucket step with an explicit colour keeps it through .atn (#7199): replayed on a fresh
+/// document, whose foreground is black, it still fills red. A colour .atn can't hold makes the
+/// step not export rather than fill with the foreground.
+#[test]
+fn bucket_keeps_an_explicit_color_through_atn() {
+    let fill = |params: &Value| {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 8, "height": 8, "background": "#ffffff"})).unwrap();
+        s.execute("paint.bucket", params.clone()).unwrap();
+        let d = s.active().unwrap();
+        d.doc.layer(d.active_layer.unwrap()).unwrap().surface().unwrap().pixel(2, 2)
+    };
+    let red = json!({"x": 2, "y": 2, "antiAlias": false, "color": "#ff0000"});
+    let back = bucket_round_trip(red.clone()).unwrap();
+    assert_eq!(back["color"], "#ff0000", "{back}");
+    assert_eq!(fill(&back), fill(&red));
+    assert_eq!(fill(&back), vec![1.0, 0.0, 0.0, 1.0]);
+    // The colour as an array of channels.
+    assert_eq!(bucket_round_trip(json!({"x": 1, "y": 1, "color": [0.0, 0.5, 1.0]})).unwrap()["color"], "#0080ff");
+    // No colour, or one the command can't read: the foreground, as before.
+    for p in [json!({"x": 1, "y": 1}), json!({"x": 1, "y": 1, "color": "red"})] {
+        let back = bucket_round_trip(p.clone()).unwrap();
+        assert!(back.get("color").is_none() && back.get("contents").is_none(), "{p} → {back}");
+    }
+    // A pattern fill ignores the colour, also when named with the older `source`.
+    for key in ["contents", "source"] {
+        let back = bucket_round_trip(json!({"x": 1, "y": 1, key: "pattern", "color": "#ff0000"})).unwrap();
+        assert_eq!(back["contents"], "pattern", "{key}: {back}");
+        assert!(back.get("color").is_none(), "{key}: {back}");
+    }
+    // Translucent or out-of-range colours have no .atn form.
+    for c in [json!("#ff000080"), json!([1.0, 0.0, 0.0, 0.5]), json!([2.0, 0.0, 0.0])] {
+        assert!(bucket_round_trip(json!({"x": 1, "y": 1, "color": c})).is_none(), "{c}");
+    }
+}
+
 #[test]
 fn unsupported_shapes_become_photoshop_steps_not_errors() {
     // Image size in two different percentages, a Paint Bucket click in percent of the canvas, a
diff --git a/crates/engine/src/brush_cmds.rs b/crates/engine/src/brush_cmds.rs
index b76f8c836d..3de6bc84a1 100644
--- a/crates/engine/src/brush_cmds.rs
+++ b/crates/engine/src/brush_cmds.rs
@@ -793,13 +793,19 @@ fn presets_delete(s: &mut Session, p: &Value) -> Result<Value> {
     if s.tools.presets.len() == before {
         return Err(bad(cmd, format!("no brush preset named `{name}`")));
     }
-    if s.tools.current_preset.as_ref().is_some_and(|c| c.eq_ignore_ascii_case(&name)) {
+    forget_deleted_preset(s, &name);
+    Ok(json!({ "count": s.tools.presets.len() }))
+}
+
+/// After preset `name` was deleted (here or in Edit › Presets › Preset Manager): the current
+/// brush no longer comes from a preset, and the library is saved.
+pub(crate) fn forget_deleted_preset(s: &mut Session, name: &str) {
+    if s.tools.current_preset.as_ref().is_some_and(|c| c.eq_ignore_ascii_case(name)) {
         s.tools.current_preset = None;
         // The remembered brush names the preset it was picked from: the name went away.
         s.tools.brush_changed();
     }
     s.brush_presets_changed();
-    Ok(json!({ "count": s.tools.presets.len() }))
 }
 
 /// Overwrite an existing preset with the current brush (or the current brush plus a `brush`
@@ -863,9 +869,16 @@ fn define_from_selection(s: &mut Session, p: &Value) -> Result<Value> {
     }
     // Paint amount = darkness × alpha × selection (black = full paint, like Photoshop).
     let (w, h) = (area.width() as usize, area.height() as usize);
-    let mut v = vec![0.0f32; w * h];
+    // The sampled tip is one f32 buffer over the whole selection; a large selection must fail
+    // gracefully instead of aborting the process on allocation, so reserve it fallibly. The
+    // multiply is checked too: on a 32-bit target (wasm32) it can overflow where the rest of
+    // this command is already fallible.
+    let len = w.checked_mul(h).ok_or_else(|| crate::allocation::error("defining a brush from the selection", "requested size overflowed"))?;
+    let mut v = crate::allocation::filled(len, 0.0, "defining a brush from the selection")?;
     let sc = sel.channels();
-    let sv = sel.read_region(area);
+    // The selection mask is a second buffer of the same size; it must fail gracefully too
+    // (review of #5469), so read it through the fallible allocator.
+    let sv = crate::allocation::read_region(sel, area, "defining a brush from the selection")?;
     for y in 0..h {
         for x in 0..w {
             let c = surf.rgba(area.x0 + x as i32, area.y0 + y as i32);
diff --git a/crates/engine/src/brush_cmds/tests.rs b/crates/engine/src/brush_cmds/tests.rs
index eaf69281bc..5977603f94 100644
--- a/crates/engine/src/brush_cmds/tests.rs
+++ b/crates/engine/src/brush_cmds/tests.rs
@@ -442,6 +442,26 @@ fn define_brush_from_selection() {
     assert!(rgba(&s, 30, 32)[3] > 0.9);
 }
 
+#[test]
+fn define_brush_from_selection_survives_allocation_failure() {
+    // The sampled tip is one f32 buffer over the whole selection, and the selection mask is a
+    // second of the same size. Both are reserved through the fallible allocator, so an allocation
+    // failure must be a graceful error (brush, presets, history and document untouched), never a
+    // panic or an OOM abort.
+    let mut s = session(40, 40);
+    s.execute("select.rect", json!({"x": 5, "y": 5, "width": 20, "height": 20})).unwrap();
+    let brush_before = s.tools.brush.clone();
+    let presets_before = s.tools.presets.clone();
+    let history_before = s.active().unwrap().history.past_len();
+    crate::allocation::fail_next_for_test();
+    let result = s.execute("brush.defineFromSelection", json!({"name": "Blob"}));
+    let _ = crate::allocation::capacity::<u8>(0, "reset failpoint");
+    assert!(result.is_err(), "an allocation failure must be reported, not panic");
+    assert_eq!(s.tools.brush, brush_before, "the current brush is unchanged");
+    assert_eq!(s.tools.presets, presets_before, "the preset list is unchanged");
+    assert_eq!(s.active().unwrap().history.past_len(), history_before, "no history step was recorded");
+}
+
 #[test]
 fn works_on_cmyk_and_16_bit() {
     for (mode, depth) in [("cmyk", 8), ("rgb", 16), ("grayscale", 32)] {
diff --git a/crates/engine/src/brush_preset_cmds.rs b/crates/engine/src/brush_preset_cmds.rs
index 46331126ac..1c126ec477 100644
--- a/crates/engine/src/brush_preset_cmds.rs
+++ b/crates/engine/src/brush_preset_cmds.rs
@@ -109,21 +109,29 @@ fn rename(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "brush.presets.rename";
     let i = find(s, p, "name", cmd)?;
     let new = text(p, "newName", cmd)?;
-    if index_of(&s.tools.presets, &new).is_some_and(|j| j != i) {
+    rename_at(s, i, &new, cmd)?;
+    Ok(json!({ "name": new }))
+}
+
+/// Rename preset `i` (shared by Brush Settings and Edit › Presets › Preset Manager): refuses a
+/// name another preset has (case-insensitively), makes the preset the user's and keeps the
+/// current preset pointing at it.
+pub(crate) fn rename_at(s: &mut Session, i: usize, new: &str, cmd: &str) -> Result<()> {
+    if index_of(&s.tools.presets, new).is_some_and(|j| j != i) {
         return Err(bad(cmd, format!("a brush preset named `{new}` already exists")));
     }
     let pr = s.tools.presets.get_mut(i).ok_or_else(|| bad(cmd, "no such preset"))?;
     if pr.name != new {
         let was_current = s.tools.current_preset.as_ref().is_some_and(|c| c.eq_ignore_ascii_case(&pr.name));
-        pr.name = new.clone();
+        pr.name = new.to_string();
         pr.builtin = false;
         if was_current {
-            s.tools.current_preset = Some(new.clone());
+            s.tools.current_preset = Some(new.to_string());
             s.tools.brush_changed();
         }
         s.brush_presets_changed();
     }
-    Ok(json!({ "name": new }))
+    Ok(())
 }
 
 fn move_preset(s: &mut Session, p: &Value) -> Result<Value> {
diff --git a/crates/engine/src/clip_group.rs b/crates/engine/src/clip_group.rs
index 4e356efce9..31f62696a3 100644
--- a/crates/engine/src/clip_group.rs
+++ b/crates/engine/src/clip_group.rs
@@ -42,6 +42,11 @@ fn group_of(doc: &Document, id: LayerId) -> Vec<LayerId> {
     if group.len() > 1 { group } else { Vec::new() }
 }
 
+/// The base `id` clips to (itself when it is a base), when it is in a clip group.
+pub(crate) fn base_of(doc: &Document, id: LayerId) -> Option<LayerId> {
+    group_of(doc, id).first().copied()
+}
+
 /// The layers clipped to `id`: the clipped run directly above it. Empty when `id` is itself
 /// clipped (it is not a base) or nothing is clipped to it.
 fn clipped_to(doc: &Document, id: LayerId) -> Vec<LayerId> {
@@ -51,6 +56,14 @@ fn clipped_to(doc: &Document, id: LayerId) -> Vec<LayerId> {
     }
 }
 
+/// The clipped layers directly above `id` among its siblings (Release Clipping Mask releases them
+/// with it).
+pub(crate) fn clipped_above(doc: &Document, id: LayerId) -> Vec<LayerId> {
+    let Some(path) = doc.path_of(id) else { return Vec::new() };
+    let Some((list, idx)) = siblings(doc, &path) else { return Vec::new() };
+    list.iter().skip(idx.saturating_add(1)).take_while(|l| l.clipped).map(|l| l.id).collect()
+}
+
 /// The clip groups of layers about to move or be deleted, read before they leave their slots.
 #[derive(Default)]
 pub(crate) struct Before {
diff --git a/crates/engine/src/color_to_alpha_cmds.rs b/crates/engine/src/color_to_alpha_cmds.rs
index a6208e8246..34356a3bfb 100644
--- a/crates/engine/src/color_to_alpha_cmds.rs
+++ b/crates/engine/src/color_to_alpha_cmds.rs
@@ -64,10 +64,9 @@ fn validate(p: &Value) -> Result<()> {
         Some(Value::String(s)) => {
             crate::commands::parse_hex(s).ok_or_else(|| bad(format!("`color` must be \"#rrggbb\", not {s:?}")))?;
         }
+        Some(Value::Array(a)) if (3..=4).contains(&a.len()) && a.iter().all(|v| v.as_f64().is_some_and(|x| x.is_finite() && (0.0..=1.0).contains(&x))) => {}
         Some(Value::Array(a)) if (3..=4).contains(&a.len()) => {
-            if !a.iter().all(|v| v.as_f64().is_some_and(|x| x.is_finite() && (0.0..=1.0).contains(&x))) {
-                return Err(bad("`color` as an array must hold 3 or 4 numbers in 0..1"));
-            }
+            return Err(bad("`color` as an array must hold 3 or 4 numbers in 0..1"));
         }
         Some(_) => return Err(bad("`color` must be \"#rrggbb\" or [r, g, b] in 0..1")),
     }
diff --git a/crates/engine/src/commands.rs b/crates/engine/src/commands.rs
index 7ddad80737..09ea34233c 100644
--- a/crates/engine/src/commands.rs
+++ b/crates/engine/src/commands.rs
@@ -117,7 +117,10 @@ fn has_selection(s: &Session) -> std::result::Result<(), String> {
 fn turn(s: &mut Session, label: &str, t: crate::canvas_geom::Turn) -> Result<Value> {
     if let Some(d) = s.active() {
         let a = t.affine(f64::from(d.doc.size.width), f64::from(d.doc.size.height));
-        s.set_sampler_map(a);
+        // Sampler points are pixel indices, not pixel edges: map the pixel's centre, so the point
+        // lands on the same pixel `Turn::pixel_map` moves the pixels to (`w - 1 - x`).
+        let half = photocraft_geom::Affine::translate(0.5, 0.5);
+        s.set_sampler_map(half.then(&a).then(&photocraft_geom::Affine::translate(-0.5, -0.5)));
     }
     s.edit(label, |doc, _| {
         crate::canvas_geom::turn_canvas(doc, t);
@@ -253,7 +256,10 @@ pub(crate) fn parse_hex(s: &str) -> Option<[f32; 4]> {
 }
 /// Layer › Create / Release Clipping Mask. With a `layer` param, just that layer. Otherwise, as in
 /// Photoshop, the selection (#1248): Create clips every selected layer except the lowest, which
-/// becomes the base; Release releases every selected layer. One history step either way.
+/// becomes the base; Release releases every selected layer. Releasing a clipped layer also
+/// releases the clipped layers above it in its group, as Adobe documents ("removes the selected
+/// layer and any layers above it from the clipping mask"), so none is left clipped to a layer
+/// that is no longer clipped. One history step either way.
 fn set_clipped(s: &mut Session, p: &Value, clip: bool) -> Result<Value> {
     let label = if clip { "Create Clipping Mask" } else { "Release Clipping Mask" };
     let ids: Vec<LayerId> = if p.get("layer").is_some() {
@@ -267,6 +273,20 @@ fn set_clipped(s: &mut Session, p: &Value, clip: bool) -> Result<Value> {
             (false, all) => all.to_vec(),
         }
     };
+    let ids = if clip {
+        ids
+    } else {
+        let doc = &s.active().ok_or(EngineError::NoDocument)?.doc;
+        let mut all = ids.clone();
+        for id in ids.iter().filter(|id| doc.layer(**id).is_some_and(|l| l.clipped)) {
+            for above in crate::clip_group::clipped_above(doc, *id) {
+                if !all.contains(&above) {
+                    all.push(above);
+                }
+            }
+        }
+        all
+    };
     s.edit(label, |doc, _| {
         for id in &ids {
             doc.layer_mut(*id).ok_or(EngineError::NoLayer(*id))?.clipped = clip;
@@ -278,7 +298,8 @@ fn set_clipped(s: &mut Session, p: &Value, clip: bool) -> Result<Value> {
 
 /// The layer a command's `"layer"` param names: an id, or a name (the topmost layer of that
 /// name, as Photoshop's "select layer by name" action step finds it, so a loaded action replays
-/// in another document). `None` when the param is absent.
+/// in another document; a name that matches no layer exactly matches regardless of case, so
+/// `"background"` finds the Background). `None` when the param is absent.
 pub(crate) fn explicit_layer(s: &Session, p: &Value) -> Result<Option<LayerId>> {
     match p.get("layer") {
         Some(Value::Number(n)) => {
@@ -286,19 +307,41 @@ pub(crate) fn explicit_layer(s: &Session, p: &Value) -> Result<Option<LayerId>>
         }
         Some(Value::String(name)) => {
             let d = s.active().ok_or(EngineError::NoDocument)?;
-            d.doc
-                .walk()
-                .into_iter()
-                .rev()
+            let layers = d.doc.walk();
+            let mut top_down = layers.iter().rev();
+            top_down
+                .clone()
                 .find(|(_, _, l)| l.name == *name)
+                .or_else(|| top_down.find(|(_, _, l)| l.name.to_lowercase() == name.to_lowercase()))
                 .map(|(_, _, l)| Some(l.id))
-                .ok_or_else(|| EngineError::Other(format!("no layer named \"{name}\"")))
+                .ok_or_else(|| EngineError::Other(format!("no layer named \"{name}\"; {}", layer_listing(&d.doc))))
         }
         Some(Value::Null) | None => Ok(None),
         Some(other) => Err(EngineError::Other(format!("`layer` must be an id or a name, not {other}"))),
     }
 }
 
+/// The layers of `doc` as a caller can name them, for an error about a layer that isn't there:
+/// `the document's layers are 2 "Background", 3 "Layer 1"` (top-down, at most 20).
+pub(crate) fn layer_listing(doc: &Document) -> String {
+    const MAX: usize = 20;
+    let layers = doc.walk();
+    if layers.is_empty() {
+        return "the document has no layers".into();
+    }
+    // Names are unbounded input: each one is cut at NAME characters so the error stays short.
+    const NAME: usize = 64;
+    let name = |n: &str| match n.char_indices().nth(NAME) {
+        Some((cut, _)) => format!("{}…", &n[..cut]),
+        None => n.to_string(),
+    };
+    let mut list: Vec<String> = layers.iter().rev().take(MAX).map(|(_, _, l)| format!("{} {:?}", l.id.0, name(&l.name))).collect();
+    if layers.len() > MAX {
+        list.push(format!("… {} more (see `document.inspect`)", layers.len() - MAX));
+    }
+    format!("the document's layers are {} (a `layer` param takes an id or a name)", list.join(", "))
+}
+
 /// The layer a command targets: [`explicit_layer`], else the active layer.
 pub(crate) fn layer_param(s: &Session, p: &Value) -> Result<LayerId> {
     match explicit_layer(s, p)? {
@@ -381,12 +424,12 @@ fn destructive_adjust(s: &mut Session, label: &str, adj: Adjustment, p: &Value)
         });
     }
     if crate::channel_cmds::is_channel_target(p) {
-        // Alpha channel / Quick Mask target: the adjustment runs on the grayscale channel.
+        // Alpha channel / Quick Mask target: the adjustment runs on the grayscale channel as on
+        // a layer mask, its unstored black included, so ⌘I in Quick Mask inverts it all (#6095).
         return s.edit(label, |doc, _| {
             let sel = doc.selection.clone();
             if let Some(surf) = crate::channel_cmds::channel_surface_for_filter(doc, None, p)? {
-                pixels::adjust_surface(surf, &adj, sel.as_ref(), ColorMode::Grayscale);
-                surf.prune();
+                pixels::adjust_mask(surf, &adj, sel.as_ref());
             }
             Ok(Value::Null)
         });
@@ -724,10 +767,32 @@ fn build() -> Vec<CommandSpec> {
             "Layer Properties",
             [],
             None,
-            r##"{"layer":id?,"name":str?,"visible":bool?,"opacity":0..1?,"fill":0..1?,"blend":"Multiply|…"?,"clipped":bool?,"locked":bool?,"locks":{"transparency","pixels","position","artboard","all":bool}?,"channels":[bool,…]? (Advanced Blending: which colour channels blend, R G B / C M Y K / L a b)}"##,
+            r##"{"layer":id?,"layers":[id,…]? (the same change to each, one step: the Layers panel's controls with several layers selected),"name":str? (one layer only),"visible":bool?,"opacity":0..1?,"fill":0..1?,"blend":"Multiply|…"?,"clipped":bool?,"locked":bool?,"locks":{"transparency","pixels","position","artboard","all":bool}?,"channels":[bool,…]? (Advanced Blending: which colour channels blend, R G B / C M Y K / L a b)}"##,
             has_layer,
             |s, p| {
-                let id = layer_param(s, p)?;
+                // Several layers at once (the Layers panel with several selected, as in Photoshop),
+                // else the given or active one.
+                let ids: Vec<LayerId> = match p.get("layers") {
+                    None | Some(Value::Null) => vec![layer_param(s, p)?],
+                    Some(Value::Array(a)) if !a.is_empty() && a.len() <= 10_000 => {
+                        let doc = &s.active().ok_or(EngineError::NoDocument)?.doc;
+                        let mut ids = Vec::with_capacity(a.len());
+                        for v in a {
+                            let id = v.as_u64().map(LayerId).ok_or_else(|| bad("layer.setProps", format!("`layers` holds layer ids, got {v}")))?;
+                            if doc.layer(id).is_none() {
+                                return Err(EngineError::NoLayer(id));
+                            }
+                            if !ids.contains(&id) {
+                                ids.push(id);
+                            }
+                        }
+                        ids
+                    }
+                    Some(v) => return Err(bad("layer.setProps", format!("`layers` is a non-empty list of layer ids, got {v}"))),
+                };
+                if ids.len() > 1 && p.get("name").is_some() {
+                    return Err(bad("layer.setProps", "`name` renames one layer, not several"));
+                }
                 // Opacity and Fill are fractions here, while the Layer Style commands take
                 // percentages: a value outside 0..1 is refused, never clamped to 100 % (#5242).
                 let unit = |key: &str| -> Result<Option<f32>> {
@@ -738,9 +803,19 @@ fn build() -> Vec<CommandSpec> {
                     }
                 };
                 let (opacity, fill) = (unit("opacity")?, unit("fill")?);
-                let only_visibility =
-                    p.as_object().is_some_and(|o| o.contains_key("visible") && o.keys().all(|k| matches!(k.as_str(), "layer" | "visible" | "coalesce")));
-                let label = if only_visibility { "Layer Visibility" } else { "Layer Properties" };
+                // Photoshop's History names for a single kind of change; a mix is "Layer Properties".
+                let changed: Vec<&str> = p
+                    .as_object()
+                    .map(|o| o.keys().map(String::as_str).filter(|k| !matches!(*k, "layer" | "layers" | "coalesce")).collect())
+                    .unwrap_or_default();
+                let label = match changed.as_slice() {
+                    ["visible"] => "Layer Visibility",
+                    ["opacity"] => "Opacity Change",
+                    ["fill"] => "Fill Opacity Change",
+                    ["blend"] => "Blending Change",
+                    ["name"] => "Rename Layer",
+                    _ => "Layer Properties",
+                };
                 let before = s.active().ok_or(EngineError::NoDocument)?.doc.clone();
                 // Clipping and channel changes reach the layers around it: recomposite everything.
                 let local = p.get("clipped").is_none() && p.get("channels").is_none();
@@ -749,47 +824,54 @@ fn build() -> Vec<CommandSpec> {
                     // one that changes its look turns it into a normal layer ("Layer 0") first.
                     let num = |k: &str| p.get(k).and_then(Value::as_f64).is_some_and(|v| v < 1.0);
                     let blends = p.get("blend").and_then(Value::as_str).and_then(blend_from_str).is_some_and(|b| b != photocraft_color::BlendMode::Normal);
-                    if num("opacity") || num("fill") || blends {
-                        crate::extra_cmds::background_to_layer(doc, id);
-                    }
-                    let l = doc.layer_mut(id).ok_or(EngineError::NoLayer(id))?;
-                    if let Some(v) = p.get("name").and_then(Value::as_str) {
-                        l.name = v.to_string();
-                    }
-                    if let Some(v) = p.get("visible").and_then(Value::as_bool) {
-                        l.visible = v;
-                    }
-                    if let Some(v) = opacity {
-                        l.opacity = v;
-                    }
-                    if let Some(v) = fill {
-                        l.fill_opacity = v;
-                    }
-                    if let Some(v) = p.get("blend").and_then(Value::as_str) {
-                        l.blend = blend_from_str(v).ok_or_else(|| bad("layer.setProps", format!("unknown blend mode `{v}`")))?;
-                    }
-                    if let Some(v) = p.get("clipped").and_then(Value::as_bool) {
-                        l.clipped = v;
-                    }
-                    if let Some(v) = p.get("locked").and_then(Value::as_bool) {
-                        l.locks.all = v;
-                    }
-                    if let Some(Value::Array(ch)) = p.get("channels") {
-                        // Blending Options › Advanced Blending › Channels: unchecked = left out.
-                        l.excluded_channels = ch.iter().take(32).enumerate().filter(|(_, v)| v.as_bool() == Some(false)).fold(0, |m, (i, _)| m | 1 << i);
-                    }
-                    if let Some(Value::Object(m)) = p.get("locks") {
-                        for (k, v) in m {
-                            let v = v.as_bool().unwrap_or(false);
-                            if !l.locks.set(k, v) {
-                                return Err(bad("layer.setProps", format!("unknown lock `{k}`")));
+                    for &id in &ids {
+                        if num("opacity") || num("fill") || blends {
+                            crate::extra_cmds::background_to_layer(doc, id);
+                        }
+                        let l = doc.layer_mut(id).ok_or(EngineError::NoLayer(id))?;
+                        if let Some(v) = p.get("name").and_then(Value::as_str) {
+                            l.name = v.to_string();
+                        }
+                        if let Some(v) = p.get("visible").and_then(Value::as_bool) {
+                            l.visible = v;
+                        }
+                        if let Some(v) = opacity {
+                            l.opacity = v;
+                        }
+                        if let Some(v) = fill {
+                            l.fill_opacity = v;
+                        }
+                        if let Some(v) = p.get("blend").and_then(Value::as_str) {
+                            let b = blend_from_str(v).ok_or_else(|| bad("layer.setProps", format!("unknown blend mode `{v}`")))?;
+                            // Pass Through is a group's mode only, as in Photoshop.
+                            if b == photocraft_color::BlendMode::PassThrough && !l.is_group() {
+                                return Err(bad("layer.setProps", format!("Pass Through applies to groups only; layer {} isn't one", l.id.0)));
+                            }
+                            l.blend = b;
+                        }
+                        if let Some(v) = p.get("clipped").and_then(Value::as_bool) {
+                            l.clipped = v;
+                        }
+                        if let Some(v) = p.get("locked").and_then(Value::as_bool) {
+                            l.locks.all = v;
+                        }
+                        if let Some(Value::Array(ch)) = p.get("channels") {
+                            // Blending Options › Advanced Blending › Channels: unchecked = left out.
+                            l.excluded_channels = ch.iter().take(32).enumerate().filter(|(_, v)| v.as_bool() == Some(false)).fold(0, |m, (i, _)| m | 1 << i);
+                        }
+                        if let Some(Value::Object(m)) = p.get("locks") {
+                            for (k, v) in m {
+                                let v = v.as_bool().unwrap_or(false);
+                                if !l.locks.set(k, v) {
+                                    return Err(bad("layer.setProps", format!("unknown lock `{k}`")));
+                                }
                             }
                         }
                     }
                     Ok(())
                 })?;
                 if local {
-                    crate::layer_multi_cmds::note_damage(s, &before, &[id]);
+                    crate::layer_multi_cmds::note_damage(s, &before, &ids);
                 }
                 Ok(Value::Null)
             }
@@ -1366,6 +1448,7 @@ fn build() -> Vec<CommandSpec> {
     v.extend(crate::edit_menu_cmds::specs());
     v.extend(crate::fill_key_cmds::specs());
     v.extend(crate::sample_cmds::specs());
+    v.extend(crate::face_cmds::specs());
     v.extend(crate::sampler_cmds::specs());
     v.extend(crate::brush_key_cmds::specs());
     v.extend(crate::stamp_cmds::specs());
diff --git a/crates/engine/src/doc_path.rs b/crates/engine/src/doc_path.rs
new file mode 100644
index 0000000000..b51d164e74
--- /dev/null
+++ b/crates/engine/src/doc_path.rs
@@ -0,0 +1,58 @@
+//! Paths stored in a document reach the file system only through [`resolve`] (built on
+//! [`photocraft_io::doc_path::resolve`]): linked smart objects, the Displace map and Color Lookup
+//! file a smart filter re-reads, data-set images and video footage. A refused path is handled like
+//! a missing file: the layer keeps its last rendering, and commands that need the file say why.
+//!
+//! Smart-object rendering has no `Session` argument, so the path of the document being worked on
+//! travels in a thread-local scope, entered where commands run ([`crate::Session::edit`], command
+//! dispatch, background jobs). Outside a scope there is no document: relative paths are refused
+//! and only local absolute paths are followed.
+
+use std::cell::RefCell;
+use std::path::{Path, PathBuf};
+
+pub use photocraft_io::doc_path::NotFollowed;
+
+thread_local! {
+    static DOCUMENT: RefCell<Option<PathBuf>> = const { RefCell::new(None) };
+}
+
+/// Restores the previous document path when dropped.
+pub(crate) struct DocumentScope(Option<PathBuf>);
+
+impl Drop for DocumentScope {
+    fn drop(&mut self) {
+        let previous = self.0.take();
+        DOCUMENT.with(|d| *d.borrow_mut() = previous);
+    }
+}
+
+/// Resolve stored paths against `document` (the path of the document being worked on, `None`
+/// for one without a file) until the returned scope is dropped.
+pub(crate) fn scope(document: Option<&Path>) -> DocumentScope {
+    let next = document.filter(|d| !d.as_os_str().is_empty()).map(Path::to_path_buf);
+    DocumentScope(DOCUMENT.with(|d| d.replace(next)))
+}
+
+/// The document path of the current scope (to carry it to another thread).
+pub(crate) fn current() -> Option<PathBuf> {
+    DOCUMENT.with(|d| d.borrow().clone())
+}
+
+/// The file to open for `stored`, a path stored in the document of the current scope.
+pub fn resolve(stored: &str) -> Result<PathBuf, NotFollowed> {
+    resolve_in(stored, current().as_deref())
+}
+
+/// The file to open for `stored`, a path stored in the document saved at `document`.
+pub fn resolve_in(stored: &str, document: Option<&Path>) -> Result<PathBuf, NotFollowed> {
+    photocraft_io::doc_path::resolve(stored, document)
+}
+
+/// The message for a stored path that is not followed.
+pub(crate) fn refusal(what: &str, stored: &str, why: NotFollowed) -> crate::EngineError {
+    crate::EngineError::Other(format!("{what} {stored} is not opened: {why}"))
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/engine/src/doc_path/tests.rs b/crates/engine/src/doc_path/tests.rs
new file mode 100644
index 0000000000..393e85a062
--- /dev/null
+++ b/crates/engine/src/doc_path/tests.rs
@@ -0,0 +1,227 @@
+//! Each kind of place that follows a path stored in a document goes through [`super::resolve`]: a
+//! link to another computer is never followed, and a relative link next to the document is.
+
+use std::path::{Path, PathBuf};
+
+use photocraft_doc::{LayerContent, LayerId, SmartSource};
+use photocraft_geom::Rect;
+use serde_json::json;
+
+use crate::Session;
+
+/// A link to a share on a TEST-NET-1 address, which never answers.
+const REMOTE: &str = r"\\192.0.2.1\share\x.png";
+
+/// An empty folder of its own (tests run in parallel).
+fn dir(name: &str) -> PathBuf {
+    let d = std::env::temp_dir().join(format!("photocraft-doc-path-{name}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).unwrap();
+    d
+}
+
+/// A 32×32 PNG whose pixel at column `x` is `rgb(x)`.
+fn png(path: &Path, rgb: impl Fn(u32) -> [u8; 3]) {
+    let mut px = Vec::new();
+    for _ in 0..32 {
+        for x in 0..32 {
+            px.extend(rgb(x));
+        }
+    }
+    let image = photocraft_codecs::Image::from_u8(32, 32, photocraft_codecs::ChannelLayout::Rgb, px).unwrap();
+    std::fs::write(path, photocraft_codecs::encode(&image, photocraft_codecs::Format::Png, &Default::default()).unwrap()).unwrap();
+}
+
+/// On Unix `//` followed by an absolute path names that same local file, while the resolver sees a
+/// path on another computer: a place that skipped the resolver would read the file.
+#[cfg(unix)]
+fn network_alias(p: &Path) -> String {
+    format!("/{}", p.display())
+}
+
+/// A 32×32 white document saved (as far as its links know) at `d/doc.pcraft`, with `file` placed
+/// linked → (session, layer id).
+fn document(d: &Path, file: &Path) -> (Session, LayerId) {
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 32, "height": 32})).unwrap();
+    s.active_mut().unwrap().path = Some(d.join("doc.pcraft").to_string_lossy().into_owned());
+    s.execute("file.placeLinked", json!({"path": file.to_string_lossy()})).unwrap();
+    let id = s.active().unwrap().active_layer.unwrap();
+    (s, id)
+}
+
+/// Point smart object `id` at `path` without re-rendering it.
+fn relink(s: &mut Session, id: LayerId, path: &str) {
+    s.edit("Relink", |doc, _| {
+        if let Some(LayerContent::Smart(sm)) = doc.layer_mut(id).map(|l| &mut l.content) {
+            sm.source = SmartSource::Linked { path: path.into() };
+        }
+        Ok(())
+    })
+    .unwrap();
+}
+
+fn centre(s: &Session) -> [f32; 3] {
+    let p = photocraft_compose::render(&s.active().unwrap().doc, Rect::new(16, 16, 17, 17)).px[0];
+    [p[0], p[1], p[2]]
+}
+
+const RED: [f32; 3] = [1.0, 0.0, 0.0];
+const BLUE: [f32; 3] = [0.0, 0.0, 1.0];
+
+fn update(s: &mut Session) -> Result<serde_json::Value, String> {
+    s.execute("layer.smartObjects.updateModifiedContent", json!({})).map_err(|e| e.to_string())
+}
+
+#[test]
+fn linked_smart_objects_follow_only_local_files() {
+    let d = dir("links");
+    png(&d.join("red.png"), |_| [255, 0, 0]);
+    png(&d.join("blue.png"), |_| [0, 0, 255]);
+    let (mut s, id) = document(&d, &d.join("red.png"));
+    assert_eq!(centre(&s), RED);
+
+    relink(&mut s, id, REMOTE);
+    s.start_link_scan();
+    assert!(s.link_scan.is_none(), "no look at a file on another computer");
+    assert_eq!(s.execute("layer.smartObjects.updateChanged", json!({})).unwrap(), json!({"updated": []}));
+    let err = update(&mut s).unwrap_err();
+    assert!(err.contains("is not opened: the path is on another computer"), "{err}");
+    assert_eq!(centre(&s), RED, "the layer keeps its rendering");
+    #[cfg(unix)]
+    {
+        relink(&mut s, id, &network_alias(&d.join("blue.png")));
+        assert!(update(&mut s).is_err());
+        assert_eq!(centre(&s), RED, "the file was not read");
+    }
+
+    // A relative link is taken from the document's folder.
+    relink(&mut s, id, "blue.png");
+    update(&mut s).unwrap();
+    assert_eq!(centre(&s), BLUE);
+    s.start_link_scan();
+    assert!(s.link_scan.is_some(), "a followed link is looked at");
+}
+
+#[test]
+fn package_copies_only_followed_links() {
+    let d = dir("package");
+    png(&d.join("red.png"), |_| [255, 0, 0]);
+    let (mut s, id) = document(&d, &d.join("red.png"));
+    relink(&mut s, id, "red.png");
+    #[allow(unused_mut)]
+    let mut remote = vec![REMOTE.to_string()];
+    #[cfg(unix)]
+    remote.push(network_alias(&d.join("red.png")));
+    for path in &remote {
+        s.execute("file.placeLinked", json!({"path": d.join("red.png").to_string_lossy()})).unwrap();
+        let other = s.active().unwrap().active_layer.unwrap();
+        relink(&mut s, other, path);
+    }
+    let r = s.execute("file.package", json!({"dir": d.join("pkg").to_string_lossy()})).unwrap();
+    let mut missing: Vec<String> = serde_json::from_value(r["missing"].clone()).unwrap();
+    missing.sort();
+    remote.sort();
+    assert_eq!(missing, remote);
+    let links = r["links"].as_array().unwrap();
+    assert_eq!(links.len(), 1);
+    assert!(links[0].as_str().unwrap().ends_with("red.png"), "{links:?}");
+}
+
+#[test]
+fn psd_saves_embed_only_followed_links() {
+    let d = dir("psd");
+    png(&d.join("red.png"), |_| [255, 0, 0]);
+    let (mut s, id) = document(&d, &d.join("red.png"));
+    relink(&mut s, id, "red.png");
+    s.execute("file.placeLinked", json!({"path": d.join("red.png").to_string_lossy()})).unwrap();
+    let other = s.active().unwrap().active_layer.unwrap();
+    relink(&mut s, other, REMOTE);
+    let warnings = |r: serde_json::Value| r["warnings"].as_array().unwrap().iter().map(|w| w.as_str().unwrap().to_string()).collect::<Vec<_>>();
+    let saved = warnings(s.execute("file.saveACopy", json!({"path": d.join("copy.psd").to_string_lossy()})).unwrap());
+    assert!(saved.iter().any(|w| w.contains("red.png was embedded")), "{saved:?}");
+    assert!(saved.iter().any(|w| w.contains("is not opened: the path is on another computer")), "{saved:?}");
+    // Package as PSD writes the copy of the document, whose remote link stays as it was.
+    let packaged = warnings(s.execute("file.package", json!({"dir": d.join("pkg").to_string_lossy(), "format": "psd"})).unwrap());
+    assert!(packaged.iter().any(|w| w.contains("is not opened: the path is on another computer")), "{packaged:?}");
+}
+
+/// The pixels of the active document after its smart object `id` re-renders with its first smart
+/// filter's params set to `params`.
+fn replayed(s: &mut Session, id: LayerId, params: serde_json::Value) -> Vec<[f32; 4]> {
+    s.edit("Params", |doc, _| {
+        if let Some(LayerContent::Smart(sm)) = doc.layer_mut(id).map(|l| &mut l.content) {
+            sm.smart_filters[0].params = params;
+        }
+        crate::smart_cmds::refresh(doc, id).map(|_| ())
+    })
+    .unwrap();
+    let doc = &s.active().unwrap().doc;
+    photocraft_compose::render(doc, doc.bounds()).px
+}
+
+#[test]
+fn smart_filters_reread_only_followed_files() {
+    let d = dir("filters");
+    png(&d.join("ramp.png"), |x| [(x * 8) as u8, 0, 0]);
+    png(&d.join("map.png"), |_| [255, 255, 255]);
+    // An inverting look: corner (r, g, b) of the cube maps to (1-r, 1-g, 1-b), red fastest.
+    let corners = (0..8).map(|i| format!("{} {} {}\n", 1 - (i & 1), 1 - ((i >> 1) & 1), 1 - ((i >> 2) & 1))).collect::<String>();
+    std::fs::write(d.join("invert.cube"), format!("LUT_3D_SIZE 2\n{corners}")).unwrap();
+    let path = |name: &str| d.join(name).to_string_lossy().into_owned();
+
+    // Displace re-reads its `mapPath`.
+    let (mut s, id) = document(&d, &d.join("ramp.png"));
+    s.execute("filter.distort.displace", json!({"layer": id.0, "mapPath": path("map.png"), "horizontal": 50, "vertical": 0})).unwrap();
+    let displaced = replayed(&mut s, id, json!({"mapPath": path("map.png"), "horizontal": 50, "vertical": 0}));
+    let unfiltered = replayed(&mut s, id, json!({"mapPath": REMOTE, "horizontal": 50, "vertical": 0}));
+    assert_ne!(displaced, unfiltered, "the map moves the pixels");
+    assert_eq!(replayed(&mut s, id, json!({"mapPath": "map.png", "horizontal": 50, "vertical": 0})), displaced, "a relative map next to the document");
+    #[cfg(unix)]
+    assert_eq!(replayed(&mut s, id, json!({"mapPath": network_alias(&d.join("map.png")), "horizontal": 50, "vertical": 0})), unfiltered);
+
+    // Color Lookup re-reads its LUT `file`.
+    let (mut s, id) = document(&d, &d.join("ramp.png"));
+    s.execute("image.adjustments.colorLookup", json!({"layer": id.0, "lut": "none"})).unwrap();
+    let inverted = replayed(&mut s, id, json!({"file": path("invert.cube")}));
+    let unfiltered = replayed(&mut s, id, json!({"file": REMOTE}));
+    assert_ne!(inverted, unfiltered, "the look changes the pixels");
+    assert_eq!(replayed(&mut s, id, json!({"file": "invert.cube"})), inverted, "a relative look next to the document");
+    #[cfg(unix)]
+    assert_eq!(replayed(&mut s, id, json!({"file": network_alias(&d.join("invert.cube"))})), unfiltered);
+}
+
+#[test]
+fn data_sets_and_footage_read_only_followed_files() {
+    let d = dir("datasets");
+    png(&d.join("blue.png"), |_| [0, 0, 255]);
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 32, "height": 32, "background": "#ff0000"})).unwrap();
+    s.active_mut().unwrap().path = Some(d.join("doc.pcraft").to_string_lossy().into_owned());
+    let layer = s.active().unwrap().active_layer.unwrap();
+    s.execute("image.variables.define", json!({"defs": [{"name": "img", "layer": layer.0, "type": "pixelReplacement", "method": "conform"}]})).unwrap();
+    let set = |name: &str, path: &str| json!({"name": name, "values": [{"variable": "img", "kind": "pixels", "value": path}]});
+    s.execute("image.variables.dataSets", json!({"dataSets": [set("remote", REMOTE), set("relative", "blue.png")]})).unwrap();
+    let err = s.execute("image.applyDataSet", json!({"name": "remote"})).unwrap_err().to_string();
+    assert!(err.contains("is not opened: the path is on another computer"), "{err}");
+    assert_eq!(centre(&s), RED);
+    s.execute("image.applyDataSet", json!({"name": "relative"})).unwrap();
+    assert_eq!(centre(&s), BLUE);
+
+    // Reload Frame re-reads the video layer's footage.
+    s.execute("layer.videoLayers.newVideoLayerFromFile", json!({"path": d.join("blue.png").to_string_lossy()})).unwrap();
+    let footage = |s: &mut Session, path: &str| {
+        let id = s.active().unwrap().active_layer.unwrap();
+        s.edit("Footage", |doc, _| {
+            if let Some(v) = doc.layer_mut(id).and_then(|l| l.video.as_mut()) {
+                v.source = photocraft_doc::VideoSource::File { path: path.into() };
+            }
+            Ok(())
+        })
+        .unwrap();
+        s.execute("layer.videoLayers.reloadFrame", json!({})).map_err(|e| e.to_string())
+    };
+    let err = footage(&mut s, REMOTE).unwrap_err();
+    assert!(err.contains("is not opened: the path is on another computer"), "{err}");
+    footage(&mut s, "blue.png").unwrap();
+}
diff --git a/crates/engine/src/edit_menu_cmds.rs b/crates/engine/src/edit_menu_cmds.rs
index 11e2273601..c5f312e2cb 100644
--- a/crates/engine/src/edit_menu_cmds.rs
+++ b/crates/engine/src/edit_menu_cmds.rs
@@ -110,6 +110,12 @@ fn always(_: &Session) -> std::result::Result<(), String> {
 fn pixel_layer(s: &Session) -> std::result::Result<LayerId, String> {
     let d = s.active().ok_or("no document open")?;
     let id = d.active_layer.ok_or("no active layer")?;
+    pixel_layer_id(s, id)
+}
+
+/// `id` if it is an unlocked pixel layer of the active document.
+fn pixel_layer_id(s: &Session, id: LayerId) -> std::result::Result<LayerId, String> {
+    let d = s.active().ok_or("no document open")?;
     let l = d.doc.layer(id).ok_or("no active layer")?;
     if !matches!(l.content, LayerContent::Raster(_)) {
         return Err(format!("active layer is {} {} layer, not a pixel layer", l.content.article(), l.content.kind_name()));
@@ -358,38 +364,169 @@ fn delete_and_fill(s: &mut Session, _: &Value) -> Result<Value> {
     content_aware_fill_as(s, &json!({"sampling": "rectangular"}), "edit.deleteAndFillSelection", "Delete and Fill Selection")
 }
 
-fn content_aware_fill_as(s: &mut Session, p: &Value, cmd: &'static str, label: &'static str) -> Result<Value> {
-    use photocraft_algo::content_aware::{FillOptions, auto_sampling_with, color_level, fill_owned, rotation_level};
-    let id = pixel_layer(s).map_err(EngineError::Other)?;
-    let st = s.active().ok_or(EngineError::NoDocument)?;
-    let doc = st.doc.clone();
-    let sel = doc.selection.clone().ok_or_else(|| bad(cmd, "no selection"))?;
-    let hb = sel.content_bounds().intersect(&doc.bounds());
-    if hb.is_empty() {
+/// Everything one Content-Aware Fill needs, worked out from the document and the command's
+/// params. The Content-Aware Fill workspace runs exactly this for its preview, so what it shows
+/// is what OK and Apply write.
+pub struct CafPlan {
+    pub layer: LayerId,
+    /// The rectangle worked on: the sampling window, and any sampling-brush strokes or custom
+    /// area beyond it.
+    pub rect: Rect,
+    /// Photoshop's sampling window around the fill area (`content_aware::sampling_window`).
+    pub window: Rect,
+    pub fmt: PixelFormat,
+    /// What is sampled over `rect`: the target's pixels, or with Sample All Layers the visible
+    /// composite in the target's encoding.
+    pub img: Vec<f32>,
+    /// The target's own pixels over `rect` when they differ from `img` (Sample All Layers); see
+    /// [`CafPlan::layer_pixels`].
+    pub layer_px: Option<Vec<f32>>,
+    /// The fill area (selection coverage, after the workspace's lasso edits) over `rect`.
+    pub cover: Vec<f32>,
+    pub hole: Vec<bool>,
+    /// What may be copied from: the sampling option's area before the brush strokes, and after.
+    pub base: Vec<bool>,
+    pub source: Vec<bool>,
+    pub opts: photocraft_algo::content_aware::FillOptions,
+    pub output: String,
+}
+
+impl CafPlan {
+    /// The target layer's pixels over `rect`.
+    pub fn layer_pixels(&self) -> &[f32] {
+        self.layer_px.as_deref().unwrap_or(&self.img)
+    }
+}
+
+/// The workspace's lasso edits of the fill area: `{"op": "new|add|subtract|intersect", "points":
+/// [[x, y], ...]}` or `{"op": "expand|contract", "by": px}`, applied in order.
+#[derive(Clone, Debug, PartialEq)]
+pub enum FillEdit {
+    Lasso { op: SelOp, points: Vec<[f64; 2]> },
+    Grow(i32),
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum SelOp {
+    New,
+    Add,
+    Subtract,
+    Intersect,
+}
+
+/// Most `fillEdits` and `samplingStrokes` one fill takes, and most points in all of them
+/// together: the strokes and lassos are painted pixel by pixel, segment by segment.
+pub const MAX_CAF_EDITS: usize = 1_000;
+pub const MAX_CAF_POINTS: usize = 200_000;
+
+fn points_param(v: &Value, cmd: &str, what: &str, budget: &mut usize) -> Result<Vec<[f64; 2]>> {
+    let a = v.get("points").and_then(Value::as_array).ok_or_else(|| bad(cmd, format!("{what} needs `points` [[x, y], ...]")))?;
+    *budget = budget.checked_sub(a.len()).ok_or_else(|| bad(cmd, format!("at most {MAX_CAF_POINTS} points in all fill edits and sampling strokes")))?;
+    a.iter()
+        .map(|p| {
+            let x = p.get(0).and_then(Value::as_f64).filter(|v| v.is_finite() && v.abs() < 1e7);
+            let y = p.get(1).and_then(Value::as_f64).filter(|v| v.is_finite() && v.abs() < 1e7);
+            match (x, y) {
+                (Some(x), Some(y)) => Ok([x, y]),
+                _ => Err(bad(cmd, format!("{what} points must be pairs of finite numbers"))),
+            }
+        })
+        .collect()
+}
+
+/// `p[key]` as an array of at most [`MAX_CAF_EDITS`] entries (empty when absent).
+fn edits_param<'a>(p: &'a Value, key: &str, cmd: &str) -> Result<&'a [Value]> {
+    let Some(a) = p.get(key) else { return Ok(&[]) };
+    let a = a.as_array().ok_or_else(|| bad(cmd, format!("`{key}` must be an array")))?;
+    if a.len() > MAX_CAF_EDITS {
+        return Err(bad(cmd, format!("`{key}` takes at most {MAX_CAF_EDITS} entries")));
+    }
+    Ok(a)
+}
+
+fn fill_edits(p: &Value, cmd: &str, budget: &mut usize) -> Result<Vec<FillEdit>> {
+    edits_param(p, "fillEdits", cmd)?
+        .iter()
+        .map(|e| {
+            let op = e.get("op").and_then(Value::as_str).unwrap_or("");
+            Ok(match op {
+                "expand" | "contract" => {
+                    let by = e
+                        .get("by")
+                        .and_then(Value::as_f64)
+                        .filter(|v| v.is_finite() && (0.0..=1000.0).contains(v))
+                        .ok_or_else(|| bad(cmd, "`by` must be 0..1000 px"))?;
+                    FillEdit::Grow(if op == "expand" { by.round() as i32 } else { -(by.round() as i32) })
+                }
+                "new" | "add" | "subtract" | "intersect" => FillEdit::Lasso {
+                    op: match op {
+                        "new" => SelOp::New,
+                        "add" => SelOp::Add,
+                        "subtract" => SelOp::Subtract,
+                        _ => SelOp::Intersect,
+                    },
+                    points: points_param(e, cmd, "a lasso edit", budget)?,
+                },
+                o => return Err(bad(cmd, format!("unknown fill edit `{o}` (new|add|subtract|intersect|expand|contract)"))),
+            })
+        })
+        .collect()
+}
+
+fn sampling_strokes(p: &Value, cmd: &str, budget: &mut usize) -> Result<Vec<photocraft_algo::content_aware::SamplingStroke>> {
+    edits_param(p, "samplingStrokes", cmd)?
+        .iter()
+        .map(|e| {
+            let add = match e.get("mode").and_then(Value::as_str).unwrap_or("add") {
+                "add" => true,
+                "subtract" => false,
+                o => return Err(bad(cmd, format!("unknown stroke mode `{o}` (add|subtract)"))),
+            };
+            let size = e
+                .get("size")
+                .and_then(Value::as_f64)
+                .filter(|v| v.is_finite() && (1.0..=5000.0).contains(v))
+                .ok_or_else(|| bad(cmd, "a stroke's `size` must be 1..5000 px"))?;
+            Ok(photocraft_algo::content_aware::SamplingStroke { add, size, points: points_param(e, cmd, "a sampling stroke", budget)? })
+        })
+        .collect()
+}
+
+/// A Content-Aware Fill's params, checked against the document before any pixel is read.
+struct CafParams<'a> {
+    sel: &'a Surface,
+    /// The selection's bounds on the canvas.
+    sb: Rect,
+    edits: Vec<FillEdit>,
+    strokes: Vec<photocraft_algo::content_aware::SamplingStroke>,
+    sampling: String,
+    custom_mask: Option<&'a Surface>,
+    custom_rect: Option<Rect>,
+    opts: photocraft_algo::content_aware::FillOptions,
+    output: String,
+    surf: &'a Surface,
+}
+
+fn caf_params<'a>(doc: &'a Document, id: LayerId, p: &Value, cmd: &str) -> Result<CafParams<'a>> {
+    use photocraft_algo::content_aware::{FillOptions, color_level, rotation_level};
+    let sel = doc.selection.as_ref().ok_or_else(|| bad(cmd, "no selection"))?;
+    let sb = sel.content_bounds().intersect(&doc.bounds());
+    if sb.is_empty() {
         return Err(bad(cmd, "the selection is outside the canvas"));
     }
+    let mut budget = MAX_CAF_POINTS;
+    let edits = fill_edits(p, cmd, &mut budget)?;
+    let strokes = sampling_strokes(p, cmd, &mut budget)?;
     let sampling = str_or(p, "sampling", "auto").to_string();
-    let custom_mask: Option<Surface> = p.get("channel").and_then(|v| channel_mask(&doc, v)).cloned();
+    let custom_mask: Option<&Surface> = p.get("channel").and_then(|v| channel_mask(doc, v));
     let custom_rect = if p.get("area").is_some() { Some(rect_param(p, "area", cmd)?) } else { None };
-    // Photoshop's window (`content_aware::sampling_window`) for Auto and Rectangular; `margin`
-    // asks for a rectangle that far around the selection instead.
-    let window = match sampling.as_str() {
-        "auto" => crate::fill_cmds::sampling_window(hb, doc.bounds()),
-        "rectangular" => match int(p, "margin") {
-            Some(m) => hb.inflate(m.clamp(0, 100_000) as i32),
-            None => crate::fill_cmds::sampling_window(hb, doc.bounds()),
-        },
-        "custom" => {
-            let r = match (custom_rect, custom_mask.as_ref()) {
-                (Some(r), _) => r,
-                (None, Some(m)) => m.content_bounds(),
-                (None, None) => return Err(bad(cmd, "custom sampling needs `area` [x,y,w,h] or `channel` (alpha channel index or name)")),
-            };
-            r.union(&hb).inflate(4)
-        }
+    match sampling.as_str() {
+        "auto" | "rectangular" => {}
+        // The workspace's Custom: only what the Sampling Brush adds.
+        "custom" if custom_rect.is_some() || custom_mask.is_some() || strokes.iter().any(|s| s.add) => {}
+        "custom" => return Err(bad(cmd, "custom sampling needs `area` [x,y,w,h], `channel` (alpha channel index or name) or `samplingStrokes`")),
         other => return Err(bad(cmd, format!("unknown sampling `{other}` (auto|rectangular|custom)"))),
     }
-    .intersect(&doc.bounds());
     let opts = FillOptions {
         color_adaptation: color_level(str_or(p, "colorAdaptation", "default")),
         rotations: rotation_level(str_or(p, "rotationAdaptation", "none")),
@@ -402,6 +539,77 @@ fn content_aware_fill_as(s: &mut Session, p: &Value, cmd: &'static str, label: &
         return Err(bad(cmd, "`output` must be current|new|duplicate"));
     }
     let surf = doc.layer(id).and_then(|l| l.surface()).ok_or(EngineError::NoLayer(id))?;
+    Ok(CafParams { sel, sb, edits, strokes, sampling, custom_mask, custom_rect, opts, output, surf })
+}
+
+/// Work out a Content-Aware Fill (see [`CafPlan`]) on layer `id` of `doc`.
+pub fn content_aware_plan(doc: &Document, id: LayerId, p: &Value, cmd: &str) -> Result<CafPlan> {
+    content_aware_plan_with(doc, id, p, cmd, &photocraft_raster::Interrupt::NONE)
+}
+
+/// [`content_aware_plan`], asking `ctl` row by row whether to stop ([`EngineError::Cancelled`]).
+pub fn content_aware_plan_with(doc: &Document, id: LayerId, p: &Value, cmd: &str, ctl: &photocraft_raster::Interrupt) -> Result<CafPlan> {
+    use photocraft_algo::content_aware::{auto_sampling_with, grow_mask, paint_strokes, polygon_mask};
+    use rayon::prelude::*;
+
+    use crate::fill_cmds::{read_window, read_window_mask};
+    let CafParams { sel, sb, edits, strokes, sampling, custom_mask, custom_rect, opts, output, surf } = caf_params(doc, id, p, cmd)?;
+    let canvas = doc.bounds();
+    let cancel = || ctl.cancelled();
+    let stop = || if ctl.cancelled() { Err(EngineError::Cancelled) } else { Ok(()) };
+    // The fill area: the selection, then the lasso edits, over a rectangle that holds them all.
+    let grow: i32 = edits.iter().map(|e| if let FillEdit::Grow(b) = e { b.max(&0) } else { &0 }).sum();
+    let reach = edits.iter().fold(sb, |r, e| match e {
+        FillEdit::Lasso { points, .. } => {
+            points.iter().fold(r, |r, q| r.union(&Rect::new(q[0].floor() as i32, q[1].floor() as i32, q[0].floor() as i32 + 1, q[1].floor() as i32 + 1)))
+        }
+        FillEdit::Grow(_) => r,
+    });
+    let er = reach.inflate(grow.saturating_add(1)).intersect(&canvas);
+    let (ew, eh) = crate::fill_cmds::window_size(er)?;
+    let ecover = read_window_mask(sel, er, &cancel).ok_or(EngineError::Cancelled)?;
+    let mut ehole: Vec<bool> = ecover.par_iter().map(|c| *c > 0.0).collect();
+    for e in &edits {
+        stop()?;
+        match e {
+            FillEdit::Lasso { op, points } => {
+                let m = polygon_mask(er, points);
+                for (h, v) in ehole.iter_mut().zip(&m) {
+                    *h = match op {
+                        SelOp::New => *v,
+                        SelOp::Add => *h || *v,
+                        SelOp::Subtract => *h && !*v,
+                        SelOp::Intersect => *h && *v,
+                    };
+                }
+            }
+            FillEdit::Grow(by) => ehole = grow_mask(&ehole, ew, eh, *by),
+        }
+    }
+    let (bx0, by0, bx1, by1) = mask_bounds(ew, eh, &ehole);
+    if bx1 <= bx0 {
+        return Err(bad(cmd, "the fill area is empty"));
+    }
+    let hb = Rect::new(er.x0 + bx0 as i32, er.y0 + by0 as i32, er.x0 + bx1 as i32, er.y0 + by1 as i32);
+    // Photoshop's window (`content_aware::sampling_window`) for Auto and Rectangular; `margin`
+    // asks for a rectangle that far around the fill area instead.
+    let window = match sampling.as_str() {
+        "rectangular" => match int(p, "margin") {
+            Some(m) => hb.inflate(m.clamp(0, 100_000) as i32),
+            None => crate::fill_cmds::sampling_window(hb, canvas),
+        },
+        "custom" => match (custom_rect, custom_mask) {
+            (Some(r), _) => r,
+            (None, Some(m)) => m.content_bounds(),
+            (None, None) => hb,
+        }
+        .union(&hb)
+        .inflate(4),
+        _ => crate::fill_cmds::sampling_window(hb, canvas),
+    }
+    .intersect(&canvas);
+    // Strokes that add to the sampling area may reach past the window.
+    let rect = strokes.iter().filter(|s| s.add).fold(window, |r, s| r.union(&s.bounds())).intersect(&canvas);
     let fmt = surf.format();
     // Photoshop's Sample All Layers checkbox is off unless the caller asks. When the active
     // layer has no pixels in the window there is nothing to sample, so that case uses the
@@ -412,56 +620,127 @@ fn content_aware_fill_as(s: &mut Session, p: &Value, cmd: &'static str, label: &
     };
     let n = fmt.channels();
     // Refuse a window too large to read before allocating for it, whatever the sampling (#963).
-    let (w, h) = crate::fill_cmds::window_size(window)?;
-    // A background job when started with `Session::start` (#210): reading the window and the
-    // PatchMatch fill run on a worker against the document snapshot, cancellable per row band.
+    let (w, h) = crate::fill_cmds::window_size(rect)?;
+    let pixels = read_window(surf, rect, &cancel).ok_or(EngineError::Cancelled)?;
+    let (img, layer_px) = if sample_all {
+        stop()?;
+        (crate::retouch_cmds::composite_region(doc, Some(id), crate::retouch_cmds::SampleLayers::All, rect, fmt).data, Some(pixels))
+    } else {
+        (pixels, None)
+    };
+    stop()?;
+    let mut cover = vec![0.0f32; w * h];
+    let mut hole = vec![false; w * h];
+    cover.par_chunks_mut(w.max(1)).zip(hole.par_chunks_mut(w.max(1))).enumerate().try_for_each(|(y, (crow, hrow))| {
+        stop()?;
+        let dy = rect.y0 + y as i32;
+        if dy < er.y0 || dy >= er.y1 {
+            return Ok(());
+        }
+        for (x, (c, hl)) in crow.iter_mut().zip(hrow.iter_mut()).enumerate() {
+            let dx = rect.x0 + x as i32;
+            if dx >= er.x0 && dx < er.x1 {
+                let j = (dy - er.y0) as usize * ew + (dx - er.x0) as usize;
+                let (eh, ec) = (ehole.get(j).copied().unwrap_or(false), ecover.get(j).copied().unwrap_or(0.0));
+                *hl = eh;
+                // Pixels the lasso added are filled outright; selected ones by their coverage.
+                *c = if eh { if ec > 0.0 { ec } else { 1.0 } } else { 0.0 };
+            }
+        }
+        Ok::<(), EngineError>(())
+    })?;
+    drop((ecover, ehole));
+    // The sampling option's area: Auto keeps what looks like the surroundings within the window,
+    // Rectangular the whole window, Custom the given area (or nothing, for the brush to add to).
+    let mut base = vec![false; w * h];
+    match sampling.as_str() {
+        "auto" | "rectangular" => {
+            let (ww, wh) = (window.width() as usize, window.height() as usize);
+            let (ox, oy) = ((window.x0 - rect.x0) as usize, (window.y0 - rect.y0) as usize);
+            let area: Vec<bool> = match sampling.as_str() {
+                "auto" if window == rect => auto_sampling_with(w, h, n, &img, &hole, ctl).map_err(|_| EngineError::Cancelled)?,
+                "auto" => {
+                    let mut wimg = vec![0.0f32; ww * wh * n];
+                    let mut whole = vec![false; ww * wh];
+                    for y in 0..wh {
+                        let s = ((oy + y) * w + ox) * n;
+                        wimg[y * ww * n..(y + 1) * ww * n].copy_from_slice(&img[s..s + ww * n]);
+                        whole[y * ww..(y + 1) * ww].copy_from_slice(&hole[(oy + y) * w + ox..(oy + y) * w + ox + ww]);
+                    }
+                    auto_sampling_with(ww, wh, n, &wimg, &whole, ctl).map_err(|_| EngineError::Cancelled)?
+                }
+                _ => vec![true; ww * wh],
+            };
+            for y in 0..wh {
+                base[(oy + y) * w + ox..(oy + y) * w + ox + ww].copy_from_slice(&area[y * ww..(y + 1) * ww]);
+            }
+        }
+        _ => match (custom_rect, custom_mask) {
+            (Some(r), _) => base.par_iter_mut().enumerate().for_each(|(i, b)| *b = r.contains(rect.x0 + (i % w) as i32, rect.y0 + (i / w) as i32)),
+            (None, Some(m)) => {
+                let v = read_window_mask(m, rect, &cancel).ok_or(EngineError::Cancelled)?;
+                base.par_iter_mut().zip(&v).for_each(|(b, v)| *b = *v > 0.5);
+            }
+            (None, None) => {}
+        },
+    }
+    stop()?;
+    base.par_iter_mut().zip(&hole).for_each(|(b, h)| *b &= !*h);
+    let mut source = base.clone();
+    paint_strokes(&mut source, rect, &strokes);
+    source.par_iter_mut().zip(&hole).for_each(|(s, h)| *s &= !*h);
+    Ok(CafPlan { layer: id, rect, window, fmt, img, layer_px, cover, hole, base, source, opts, output })
+}
+
+fn content_aware_fill_as(s: &mut Session, p: &Value, cmd: &'static str, label: &'static str) -> Result<Value> {
+    use photocraft_algo::content_aware::fill_owned;
+    // The workspace names the layer it opened on: after an Apply to a new layer that one is
+    // active, but the fill still samples the original.
+    let id = match p.get("layer").and_then(Value::as_u64) {
+        Some(l) => pixel_layer_id(s, LayerId(l)),
+        None => pixel_layer(s),
+    }
+    .map_err(EngineError::Other)?;
+    let st = s.active().ok_or(EngineError::NoDocument)?;
+    let doc = st.doc.clone();
+    // Check the params before the job starts.
+    caf_params(&doc, id, p, cmd)?;
+    let p = p.clone();
+    // A background job when started with `Session::start` (#210): working out the fill area and
+    // the sampling area, reading the pixels and the PatchMatch fill run on a worker against the
+    // document snapshot, cancellable per row band.
     crate::jobs::run(
         s,
         label,
         true,
         move |ctx| {
             use rayon::prelude::*;
-
-            use crate::fill_cmds::{read_window, read_window_cover, read_window_mask};
             ctx.progress(0.0, label);
             let cancel = || ctx.cancelled();
-            let surf = doc.layer(id).and_then(|l| l.surface()).ok_or(EngineError::NoLayer(id))?;
-            let img = if sample_all {
-                if cancel() {
-                    return Err(EngineError::Cancelled);
-                }
-                let region = crate::retouch_cmds::composite_region(&doc, None, crate::retouch_cmds::SampleLayers::All, window, fmt);
-                if cancel() {
-                    return Err(EngineError::Cancelled);
-                }
-                region.data
-            } else {
-                read_window(surf, window, &cancel).ok_or(EngineError::Cancelled)?
-            };
-            let hole = read_window_cover(&sel, window, &cancel).ok_or(EngineError::Cancelled)?;
-            let mut source = match (sampling.as_str(), custom_rect, custom_mask.as_ref()) {
-                ("custom", Some(r), _) => (0..w * h).into_par_iter().map(|i| r.contains(window.x0 + (i % w) as i32, window.y0 + (i / w) as i32)).collect(),
-                ("custom", None, Some(m)) => read_window_mask(m, window, &cancel).ok_or(EngineError::Cancelled)?.par_iter().map(|v| *v > 0.5).collect(),
-                _ => vec![true; w * h],
-            };
-            ctx.check()?;
-            // Auto: only what looks like the selection's surroundings.
-            if sampling == "auto" {
-                source = auto_sampling_with(w, h, n, &img, &hole, &photocraft_raster::Interrupt::cancel_only(&cancel)).map_err(|_| EngineError::Cancelled)?;
-            }
-            ctx.check()?;
-            // The fill changes only the selected pixels: keep the original and the coverage over
-            // their bounds for the apply step, and fill the window's pixels themselves.
+            let plan = content_aware_plan_with(&doc, id, &p, cmd, &photocraft_raster::Interrupt::cancel_only(&cancel))?;
+            let CafPlan { layer, rect, fmt, img, layer_px, cover, hole, source, opts, output, .. } = plan;
+            let (w, h) = (rect.width() as usize, rect.height() as usize);
+            let n = fmt.channels();
+            // The fill changes only the fill area: keep the layer's pixels and the coverage over
+            // its bounds for the apply step, and fill the sampled pixels themselves.
             let (bx0, by0, bx1, by1) = mask_bounds(w, h, &hole);
-            let original: Vec<f32> = (by0..by1).flat_map(|y| img[(y * w + bx0) * n..(y * w + bx1) * n].iter().copied()).collect();
-            let at = |x: usize, y: usize| (window.x0 + x as i32, window.y0 + y as i32);
-            let ((x0, y0), (x1, y1)) = (at(bx0, by0), at(bx1, by1));
-            let cover = read_window_mask(&sel, Rect::new(x0, y0, x1, y1), &cancel).ok_or(EngineError::Cancelled)?;
+            let own = layer_px.as_deref().unwrap_or(&img);
+            let original: Vec<f32> = (by0..by1).flat_map(|y| own[(y * w + bx0) * n..(y * w + bx1) * n].iter().copied()).collect();
+            let cover: Vec<f32> = (by0..by1).flat_map(|y| cover[y * w + bx0..y * w + bx1].iter().copied()).collect();
             let n_hole = cover.iter().filter(|c| **c > 0.0).count();
-            let filled = ctx.stage(0.05, 1.0, label, |ctl| fill_owned(w, h, n, img, &hole, &source, &opts, ctl)).map_err(|_| EngineError::Cancelled)?;
-            Ok(FilledWindow { filled, bounds: (bx0, by0, bx1, by1), original, cover, n_hole })
+            ctx.check()?;
+            let mut filled = ctx.stage(0.05, 1.0, label, |ctl| fill_owned(w, h, n, img, &hole, &source, &opts, ctl)).map_err(|_| EngineError::Cancelled)?;
+            // Sampled from all layers: outside the fill area the window keeps the layer's pixels.
+            if let Some(own) = layer_px {
+                filled.par_chunks_mut(n.max(1)).zip(own.par_chunks(n.max(1))).zip(hole.par_iter()).for_each(|((f, o), h)| {
+                    if !*h {
+                        f.copy_from_slice(o);
+                    }
+                });
+            }
+            Ok((layer, rect, fmt, output, FilledWindow { filled, bounds: (bx0, by0, bx1, by1), original, cover, n_hole }))
         },
-        move |s, done| apply_content_aware_fill(s, label, id, &output, fmt, window, done),
+        move |s, (layer, rect, fmt, output, done)| apply_content_aware_fill(s, label, layer, &output, fmt, rect, done),
     )
 }
 
@@ -1027,18 +1306,18 @@ fn preset_manager(s: &mut Session, p: &Value) -> Result<Value> {
             let new =
                 p.get("newName").and_then(Value::as_str).map(str::trim).filter(|n| !n.is_empty()).ok_or_else(|| bad(cmd, "missing `newName`"))?.to_string();
             match kind.as_str() {
-                "brushes" => {
-                    // A renamed built-in is the user's preset now (and persists as one).
-                    let b = &mut s.tools.presets[i];
-                    b.name = new;
-                    b.builtin = false;
-                }
+                // Same rules as Brush Settings: no duplicate names (case-insensitive), the current
+                // preset follows, a renamed built-in is the user's preset now (and persists as one).
+                "brushes" => crate::brush_preset_cmds::rename_at(s, i, &new, cmd)?,
                 "patterns" => s.patterns.items[i].name = new,
                 _ => s.edit_state.custom_shapes[i].name = new,
             }
         }
         "delete" => match kind.as_str() {
-            "brushes" => drop(s.tools.presets.remove(i)),
+            "brushes" => {
+                let gone = s.tools.presets.remove(i);
+                crate::brush_cmds::forget_deleted_preset(s, &gone.name);
+            }
             "patterns" => drop(s.patterns.items.remove(i)),
             _ => drop(s.edit_state.custom_shapes.remove(i)),
         },
@@ -1169,7 +1448,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Content-Aware Fill…",
             ["Edit"],
             None,
-            r##"{"sampling":"auto|rectangular|custom","margin":px?,"area":[x,y,w,h]?,"channel":index|name?,"colorAdaptation":"default|none|high|veryHigh","rotationAdaptation":"none|low|medium|high|full","scale":bool=false,"mirror":bool=false,"sampleAllLayers":bool=false,"output":"current|new|duplicate","seed":u64=1}"##,
+            r##"{"sampling":"auto|rectangular|custom","margin":px?,"area":[x,y,w,h]?,"channel":index|name?,"samplingStrokes":[{"mode":"add|subtract","size":px,"points":[[x,y],…]}]? (the workspace's Sampling Brush, after the sampling option's area; added strokes may lie outside the window),"fillEdits":[{"op":"new|add|subtract|intersect","points":[[x,y],…]}|{"op":"expand|contract","by":px}]? (the workspace's lasso edits of the fill area, in order),"sampleAllLayers":bool=false,"colorAdaptation":"default|none|high|veryHigh","rotationAdaptation":"none|low|medium|high|full","scale":bool=false,"mirror":bool=false,"output":"current|new|duplicate","layer":id?=active (the layer filled and sampled),"seed":u64=1}"##,
             can_caf,
             content_aware_fill
         ),
diff --git a/crates/engine/src/edit_menu_cmds/tests.rs b/crates/engine/src/edit_menu_cmds/tests.rs
index f7c2f23e83..ecbb8a7cda 100644
--- a/crates/engine/src/edit_menu_cmds/tests.rs
+++ b/crates/engine/src/edit_menu_cmds/tests.rs
@@ -266,6 +266,52 @@ fn content_aware_fill_samples_photoshops_window() {
     }
 }
 
+#[test]
+fn content_aware_fill_takes_the_workspace_edits() {
+    // The plan the workspace previews: lasso edits change the fill area (and the window follows),
+    // sampling-brush strokes change what may be copied, also outside the window.
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 600, "height": 400, "background": "white"})).unwrap();
+    s.execute("select.rect", json!({"x": 275, "y": 175, "width": 50, "height": 50})).unwrap();
+    let st = s.active().unwrap();
+    let (doc, id) = (st.doc.clone(), st.active_layer.unwrap());
+    let plan = |p: Value| content_aware_plan(&doc, id, &p, "edit.contentAwareFill");
+    let count = |m: &[bool]| m.iter().filter(|v| **v).count();
+    let base = plan(json!({"sampling": "rectangular"})).unwrap();
+    assert_eq!((base.window, count(&base.hole)), (Rect::new(200, 100, 400, 300), 2500));
+    assert_eq!(count(&base.source), 200 * 200 - 2500);
+    // A lasso square added beside the selection: a bigger fill area, a window around both.
+    let p = plan(json!({"sampling": "rectangular", "fillEdits": [{"op": "add", "points": [[340, 175], [390, 175], [390, 225], [340, 225]]}]})).unwrap();
+    assert_eq!(count(&p.hole), 5000);
+    assert!(p.window.width() > 200 && p.window.contains_rect(&Rect::new(275, 175, 390, 225)), "{:?}", p.window);
+    // Expand by 2 grows the 50 px square to about 54 px (rounded corners).
+    let p = plan(json!({"sampling": "rectangular", "fillEdits": [{"op": "expand", "by": 2}]})).unwrap();
+    assert!((54 * 54 - 20..=54 * 54).contains(&count(&p.hole)), "{}", count(&p.hole));
+    // Subtracting it all leaves nothing to fill.
+    assert!(plan(json!({"fillEdits": [{"op": "subtract", "points": [[0, 0], [600, 0], [600, 400], [0, 400]]}]})).is_err());
+    // A subtracting stroke takes a band out of the sampling area; an adding one far away reaches
+    // past the window, and the plan's rectangle grows to hold it.
+    let p = plan(json!({"sampling": "rectangular", "samplingStrokes": [{"mode": "subtract", "size": 10, "points": [[210, 110], [390, 110]]}]})).unwrap();
+    assert!((count(&base.source) - count(&p.source)).abs_diff(10 * 190) < 60);
+    let p = plan(json!({"sampling": "rectangular", "samplingStrokes": [{"mode": "add", "size": 20, "points": [[540, 350], [580, 350]]}]})).unwrap();
+    assert!(p.rect.contains(560, 350) && !p.window.contains(560, 350));
+    assert!(count(&p.source) > count(&base.source) + 600);
+    // Custom from strokes alone; bad edits are errors.
+    let p = plan(json!({"sampling": "custom", "samplingStrokes": [{"mode": "add", "size": 20, "points": [[100, 100], [160, 100]]}]})).unwrap();
+    assert!((1450..1600).contains(&count(&p.source)), "a 20 px brush along 60 px: {}", count(&p.source));
+    for bad in [
+        json!({"samplingStrokes": [{"mode": "paint", "size": 10, "points": [[0, 0]]}]}),
+        json!({"samplingStrokes": [{"size": 0, "points": [[0, 0]]}]}),
+        json!({"fillEdits": [{"op": "add", "points": [[0, "x"]]}]}),
+        json!({"fillEdits": [{"op": "expand", "by": -3}]}),
+    ] {
+        assert!(plan(bad.clone()).is_err(), "{bad}");
+    }
+    // The command fills with the same plan; `layer` names the layer even when another is active.
+    let r = s.execute("edit.contentAwareFill", json!({"sampling": "rectangular", "fillEdits": [{"op": "expand", "by": 2}], "layer": id.0})).unwrap();
+    assert!(r["filled"].as_u64().unwrap() > 2800);
+}
+
 #[test]
 fn content_aware_fill_outputs_and_sampling() {
     let mut s = blob_session(8);
@@ -427,6 +473,35 @@ fn define_custom_shape_and_preset_manager() {
     assert!(t.execute("edit.presets.exportImportPresets", json!({"action": "import", "data": {"format": "other"}})).is_err());
 }
 
+#[test]
+fn preset_manager_brush_rename_follows_current_preset() {
+    let mut s = Session::new();
+    s.execute("brush.presets.setCurrent", json!({"name": "Chalk"})).unwrap();
+    s.execute("edit.presets.presetManager", json!({"action": "rename", "kind": "brushes", "name": "Chalk", "newName": "Chalky"})).unwrap();
+    assert_eq!(s.tools.current_preset.as_deref(), Some("Chalky"));
+    s.execute("brush.presets.update", json!({})).unwrap();
+}
+
+#[test]
+fn preset_manager_brush_rename_refuses_duplicate_name() {
+    let mut s = Session::new();
+    let before: Vec<String> = s.tools.presets.iter().map(|b| b.name.clone()).collect();
+    let r = s.execute("edit.presets.presetManager", json!({"action": "rename", "kind": "brushes", "name": "Soft Round", "newName": "hard round"}));
+    assert!(r.is_err(), "a case-insensitive duplicate name must be refused");
+    assert_eq!(s.tools.presets.iter().map(|b| b.name.clone()).collect::<Vec<_>>(), before);
+    // Renaming to a different case of its own name is fine.
+    s.execute("edit.presets.presetManager", json!({"action": "rename", "kind": "brushes", "name": "Soft Round", "newName": "soft round"})).unwrap();
+}
+
+#[test]
+fn preset_manager_brush_delete_clears_current_preset() {
+    let mut s = Session::new();
+    s.execute("brush.presets.setCurrent", json!({"name": "Chalk"})).unwrap();
+    s.execute("edit.presets.presetManager", json!({"action": "delete", "kind": "brushes", "name": "Chalk"})).unwrap();
+    assert!(!s.tools.presets.iter().any(|b| b.name == "Chalk"));
+    assert_eq!(s.tools.current_preset, None);
+}
+
 #[test]
 fn define_brush_preset_wraps_define_from_selection() {
     let mut s = session(8);
diff --git a/crates/engine/src/exr_cmds.rs b/crates/engine/src/exr_cmds.rs
index 908942d4fd..5fbc355314 100644
--- a/crates/engine/src/exr_cmds.rs
+++ b/crates/engine/src/exr_cmds.rs
@@ -52,7 +52,8 @@ fn open_exr_parts(s: &mut Session, p: &Value) -> Result<Value> {
         precomp: p.get("precomp").and_then(Value::as_bool).unwrap_or(false),
     };
     let bytes = read_file(&path)?;
-    let r = photocraft_io::exr_parts::import(&stem(&path), &bytes, &sel).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
+    let mut r = photocraft_io::exr_parts::import(&stem(&path), &bytes, &sel).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
+    crate::file_cmds::tag_exr_colorspace(s, &path, &mut r.document);
     let (i, color) = s.open_document(r.document, Some(path.clone()));
     Ok(json!({"document": i, "color": color, "warnings": r.warnings}))
 }
@@ -173,6 +174,25 @@ mod tests {
         std::fs::remove_dir_all(&dir).unwrap();
     }
 
+    /// File Handling › "Open color-less EXR as ACEScg" applies to Open EXR Parts too.
+    #[test]
+    fn open_exr_parts_honours_the_aces_cg_preference() {
+        let dir = std::env::temp_dir().join(format!("pcraft-exr-aces-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("aov.exr");
+        write_multipart(&path);
+        let linear = photocraft_cms::Builtin::LinearSrgb.profile().to_bytes();
+        let aces = photocraft_cms::Builtin::AcesCg.profile().to_bytes();
+        for (on, want) in [(false, &linear), (true, &aces)] {
+            let mut s = session();
+            s.prefs.edit(|p| p.file_handling.exr_aces_cg = on);
+            s.execute("file.openExrParts", json!({"path": path.to_str().unwrap(), "part/beauty": true})).unwrap();
+            let doc = &s.active().unwrap().doc;
+            assert_eq!(doc.icc_profile.as_deref().map(|v| v.as_slice()), Some(want.as_slice()), "exr_aces_cg = {on}");
+        }
+        std::fs::remove_dir_all(&dir).unwrap();
+    }
+
     #[test]
     fn open_exr_parts_refuses_an_empty_selection_and_unknown_names() {
         let dir = std::env::temp_dir().join(format!("pcraft-exr-empty-{}", std::process::id()));
diff --git a/crates/engine/src/extra_cmds.rs b/crates/engine/src/extra_cmds.rs
index 3a27c99be3..e75b2347a3 100644
--- a/crates/engine/src/extra_cmds.rs
+++ b/crates/engine/src/extra_cmds.rs
@@ -335,15 +335,18 @@ fn clouds(s: &mut Session, p: &Value, difference: bool) -> Result<Value> {
 const TRANSFORM_TARGET: &str =
     r#"{"target":"pixels"|"mask"|"quickMask"|{"channel":i}=Channels panel target (an unlinked mask, an alpha channel or the Quick Mask turns alone)}"#;
 
+/// Flips and turns about the centre of the box Free Transform would open: with a selection
+/// limiting the transform it is the selection's own bounds, as in Photoshop, so Select All
+/// mirrors across the canvas (#6928); otherwise the content's bounds.
 fn transform_preset(s: &mut Session, p: &Value, kind: &str) -> Result<Value> {
     let d = s.active().ok_or(EngineError::NoDocument)?;
     // A targeted alpha channel, the Quick Mask or an unlinked layer mask turns by itself (#2835).
     let (b, mut params) = match crate::transform_cmds::lone_target(&d.doc, d.active_layer, p)? {
-        Some(surf) => (crate::transform_cmds::target_bounds(&d.doc, surf), json!({"target": p.get("target")})),
+        Some(surf) => (crate::transform_cmds::target_frame(&d.doc, surf), json!({"target": p.get("target")})),
         None => {
             let id = d.active_layer.ok_or(EngineError::Other("no active layer".into()))?;
             let l = d.doc.layer(id).ok_or(EngineError::NoLayer(id))?;
-            (crate::transform_cmds::transform_bounds(&d.doc, l), json!({"layer": id.0}))
+            (crate::transform_cmds::transform_frame(&d.doc, l), json!({"layer": id.0}))
         }
     };
     if b.is_empty() {
@@ -522,11 +525,16 @@ fn delete_where(s: &mut Session, label: &str, pred: fn(&Layer) -> bool) -> Resul
             n
         }
         let backup = doc.layers.clone();
+        // The clip groups of the doomed layers, read before they go (clip_group rule 3: layers
+        // clipped to a deleted base are released).
+        let doomed: Vec<LayerId> = doc.walk().into_iter().filter(|(_, _, l)| pred(l)).map(|(_, _, l)| l.id).collect();
+        let before = crate::clip_group::Before::read(doc, &doomed);
         let n = rec(&mut doc.layers, pred);
         if doc.layers.is_empty() {
             doc.layers = backup;
             return Err(EngineError::Other("a document must keep at least one layer".into()));
         }
+        crate::clip_group::settle(doc, &[], &before, false);
         if active.is_none_or(|id| doc.layer(id).is_none()) {
             *active = doc.top_layer();
         }
@@ -878,8 +886,17 @@ pub fn specs() -> Vec<CommandSpec> {
         ),
         spec!("layer.layerStyle.copyLayerStyle", "Copy Layer Style", &["Layer", "Layer Style"], None, r##"{"layer":id?}"##, has_layer, |s, p| {
             let id = layer_param(s, p)?;
-            let l = s.active().and_then(|d| d.doc.layer(id)).ok_or(EngineError::NoLayer(id))?;
-            let style = (l.effects.clone(), l.blend, l.fill_opacity, l.advanced);
+            let d = s.active().ok_or(EngineError::NoDocument)?;
+            let l = d.doc.layer(id).ok_or(EngineError::NoLayer(id))?;
+            let style = crate::CopiedStyle {
+                effects: l.effects.clone(),
+                blend: l.blend,
+                fill: l.fill_opacity,
+                advanced: l.advanced,
+                blend_if: l.blend_if.clone(),
+                excluded_channels: l.excluded_channels,
+                mode: d.doc.mode,
+            };
             s.style_clipboard = Some(style);
             Ok(Value::Null)
         }),
@@ -895,17 +912,38 @@ pub fn specs() -> Vec<CommandSpec> {
             },
             |s, p| {
                 let ids = style_targets(s, p, |_| true)?;
-                let (mut fx, blend, fill, advanced) = s.style_clipboard.clone().ok_or(EngineError::Other("no layer style has been copied".into()))?;
+                let style = s.style_clipboard.clone().ok_or(EngineError::Other("no layer style has been copied".into()))?;
+                let mut fx = style.effects;
                 s.edit("Paste Layer Style", |doc, _| {
                     // A style copied from a document in another mode takes this one's colours.
                     let mode = doc.mode;
                     fx.items = std::mem::take(&mut fx.items).into_iter().map(|e| e.in_mode(mode)).collect();
+                    // Blend If's Gray range carries over to any mode; its channel ranges and the
+                    // channel restrictions only to the mode they were set in.
+                    let same_mode = style.mode == mode;
+                    let blend_if = if same_mode {
+                        style.blend_if.clone()
+                    } else {
+                        // Through `set`, which keeps the normalised form (no trailing full
+                        // entries), so a full Gray range pastes as the default.
+                        let mut gray = photocraft_doc::BlendIf::default();
+                        gray.set(0, style.blend_if.get(0));
+                        gray
+                    };
                     for id in ids {
                         let l = doc.layer_mut(id).ok_or(EngineError::NoLayer(id))?;
                         l.effects = fx.clone();
-                        l.blend = blend;
-                        l.fill_opacity = fill;
-                        l.advanced = advanced;
+                        // Pass Through is a group's mode: a group's style pastes onto other layers as
+                        // Normal, as a merged group's Pass Through becomes Normal.
+                        l.blend = if style.blend == photocraft_color::BlendMode::PassThrough && !l.is_group() {
+                            photocraft_color::BlendMode::Normal
+                        } else {
+                            style.blend
+                        };
+                        l.fill_opacity = style.fill;
+                        l.advanced = style.advanced;
+                        l.blend_if = blend_if.clone();
+                        l.excluded_channels = if same_mode { style.excluded_channels } else { 0 };
                     }
                     Ok(())
                 })?;
@@ -1434,6 +1472,49 @@ mod tests {
         assert_eq!(pixel(&s, 10, 10), vec![0.0, 1.0, 0.0, 1.0]);
     }
 
+    /// #6928: with a selection, the presets flip and turn about the selection's own bounds, as
+    /// in Photoshop: Select All mirrors across the canvas, a marquee across its own centre.
+    /// Without a selection they keep turning about the content (above).
+    #[test]
+    fn transform_presets_turn_about_the_selection() {
+        let mut s = session(8);
+        paint_square(&mut s, Rect::new(10, 10, 20, 14), [1.0, 0.0, 0.0, 1.0]);
+        paint_square(&mut s, Rect::new(10, 10, 11, 11), [0.0, 1.0, 0.0, 1.0]);
+        let green = vec![0.0, 1.0, 0.0, 1.0];
+        // Select All on the 40 × 30 canvas: across the canvas's centre lines.
+        s.execute("select.all", json!({})).unwrap();
+        let past = s.active().unwrap().history.past_len();
+        s.execute("edit.transform.flipHorizontal", json!({})).unwrap();
+        assert_eq!(active(&s).surface().unwrap().content_bounds(), Rect::new(20, 10, 30, 14));
+        assert_eq!(pixel(&s, 29, 10), green);
+        assert_eq!(s.active().unwrap().history.past_len(), past + 1, "one undo step");
+        s.execute("edit.transform.flipVertical", json!({})).unwrap();
+        assert_eq!(active(&s).surface().unwrap().content_bounds(), Rect::new(20, 16, 30, 20));
+        assert_eq!(pixel(&s, 29, 19), green);
+        s.execute("edit.transform.rotate180", json!({})).unwrap();
+        assert_eq!(active(&s).surface().unwrap().content_bounds(), Rect::new(10, 10, 20, 14));
+        assert_eq!(pixel(&s, 10, 10), green);
+        // A marquee (0, 0)–(24, 30) holding the whole square: across x = 12.
+        s.execute("select.rect", json!({"x": 0, "y": 0, "width": 24, "height": 30})).unwrap();
+        s.execute("edit.transform.flipHorizontal", json!({})).unwrap();
+        assert_eq!(active(&s).surface().unwrap().content_bounds(), Rect::new(4, 10, 14, 14));
+        assert_eq!(pixel(&s, 13, 10), green);
+        // Undo puts it back where it was.
+        s.undo();
+        assert_eq!(active(&s).surface().unwrap().content_bounds(), Rect::new(10, 10, 20, 14));
+        // A targeted alpha channel turns about the selection's bounds too.
+        s.execute("channel.new", json!({})).unwrap();
+        s.edit("paint channel", |doc, _| {
+            doc.channels[0].surface.fill_rect(Rect::new(10, 10, 20, 20), &[1.0]);
+            Ok(())
+        })
+        .unwrap();
+        s.execute("channel.target", json!({"channel": 0})).unwrap();
+        s.execute("select.all", json!({})).unwrap();
+        s.execute("edit.transform.flipHorizontal", json!({})).unwrap();
+        assert_eq!(s.active().unwrap().doc.channels[0].surface.content_bounds(), Rect::new(20, 10, 30, 20));
+    }
+
     #[test]
     fn reselect_restores_the_last_selection() {
         let mut s = session(8);
diff --git a/crates/engine/src/face_cmds.rs b/crates/engine/src/face_cmds.rs
new file mode 100644
index 0000000000..d48df95b84
--- /dev/null
+++ b/crates/engine/src/face_cmds.rs
@@ -0,0 +1,115 @@
+//! Face detection (#3603): the faces in the document, with their box and five landmarks, from
+//! [`photocraft_algo::faces`]. Select › Color Range's Detect Faces and Face-Aware Liquify read
+//! faces through [`faces_in`]; `image.detectFaces` reports them to scripts and agents.
+
+use photocraft_algo::faces::{self, Face};
+use photocraft_doc::{Document, LayerId};
+use serde_json::{Value, json};
+
+use crate::commands::CommandSpec;
+use crate::{EngineError, Result, Session};
+
+/// Faces scoring below this are left out unless asked for (libfacedetection's own threshold for a
+/// reliable face).
+pub const MIN_SCORE: f32 = 0.5;
+
+/// Why there are no faces in the browser build (see [`photocraft_algo::faces`]).
+const UNAVAILABLE: &str = "face detection isn't available in the browser version of PhotoCraft; use the desktop app";
+
+/// The faces in `px` (`w × h` straight RGBA), as [`faces::detect`] finds them.
+pub fn detect(px: &[[f32; 4]], w: usize, h: usize, min_score: f32) -> Result<Vec<Face>> {
+    if !faces::AVAILABLE {
+        return Err(EngineError::Other(UNAVAILABLE.into()));
+    }
+    faces::detect(px, w, h, min_score).ok_or_else(|| EngineError::Other("face detection failed".into()))
+}
+
+/// The faces in `doc`, best first: in the composite, or in the active layer's pixels when
+/// `all_layers` is off. Coordinates are document pixels.
+pub fn faces_in(doc: &Document, active: Option<LayerId>, all_layers: bool, min_score: f32) -> Result<Vec<Face>> {
+    let area = doc.bounds();
+    let (w, h) = (area.width() as usize, area.height() as usize);
+    let surface = active.and_then(|id| doc.layer(id)).and_then(|l| l.surface()).filter(|_| !all_layers);
+    let px = match surface {
+        Some(surf) => {
+            let mut px = vec![[0.0f32; 4]; w * h];
+            surf.read_rgba_into(area, &mut px);
+            px
+        }
+        None => photocraft_compose::render(doc, area).px,
+    };
+    let found = detect(&px, w, h, min_score)?;
+    let (x0, y0) = (area.x0 as f32, area.y0 as f32);
+    Ok(found
+        .into_iter()
+        .map(|f| Face { rect: [f.rect[0] + x0, f.rect[1] + y0, f.rect[2], f.rect[3]], landmarks: f.landmarks.map(|[x, y]| [x + x0, y + y0]), ..f })
+        .collect())
+}
+
+fn face_json(f: &Face) -> Value {
+    let pt = |i: usize| json!([f.landmarks[i][0], f.landmarks[i][1]]);
+    json!({
+        "score": f.score,
+        "rect": f.rect,
+        "landmarks": {"rightEye": pt(0), "leftEye": pt(1), "nose": pt(2), "mouthRight": pt(3), "mouthLeft": pt(4)},
+    })
+}
+
+fn detect_faces(s: &mut Session, p: &Value) -> Result<Value> {
+    const CMD: &str = "image.detectFaces";
+    let bad = |msg: &str| EngineError::BadParams { cmd: CMD.into(), msg: msg.into() };
+    let min_score = match p.get("minScore") {
+        None => MIN_SCORE,
+        Some(v) => v.as_f64().filter(|v| (0.0..=1.0).contains(v)).ok_or_else(|| bad("minScore must be a number in 0..1"))? as f32,
+    };
+    let all_layers = match p.get("sampleAllLayers") {
+        None => true,
+        Some(v) => v.as_bool().ok_or_else(|| bad("sampleAllLayers must be true or false"))?,
+    };
+    let d = s.active().ok_or(EngineError::NoDocument)?;
+    let found = faces_in(&d.doc, d.active_layer, all_layers, min_score)?;
+    Ok(json!({ "faces": found.iter().map(face_json).collect::<Vec<_>>() }))
+}
+
+pub fn specs() -> Vec<CommandSpec> {
+    vec![CommandSpec {
+        id: "image.detectFaces",
+        label: "Detect Faces",
+        menu: &[],
+        shortcut: None,
+        params: r##"{"minScore":0..1=0.5,"sampleAllLayers":bool=true} → {"faces":[{"score","rect":[x,y,w,h],"landmarks":{"rightEye","leftEye","nose","mouthRight","mouthLeft"}: [x,y] each},…]} (best first; "rightEye" is the one on the image's left)"##,
+        enabled: |s| {
+            if !faces::AVAILABLE {
+                return Err(UNAVAILABLE.into());
+            }
+            s.active().map(|_| ()).ok_or_else(|| "no document open".into())
+        },
+        run: detect_faces,
+        journal: false,
+    }]
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use crate::Session;
+
+    #[test]
+    fn detect_faces_reports_no_faces_on_a_plain_image_and_validates_params() {
+        let mut s = Session::new();
+        assert!(s.execute("image.detectFaces", json!({})).is_err(), "no document");
+        assert!(!s.is_enabled("image.detectFaces"));
+        s.execute("file.new", json!({"width": 64, "height": 48, "background": "white"})).unwrap();
+        assert!(s.is_enabled("image.detectFaces"));
+        s.execute("select.all", json!({})).unwrap();
+        assert_eq!(s.execute("image.detectFaces", json!({})).unwrap(), json!({"faces": []}));
+        assert_eq!(s.execute("image.detectFaces", json!({"minScore": 0, "sampleAllLayers": false})).unwrap(), json!({"faces": []}));
+        // No history step of its own: Undo undoes the Select All before it.
+        s.execute("edit.undo", json!({})).unwrap();
+        assert!(s.active().unwrap().doc.selection.is_none());
+        for bad in [json!({"minScore": 2}), json!({"minScore": "high"}), json!({"sampleAllLayers": 1})] {
+            assert!(s.execute("image.detectFaces", bad.clone()).is_err(), "{bad}");
+        }
+    }
+}
diff --git a/crates/engine/src/file_cmds.rs b/crates/engine/src/file_cmds.rs
index 43828b76b1..f99aefcff0 100644
--- a/crates/engine/src/file_cmds.rs
+++ b/crates/engine/src/file_cmds.rs
@@ -219,6 +219,40 @@ pub(crate) fn stem(path: &str) -> String {
     }
 }
 
+/// Whether `a` and `b` name the same file: the same text, or, when both exist, the same file on
+/// disk (a hard link, a different case on a case-insensitive volume, `./` or `..` in one of them).
+pub fn same_file(a: &str, b: &str) -> bool {
+    if a == b {
+        return true;
+    }
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::MetadataExt;
+        if let (Ok(x), Ok(y)) = (std::fs::metadata(a), std::fs::metadata(b)) {
+            return x.dev() == y.dev() && x.ino() == y.ino();
+        }
+    }
+    #[cfg(windows)]
+    {
+        // NTFS and FAT compare names without case.
+        if let (Ok(x), Ok(y)) = (std::fs::canonicalize(a), std::fs::canonicalize(b)) {
+            return x.to_string_lossy().to_lowercase() == y.to_string_lossy().to_lowercase();
+        }
+    }
+    false
+}
+
+/// A path as command results report it: `/` between components, whatever the platform.
+///
+/// `join` already builds with `/`, but a directory from the caller or from `std::path::absolute`
+/// carries the native separator, which would leave a reported path mixed. The control channel
+/// takes `/` and rejects alternate separators (`AuthorizedWorkspace` in `crates/automation`), so
+/// a result spelt this way can be handed straight back to it. Verbatim and UNC prefixes keep
+/// theirs: Win32 does not accept `/` after a leading `\\`.
+pub(crate) fn forward_slashes(path: String) -> String {
+    if path.starts_with(r"\\") { path } else { path.replace('\\', "/") }
+}
+
 pub(crate) fn join(dir: &str, name: &str) -> String {
     if dir.is_empty() {
         name.to_string()
@@ -340,6 +374,8 @@ pub(crate) fn encode(doc: &Document, path: &str, save: impl Into<SaveOpts>) -> R
         tga_bits: save.tga_bits,
         image_previews: save.image_previews,
         psd_maximize_compatibility: save.psd_maximize_compatibility,
+        // Linked files a PSD embeds are resolved against the document being worked on.
+        document_path: crate::doc_path::current(),
         ..Default::default()
     };
     // No quality chosen: write the file the way it was opened (a JPEG at its own quality, a WebP
@@ -461,7 +497,7 @@ fn save_a_copy(s: &mut Session, p: &Value) -> Result<Value> {
 /// With File Handling's ACEScg option on, such an EXR opens as ACEScg instead (AP1,
 /// linear) — the working space ACES render pipelines write. Only the io default is
 /// replaced; an embedded or EXIF-declared profile is kept untouched.
-fn tag_exr_colorspace(s: &Session, name: &str, doc: &mut Document) {
+pub(crate) fn tag_exr_colorspace(s: &Session, name: &str, doc: &mut Document) {
     if !name.to_ascii_lowercase().ends_with(".exr") || !s.prefs.get().file_handling.exr_aces_cg {
         return;
     }
@@ -578,7 +614,16 @@ fn place(s: &mut Session, p: &Value, linked: bool) -> Result<Value> {
     let cmd = if linked { "file.placeLinked" } else { "file.placeEmbedded" };
     let path = str_param(p, "path", cmd)?.to_string();
     let bytes = read_file(&path)?;
-    place_bytes(s, &path, bytes, linked.then(|| path.clone()), p)
+    // The link is stored absolute: a relative one would later be taken from the document's
+    // folder (`doc_path`), not the working directory the path was given in.
+    let link = linked.then(|| {
+        if std::path::Path::new(&path).is_relative() {
+            std::path::absolute(&path).map_or_else(|_| path.clone(), |a| a.to_string_lossy().into_owned())
+        } else {
+            path.clone()
+        }
+    });
+    place_bytes(s, &path, bytes, link, p)
 }
 
 // ---------- File Info (XMP) ----------
@@ -1432,7 +1477,7 @@ fn bake_cube_layers(size: usize, title: &str, layers: &[&Layer]) -> String {
         lattice.layers.push(a);
     }
     let out = photocraft_compose::flatten(&lattice);
-    let mut s = format!("TITLE \"{}\"\n# Created by Photocraft\nLUT_3D_SIZE {n}\nDOMAIN_MIN 0.0 0.0 0.0\nDOMAIN_MAX 1.0 1.0 1.0\n", title.replace('"', "'"));
+    let mut s = format!("TITLE \"{}\"\n# Created by PhotoCraft\nLUT_3D_SIZE {n}\nDOMAIN_MIN 0.0 0.0 0.0\nDOMAIN_MAX 1.0 1.0 1.0\n", title.replace('"', "'"));
     // .cube order: red changes fastest, then green, then blue.
     for b in 0..n {
         for g in 0..n {
@@ -1761,4 +1806,38 @@ mod aces_exr_tests {
         let d = &s.active().unwrap().doc;
         assert_eq!(d.icc_profile.as_deref().map(|v| v.as_slice()), Some(aces.as_slice()));
     }
+
+    /// The desktop app opens files as background jobs (File > Open, drag-drop, Open Recent):
+    /// the ACEScg preference applies there too, not only to `file.openAs`.
+    #[test]
+    fn exr_aces_cg_preference_applies_to_background_opens() {
+        use crate::jobs::{OpenSource, Started};
+        let image = photocraft_codecs::Image::from_f32(4, 4, photocraft_codecs::ChannelLayout::Rgb, &[0.5; 48]).unwrap();
+        let bytes =
+            std::sync::Arc::new(photocraft_codecs::encode(&image, photocraft_codecs::Format::OpenExr, &photocraft_codecs::EncodeOptions::default()).unwrap());
+        let linear = photocraft_cms::Builtin::LinearSrgb.profile().to_bytes();
+        let aces = photocraft_cms::Builtin::AcesCg.profile().to_bytes();
+        for (on, want) in [(false, &linear), (true, &aces)] {
+            let mut s = Session::new();
+            s.prefs.edit(|p| p.file_handling.exr_aces_cg = on);
+            let v = match s.start_open("shot.exr", OpenSource::Bytes(std::sync::Arc::clone(&bytes))).unwrap() {
+                Started::Job(id) => s.wait_job(id).unwrap(),
+                Started::Done(v) => v,
+            };
+            // ACEScg isn't the working space, so Ask When Opening holds it for the prompt, which
+            // names the ACEScg profile; linear sRGB (io's HDR default) opens without asking.
+            let profile = match v.get("held").and_then(Value::as_u64) {
+                Some(held) => {
+                    assert!(on, "{v}");
+                    assert!(v["color"]["embedded"].as_str().unwrap().starts_with("ACEScg"), "{v}");
+                    s.take_held_open(held).unwrap().0.icc_profile
+                }
+                None => {
+                    assert!(v.get("document").is_some(), "{v}");
+                    s.active().unwrap().doc.icc_profile.clone()
+                }
+            };
+            assert_eq!(profile.as_deref().map(|v| v.as_slice()), Some(want.as_slice()), "exr_aces_cg = {on}");
+        }
+    }
 }
diff --git a/crates/engine/src/file_cmds/tests.rs b/crates/engine/src/file_cmds/tests.rs
index 3cc72c30c4..624edfdd3f 100644
--- a/crates/engine/src/file_cmds/tests.rs
+++ b/crates/engine/src/file_cmds/tests.rs
@@ -1033,7 +1033,7 @@ fn reveal_in_finder_reveals_the_documents_saved_path() {
     let path = "/tmp/pics/a.psd";
     s.active_mut().unwrap().path = Some(path.into());
     let r = s.execute("file.revealInFinder", json!({"dryRun": true})).unwrap();
-    let (program, args) = crate::layer_menu_cmds::reveal_command(path);
+    let (program, args) = crate::layer_menu_cmds::reveal_command(path).unwrap();
     assert_eq!(r["program"], json!(program));
     assert_eq!(r["args"], json!(args));
     // The tab menu names a background tab: the active document is not the one revealed.
diff --git a/crates/engine/src/fill_cmds.rs b/crates/engine/src/fill_cmds.rs
index 2aa0a02bdc..b636dd441b 100644
--- a/crates/engine/src/fill_cmds.rs
+++ b/crates/engine/src/fill_cmds.rs
@@ -334,30 +334,6 @@ pub(crate) fn read_window(surf: &Surface, r: Rect, cancelled: &(dyn Fn() -> bool
     if cancelled() { None } else { Some(out) }
 }
 
-/// Which pixels of `r` a selection (or mask) covers at all: channel 0 above zero, read in
-/// parallel bands as [`read_window`] does, without holding the coverage itself.
-pub(crate) fn read_window_cover(surf: &Surface, r: Rect, cancelled: &(dyn Fn() -> bool + Sync)) -> Option<Vec<bool>> {
-    use rayon::prelude::*;
-    const BAND: usize = 64;
-    let n = surf.channels().max(1);
-    let (w, h) = (r.width() as usize, r.height() as usize);
-    let mut out = vec![false; w * h];
-    if out.is_empty() {
-        return Some(out);
-    }
-    out.par_chunks_mut(BAND * w).enumerate().for_each_init(Vec::new, |buf, (i, chunk)| {
-        if cancelled() {
-            return;
-        }
-        let y0 = r.y0 + (i * BAND) as i32;
-        surf.read_region_into(Rect::new(r.x0, y0, r.x1, y0 + (chunk.len() / w) as i32), buf);
-        for (o, px) in chunk.iter_mut().zip(buf.chunks_exact(n)) {
-            *o = px[0] > 0.0;
-        }
-    });
-    if cancelled() { None } else { Some(out) }
-}
-
 /// Channel 0 of [`read_window`] (a selection's or an alpha channel's coverage).
 pub(crate) fn read_window_mask(surf: &Surface, r: Rect, cancelled: &(dyn Fn() -> bool + Sync)) -> Option<Vec<f32>> {
     use rayon::prelude::*;
diff --git a/crates/engine/src/filters.rs b/crates/engine/src/filters.rs
index 9cd6ff4600..e40be7b6ac 100644
--- a/crates/engine/src/filters.rs
+++ b/crates/engine/src/filters.rs
@@ -174,8 +174,9 @@ pub fn params_for(id: &str, p: &Value) -> Option<FilterParams> {
 /// Runs filter command `id` with JSON `params` on `surf` (the pixel function behind every
 /// `filter.*` command; smart filters re-run it on re-render). `bounds` frames distortions;
 /// `selection` limits the result. Like layer filters, neighbourhood filters repeat the edge pixels
-/// of `canvas` ∪ the surface's content instead of fading in transparency, and the output is
-/// clipped to it. `None` for ids that aren't pixel filters.
+/// `None` for ids that aren't pixel filters. `Err` when the requesting session's authority denies
+/// the filter's params (an ambient path the session may not read): the caller must surface the
+/// error rather than render unfiltered pixels.
 pub fn apply_filter_to_surface(
     id: &str,
     params: &Value,
@@ -183,31 +184,36 @@ pub fn apply_filter_to_surface(
     bounds: photocraft_geom::Rect,
     selection: Option<&photocraft_raster::Surface>,
     canvas: photocraft_geom::Rect,
-) -> Option<photocraft_raster::Surface> {
+) -> Result<Option<photocraft_raster::Surface>> {
+    // Replays bypass command dispatch; nested paths must still obey the requesting session's
+    // authority, including adjustment LUTs and plug-ins, before any resolver can read them.
+    crate::jobs::authorize_render_command(id, params)?;
     // Liquify / Puppet Warp / Perspective Warp smart filters (distort_cmds).
     if let Some(out) = crate::distort_cmds::apply_to_surface(id, params, surf, canvas) {
-        return Some(out);
+        return Ok(Some(out));
     }
     // Lens Correction / Adaptive Wide Angle / Camera Raw smart filters (lens_cmds).
     if let Some(out) = crate::lens_cmds::apply_to_surface(id, params, surf, canvas) {
-        return Some(out);
+        return Ok(Some(out));
     }
     // Image › Adjustments recorded as smart filters (Levels, Curves, Shadows/Highlights… from PSD).
     if let Some(kind) = id.strip_prefix("image.adjustments.") {
-        return crate::adjust_cmds::adjust_as_filter(kind, params, surf);
+        return Ok(crate::adjust_cmds::adjust_as_filter(kind, params, surf));
     }
     // WebAssembly plug-in smart filters (plugin_cmds).
     if id == crate::plugin_cmds::RUN {
-        return crate::plugin_cmds::apply_to_surface(id, params, surf, selection, canvas);
+        return Ok(crate::plugin_cmds::apply_to_surface(id, params, surf, selection, canvas));
     }
-    let mut fp = params_for(id, params)?;
+    let Some(mut fp) = params_for(id, params) else { return Ok(None) };
     // A map that can no longer be read (moved or deleted since) leaves the pixels alone, like an
     // unknown filter; the command itself already refused an unreadable map when it was added.
-    crate::filters_ext::resolve_map_path(&mut fp, params).ok()?;
+    if crate::filters_ext::resolve_map_path(&mut fp, params).is_err() {
+        return Ok(None);
+    }
     let sel_bounds = selection.map(photocraft_raster::Surface::content_bounds);
     let content = surf.content_bounds();
     let area = algo::output_area(&fp, content, bounds, sel_bounds);
-    Some(algo::apply_in(surf, &fp, area, bounds, selection, canvas.union(&content)))
+    Ok(Some(algo::apply_in(surf, &fp, area, bounds, selection, canvas.union(&content))))
 }
 
 pub(crate) fn has_filterable_layer(s: &Session) -> std::result::Result<(), String> {
diff --git a/crates/engine/src/filters_ext.rs b/crates/engine/src/filters_ext.rs
index dae5e9b98b..e4f6523a19 100644
--- a/crates/engine/src/filters_ext.rs
+++ b/crates/engine/src/filters_ext.rs
@@ -466,13 +466,15 @@ fn map_from_path(path: &str, layer: Option<u64>) -> Result<Option<algo::Image>>
 
 /// The session-free part of [`resolve`]: Displace's `mapPath`. Smart filters record params, not
 /// the map, so their re-render reads the map again here; without it the filter passed the pixels
-/// through. `mapDocument` needs the session and is left unresolved.
+/// through. The path is stored in the document, so it is followed only as
+/// [`crate::doc_path::resolve`] allows. `mapDocument` needs the session and is left unresolved.
 pub(crate) fn resolve_map_path(fp: &mut FilterParams, p: &Value) -> Result<()> {
     if let FilterParams::Displace { map, .. } = fp
         && map.is_none()
         && let Some(path) = map_path(p)
     {
-        *map = map_from_path(path, p.get("mapLayer").and_then(Value::as_u64))?.map(Arc::new);
+        let file = crate::doc_path::resolve(path).map_err(|why| crate::doc_path::refusal("the displacement map", path, why))?;
+        *map = map_from_path(&file.to_string_lossy(), p.get("mapLayer").and_then(Value::as_u64))?.map(Arc::new);
     }
     Ok(())
 }
diff --git a/crates/engine/src/jobs.rs b/crates/engine/src/jobs.rs
index 527bc6f22b..b30e56da3a 100644
--- a/crates/engine/src/jobs.rs
+++ b/crates/engine/src/jobs.rs
@@ -29,6 +29,43 @@ use serde_json::{Value, json};
 
 use crate::{EngineError, Result, Session};
 
+type Authorization = fn(&str, &Value) -> Result<()>;
+
+thread_local! {
+    // Smart-filter rendering has no Session argument. Carry the requesting session's gate
+    // through synchronous rendering and explicitly reinstall it on background workers.
+    static RENDER_AUTHORIZATION: std::cell::Cell<Option<Authorization>> = const { std::cell::Cell::new(None) };
+}
+
+pub(crate) struct AuthorizationScope(Option<Authorization>);
+
+impl AuthorizationScope {
+    fn enter(gate: Option<Authorization>) -> Self {
+        Self(RENDER_AUTHORIZATION.with(|current| current.replace(gate.or(current.get()))))
+    }
+}
+
+impl Drop for AuthorizationScope {
+    fn drop(&mut self) {
+        RENDER_AUTHORIZATION.with(|current| current.set(self.0));
+    }
+}
+
+/// [`AuthorizationScope`] entered with `gate` (or the one already installed, so trusted work on
+/// this thread keeps ambient paths usable). [`Session::edit`] and the job paths use this to carry
+/// the requesting session's authority into every smart-object re-render.
+pub(crate) fn render_authorization_scope(gate: Option<Authorization>) -> AuthorizationScope {
+    AuthorizationScope::enter(gate)
+}
+
+/// Recheck a stored filter's command and parameters before evaluating it or using its cache.
+pub(crate) fn authorize_render_command(id: &str, params: &Value) -> Result<()> {
+    match RENDER_AUTHORIZATION.with(std::cell::Cell::get) {
+        Some(gate) => gate(id, params),
+        None => Ok(()),
+    }
+}
+
 /// Identifies one background job for the session's lifetime.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, serde::Deserialize)]
 pub struct JobId(pub u64);
@@ -284,6 +321,11 @@ pub fn run<T: Send + 'static>(
     work: impl FnOnce(&JobCtx) -> Result<T> + Send + 'static,
     apply: impl FnOnce(&mut Session, T) -> Result<Value> + Send + 'static,
 ) -> Result<Value> {
+    let authorization = s.authorize.or_else(|| RENDER_AUTHORIZATION.with(std::cell::Cell::get));
+    let _authorization = AuthorizationScope::enter(authorization);
+    // The job's document: stored paths it follows are resolved against it on any thread.
+    let document = s.active().and_then(|d| d.path.as_deref()).map(std::path::PathBuf::from);
+    let _document = crate::doc_path::scope(document.as_deref());
     if !s.jobs.spawn || cfg!(target_arch = "wasm32") {
         let t = work(&s.jobs.inline.clone().unwrap_or_default())?;
         return apply(s, t);
@@ -298,7 +340,10 @@ pub fn run<T: Send + 'static>(
     };
     let ctx = JobCtx::new();
     let (tx, rx) = std::sync::mpsc::channel::<Result<Payload>>();
+    let apply_document = document.clone();
     let erased: Apply = Box::new(move |s, any| {
+        let _authorization = AuthorizationScope::enter(authorization);
+        let _document = crate::doc_path::scope(apply_document.as_deref());
         let t = any.downcast::<T>().map_err(|_| EngineError::Other("internal error: job result type mismatch".into()))?;
         apply(s, *t)
     });
@@ -311,6 +356,8 @@ pub fn run<T: Send + 'static>(
         // The work closure is moved into the thread. If spawning fails (thread limits), there is
         // no way to get it back, so the error is reported instead.
         let spawned = std::thread::Builder::new().name(format!("photocraft-job-{}", id.0)).spawn(move || {
+            let _authorization = AuthorizationScope::enter(authorization);
+            let _document = crate::doc_path::scope(document.as_deref());
             let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| work(&wctx).map(|t| Box::new(t) as Payload)))
                 .unwrap_or_else(|_| Err(EngineError::Other(format!("`{label_w}` failed with an internal error (logged); the document is unchanged"))));
             // The receiver is gone when the job was cancelled: nothing to report.
@@ -462,7 +509,9 @@ impl Session {
                 warm_layer_bounds(&imported.document, || ctx.check())?;
                 Ok(imported)
             },
-            move |s, r: photocraft_io::ImportResult| {
+            move |s, mut r: photocraft_io::ImportResult| {
+                // File Handling's ACEScg option, before the colour prompt looks at the profile.
+                crate::file_cmds::tag_exr_colorspace(s, &name_a, &mut r.document);
                 // Ask When Opening: held back until the prompt is answered (`take_held_open`). A
                 // developed raw has no embedded profile to ask about.
                 let raw = r.warnings.iter().any(|w| w.contains(photocraft_io::raw::DEVELOPED_NOTE));
@@ -502,7 +551,7 @@ impl Session {
                 job.ctx.cancel();
                 Err(e)
             }
-            (Err(e), None) => Err(e),
+            (Err(e), None) => Err(self.explain_missing_layer(e)),
             (Ok(_), Some(mut job)) => {
                 job.command = command.to_string();
                 job.params = params;
@@ -652,6 +701,8 @@ impl Session {
         if let Some(gate) = self.authorize {
             gate(id, &params)?;
         }
+        let _authorization = AuthorizationScope::enter(self.authorize);
+        let _document = crate::doc_path::scope(self.active().and_then(|d| d.path.as_deref()).map(std::path::Path::new));
         // Last Filter runs as the filter it repeats: journaled, recorded in an action, faded and
         // run as a job like that filter, so a recorded step replays the same filter anywhere
         // (#3089), as Transform Again records its transform (#1440). With no filter yet it falls
@@ -671,17 +722,7 @@ impl Session {
             return Ok(Started::Done(v));
         }
         // Pixel commands follow the Channels panel target unless the caller names one.
-        let run_params = crate::channel_cmds::inject_target(self, id, crate::commands::inject_kind(id, params.clone()));
-        if let Err(why) = self.explicit_layer_enabled(spec, &params).unwrap_or_else(|| self.precondition(spec, &run_params)) {
-            return Err(EngineError::Disabled(id.to_string(), why));
-        }
-        if let Some(why) = self.job_conflict(id, spec.journal) {
-            return Err(EngineError::Disabled(id.to_string(), why));
-        }
-        // Painting on or moving a hidden layer is refused, as in Photoshop (#571).
-        if let Some(why) = crate::hidden_target::refusal(self, id, &params) {
-            return Err(EngineError::Other(why.into()));
-        }
+        let run_params = self.admit(id, spec, &params)?;
         self.coalesce_request = params.get("coalesce").and_then(Value::as_str).map(str::to_string);
         self.color_restrict = crate::channel_cmds::color_restriction(self, id, &run_params);
         self.jobs.spawn = background;
@@ -708,7 +749,7 @@ impl Session {
                 job.ctx.cancel();
                 Err(e)
             }
-            (Err(e), None) => Err(e),
+            (Err(e), None) => Err(self.explain_missing_layer(e)),
             (Ok(_), Some(mut job)) => {
                 job.command = id.to_string();
                 job.params = params;
@@ -724,6 +765,18 @@ impl Session {
         }
     }
 
+    /// A command that failed on a layer id the document doesn't have says which ids it does have
+    /// (#5058): ids are not positions (an opened PNG's Background is not layer 1), and an agent
+    /// should not need `document.inspect` to recover.
+    fn explain_missing_layer(&self, e: EngineError) -> EngineError {
+        match (e, self.active()) {
+            (EngineError::NoLayer(id), Some(st)) if st.doc.layer(id).is_none() => {
+                EngineError::UnknownLayer { id, known: crate::commands::layer_listing(&st.doc) }
+            }
+            (e, _) => e,
+        }
+    }
+
     /// Bookkeeping after a command (or a job's apply) succeeded.
     ///
     /// `nested_from` is the journal length when the command started. A replayable command stands
diff --git a/crates/engine/src/kys.rs b/crates/engine/src/kys.rs
index f996e23475..6a0ff99c84 100644
--- a/crates/engine/src/kys.rs
+++ b/crates/engine/src/kys.rs
@@ -160,12 +160,14 @@ fn key(label: &str) -> String {
     l.trim_end_matches('…').trim().to_lowercase()
 }
 
-/// The engine's own candidates: every command in a menu, in command order.
+/// The engine's own candidates: every command in a menu (the engine's, then the shell's), in
+/// command order.
 pub fn command_candidates() -> Vec<Candidate> {
-    crate::command_specs()
-        .iter()
-        .filter(|c| !c.menu.is_empty())
-        .map(|c| Candidate { id: c.id.to_string(), label: c.label.to_string(), default: c.shortcut.map(str::to_string) })
+    let engine = crate::command_specs().iter().map(|c| (c.id, c.label, c.menu, c.shortcut));
+    engine
+        .chain(crate::shell_commands::SHELL_COMMANDS.iter().copied())
+        .filter(|c| !c.2.is_empty())
+        .map(|(id, label, _, default)| Candidate { id: id.to_string(), label: label.to_string(), default: default.map(str::to_string) })
         .collect()
 }
 
@@ -219,8 +221,8 @@ pub fn plan(candidates: impl IntoIterator<Item = Candidate>, set: &KysSet) -> Pl
 }
 
 /// The tool keys of `set` matched to `tools` (our tool id and Photoshop's name for it, which is
-/// ours too: "Move Tool"): tool id → key (a single letter, upper case), and the names with no
-/// tool here. A row PhotoCraft wrote names the tool by id. A key that isn't one letter is skipped.
+/// ours too: "Move Tool"): tool id → key (normalised: a letter, or an F-key), and the names with no
+/// tool here. A row PhotoCraft wrote names the tool by id. A key with modifiers is skipped.
 pub fn plan_tools<'a>(tools: impl IntoIterator<Item = (&'a str, &'a str)>, set: &KysSet) -> (BTreeMap<String, String>, Vec<String>) {
     let tools: Vec<(&str, &str)> = tools.into_iter().collect();
     let mut keys = BTreeMap::new();
@@ -232,11 +234,10 @@ pub fn plan_tools<'a>(tools: impl IntoIterator<Item = (&'a str, &'a str)>, set:
             unknown.push(row.name.clone());
             continue;
         };
-        let mut letters = row.shortcuts.first().map(|k| k.trim()).unwrap_or_default().chars();
-        if let (Some(c), None) = (letters.next(), letters.next())
-            && c.is_ascii_alphanumeric()
-        {
-            keys.insert((*id).to_string(), c.to_ascii_uppercase().to_string());
+        // One key without modifiers (Photoshop's letters; our tools may also take an F-key).
+        let key = row.shortcuts.first().and_then(|k| normalize_shortcut(k.trim()));
+        if let Some(k) = key.filter(|k| !k.contains('+') || k == "+") {
+            keys.insert((*id).to_string(), k);
         }
     }
     (keys, unknown)
@@ -448,7 +449,7 @@ mod tests {
         assert_eq!(keys.get("tools.select.move").map(String::as_str), Some("V"));
         assert_eq!(keys.get("tools.select.pencil").map(String::as_str), Some("N"), "case-insensitive, upper-cased");
         assert_eq!(keys.get("tools.select.brush").map(String::as_str), Some("B"), "by pc-id");
-        assert!(!keys.contains_key("tools.select.lasso"), "a tool key is one letter");
+        assert!(!keys.contains_key("tools.select.lasso"), "a tool key has no modifiers");
         assert_eq!(unknown, vec!["Imaginary Tool".to_string()]);
         // Our own export reads back by id.
         let out = write("T", &[Entry { id: "tools.select.pencil".into(), label: "Pencil Tool".into(), tool: true, keys: vec!["F".into()] }]);
diff --git a/crates/engine/src/layer_menu_cmds.rs b/crates/engine/src/layer_menu_cmds.rs
index 366f9c8d39..ab25912296 100644
--- a/crates/engine/src/layer_menu_cmds.rs
+++ b/crates/engine/src/layer_menu_cmds.rs
@@ -373,30 +373,56 @@ fn reveal_in_finder(s: &mut Session, p: &Value) -> Result<Value> {
     let SmartSource::Linked { path } = &sm.source else {
         return Err(other("embedded smart objects have no file to reveal"));
     };
-    reveal(path, p.get("dryRun").and_then(Value::as_bool).unwrap_or(false))
+    // The path is stored in the document: shown only when it would be followed.
+    let file =
+        crate::doc_path::resolve_in(path, d.path.as_deref().map(std::path::Path::new)).map_err(|why| crate::doc_path::refusal("the linked file", path, why))?;
+    reveal(&file.to_string_lossy(), p.get("dryRun").and_then(Value::as_bool).unwrap_or(false))
 }
 
 /// Show `path` in the platform file manager ([`reveal_command`] + [`spawn`]); `dry_run` answers
 /// the program and arguments instead (tests). Shared by the smart-object command and the document
 /// tab's Reveal in Finder (UI-217-6).
 pub(crate) fn reveal(path: &str, dry_run: bool) -> Result<Value> {
-    let (program, args) = reveal_command(path);
+    let (program, args) = reveal_command(path)?;
     if dry_run {
         return Ok(json!({"program": program, "args": args}));
     }
+    ensure_folder(program, &args)?;
     spawn(program, &args)?;
     Ok(json!({"path": path}))
 }
 
+/// `xdg-open` opens whatever it is given in its default application, so it only gets a folder: a
+/// linked path such as `tool.jar/a.png` would otherwise launch `tool.jar` instead of showing it.
+fn ensure_folder(program: &str, args: &[String]) -> Result<()> {
+    if program != "xdg-open" {
+        return Ok(());
+    }
+    match args.first() {
+        Some(dir) if std::path::Path::new(dir).is_dir() => Ok(()),
+        Some(dir) => Err(other(format!("{dir} is not a folder, so it can't be shown in the file manager"))),
+        None => Err(other("no folder to show in the file manager")),
+    }
+}
+
 /// The file-manager invocation that selects `path` on this platform.
-pub fn reveal_command(path: &str) -> (&'static str, Vec<String>) {
-    if cfg!(target_os = "macos") {
-        ("open", vec!["-R".into(), path.into()])
-    } else if cfg!(target_os = "windows") {
-        ("explorer", vec![format!("/select,{path}")])
-    } else {
-        let parent = std::path::Path::new(path).parent().map_or_else(|| ".".to_string(), |p| p.to_string_lossy().into_owned());
-        ("xdg-open", vec![parent])
+pub fn reveal_command(path: &str) -> Result<(&'static str, Vec<String>)> {
+    reveal_command_on(std::env::consts::OS, path)
+}
+
+/// [`reveal_command`] on the platform `os` (a `std::env::consts::OS` value).
+fn reveal_command_on(os: &str, path: &str) -> Result<(&'static str, Vec<String>)> {
+    match os {
+        // `--` ends the options: a path starting with `-` is not read as one.
+        "macos" => Ok(("open", vec!["-R".into(), "--".into(), path.into()])),
+        // Explorer splits `/select,` arguments at commas and reads quotes itself, so such a path
+        // would select something else.
+        "windows" if path.contains([',', '"']) => Err(other(format!("{path} can't be shown in Explorer: its path contains a comma or a quotation mark"))),
+        "windows" => Ok(("explorer", vec![format!("/select,{path}")])),
+        _ => {
+            let parent = std::path::Path::new(path).parent().map_or_else(|| ".".to_string(), |p| p.to_string_lossy().into_owned());
+            Ok(("xdg-open", vec![parent]))
+        }
     }
 }
 
diff --git a/crates/engine/src/layer_menu_cmds/tests.rs b/crates/engine/src/layer_menu_cmds/tests.rs
index 46688500b1..171034876e 100644
--- a/crates/engine/src/layer_menu_cmds/tests.rs
+++ b/crates/engine/src/layer_menu_cmds/tests.rs
@@ -465,16 +465,13 @@ fn stack_mode_rejects_sources_without_visible_layers() {
 
 #[test]
 fn reveal_in_finder_dry_run_and_enabled() {
+    let link = std::env::temp_dir().join("pics").join("a.png").to_string_lossy().into_owned();
     let mut s = session(8, "rgb");
     assert!(!s.is_enabled("layer.smartObjects.revealInFinder"));
     s.edit("linked", |doc, active| {
         let mut l = Layer::new(
             "linked",
-            LayerContent::Smart(photocraft_doc::SmartObject::new(
-                SmartSource::Linked { path: "/tmp/pics/a.png".into() },
-                photocraft_geom::Affine::IDENTITY,
-                None,
-            )),
+            LayerContent::Smart(photocraft_doc::SmartObject::new(SmartSource::Linked { path: link.clone() }, photocraft_geom::Affine::IDENTITY, None)),
         );
         l.visible = true;
         *active = Some(doc.insert_above(*active, l));
@@ -483,11 +480,61 @@ fn reveal_in_finder_dry_run_and_enabled() {
     .unwrap();
     assert!(s.is_enabled("layer.smartObjects.revealInFinder"));
     let r = s.execute("layer.smartObjects.revealInFinder", json!({"dryRun": true})).unwrap();
-    let (prog, args) = reveal_command("/tmp/pics/a.png");
+    let (prog, args) = reveal_command(&link).unwrap();
     assert_eq!(r["program"], json!(prog));
     assert_eq!(r["args"], json!(args));
 }
 
+#[test]
+fn reveal_follows_linked_paths_like_the_link_and_passes_paths_as_paths() {
+    let mut s = session(8, "rgb");
+    let folder = std::env::temp_dir().join("pics");
+    s.active_mut().unwrap().path = Some(folder.join("doc.pcraft").to_string_lossy().into_owned());
+    let mut link = |path: &str| {
+        s.edit("linked", |doc, active| {
+            let so = photocraft_doc::SmartObject::new(SmartSource::Linked { path: path.into() }, photocraft_geom::Affine::IDENTITY, None);
+            *active = Some(doc.insert_above(*active, Layer::new("linked", LayerContent::Smart(so))));
+            Ok(())
+        })
+        .unwrap();
+        s.execute("layer.smartObjects.revealInFinder", json!({"dryRun": true})).map_err(|e| e.to_string())
+    };
+    let err = link(r"\\192.0.2.1\share\x.png").unwrap_err();
+    assert!(err.contains("is not opened: the path is on another computer"), "{err}");
+    // A relative link is shown next to the document.
+    let r = link("a.png").unwrap();
+    assert_eq!(r["args"], json!(reveal_command(&folder.join("a.png").to_string_lossy()).unwrap().1));
+    // The document's own file is shown wherever it is, a network share included.
+    s.active_mut().unwrap().path = Some(r"\\192.0.2.1\share\doc.psd".into());
+    s.execute("file.revealInFinder", json!({"dryRun": true})).unwrap();
+
+    assert_eq!(reveal_command_on("macos", "-a.png").unwrap(), ("open", vec!["-R".to_string(), "--".into(), "-a.png".into()]));
+    assert_eq!(reveal_command_on("windows", r"C:\pics\a.png").unwrap(), ("explorer", vec![r"/select,C:\pics\a.png".to_string()]));
+    for path in [r"C:\pics\a,b.png", r#"C:\pics\a".png"#] {
+        assert!(reveal_command_on("windows", path).is_err(), "{path}");
+    }
+}
+
+/// `xdg-open` launches a file it is given, so Reveal hands it the link's folder only when that is a
+/// folder: a link stored as `tool.jar/a.png` names a file, not a folder, as its parent.
+#[test]
+fn reveal_on_linux_never_hands_xdg_open_a_file() {
+    let dir = std::env::temp_dir().join(format!("photocraft-reveal-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let file = dir.join("tool.jar");
+    std::fs::write(&file, b"not a folder").unwrap();
+    let (program, args) = reveal_command_on("linux", &file.join("a.png").to_string_lossy()).unwrap();
+    assert_eq!(args, vec![file.to_string_lossy().into_owned()]);
+    let err = ensure_folder(program, &args).unwrap_err();
+    assert!(err.to_string().contains("is not a folder"), "{err}");
+    let (program, args) = reveal_command_on("linux", &dir.join("a.png").to_string_lossy()).unwrap();
+    ensure_folder(program, &args).unwrap();
+    assert!(ensure_folder("xdg-open", &[]).is_err());
+    // Finder and Explorer select the file itself, whatever it is.
+    ensure_folder("open", &["-R".into(), "--".into(), file.to_string_lossy().into_owned()]).unwrap();
+    std::fs::remove_dir_all(&dir).unwrap();
+}
+
 #[test]
 fn mask_all_objects_masks_the_subject() {
     let mut s = session(8, "rgb");
diff --git a/crates/engine/src/layer_multi_cmds.rs b/crates/engine/src/layer_multi_cmds.rs
index 9a79a72050..1b71e966a4 100644
--- a/crates/engine/src/layer_multi_cmds.rs
+++ b/crates/engine/src/layer_multi_cmds.rs
@@ -263,7 +263,8 @@ fn can_align(s: &Session) -> std::result::Result<(), String> {
     let d = doc_state(s)?;
     match d.selected_layers().len() {
         0 => Err("no layer selected".into()),
-        // Photoshop aligns a single layer to the canvas (or to an active selection); 2+ align to each other.
+        // Photoshop aligns to an active selection however many layers are selected; without one,
+        // a single layer aligns to the canvas and 2+ align to each other.
         _ => Ok(()),
     }
 }
@@ -961,8 +962,9 @@ fn align(s: &mut Session, p: &Value, kind: &str) -> Result<Value> {
             "canvas" => doc.bounds(),
             "selection" => doc.selection.as_ref().map(|m| m.content_bounds()).ok_or_else(|| EngineError::Other("there is no selection to align to".into()))?,
             "auto" | "layers" => match (&doc.selection, sel.len()) {
-                // Photoshop: one layer plus an active selection aligns to the selection bounds.
-                (Some(m), 1) if to == "auto" => m.content_bounds(),
+                // Photoshop: with an active selection, the layers align to its bounds (Layer › Align
+                // Layers to Selection), however many are selected.
+                (Some(m), _) if to == "auto" && !m.content_bounds().is_empty() => m.content_bounds(),
                 // One layer with no selection aligns to the canvas (otherwise it would align to itself).
                 (None, 1) if to == "auto" => doc.bounds(),
                 _ => items.iter().fold(Rect::EMPTY, |a, (_, b)| a.union(b)),
@@ -1312,6 +1314,12 @@ fn merge_layers(s: &mut Session) -> Result<Value> {
         let fmt = PixelFormat::new(fmt.mode, fmt.sample, true);
         let mut merged = Layer::raster(top.name.clone(), fmt);
         merged.locks = top.locks;
+        merged.label = top.label;
+        // Clipped layers of one chain merge into a layer still clipped to their base. Clipped
+        // layers of different chains don't: the result, at the top one's slot, would clip the
+        // lower chain's pixels to the upper chain's base.
+        let base = crate::clip_group::base_of(doc, top_id);
+        merged.clipped = base.is_some() && solo.layers.iter().all(|l| l.clipped && crate::clip_group::base_of(doc, l.id) == base);
         *crate::pixels_mut(&mut merged)? = crate::pixels::composite_layers_uncropped(&solo, fmt);
         let mid = merged.id;
         // Hidden selected layers are discarded, as in Photoshop.
@@ -1431,7 +1439,7 @@ pub fn specs() -> Vec<CommandSpec> {
             CommandSpec { id: $id, label: $label, menu: $menu, shortcut: $sc, params: $params, enabled: $enabled, journal: true, run: $run }
         };
     }
-    const ALIGN: &str = r##"{"to":"auto|layers|selection|canvas"="auto"} (auto: the selection bounds with one layer and an active selection, else the selected layers' bounds)"##;
+    const ALIGN: &str = r##"{"to":"auto|layers|selection|canvas"="auto"} (auto: the active selection's bounds when there is one, however many layers are selected; else one layer aligns to the canvas and several to their combined bounds)"##;
     vec![
         spec!("select.allLayers", "All Layers", &["Select"], Some("Cmd+Alt+A"), "{}", has_doc, |s, _| select_all_layers(s)),
         spec!("select.deselectLayers", "Deselect Layers", &["Select"], None, "{}", has_doc, |s, _| {
@@ -1479,7 +1487,15 @@ pub fn specs() -> Vec<CommandSpec> {
             link_layers(s)
         }),
         spec!("layer.mergeLayers", "Merge Layers", &["Layer"], Some("Cmd+E"), "{} (one layer selected: Merge Down)", has_layer, |s, _| merge_layers(s)),
-        spec!("layer.new.groupFromLayers", "Group from Layers…", &["Layer", "New"], None, r##"{"name":str?}"##, has_layer, group_layers),
+        spec!(
+            "layer.new.groupFromLayers",
+            "Group from Layers…",
+            &["Layer", "New"],
+            None,
+            r##"{"layer":id?,"name":str?} (no layer: every selected layer)"##,
+            has_layer,
+            group_layers
+        ),
         spec!("layer.arrange.reverse", "Reverse", &["Layer", "Arrange"], None, "{}", two_plus, |s, _| reverse(s)),
         spec!(
             "layer.lockLayers",
diff --git a/crates/engine/src/lens_cmds.rs b/crates/engine/src/lens_cmds.rs
index 379ca2402a..9a566fb925 100644
--- a/crates/engine/src/lens_cmds.rs
+++ b/crates/engine/src/lens_cmds.rs
@@ -147,6 +147,9 @@ pub fn raw_params(cmd: &str, p: &Value) -> Result<CameraRaw> {
     cr.noise_luminance_detail = cr.noise_luminance_detail.clamp(0.0, 100.0);
     cr.noise_color = cr.noise_color.clamp(0.0, 100.0);
     cr.noise_color_detail = cr.noise_color_detail.clamp(0.0, 100.0);
+    // `exposure` becomes `2^exposure`, which overflows f32 to infinity from 128 up (and then
+    // writes inf/NaN into 32-bit layers). Clamp to the documented -5..5.
+    cr.exposure = cr.exposure.clamp(-5.0, 5.0);
     Ok(cr)
 }
 
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index d2aecf37db..ba7556901b 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -1,4 +1,4 @@
-//! The Photocraft engine façade: open documents, history, and the command registry.
+//! The PhotoCraft engine façade: open documents, history, and the command registry.
 //!
 //! Every user-visible action is a command with a stable id (Photoshop-style, such as
 //! `layer.newAdjustmentLayer.invert`) and JSON parameters. Every frontend goes through the same
@@ -34,6 +34,7 @@ mod crop_fill;
 pub mod cutout_cmds;
 pub mod display_color;
 pub mod distort_cmds;
+pub mod doc_path;
 pub mod document_preset_cmds;
 pub mod edit_cmds;
 pub mod edit_menu_cmds;
@@ -41,6 +42,7 @@ pub mod eraser_cmds;
 pub mod export_preset_cmds;
 pub mod exr_cmds;
 pub mod extra_cmds;
+pub mod face_cmds;
 pub mod file_cmds;
 pub mod fill_cmds;
 pub mod fill_key_cmds;
@@ -103,6 +105,7 @@ pub mod sample_cmds;
 pub mod sampler_cmds;
 pub mod select_extra_cmds;
 pub mod selection_cmds;
+pub mod shell_commands;
 pub mod shortcut_sets;
 pub mod slice_cmds;
 pub mod smart_cmds;
@@ -154,6 +157,10 @@ pub enum EngineError {
     NoDocument,
     #[error("no such layer {0:?}")]
     NoLayer(LayerId),
+    /// [`Self::NoLayer`] as a command reports it: with the layers the document does have, as
+    /// ids are not positions (#5058).
+    #[error("no such layer {}; {known}", id.0)]
+    UnknownLayer { id: LayerId, known: String },
     #[error("{0}")]
     Other(String),
     /// A background job was cancelled (see [`jobs`]); nothing changed.
@@ -406,6 +413,29 @@ impl Default for ToolState {
     }
 }
 
+/// Layer › Layer Style › Copy Layer Style: the effects and the Blending Options, as Photoshop
+/// copies them (Paste Layer Style puts them all on each target).
+#[derive(Clone, Debug)]
+pub struct CopiedStyle {
+    pub effects: photocraft_doc::Effects,
+    pub blend: photocraft_color::BlendMode,
+    pub fill: f32,
+    pub advanced: photocraft_doc::AdvancedBlending,
+    pub blend_if: photocraft_doc::BlendIf,
+    pub excluded_channels: u32,
+    /// The colour mode it was copied in: Blend If's channel ranges and the channel restrictions
+    /// only carry over to a document in the same mode.
+    pub mode: photocraft_color::ColorMode,
+}
+
+/// The commands whose [`Session::precheck`] is complete: it accepts what `execute` does (Free
+/// Transform applies its box before these, and only when they will run), but for the group
+/// nesting limit ([`photocraft_doc::MAX_GROUP_DEPTH`]): grouping layers already that deep is
+/// refused only as the edit is made. Layer via Copy and
+/// Cut aren't: whether they have anything to copy (a selection over transparent pixels, a group
+/// or fill layer) is known only when they run.
+pub const PRECHECKED: &[&str] = &["layer.new.layer", "layer.new.group", "layer.new.groupFromLayers", "layer.new.layerFromBackground"];
+
 #[derive(Default)]
 pub struct Session {
     docs: Vec<DocState>,
@@ -417,9 +447,9 @@ pub struct Session {
     coalesce_request: Option<String>,
     /// Pixels copied with Edit › Copy / Cut (shared by all documents, like Photoshop).
     pub clipboard: Option<edit_cmds::Clip>,
-    /// Layer › Layer Style › Copy Layer Style: effects, blend mode, fill opacity and the Advanced
-    /// Blending switches.
-    pub style_clipboard: Option<(photocraft_doc::Effects, photocraft_color::BlendMode, f32, photocraft_doc::AdvancedBlending)>,
+    /// Layer › Layer Style › Copy Layer Style: the effects and the Blending Options
+    /// ([`CopiedStyle`]: blend mode, fill opacity, Advanced Blending, Blend If, channels).
+    pub style_clipboard: Option<CopiedStyle>,
     /// Shape path context menu: copied vector fill and stroke styles.
     pub path_fill_clipboard: Option<photocraft_doc::Fill>,
     pub path_stroke_clipboard: Option<photocraft_doc::ShapeStroke>,
@@ -456,6 +486,9 @@ pub struct Session {
     /// the same check a top-level request sees. `None` runs everything, which is what a local
     /// UI and `photocraft-cli run` do.
     pub authorize: Option<fn(&str, &serde_json::Value) -> Result<()>>,
+    /// A further route for File › Print when neither `lp` nor a CUPS server over IPP is
+    /// reachable (the XDG Print portal in a Flatpak); see `print_cmds::Spooler`.
+    pub print_spooler: Option<print_cmds::Spooler>,
     /// Background jobs (see [`jobs`]).
     jobs: jobs::Jobs,
     /// Color Sampler points dropped by the last canvas-size change (crop, Canvas Size, Image Size,
@@ -644,6 +677,53 @@ impl Session {
         self.live_commit = None;
     }
 
+    /// Check a call without running it: the command exists, its params have the shape
+    /// [`Self::execute`] requires (New Layer's fully), and it can run now. For a caller that does
+    /// something first only when the command will go through: Free Transform applies its box
+    /// before a new layer is made.
+    ///
+    /// Complete for the commands in [`PRECHECKED`]: there it accepts what `execute` accepts, but
+    /// for the group nesting limit (a test holds the two together). For others it checks only what they share.
+    pub fn precheck(&mut self, id: &str, params: &Value) -> Result<()> {
+        let spec = crate::commands::find(id).ok_or_else(|| EngineError::UnknownCommand(id.to_string()))?;
+        if !(params.is_object() || params.is_null()) {
+            return Err(EngineError::BadParams { cmd: id.to_string(), msg: "params must be a JSON object".into() });
+        }
+        crate::param_check::check(spec, params)?;
+        crate::filters::validate_params(id, params)?;
+        if id == "layer.new.layer" {
+            crate::new_layer::parse(params)?;
+        }
+        // A command that takes `"layer"` (an id or a name, as it resolves it) fails on one the
+        // document doesn't have.
+        if spec.params.contains("\"layer\":id")
+            && let Some(l) = commands::explicit_layer(self, params)?
+            && self.active().is_none_or(|st| st.doc.layer(l).is_none())
+        {
+            return Err(EngineError::BadParams { cmd: id.to_string(), msg: format!("no layer {}", l.0) });
+        }
+        self.admit(id, spec, params).map(|_| ())
+    }
+
+    /// What `dispatch` checks once the params are valid and a floating selection has dropped:
+    /// the precondition (on a named layer for commands that take one), a job running on the
+    /// document, a hidden target. The run params (the Channels panel's target filled in) when it
+    /// may run.
+    pub(crate) fn admit(&mut self, id: &str, spec: &commands::CommandSpec, params: &Value) -> Result<Value> {
+        let run_params = channel_cmds::inject_target(self, id, commands::inject_kind(id, params.clone()));
+        if let Err(why) = self.explicit_layer_enabled(spec, params).unwrap_or_else(|| self.precondition(spec, &run_params)) {
+            return Err(EngineError::Disabled(id.to_string(), why));
+        }
+        if let Some(why) = self.job_conflict(id, spec.journal) {
+            return Err(EngineError::Disabled(id.to_string(), why));
+        }
+        // Painting on or moving a hidden layer is refused, as in Photoshop (#571).
+        if let Some(why) = hidden_target::refusal(self, id, params) {
+            return Err(EngineError::Other(why.into()));
+        }
+        Ok(run_params)
+    }
+
     /// Is the command currently runnable? (drives menu enablement)
     pub fn is_enabled(&self, id: &str) -> bool {
         self.is_enabled_with(id, &Value::Null)
@@ -708,6 +788,10 @@ impl Session {
 
     /// Apply an undoable edit to the active document.
     pub fn edit<R>(&mut self, label: &str, f: impl FnOnce(&mut Document, &mut Option<LayerId>) -> Result<R>) -> Result<R> {
+        // Every mutation path (linked-file refresh, transform, place) re-renders smart objects
+        // through this entry; the requesting session's authority must reach those renders.
+        let _authorization = crate::jobs::render_authorization_scope(self.authorize);
+        let _document = crate::doc_path::scope(self.active().and_then(|d| d.path.as_deref()).map(std::path::Path::new));
         let restrict = self.color_restrict;
         let sampler_map = self.sampler_map.take();
         let st = self.active_mut().ok_or(EngineError::NoDocument)?;
diff --git a/crates/engine/src/link_watch.rs b/crates/engine/src/link_watch.rs
index 5c235fb919..453af7806b 100644
--- a/crates/engine/src/link_watch.rs
+++ b/crates/engine/src/link_watch.rs
@@ -16,6 +16,9 @@
 //! keeps waiting for Update Modified Content, as in Photoshop); one that can't be read (another app
 //! is still writing it) is tried again once it changes again, not on every look. Only smart objects
 //! of the document itself follow their files, not ones nested in another smart object's contents.
+//! While a background job runs on the document, its files aren't looked at: an update would replace
+//! the snapshot the job works on and its result would be thrown away. The first look after the job
+//! ends catches up.
 
 use std::collections::{BTreeMap, HashMap, HashSet};
 use std::sync::{Arc, Mutex, PoisonError};
@@ -32,15 +35,17 @@ pub type Stamp = (u64, u128);
 /// ids, stamp)]).
 pub type LinkScan = Arc<Mutex<Option<(u64, Vec<(String, Vec<u64>, Option<Stamp>)>)>>>;
 
+/// Stamps `file`, a linked path resolved by [`crate::doc_path`]; `None` (not looked at, like a
+/// missing file) when it is not followed.
 #[cfg(not(target_arch = "wasm32"))]
-fn stamp(path: &str) -> Option<Stamp> {
-    let meta = std::fs::metadata(path).ok()?;
+fn stamp(file: Option<&std::path::Path>) -> Option<Stamp> {
+    let meta = std::fs::metadata(file?).ok()?;
     let modified = meta.modified().ok()?.duration_since(std::time::UNIX_EPOCH).ok()?;
     Some((meta.len(), modified.as_nanos()))
 }
 
 #[cfg(target_arch = "wasm32")]
-fn stamp(_: &str) -> Option<Stamp> {
+fn stamp(_: Option<&std::path::Path>) -> Option<Stamp> {
     None
 }
 
@@ -61,11 +66,24 @@ pub fn linked_files(d: &Document) -> Vec<(String, Vec<u64>)> {
 /// the layers of the ones that changed.
 pub(crate) fn update_changed(s: &mut Session, _: &Value) -> Result<Value> {
     let st = s.active().ok_or(EngineError::NoDocument)?;
-    let (doc, files) = (st.doc.id.0, linked_files(&st.doc));
-    let now = files.into_iter().map(|(p, ids)| (p.clone(), ids, stamp(&p))).collect();
+    let (doc, files) = (st.doc.id.0, resolved_files(st));
+    let now = files.into_iter().map(|(p, file, ids)| (p, ids, stamp(file.as_deref()))).collect();
     s.apply_link_stamps(doc, now)
 }
 
+/// [`linked_files`] of `st`'s document with the file each path resolves to, or `None` for a path
+/// that is not followed ([`crate::doc_path`]).
+fn resolved_files(st: &crate::DocState) -> Vec<(String, Option<std::path::PathBuf>, Vec<u64>)> {
+    let document = st.path.as_deref().map(std::path::Path::new);
+    linked_files(&st.doc)
+        .into_iter()
+        .map(|(p, ids)| {
+            let file = crate::doc_path::resolve_in(&p, document).ok();
+            (p, file, ids)
+        })
+        .collect()
+}
+
 impl Session {
     /// Start stamping the active document's linked files on a worker thread, unless a look is
     /// still running (or the build has no files to look at: the web app).
@@ -74,14 +92,15 @@ impl Session {
             return;
         }
         let Some(st) = self.active() else { return };
-        let (doc, files) = (st.doc.id.0, linked_files(&st.doc));
-        if files.is_empty() {
+        let (doc, files) = (st.doc.id.0, resolved_files(st));
+        // Nothing to look at: no links, or none that is followed.
+        if files.iter().all(|(_, file, _)| file.is_none()) {
             return;
         }
         let slot: LinkScan = Arc::default();
         let out = slot.clone();
         let spawned = std::thread::Builder::new().name("link-watch".into()).spawn(move || {
-            let stamps = files.into_iter().map(|(p, ids)| (p.clone(), ids, stamp(&p))).collect();
+            let stamps = files.into_iter().map(|(p, file, ids)| (p, ids, stamp(file.as_deref()))).collect();
             *out.lock().unwrap_or_else(PoisonError::into_inner) = Some((doc, stamps));
         });
         if spawned.is_ok() {
@@ -103,6 +122,12 @@ impl Session {
         if self.active().map(|d| d.doc.id.0) != Some(doc) {
             return Ok(json!({"updated": []}));
         }
+        // A background job holds the document: refreshing now would replace the snapshot it works
+        // on and its result would be discarded. The stamps stay as they were, so the change is
+        // seen again by the first look after the job ends.
+        if self.active_job().is_some() {
+            return Ok(json!({"updated": []}));
+        }
         // This document's last stamps; those of closed documents are dropped.
         let open: HashSet<u64> = self.documents().iter().map(|d| d.doc.id.0).collect();
         let mut before: HashMap<String, Stamp> = HashMap::new();
@@ -155,7 +180,7 @@ mod tests {
     use photocraft_geom::Rect;
     use serde_json::json;
 
-    use crate::Session;
+    use crate::{EngineError, Session};
 
     fn dir(name: &str) -> std::path::PathBuf {
         let d = std::env::temp_dir().join(format!("photocraft-link-watch-{name}-{}", std::process::id()));
@@ -280,4 +305,53 @@ mod tests {
         assert!(is(centre(&s), BLUE));
         assert!(s.link_scan.is_none());
     }
+
+    #[test]
+    fn a_refresh_waits_for_a_running_job_on_the_document() {
+        let d = dir("job");
+        let path = d.join("art.png");
+        std::fs::write(&path, png(10, 10, "#ff0000")).unwrap();
+        let (mut s, id) = placed(&path);
+        s.execute("layer.smartObjects.updateChanged", json!({})).unwrap();
+        let (release, job) = gated_job(&mut s);
+        save(&path, &png(10, 10, "#0000ff"));
+        let snapshot = s.active().unwrap().doc.clone();
+        // The path the desktop app's timer takes: it doesn't go through the command conflict check.
+        assert_eq!(super::update_changed(&mut s, &json!({})).unwrap(), json!({"updated": []}));
+        assert!(std::sync::Arc::ptr_eq(&s.active().unwrap().doc, &snapshot), "the job's snapshot must stay in place");
+        release.send(()).unwrap();
+        s.wait_job(job).unwrap();
+        // The job finished; the change that came meanwhile is picked up exactly once.
+        assert_eq!(s.execute("layer.smartObjects.updateChanged", json!({})).unwrap(), json!({"updated": [id]}));
+        assert!(is(centre(&s), BLUE));
+        assert_eq!(s.execute("layer.smartObjects.updateChanged", json!({})).unwrap(), json!({"updated": []}));
+    }
+
+    #[test]
+    fn a_job_on_another_document_does_not_hold_up_a_refresh() {
+        let d = dir("job-other");
+        let path = d.join("art.png");
+        std::fs::write(&path, png(10, 10, "#ff0000")).unwrap();
+        let (mut s, id) = placed(&path);
+        s.execute("layer.smartObjects.updateChanged", json!({})).unwrap();
+        s.execute("file.new", json!({"width": 10, "height": 10})).unwrap();
+        let (release, job) = gated_job(&mut s);
+        s.set_active(0);
+        save(&path, &png(10, 10, "#0000ff"));
+        assert_eq!(super::update_changed(&mut s, &json!({})).unwrap(), json!({"updated": [id]}));
+        assert!(is(centre(&s), BLUE));
+        release.send(()).unwrap();
+        s.wait_job(job).unwrap();
+    }
+
+    /// A background job that locks the active document until something is sent on the returned
+    /// sender.
+    fn gated_job(s: &mut Session) -> (std::sync::mpsc::Sender<()>, crate::jobs::JobId) {
+        let (release, gate) = std::sync::mpsc::channel::<()>();
+        let r = s.start_job("test.gated", json!({}), "Gated job", true, move |_| gate.recv().map_err(|_| EngineError::Cancelled), |_, ()| Ok(json!(null)));
+        match r.unwrap() {
+            crate::jobs::Started::Job(j) => (release, j),
+            other => panic!("expected a background job, got {other:?}"),
+        }
+    }
 }
diff --git a/crates/engine/src/mode_cmds.rs b/crates/engine/src/mode_cmds.rs
index fe22a192c7..840f1c6096 100644
--- a/crates/engine/src/mode_cmds.rs
+++ b/crates/engine/src/mode_cmds.rs
@@ -444,6 +444,10 @@ fn parse_inks(cmd: &str, v: &Value, n: usize) -> Result<Vec<DuotoneInk>> {
         if let Some(pts) = ink.get("curve").and_then(Value::as_array) {
             let mut curve: Vec<CurvePoint> =
                 pts.iter().filter_map(|p| Some(CurvePoint { input: p.get(0)?.as_f64()? as f32 / 100.0, output: p.get(1)?.as_f64()? as f32 / 100.0 })).collect();
+            // 1e39 is a valid JSON number but inf as f32, and a .pcraft with an inf curve can't be saved.
+            if curve.iter().any(|p| !p.input.is_finite() || !p.output.is_finite()) {
+                return Err(bad(cmd, "curve points must be finite numbers 0..100"));
+            }
             curve.sort_by(|a, b| a.input.total_cmp(&b.input));
             if curve.len() >= 2 {
                 d.curve = curve;
diff --git a/crates/engine/src/mode_cmds/tests.rs b/crates/engine/src/mode_cmds/tests.rs
index d6d020699e..a78a11db7d 100644
--- a/crates/engine/src/mode_cmds/tests.rs
+++ b/crates/engine/src/mode_cmds/tests.rs
@@ -353,6 +353,20 @@ fn duotone_inks_and_display() {
     assert!(!session(4, 4, 8, "rgb").is_enabled("image.mode.duotone"));
 }
 
+#[test]
+fn duotone_curve_points_must_be_finite() {
+    let mut s = session(4, 4, 8, "gray");
+    // 1e39 overflows f32 to inf, which the .pcraft writer refuses to save.
+    for curve in [json!([[0, 0], [100, 1e39]]), json!([[0, 0], [1e39, 50]]), json!([[-1e39, 0], [100, 100]])] {
+        let r = s.execute("image.mode.duotone", json!({"type": "monotone", "inks": [{"curve": curve}]}));
+        assert!(r.is_err(), "{curve} accepted");
+        assert_eq!(doc(&s).mode, ColorMode::Grayscale);
+    }
+    s.execute("image.mode.duotone", json!({"type": "monotone", "inks": [{"curve": [[0, 0], [50, 70], [100, 100]]}]})).unwrap();
+    assert_eq!(doc(&s).mode, ColorMode::Duotone);
+    photocraft_format::save_to_bytes(doc(&s), &Default::default()).unwrap();
+}
+
 #[test]
 fn modes_round_trip_through_pcraft() {
     let mut s = session(12, 12, 8, "rgb");
diff --git a/crates/engine/src/new_layer.rs b/crates/engine/src/new_layer.rs
index a6f4cefd38..cb1b151aba 100644
--- a/crates/engine/src/new_layer.rs
+++ b/crates/engine/src/new_layer.rs
@@ -24,9 +24,49 @@ pub fn neutral_color(mode: BlendMode) -> Option<([f32; 3], &'static str)> {
     }
 }
 
+/// A New Layer call's params, checked.
+pub(crate) struct NewLayer {
+    clip: bool,
+    mode: BlendMode,
+    opacity: f32,
+    label: LabelColor,
+    neutral: Option<[f32; 3]>,
+    below: bool,
+    name: Option<String>,
+}
+
 /// `layer.new.layer`: a pixel layer above the active one (below it with `position: below`, the
 /// Layers panel's ⌘/Ctrl-click), joining the clip group it lands in.
 pub fn run(s: &mut Session, p: &Value) -> Result<Value> {
+    let NewLayer { clip, mode, opacity, label, neutral, below, name } = parse(p)?;
+    let id = s.edit("New Layer", |doc, active| {
+        let name = name.clone().unwrap_or_else(|| doc.next_layer_name("Layer"));
+        let mut layer = Layer::raster(name, doc.pixel_format());
+        layer.blend = mode;
+        layer.opacity = opacity;
+        layer.label = label;
+        if let Some(rgb) = neutral {
+            let bounds = doc.bounds();
+            let surface = layer.surface_mut().ok_or_else(|| bad("a new pixel layer has no pixels"))?;
+            let px = photocraft_raster::from_rgba(&surface.format(), [rgb[0], rgb[1], rgb[2], 1.0]);
+            surface.fill_rect(bounds, &px);
+        }
+        // Nothing may sit under the Background: below it the layer lands above it instead.
+        let id = match *active {
+            Some(a) if below && doc.layer(a).is_some() && !doc.is_background(a) => doc.insert_below(Some(a), layer),
+            _ => doc.insert_above(*active, layer),
+        };
+        crate::clip_group::settle(doc, &[id], &Default::default(), clip);
+        *active = Some(id);
+        Ok(id)
+    })?;
+    crate::layer_multi_cmds::note_inert_insert(s, id);
+    Ok(json!({ "layer": id.0 }))
+}
+
+/// Check a New Layer call's params without running it (Free Transform applies its box before a
+/// new layer only when the new layer can be made).
+pub(crate) fn parse(p: &Value) -> Result<NewLayer> {
     let flag = |k: &str| match p.get(k) {
         None | Some(Value::Null) => Ok(false),
         Some(v) => v.as_bool().ok_or_else(|| bad(format!("`{k}` must be true or false"))),
@@ -62,29 +102,7 @@ pub fn run(s: &mut Session, p: &Value) -> Result<Value> {
         None | Some(Value::Null) => None,
         Some(v) => Some(v.as_str().ok_or_else(|| bad("`name` must be a string"))?.to_string()),
     };
-    let id = s.edit("New Layer", |doc, active| {
-        let name = name.clone().unwrap_or_else(|| doc.next_layer_name("Layer"));
-        let mut layer = Layer::raster(name, doc.pixel_format());
-        layer.blend = mode;
-        layer.opacity = opacity;
-        layer.label = label;
-        if let Some(rgb) = neutral {
-            let bounds = doc.bounds();
-            let surface = layer.surface_mut().ok_or_else(|| bad("a new pixel layer has no pixels"))?;
-            let px = photocraft_raster::from_rgba(&surface.format(), [rgb[0], rgb[1], rgb[2], 1.0]);
-            surface.fill_rect(bounds, &px);
-        }
-        // Nothing may sit under the Background: below it the layer lands above it instead.
-        let id = match *active {
-            Some(a) if below && doc.layer(a).is_some() && !doc.is_background(a) => doc.insert_below(Some(a), layer),
-            _ => doc.insert_above(*active, layer),
-        };
-        crate::clip_group::settle(doc, &[id], &Default::default(), clip);
-        *active = Some(id);
-        Ok(id)
-    })?;
-    crate::layer_multi_cmds::note_inert_insert(s, id);
-    Ok(json!({ "layer": id.0 }))
+    Ok(NewLayer { clip, mode, opacity, label, neutral, below, name })
 }
 
 #[cfg(test)]
diff --git a/crates/engine/src/notes_cmds.rs b/crates/engine/src/notes_cmds.rs
index 54bbd60b7a..a57eb3d548 100644
--- a/crates/engine/src/notes_cmds.rs
+++ b/crates/engine/src/notes_cmds.rs
@@ -106,6 +106,9 @@ fn set(s: &mut Session, p: &Value) -> Result<Value> {
         n.position = [nx, ny];
         // The popup travels with its icon.
         n.popup = [n.popup[0] + dx, n.popup[1] + dy, n.popup[2] + dx, n.popup[3] + dy];
+        if !n.popup.iter().all(|v| v.is_finite()) {
+            return Err(bad(CMD, "the move is too far: the note popup would leave the representable range"));
+        }
     }
     if n == d.notes[i] {
         return Ok(json!({"index": i, "note": note_json(i, &n), "changed": false}));
@@ -279,6 +282,19 @@ mod tests {
         assert!(s.execute("notes.set", json!({"index": 0})).is_err());
     }
 
+    #[test]
+    fn huge_move_is_rejected_and_document_stays_saveable() {
+        let mut s = session();
+        s.execute("notes.add", json!({"x": 1.7e308, "y": 0})).unwrap();
+        let before = s.active().unwrap().doc.notes[0].clone();
+        let past = s.active().unwrap().history.past_len();
+        assert!(s.execute("notes.set", json!({"index": 0, "x": -1.7e308})).is_err());
+        let a = s.active().unwrap();
+        assert_eq!(a.doc.notes[0], before);
+        assert_eq!(a.history.past_len(), past);
+        assert!(photocraft_format::save_to_bytes(&a.doc, &Default::default()).is_ok());
+    }
+
     #[test]
     fn bad_params() {
         let mut s = session();
diff --git a/crates/engine/src/pixels.rs b/crates/engine/src/pixels.rs
index e0cea4f39e..b046de03bd 100644
--- a/crates/engine/src/pixels.rs
+++ b/crates/engine/src/pixels.rs
@@ -415,5 +415,10 @@ pub fn merge_down(doc: &Document, lower: &Layer, upper: &Layer) -> Layer {
     // Merge Down replaces the lower layer, so keep its editing restrictions.
     // In particular, a merged Background must remain opaque and position-locked.
     merged.locks = lower.locks;
+    // And its place: two layers clipped in one chain merge into a layer still clipped to the base,
+    // with the lower layer's colour label and link.
+    merged.clipped = lower.clipped && upper.clipped;
+    merged.label = lower.label;
+    merged.link_group = lower.link_group;
     merged
 }
diff --git a/crates/engine/src/prefs.rs b/crates/engine/src/prefs.rs
index c732daeefd..2c2507226d 100644
--- a/crates/engine/src/prefs.rs
+++ b/crates/engine/src/prefs.rs
@@ -529,8 +529,19 @@ pub struct Performance {
     /// sliders while they drag) render on a reduced copy: fast, but blocky when zoomed in. Off:
     /// they render at full resolution.
     pub low_resolution_previews: bool,
+    /// Low-latency drawing (applies at next launch): frames reach the screen without waiting for
+    /// vsync, so a stroke follows the pen about 50 ms sooner (the swap chain's wait, #1343). wgpu
+    /// picks Immediate where the driver has it (most Vulkan and DX12 drivers on Windows and X11),
+    /// so the canvas usually tears while it changes; Mailbox (no tearing) only where Immediate is
+    /// missing. Frames are capped at 240 fps. Off (the default): vsync, smooth but late. Desktop
+    /// only.
+    pub low_latency_drawing: bool,
     /// Linux display server (applies at next launch; see [`LinuxDisplayServer`]).
     pub linux_display_server: LinuxDisplayServer,
+    /// GPU memory the canvas compositor may hold for layer pages and effect maps, in MB; 0 is
+    /// automatic (a graphics card's own memory isn't charged for the document's pixels, memory
+    /// shared with the system is). Layers that don't fit redraw the whole document on the CPU.
+    pub gpu_memory_mb: u32,
     /// Memory budget of the layer-effect cache, in MB.
     pub effect_cache_mb: u32,
     pub legacy_compositing: bool,
@@ -560,7 +571,9 @@ impl Default for Performance {
             rendering_mode: None,
             gpu_backend: GpuBackend::Auto,
             low_resolution_previews: true,
+            low_latency_drawing: false,
             linux_display_server: LinuxDisplayServer::Auto,
+            gpu_memory_mb: 0,
             effect_cache_mb: 768,
             legacy_compositing: false,
         }
@@ -1099,6 +1112,7 @@ pub fn range(path: &str) -> Option<(f64, f64)> {
         "interface.notificationDurationSeconds" => (1.0, 120.0),
         "export.jpegQuality" | "export.webpQuality" => (1.0, 100.0),
         "performance.memoryUsageMb" => (256.0, 1_048_576.0),
+        "performance.gpuMemoryMb" => (0.0, 1_048_576.0),
         "performance.historyStates" => (1.0, 1000.0),
         "performance.cacheLevels" => (1.0, 8.0),
         "performance.cacheTileSize" => (256.0, 16384.0),
@@ -1495,9 +1509,65 @@ pub fn default_alternates(id: &str) -> impl Iterator<Item = &'static str> + '_ {
     ALTERNATE_SHORTCUTS.iter().filter(move |(c, _)| *c == id).map(|(_, sc)| *sc)
 }
 
-/// Every bindable id with its default: commands, then the temporary tools.
+/// Keys the system takes before the app sees them (switching apps, closing the window, force
+/// quit): `edit.keyboardShortcuts` won't bind them, as Photoshop won't. `sc` is in our notation,
+/// where `Cmd` is Ctrl off the Mac.
+pub fn reserved_shortcut(sc: &str) -> bool {
+    let Some(n) = normalize_shortcut(sc) else { return false };
+    let reserved: &[&str] = if cfg!(target_os = "macos") {
+        &["Cmd+Tab", "Cmd+Shift+Tab", "Cmd+Alt+Escape", "Cmd+`"]
+    } else if cfg!(target_os = "windows") {
+        &["Alt+Tab", "Alt+Shift+Tab", "Alt+F4", "Cmd+Alt+Delete", "Cmd+Escape", "Cmd+Shift+Escape"]
+    } else {
+        // Linux and the BSDs: window switching and closing, and the virtual consoles.
+        &[
+            "Alt+Tab",
+            "Alt+Shift+Tab",
+            "Alt+F4",
+            "Cmd+Alt+Delete",
+            "Cmd+Alt+F1",
+            "Cmd+Alt+F2",
+            "Cmd+Alt+F3",
+            "Cmd+Alt+F4",
+            "Cmd+Alt+F5",
+            "Cmd+Alt+F6",
+            "Cmd+Alt+F7",
+            "Cmd+Alt+F8",
+            "Cmd+Alt+F9",
+            "Cmd+Alt+F10",
+            "Cmd+Alt+F11",
+            "Cmd+Alt+F12",
+        ]
+    };
+    reserved.iter().filter_map(|r| normalize_shortcut(r)).any(|r| r == n)
+}
+
+/// What a bindable id is: a command (the engine's or the shell's), a tool, or a held tool.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum BindKind {
+    Command,
+    Tool,
+    Hold,
+}
+
+/// Every bindable id: (id, label, menu path, default key, kind). The engine's commands, the
+/// shell's ([`crate::shell_commands::SHELL_COMMANDS`]), the tools and the held temporary tools,
+/// so Edit › Keyboard Shortcuts works the same with or without the app's UI.
+pub fn bindable_items() -> impl Iterator<Item = (&'static str, &'static str, &'static [&'static str], Option<&'static str>, BindKind)> {
+    let engine = crate::command_specs().iter().map(|c| (c.id, c.label, c.menu, c.shortcut, BindKind::Command));
+    let shell = crate::shell_commands::SHELL_COMMANDS.iter().map(|c| (c.0, c.1, c.2, c.3, BindKind::Command));
+    let tools = crate::shell_commands::TOOLS.iter().map(|t| (t.0, t.1, &["Tools"][..], t.2, BindKind::Tool));
+    let hold = TEMPORARY_TOOLS.iter().map(|t| (t.0, t.1, &["Tools", "Temporary"][..], Some(t.2), BindKind::Hold));
+    engine.chain(shell).chain(tools).chain(hold)
+}
+
+/// Every bindable id with its default.
 fn bindable() -> impl Iterator<Item = (&'static str, Option<&'static str>)> {
-    crate::command_specs().iter().map(|c| (c.id, c.shortcut)).chain(TEMPORARY_TOOLS.iter().map(|t| (t.0, Some(t.2))))
+    bindable_items().map(|i| (i.0, i.3))
+}
+
+fn is_tool(id: &str) -> bool {
+    crate::shell_commands::tool_default(id).is_some()
 }
 
 /// Shortcuts bound to more than one command: (shortcut, ids). `bindings` are (id, shortcut).
@@ -1866,18 +1936,45 @@ fn keyboard_shortcuts(s: &mut Session, p: &Value) -> Result<Value> {
     let imported;
     let mut import = None;
     let p = match p.get("importKys") {
-        Some(xml) => {
-            let xml = xml.as_str().ok_or_else(|| bad(cmd, "`importKys` is the text of a .kys file"))?;
+        Some(v) => {
+            // The file's text, or {"path": …} to read it.
+            let read;
+            let xml = match v {
+                Value::String(s) => s.as_str(),
+                Value::Object(o) => {
+                    let path =
+                        o.get("path").and_then(Value::as_str).filter(|s| !s.trim().is_empty()).ok_or_else(|| bad(cmd, "`importKys.path` is a .kys file"))?;
+                    read = read_text_file(path, crate::kys::MAX_BYTES).map_err(|e| bad(cmd, format!("{path}: {e}")))?;
+                    read.as_str()
+                }
+                _ => return Err(bad(cmd, "`importKys` is the text of a .kys file, or {\"path\": …}")),
+            };
             let set = crate::kys::parse(xml).map_err(|e| bad(cmd, e))?;
             let plan = crate::kys::plan(crate::kys::command_candidates(), &set);
             let mut merged = serde_json::Map::new();
-            for (id, sc) in &plan.set {
+            // A key the system reserves is left out (reported as `reserved`), not a failed import.
+            let mut skipped: Vec<String> = Vec::new();
+            for (id, sc) in plan.set.iter().filter(|(id, sc)| {
+                let bad = reserved_shortcut(sc);
+                if bad {
+                    skipped.push(format!("{id}: {sc}"));
+                }
+                !bad
+            }) {
                 let default = crate::command_specs().iter().find(|c| c.id == id).and_then(|c| c.shortcut).and_then(normalize_shortcut);
                 merged.insert(id.clone(), if default.as_deref() == Some(sc.as_str()) { Value::Null } else { json!(sc) });
             }
+            // Tool keys: a tool's own letter restores it (and its Shift cycling).
+            let tools = crate::shell_commands::TOOLS.iter().map(|t| (t.0, t.1));
+            let (tool_keys, unknown_tools) = crate::kys::plan_tools(tools, &set);
+            for (id, key) in &tool_keys {
+                let own = crate::shell_commands::tool_default(id).flatten().is_some_and(|d| d.eq_ignore_ascii_case(key));
+                merged.insert(id.clone(), if own { Value::Null } else { json!(key) });
+            }
             merged.extend(p.get("set").and_then(Value::as_object).cloned().unwrap_or_default());
             let mut alternates = serde_json::Map::new();
             for (id, keys) in &plan.alternate_keys {
+                let keys: &Vec<String> = &keys.iter().filter(|k| !reserved_shortcut(k)).cloned().collect();
                 let main = plan.set.get(id).map(String::as_str);
                 let default = Preferences::default().alternates(id, main);
                 alternates.insert(id.clone(), if *keys == default { Value::Null } else { json!(keys) });
@@ -1892,6 +1989,9 @@ fn keyboard_shortcuts(s: &mut Session, p: &Value) -> Result<Value> {
                 "alternates": plan.alternates,
                 "alternateKeys": plan.alternate_keys,
                 "toolKeys": set.tool_keys,
+                "tools": tool_keys,
+                "unknownTools": unknown_tools,
+                "reserved": skipped,
                 "windows": set.windows,
             }));
             let mut with_import = p.clone();
@@ -1914,6 +2014,17 @@ fn keyboard_shortcuts(s: &mut Session, p: &Value) -> Result<Value> {
     if !set.is_empty() || !alts.is_empty() {
         let allow_unknown = p.get("allowUnknown").and_then(Value::as_bool).unwrap_or(false);
         changed = true;
+        // Reserved system keys can't be bound, by hand or from a file.
+        let reserved = |v: &Value| -> Option<String> {
+            let keys = match v {
+                Value::String(s) => vec![s.clone()],
+                other => alternate_keys(other).unwrap_or_default(),
+            };
+            keys.into_iter().find(|k| reserved_shortcut(k))
+        };
+        if let Some((id, k)) = set.iter().chain(alts.iter()).find_map(|(id, v)| reserved(v).map(|k| (id, k))) {
+            return Err(bad(cmd, format!("`{k}` (for `{id}`) is reserved by the system and can't be assigned")));
+        }
         for (id, v) in set {
             if !bindable().any(|(b, _)| b == id) && !allow_unknown {
                 return Err(bad(cmd, format!("unknown command `{id}`")));
@@ -1935,9 +2046,11 @@ fn keyboard_shortcuts(s: &mut Session, p: &Value) -> Result<Value> {
                 .chain(alts.iter().flat_map(|(id, v)| alternate_keys(v).unwrap_or_default().into_iter().map(move |k| (id.as_str(), k))))
                 .collect();
             for (id, sc) in assigned {
-                // Shell commands (View › Zoom In) have alternates but no engine default.
-                let shell = ALTERNATE_SHORTCUTS.iter().filter(|(c, _)| crate::commands::find(c).is_none()).map(|(c, _)| (*c, None));
-                for (c, def) in bindable().chain(shell) {
+                for (c, def) in bindable() {
+                    // Tools may share a key: they cycle with Shift, as Photoshop's groups do.
+                    if is_tool(id) && is_tool(c) {
+                        continue;
+                    }
                     // Never strip a command that this same call is assigning:
                     // two entries for one key are a clash inside the call, which
                     // the returned conflicts list reports (#719). Stripping
@@ -1959,16 +2072,11 @@ fn keyboard_shortcuts(s: &mut Session, p: &Value) -> Result<Value> {
     }
     // Then the sets are saved, deleted or switched, from the bindings as they now stand.
     changed |= crate::shortcut_sets::store(&mut next, p).map_err(|e| bad(cmd, e))?;
-    if changed {
-        s.edit_prefs(|p| *p = next);
-    }
-    let prefs = s.prefs();
+    // The reply and the exports read the bindings as they will be; they are committed only once
+    // the exports are written, so a bad export target changes nothing.
+    let prefs = &next;
     let filter = p.get("filter").and_then(Value::as_str).map(str::to_ascii_lowercase);
-    let temporary = TEMPORARY_TOOLS.iter().map(|t| (t.0, t.1, &["Tools", "Temporary"][..], Some(t.2), true));
-    let list: Vec<Value> = crate::command_specs()
-        .iter()
-        .map(|c| (c.id, c.label, c.menu, c.shortcut, false))
-        .chain(temporary)
+    let list: Vec<Value> = bindable_items()
         .filter(|c| filter.as_ref().is_none_or(|f| c.0.to_ascii_lowercase().contains(f) || c.1.to_ascii_lowercase().contains(f)))
         .filter(|c| {
             p.get("list").and_then(Value::as_bool).unwrap_or(false)
@@ -1976,15 +2084,17 @@ fn keyboard_shortcuts(s: &mut Session, p: &Value) -> Result<Value> {
                 || prefs.shortcuts.contains_key(c.0)
                 || prefs.alternate_shortcuts.contains_key(c.0)
         })
-        .map(|(id, label, menu, def, hold)| {
+        .map(|(id, label, menu, def, kind)| {
             let main = prefs.shortcut(id, def);
             let defaults: Vec<&str> = default_alternates(id).collect();
             let mut v = json!({"id": id, "label": label, "menu": menu, "default": def, "shortcut": main, "alternates": prefs.alternates(id, main)});
             if !defaults.is_empty() {
                 v["defaultAlternates"] = json!(defaults);
             }
-            if hold {
-                v["hold"] = json!(true);
+            match kind {
+                BindKind::Hold => v["hold"] = json!(true),
+                BindKind::Tool => v["tool"] = json!(true),
+                BindKind::Command => {}
             }
             v
         })
@@ -1995,30 +2105,59 @@ fn keyboard_shortcuts(s: &mut Session, p: &Value) -> Result<Value> {
         bindings.extend(main.map(|m| (id, m.to_string())));
         bindings.extend(prefs.alternates(id, main).into_iter().map(|k| (id, k)));
     }
-    let conflicts: Vec<Value> =
-        conflicts(bindings.iter().map(|(id, k)| (*id, k.as_str()))).into_iter().map(|(sc, ids)| json!({"shortcut": sc, "commands": ids})).collect();
+    // Tools sharing a key are a cycling group, not a conflict.
+    let conflicts: Vec<Value> = conflicts(bindings.iter().map(|(id, k)| (*id, k.as_str())))
+        .into_iter()
+        .filter(|(_, ids)| !ids.iter().all(|id| is_tool(id)))
+        .map(|(sc, ids)| json!({"shortcut": sc, "commands": ids}))
+        .collect();
     let mut out = json!({"overrides": prefs.shortcuts, "alternateOverrides": prefs.alternate_shortcuts, "commands": list, "conflicts": conflicts});
     if let (Some(o), Value::Object(sets)) = (out.as_object_mut(), crate::shortcut_sets::describe(prefs)) {
         o.extend(sets);
     }
-    // The bindings as a `.kys` file, or Photoshop's Summarize page (the engine's commands; the
-    // app's dialog writes both with the shell's commands and tools added).
+    // The bindings as a `.kys` file, or Photoshop's Summarize page: every bindable item (the
+    // engine's commands, the shell's commands and the tools).
     let set_name = if prefs.shortcut_set.is_empty() { crate::shortcut_sets::DEFAULTS_NAME } else { prefs.shortcut_set.as_str() };
-    if p.get("exportKys").and_then(Value::as_bool) == Some(true) {
+    // Both targets are resolved and their texts made before anything is written, and a path that
+    // can't be written is refused before either file is: a bad export changes nothing.
+    let kys_target = file_target(cmd, p.get("exportKys"))?;
+    let html_target = file_target(cmd, p.get("summarize"))?;
+    let mut files: Vec<(&str, String, String)> = Vec::new();
+    if let Some(target) = kys_target {
         let entries: Vec<crate::kys::Entry> =
-            crate::shortcut_sets::bound(prefs).into_iter().map(|(id, label, _, keys)| crate::kys::Entry { id, label, tool: false, keys }).collect();
-        out["kys"] = json!(crate::kys::write(set_name, &entries));
+            crate::shortcut_sets::bound(prefs).into_iter().map(|b| crate::kys::Entry { id: b.id, label: b.label, tool: b.tool, keys: b.keys }).collect();
+        let text = crate::kys::write(set_name, &entries);
+        match target {
+            Some(path) => files.push(("kysPath", path, text)),
+            None => out["kys"] = json!(text),
+        }
     }
-    if let Some(v) = p.get("summarize").filter(|v| !v.is_null() && *v != &json!(false)) {
+    if let Some(target) = html_target {
+        let v = p.get("summarize").cloned().unwrap_or(Value::Null);
         let mac = v.get("mac").and_then(Value::as_bool).unwrap_or(cfg!(target_os = "macos"));
         let mut sections: Vec<crate::shortcut_sets::Section> = Vec::new();
-        for (_, label, menu, keys) in crate::shortcut_sets::bound(prefs) {
+        for crate::shortcut_sets::Bound { label, menu, keys, .. } in crate::shortcut_sets::bound(prefs) {
             match sections.iter_mut().find(|(m, _)| *m == menu) {
                 Some((_, rows)) => rows.push((label, keys)),
                 None => sections.push((menu, vec![(label, keys)])),
             }
         }
-        out["html"] = json!(crate::shortcut_sets::summarize(set_name, &sections, mac));
+        let html = crate::shortcut_sets::summarize(set_name, &sections, mac);
+        match target {
+            Some(path) => files.push(("htmlPath", path, html)),
+            None => out["html"] = json!(html),
+        }
+    }
+    for (_, path, _) in &files {
+        writable(path).map_err(|e| bad(cmd, format!("{path}: {e}")))?;
+    }
+    let list: Vec<(&str, &str)> = files.iter().map(|(_, path, text)| (path.as_str(), text.as_str())).collect();
+    write_files_atomically(&list, &rename_path).map_err(|e| bad(cmd, e))?;
+    for (key, path, _) in &files {
+        out[*key] = json!(path);
+    }
+    if changed {
+        s.edit_prefs(|p| *p = next);
     }
     if let Some(import) = import {
         out["import"] = import;
@@ -2026,6 +2165,203 @@ fn keyboard_shortcuts(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(out)
 }
 
+/// An output parameter (`exportKys`, `summarize`): absent or false → `None`; true (or an object
+/// without `path`) → `Some(None)`, the text comes back in the reply; `{"path": …}` →
+/// `Some(Some(path))`, written there.
+fn file_target(cmd: &str, v: Option<&Value>) -> Result<Option<Option<String>>> {
+    match v {
+        None | Some(Value::Null) | Some(Value::Bool(false)) => Ok(None),
+        Some(Value::Bool(true)) => Ok(Some(None)),
+        Some(Value::Object(o)) => match o.get("path") {
+            None | Some(Value::Null) => Ok(Some(None)),
+            Some(Value::String(s)) if !s.trim().is_empty() => Ok(Some(Some(s.clone()))),
+            Some(_) => Err(bad(cmd, "`path` must be a non-empty string")),
+        },
+        Some(_) => Err(bad(cmd, "expected true or {\"path\": …}")),
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn read_text_file(path: &str, max: usize) -> std::result::Result<String, String> {
+    let meta = std::fs::metadata(path).map_err(|e| e.to_string())?;
+    if !meta.is_file() || meta.len() > max as u64 {
+        return Err(format!("not a file of at most {} KiB", max / 1024));
+    }
+    std::fs::read_to_string(path).map_err(|e| e.to_string())
+}
+
+#[cfg(target_arch = "wasm32")]
+fn read_text_file(_: &str, _: usize) -> std::result::Result<String, String> {
+    Err("paths can't be read on the web; pass the file's text instead".into())
+}
+
+/// Whether `path` can be written: not a folder, in a folder that exists.
+#[cfg(not(target_arch = "wasm32"))]
+fn writable(path: &str) -> std::result::Result<(), String> {
+    let p = std::path::Path::new(path);
+    if p.is_dir() {
+        return Err("is a folder".into());
+    }
+    if std::fs::metadata(p).is_ok_and(|m| m.permissions().readonly()) {
+        return Err("is read-only".into());
+    }
+    match p.parent().filter(|d| !d.as_os_str().is_empty()) {
+        Some(d) if !d.is_dir() => Err("its folder doesn't exist".into()),
+        _ => Ok(()),
+    }
+}
+
+#[cfg(target_arch = "wasm32")]
+fn writable(_: &str) -> std::result::Result<(), String> {
+    Err("paths can't be written on the web; omit `path` to get the text back".into())
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn rename_path(from: &std::path::Path, to: &std::path::Path) -> std::io::Result<()> {
+    std::fs::rename(from, to)
+}
+
+#[cfg(target_arch = "wasm32")]
+fn rename_path(_: &std::path::Path, _: &std::path::Path) -> std::io::Result<()> {
+    Err(std::io::Error::other("paths can't be written on the web"))
+}
+
+/// Where `path` points, for telling whether two targets are one file: its folder resolved, its
+/// name compared without case where the file system ignores it.
+#[cfg(not(target_arch = "wasm32"))]
+fn path_key(path: &str) -> String {
+    let p = std::path::Path::new(path);
+    let dir = p.parent().filter(|d| !d.as_os_str().is_empty()).unwrap_or(std::path::Path::new("."));
+    let dir = dir.canonicalize().unwrap_or_else(|_| dir.to_path_buf());
+    let key = dir.join(p.file_name().unwrap_or_default()).to_string_lossy().into_owned();
+    if cfg!(any(target_os = "windows", target_os = "macos")) { key.to_lowercase() } else { key }
+}
+
+/// A new, empty file beside `path` with a name nothing else uses (`create_new`), for staging
+/// (`kind` "tmp") or a backup ("bak").
+#[cfg(not(target_arch = "wasm32"))]
+fn sibling(path: &str, kind: &str) -> std::io::Result<(std::path::PathBuf, std::fs::File)> {
+    for n in 0..1000u32 {
+        let p = std::path::PathBuf::from(format!("{path}.{}-{n}.photocraft-{kind}", std::process::id()));
+        match std::fs::OpenOptions::new().write(true).create_new(true).open(&p) {
+            Ok(f) => return Ok((p, f)),
+            Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => continue,
+            Err(e) => return Err(e),
+        }
+    }
+    Err(std::io::Error::other("no free name beside it"))
+}
+
+/// Write `files` ((path, text)) all or nothing. Each text is staged in a new file beside its
+/// target; once every one is written, each existing target is moved aside to a backup and the
+/// staged file moved in. Any failure moves the backups back and removes what was staged, so the
+/// user's files end as they began; on success the backups go. Two targets naming one file are
+/// refused. `rename` is `std::fs::rename` (a test fails it on purpose).
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) fn write_files_atomically(
+    files: &[(&str, &str)],
+    rename: &dyn Fn(&std::path::Path, &std::path::Path) -> std::io::Result<()>,
+) -> std::result::Result<(), String> {
+    use std::io::Write;
+    use std::path::{Path, PathBuf};
+    for (i, (a, _)) in files.iter().enumerate() {
+        if files.iter().skip(i + 1).any(|(b, _)| path_key(a) == path_key(b)) {
+            return Err(format!("{a}: two exports to the same file"));
+        }
+    }
+    let mut staged: Vec<PathBuf> = Vec::new();
+    let drop_all = |paths: &[PathBuf]| {
+        for p in paths {
+            let _ = std::fs::remove_file(p);
+        }
+    };
+    for (path, text) in files {
+        let (tmp, mut f) = match sibling(path, "tmp") {
+            Ok(v) => v,
+            Err(e) => {
+                drop_all(&staged);
+                return Err(format!("{path}: {e}"));
+            }
+        };
+        staged.push(tmp);
+        if let Err(e) = f.write_all(text.as_bytes()).and_then(|()| f.sync_all()) {
+            drop_all(&staged);
+            return Err(format!("{path}: {e}"));
+        }
+    }
+    // (target, its backup) of each file moved in so far.
+    let mut moved: Vec<(&Path, Option<PathBuf>)> = Vec::new();
+    // Put each backup back over its target (a target that had none is removed). What couldn't be
+    // put back is named, so the user can find their previous file.
+    let undo = |moved: &[(&Path, Option<PathBuf>)]| -> String {
+        let mut stranded = Vec::new();
+        for (target, backup) in moved.iter().rev() {
+            match backup {
+                Some(b) => {
+                    if rename(b, target).is_err() {
+                        stranded.push(format!("the previous {} is at {}", target.display(), b.display()));
+                    }
+                }
+                None => {
+                    let _ = std::fs::remove_file(target);
+                }
+            }
+        }
+        if stranded.is_empty() { String::new() } else { format!(" ({})", stranded.join("; ")) }
+    };
+    for ((path, _), tmp) in files.iter().zip(&staged) {
+        let target = Path::new(*path);
+        let backup = if target.exists() {
+            let moved_aside = sibling(path, "bak").and_then(|(b, f)| {
+                drop(f);
+                match rename(target, &b) {
+                    Ok(()) => Ok(b),
+                    Err(e) => {
+                        // The placeholder the backup name reserved goes too.
+                        let _ = std::fs::remove_file(&b);
+                        Err(e)
+                    }
+                }
+            });
+            match moved_aside {
+                Ok(b) => Some(b),
+                Err(e) => {
+                    let stranded = undo(&moved);
+                    drop_all(&staged);
+                    return Err(format!("{path}: {e}{stranded}"));
+                }
+            }
+        } else {
+            None
+        };
+        if let Err(e) = rename(tmp, target) {
+            let mut stranded = undo(&moved);
+            if let Some(b) = &backup
+                && rename(b, target).is_err()
+            {
+                stranded = format!("{stranded} (the previous {path} is at {})", b.display());
+            }
+            drop_all(&staged);
+            return Err(format!("{path}: {e}{stranded}"));
+        }
+        moved.push((target, backup));
+    }
+    for (_, backup) in moved {
+        if let Some(b) = backup {
+            let _ = std::fs::remove_file(b);
+        }
+    }
+    Ok(())
+}
+
+#[cfg(target_arch = "wasm32")]
+pub(crate) fn write_files_atomically(
+    files: &[(&str, &str)],
+    _: &dyn Fn(&std::path::Path, &std::path::Path) -> std::io::Result<()>,
+) -> std::result::Result<(), String> {
+    if files.is_empty() { Ok(()) } else { Err("paths can't be written on the web; omit `path` to get the text back".into()) }
+}
+
 /// Edit › Menus: hide/show items and give them colours.
 fn menus(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = |k: &str| -> Vec<String> {
@@ -2151,7 +2487,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Keyboard Shortcuts…",
             ["Edit"],
             Some("Cmd+Alt+Shift+K"),
-            r##"{"set":{"<command id>|tools.temporary.hand|zoomIn|zoomOut":"Cmd+Shift+X"|""(remove)|null(default)}?,"alternates":{"<command id>":["F3",…]|[](none)|null(default)}?,"reset":true|["<id>",…]?,"removeConflicts":bool=true,"filter":str?,"list":bool=false,"importKys":"<.kys XML>"?,"useSet":"<name>"|""(defaults)?,"saveSet":"<name>"?,"deleteSet":"<name>"?,"sets":{"<name>":{"shortcuts":{…},"alternateShortcuts":{…}}}?,"activeSet":"<name>"|""?,"exportKys":bool?,"summarize":bool|{"mac":bool}?}"##,
+            r##"{"set":{"<command id>|tools.temporary.hand|zoomIn|zoomOut":"Cmd+Shift+X"|""(remove)|null(default)}?,"alternates":{"<command id>":["F3",…]|[](none)|null(default)}?,"reset":true|["<id>",…]?,"removeConflicts":bool=true,"filter":str?,"list":bool=false,"importKys":"<.kys XML>"|{"path":".kys"}?,"useSet":"<name>"|""(defaults)?,"saveSet":"<name>"?,"deleteSet":"<name>"?,"sets":{"<name>":{"shortcuts":{…},"alternateShortcuts":{…}}}?,"activeSet":"<name>"|""?,"exportKys":true|{"path":".kys"}?,"summarize":true|{"mac":bool,"path":".html"}?} (with a path the file is written and the reply has kysPath/htmlPath instead of kys/html)"##,
             keyboard_shortcuts,
             true
         ),
diff --git a/crates/engine/src/prefs/tests.rs b/crates/engine/src/prefs/tests.rs
index bf2fe52efd..5314d1f197 100644
--- a/crates/engine/src/prefs/tests.rs
+++ b/crates/engine/src/prefs/tests.rs
@@ -827,3 +827,91 @@ fn shift_key_tool_switch_is_on_by_default_and_a_stored_false_is_kept() {
     let stored: Tools = serde_json::from_value(json!({"useShiftKeyForToolSwitch": false})).unwrap();
     assert!(!stored.use_shift_key_for_tool_switch);
 }
+
+/// Shortcut exports are all or nothing (#5801): a rename that fails after the first file was
+/// moved in puts the user's files back as they were and leaves nothing staged.
+#[test]
+fn exports_are_written_all_or_nothing() {
+    use super::write_files_atomically;
+    let dir = std::env::temp_dir().join(format!("photocraft-atomic-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let (a, b) = (dir.join("a.kys"), dir.join("b.html"));
+    std::fs::write(&a, "old A").unwrap();
+    std::fs::write(&b, "old B").unwrap();
+    let (pa, pb) = (a.to_str().unwrap(), b.to_str().unwrap());
+    let staged_moves = std::cell::Cell::new(0);
+    let failing = |from: &std::path::Path, to: &std::path::Path| {
+        if from.to_string_lossy().ends_with("photocraft-tmp") {
+            staged_moves.set(staged_moves.get() + 1);
+            if staged_moves.get() == 2 {
+                return Err(std::io::Error::other("disk gone"));
+            }
+        }
+        std::fs::rename(from, to)
+    };
+    assert!(write_files_atomically(&[(pa, "new A"), (pb, "new B")], &failing).is_err());
+    assert_eq!((std::fs::read_to_string(&a).unwrap(), std::fs::read_to_string(&b).unwrap()), ("old A".into(), "old B".into()));
+    let leftovers = || std::fs::read_dir(&dir).unwrap().filter_map(|e| e.ok()).filter(|e| e.file_name().to_string_lossy().contains(".photocraft-")).count();
+    assert_eq!(leftovers(), 0);
+    // A backup move that fails leaves no empty placeholder behind.
+    let backups = std::cell::Cell::new(0);
+    let failing_backup = |from: &std::path::Path, to: &std::path::Path| {
+        if to.to_string_lossy().ends_with("photocraft-bak") {
+            backups.set(backups.get() + 1);
+            if backups.get() == 2 {
+                return Err(std::io::Error::other("locked"));
+            }
+        }
+        std::fs::rename(from, to)
+    };
+    assert!(write_files_atomically(&[(pa, "new A"), (pb, "new B")], &failing_backup).is_err());
+    assert_eq!((std::fs::read_to_string(&a).unwrap(), std::fs::read_to_string(&b).unwrap()), ("old A".into(), "old B".into()));
+    assert_eq!(leftovers(), 0);
+    // The same target twice is refused before anything is written.
+    assert!(write_files_atomically(&[(pa, "x"), (pa, "y")], &|f, t| std::fs::rename(f, t)).is_err());
+    assert_eq!(std::fs::read_to_string(&a).unwrap(), "old A");
+    // A target named like a staging file is just a file.
+    let odd = dir.join("c.kys.photocraft-tmp");
+    std::fs::write(&odd, "old C").unwrap();
+    write_files_atomically(&[(pa, "new A"), (odd.to_str().unwrap(), "new C")], &|f, t| std::fs::rename(f, t)).unwrap();
+    assert_eq!((std::fs::read_to_string(&a).unwrap(), std::fs::read_to_string(&odd).unwrap()), ("new A".into(), "new C".into()));
+    assert_eq!(leftovers(), 1, "only c.kys.photocraft-tmp itself");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// A backup that can't be put back after a failed export is named in the error, and stays where
+/// it is with the user's previous text.
+#[test]
+fn a_stranded_backup_is_named_in_the_error() {
+    use super::write_files_atomically;
+    let dir = std::env::temp_dir().join(format!("photocraft-stranded-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let (a, b) = (dir.join("a.kys"), dir.join("b.html"));
+    std::fs::write(&a, "old A").unwrap();
+    std::fs::write(&b, "old B").unwrap();
+    let (pa, pb) = (a.to_str().unwrap(), b.to_str().unwrap());
+    let staged = std::cell::Cell::new(0);
+    // The second staged move fails, and so does putting a.kys's backup back.
+    let rename = |from: &std::path::Path, to: &std::path::Path| {
+        let f = from.to_string_lossy();
+        if f.ends_with("photocraft-tmp") {
+            staged.set(staged.get() + 1);
+            if staged.get() == 2 {
+                return Err(std::io::Error::other("disk gone"));
+            }
+        }
+        if f.ends_with("photocraft-bak") && to == a.as_path() {
+            return Err(std::io::Error::other("locked"));
+        }
+        std::fs::rename(from, to)
+    };
+    let e = write_files_atomically(&[(pa, "new A"), (pb, "new B")], &rename).unwrap_err();
+    assert!(e.contains(&format!("the previous {} is at", a.display())), "{e}");
+    let backup: Vec<_> =
+        std::fs::read_dir(&dir).unwrap().filter_map(|e| e.ok()).map(|e| e.path()).filter(|p| p.to_string_lossy().ends_with("photocraft-bak")).collect();
+    assert_eq!(backup.len(), 1, "{backup:?}");
+    assert!(e.contains(&backup[0].display().to_string()), "{e}");
+    assert_eq!(std::fs::read_to_string(&backup[0]).unwrap(), "old A");
+    assert_eq!(std::fs::read_to_string(&b).unwrap(), "old B");
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/engine/src/presets/mod.rs b/crates/engine/src/presets/mod.rs
index 6c722c62ef..81382b418a 100644
--- a/crates/engine/src/presets/mod.rs
+++ b/crates/engine/src/presets/mod.rs
@@ -168,10 +168,29 @@ impl PresetState {
 }
 
 impl Session {
-    /// Restore presets saved by [`PresetState::to_json`]. Missing sets keep their defaults; a
-    /// malformed blob is ignored (presets are never worth refusing to start over).
+    /// Restore presets saved by [`PresetState::to_json`]. Missing or malformed sets keep their
+    /// defaults (presets are never worth refusing to start over). Each set loads on its own: the
+    /// shell writes back only the keys that changed, so one damaged set would otherwise discard
+    /// every other set, saved document presets included, at each launch (#5602).
     pub fn load_presets_json(&mut self, v: Value) {
-        let Ok(p) = serde_json::from_value::<Persisted>(v) else { return };
+        let Value::Object(mut m) = v else { return };
+        fn take<T: serde::de::DeserializeOwned>(m: &mut serde_json::Map<String, Value>, key: &str) -> Option<T> {
+            m.remove(key).filter(|v| !v.is_null()).and_then(|v| serde_json::from_value(v).ok())
+        }
+        let p = Persisted {
+            gradients: take(&mut m, "gradients"),
+            gradient: take(&mut m, "gradient"),
+            styles: take(&mut m, "styles"),
+            shapes: take(&mut m, "shapes"),
+            pattern_groups: take(&mut m, "pattern_groups"),
+            tool_presets: take(&mut m, "tool_presets"),
+            documents: take(&mut m, "documents"),
+            recent_documents: take(&mut m, "recent_documents"),
+            export_presets: take(&mut m, "export_presets"),
+            custom_shapes: take(&mut m, "custom_shapes"),
+            layer_defaults: take(&mut m, "layer_defaults"),
+            swatches: take(&mut m, "swatches"),
+        };
         let st = &mut self.presets;
         if let Some(g) = p.gradients {
             st.gradients = g;
diff --git a/crates/engine/src/presets/tests.rs b/crates/engine/src/presets/tests.rs
index dcfc4e94d8..b7c0a3ede2 100644
--- a/crates/engine/src/presets/tests.rs
+++ b/crates/engine/src/presets/tests.rs
@@ -748,3 +748,29 @@ fn clone_source_errors_and_overlay() {
     assert_eq!(v["width"], json!(1000.0));
     assert_eq!(v["rotation"], json!(-90.0));
 }
+
+// ------------------------------------------------------------------ persistence
+
+/// #5602: one damaged preset set in the preferences file must not discard the saved New
+/// Document presets (or any other set) at the next launch.
+#[test]
+fn a_damaged_preset_set_keeps_the_other_sets() {
+    let mut s = Session::new();
+    let settings = json!({"width": 1600, "height": 900, "resolution": 144});
+    s.execute("document.presets.save", json!({"name": "Banner", "settings": settings})).unwrap();
+    let saved = s.presets.to_json(&s);
+    for key in ["gradients", "gradient", "styles", "shapes", "pattern_groups", "custom_shapes", "layer_defaults", "swatches"] {
+        let mut blob = saved.clone();
+        blob[key] = json!("not a preset set");
+        let mut next = Session::new();
+        next.load_presets_json(blob);
+        assert_eq!(next.presets.documents, s.presets.documents, "damaged `{key}`");
+        assert_eq!(next.presets.tool_presets.len(), Session::new().presets.tool_presets.len(), "damaged `{key}`");
+    }
+    // Null sets keep their defaults, as before.
+    let mut next = Session::new();
+    next.load_presets_json(json!({"tool_presets": null, "gradients": null, "documents": saved["documents"].clone()}));
+    assert_eq!(next.presets.tool_presets.len(), Session::new().presets.tool_presets.len());
+    assert_eq!(next.presets.gradients.len(), Session::new().presets.gradients.len());
+    assert_eq!(next.presets.documents, s.presets.documents);
+}
diff --git a/crates/engine/src/print_cmds.rs b/crates/engine/src/print_cmds.rs
index 9a0af4a054..3cc99aa276 100644
--- a/crates/engine/src/print_cmds.rs
+++ b/crates/engine/src/print_cmds.rs
@@ -8,6 +8,12 @@
 //! `"dryRun": true` reports the backend command without spooling; a PDF is kept only at an
 //! explicit output path. Shared spooler transport files are private and automatically removed.
 //!
+//! Where `lp` is not on the path (a Flatpak has none), the job goes to CUPS over IPP in-process
+//! (`photocraft-ipp`, through the sandbox's `--socket=cups`), and when no print server or no
+//! printer is reachable, to the app's spooler, the XDG Print portal (`Session::print_spooler`;
+//! `PHOTOCRAFT_PRINT_PORTAL=1` prefers it, `=0` removes it). `"printServer"` names a server for
+//! one job and always takes the IPP route; `file.printers` lists the queues (#2728).
+//!
 //! Paths to Illustrator writes the document's paths as an Adobe Illustrator 3 compatible
 //! PostScript file (`m`/`L`/`C` path construction, `n`/`N` unpainted closed/open paths, `*u`/`*U`
 //! compound paths), following the public PostScript Language Reference and the AI3 format notes.
@@ -31,6 +37,191 @@ fn other(e: impl std::fmt::Display) -> EngineError {
     EngineError::Other(e.to_string())
 }
 
+// ---------- Spooling ----------
+
+/// A rendered page on its way to the printer: what the IPP route and the app's spooler need.
+#[derive(Debug, Clone)]
+pub struct PrintJob {
+    pub pdf: Vec<u8>,
+    /// The printer asked for; `None` means the default.
+    pub printer: Option<String>,
+    pub copies: u32,
+    /// The queue entry's name: the document's.
+    pub title: String,
+    /// A print server named in the request (`printServer`), else the system's.
+    pub server: Option<String>,
+    /// The page size in points, as laid out (landscape already applied).
+    pub paper: (f64, f64),
+    pub landscape: bool,
+}
+
+/// A spooler's work: the job in, where it went out.
+pub type SpoolFn = std::sync::Arc<dyn Fn(&PrintJob) -> std::result::Result<String, String> + Send + Sync>;
+
+/// A further route to the printer, installed by the app on `Session::print_spooler`: the XDG
+/// Print portal, which shows the system print dialog from inside a sandbox. It takes the jobs
+/// no other route can (no print server reachable, no printer set up), or every job when
+/// `preferred`.
+#[derive(Clone)]
+pub struct Spooler {
+    /// Reported as the job's `backend`.
+    pub name: &'static str,
+    pub preferred: bool,
+    /// Returns where the job went ("the system print dialog").
+    pub run: SpoolFn,
+}
+
+/// Why the IPP route could not spool: no route at all (the app's spooler may have one), or a
+/// failure on a route that exists (a wrong printer name, a rejected job).
+enum SpoolError {
+    NoRoute(String),
+    Failed(String),
+}
+
+/// Sends the job and says where it went and through what. A named print server takes the IPP
+/// route. Otherwise: the app's spooler when it is preferred; else `craft-print` (`lp`, or the
+/// Windows spooler) when it is there; else CUPS over IPP; and the app's spooler when that had
+/// no route either. A route that exists but fails (an unknown printer, a refused job) is an
+/// error, never a fall-through.
+fn spool_job(spooler: Option<&Spooler>, job: &PrintJob, lp: &craft_print::Job) -> Result<(String, String)> {
+    let app = |sp: &Spooler| (sp.run)(job).map(|m| (m, sp.name.to_string())).map_err(other);
+    if job.server.is_none() {
+        if let Some(sp) = spooler.filter(|sp| sp.preferred) {
+            return app(sp);
+        }
+        if let Some(name) = system_spooler() {
+            return craft_print::submit(&job.pdf, lp).map(|m| (m, name.to_string())).map_err(other);
+        }
+    }
+    match cups_spool(job) {
+        Ok(m) => Ok((m, "ipp".into())),
+        Err(SpoolError::NoRoute(why)) => match spooler {
+            Some(sp) => app(sp),
+            None => Err(other(why)),
+        },
+        Err(SpoolError::Failed(why)) => Err(other(why)),
+    }
+}
+
+/// The spooler `craft-print` can talk to, as the job's `backend` name: `lp` when CUPS' command
+/// is on the path, the Windows spooler on Windows. `None` in a sandbox without `lp` and in the
+/// browser.
+fn system_spooler() -> Option<&'static str> {
+    match craft_print::backend()? {
+        craft_print::Backend::WindowsPdf => Some("windows"),
+        craft_print::Backend::Cups => {
+            let path = std::env::var_os("PATH")?;
+            std::env::split_paths(&path).any(|dir| dir.join("lp").is_file()).then_some("lp")
+        }
+    }
+}
+
+/// The printer a job goes to: the one asked for when the server knows it, else the default,
+/// else the only one; otherwise an error that names what there is.
+#[cfg(all(not(target_arch = "wasm32"), not(target_os = "windows")))]
+fn resolve_printer(requested: Option<&str>, default: Option<&str>, printers: &[photocraft_ipp::Printer]) -> std::result::Result<String, SpoolError> {
+    let names: Vec<&str> = printers.iter().map(|p| p.name.as_str()).collect();
+    let known = |n: &str| names.iter().find(|k| k.eq_ignore_ascii_case(n)).map(|k| (*k).to_string());
+    if let Some(r) = requested {
+        let choices = if names.is_empty() { "none".to_string() } else { names.join(", ") };
+        return known(r).ok_or_else(|| SpoolError::Failed(format!("no printer called `{r}`; the print server knows: {choices}")));
+    }
+    if printers.is_empty() {
+        return Err(SpoolError::NoRoute("no printer is set up on this computer; add one in the system settings, or print to PDF".into()));
+    }
+    if let Some(d) = default.and_then(known) {
+        return Ok(d);
+    }
+    match names.as_slice() {
+        [only] => Ok((*only).to_string()),
+        _ => Err(SpoolError::Failed(format!("no default printer; choose one in the Printer field: {}", names.join(", ")))),
+    }
+}
+
+#[cfg(all(not(target_arch = "wasm32"), not(target_os = "windows")))]
+fn cups_server(named: Option<&str>) -> std::result::Result<photocraft_ipp::Endpoint, SpoolError> {
+    match named {
+        Some(server) => {
+            let ep = photocraft_ipp::Endpoint::parse(server);
+            if !ep.reachable() {
+                return Err(SpoolError::Failed(format!("no print server at {ep}")));
+            }
+            Ok(ep)
+        }
+        None => photocraft_ipp::Endpoint::detect()
+            .ok_or_else(|| SpoolError::NoRoute("no print server: CUPS is not running, or not reachable from this sandbox; print to PDF instead".into())),
+    }
+}
+
+/// The IPP route: the job to the system's (or the named) CUPS server.
+#[cfg(all(not(target_arch = "wasm32"), not(target_os = "windows")))]
+fn cups_spool(job: &PrintJob) -> std::result::Result<String, SpoolError> {
+    let failed = |e: photocraft_ipp::Error| SpoolError::Failed(e.to_string());
+    let ep = cups_server(job.server.as_deref())?;
+    let printers = photocraft_ipp::printers(&ep).map_err(failed)?;
+    let default = printers.iter().find(|p| p.is_default).map(|p| p.name.clone());
+    let printer = resolve_printer(job.printer.as_deref(), default.as_deref(), &printers)?;
+    let is_class = printers.iter().any(|p| p.name == printer && p.is_class);
+    let user = std::env::var("USER").or_else(|_| std::env::var("USERNAME")).unwrap_or_else(|_| "photocraft".into());
+    let id = photocraft_ipp::print_job(
+        &ep,
+        &photocraft_ipp::Job { printer: &printer, is_class, title: &job.title, user: &user, copies: job.copies, document: &job.pdf, format: "application/pdf" },
+    )
+    .map_err(failed)?;
+    Ok(format!("job {id} on {printer}"))
+}
+
+/// No IPP route here: a named server is a failure, the system's a missing route (the app's
+/// spooler may have one).
+#[cfg(any(target_arch = "wasm32", target_os = "windows"))]
+fn cups_spool(job: &PrintJob) -> std::result::Result<String, SpoolError> {
+    let why = if cfg!(target_arch = "wasm32") {
+        "printing needs the desktop app"
+    } else {
+        "a print server over IPP is not available on Windows yet; print to PDF instead"
+    };
+    match job.server {
+        Some(_) => Err(SpoolError::Failed(why.into())),
+        None => Err(SpoolError::NoRoute(why.into())),
+    }
+}
+
+/// `file.printers`: the printers the system's (or `printServer`'s) print server knows, with the default. From
+/// `craft-print` (`lpstat`, the Windows spooler) where that is the route; over IPP for a named
+/// server and where there is no `lp` (a sandbox).
+fn system_printers(_s: &mut Session, p: &Value) -> Result<Value> {
+    let named = p.get("printServer").and_then(Value::as_str).filter(|v| !v.is_empty());
+    if named.is_none() && system_spooler().is_some() {
+        let list = craft_print::printers();
+        let default = list.iter().find(|p| p.default).map(|p| p.name.clone());
+        let printers: Vec<Value> = list.into_iter().map(|p| json!({"name": p.name, "default": p.default})).collect();
+        return Ok(json!({"server": Value::Null, "default": default, "printers": printers}));
+    }
+    #[cfg(all(not(target_arch = "wasm32"), not(target_os = "windows")))]
+    {
+        let ep = match cups_server(named) {
+            Ok(ep) => ep,
+            Err(SpoolError::NoRoute(why) | SpoolError::Failed(why)) => {
+                return Ok(json!({"server": Value::Null, "default": Value::Null, "printers": [], "note": why}));
+            }
+        };
+        let list = photocraft_ipp::printers(&ep).map_err(other)?;
+        let default = list.iter().find(|p| p.is_default).map(|p| p.name.clone());
+        let printers: Vec<Value> = list
+            .iter()
+            .map(|p| {
+                json!({"name": p.name, "info": p.info, "state": match p.state { 4 => "printing", 5 => "stopped", _ => "idle" }, "acceptingJobs": p.accepting_jobs, "default": p.is_default, "class": p.is_class})
+            })
+            .collect();
+        Ok(json!({"server": ep.to_string(), "default": default, "printers": printers}))
+    }
+    #[cfg(not(all(not(target_arch = "wasm32"), not(target_os = "windows"))))]
+    {
+        let _ = named;
+        Ok(json!({"server": Value::Null, "default": Value::Null, "printers": [], "note": "listing printers is not available on this platform yet"}))
+    }
+}
+
 // ---------- PDF ----------
 
 /// Paper sizes in points (portrait).
@@ -343,6 +534,7 @@ fn do_print(s: &mut Session, p: &Value, cmd: &str) -> Result<Value> {
     let params = p.clone();
     let worker_params = params.clone();
     let command = cmd.to_string();
+    let spooler = s.print_spooler.clone();
     if send && !dry {
         // Session::execute remains synchronous; the desktop's Session::start snapshots here
         // and runs PDF composition and the potentially slow driver on a worker.
@@ -352,7 +544,7 @@ fn do_print(s: &mut Session, p: &Value, cmd: &str) -> Result<Value> {
             false,
             move |ctx| {
                 ctx.progress(0.0, "Print");
-                render_and_spool(&doc, &worker_params, &command)
+                render_and_spool(&doc, &worker_params, &command, spooler.as_ref())
             },
             move |s, result| {
                 remember_print(s, &params);
@@ -370,13 +562,13 @@ fn do_print(s: &mut Session, p: &Value, cmd: &str) -> Result<Value> {
             },
         );
     }
-    let result = render_and_spool(&doc, p, cmd)?;
+    let result = render_and_spool(&doc, p, cmd, spooler.as_ref())?;
     remember_print(s, p);
     crate::automate_cmds::fire_event(s, "print");
     Ok(result)
 }
 
-fn render_and_spool(doc: &Document, p: &Value, cmd: &str) -> Result<Value> {
+fn render_and_spool(doc: &Document, p: &Value, cmd: &str, spooler: Option<&Spooler>) -> Result<Value> {
     let PrintLayout { paper: (pw, ph), rect: (x, y, w, h), scale, marks, emulsion_down } = layout(doc, p, cmd)?;
     let (img, color) = print_image(doc, p, cmd)?;
     let description = p
@@ -394,7 +586,12 @@ fn render_and_spool(doc: &Document, p: &Value, cmd: &str) -> Result<Value> {
     // Sending follows the shared command contract; fuzz tests explicitly request dryRun.
     // The worker returns its result before repeat settings and hooks are applied once.
     let handling = p.get("colorHandling").and_then(Value::as_str).unwrap_or("printerManages");
-    if cfg!(windows) && send && !dry && output.is_none() && native_rgb_compatible(&page, handling) {
+    // A named print server always takes the IPP route and a preferred app spooler takes every
+    // job (the route order in `spool_job`), on Windows too: neither may enter the native path
+    // below, which would print on the local default printer instead.
+    let named_server = p.get("printServer").and_then(Value::as_str).is_some_and(|v| !v.is_empty());
+    let skip_native = named_server || spooler.is_some_and(|sp| sp.preferred);
+    if cfg!(windows) && !skip_native && send && !dry && output.is_none() && native_rgb_compatible(&page, handling) {
         require_printing_enabled()?;
         let printed = print_windows(&page, p, &doc.name, copies)?;
         return Ok(json!({
@@ -402,10 +599,11 @@ fn render_and_spool(doc: &Document, p: &Value, cmd: &str) -> Result<Value> {
             "copies": copies, "command": Value::Null, "sent": true, "spooler": printed, "color": color,
         }));
     }
-    if cfg!(windows) && send && !dry && output.is_none() && printer_settings(p)?.is_some() {
+    if cfg!(windows) && !skip_native && send && !dry && output.is_none() && printer_settings(p)?.is_some() {
         return Err(other("the selected color profile or page text requires PDF printing. Save as PDF, or clear Print Settings to use PDF printing."));
     }
     let pdf = print_pdf(&page);
+    let pdf_len = pdf.len();
     let job = craft_print::Job {
         printer: p.get("printer").and_then(Value::as_str).filter(|v| !v.is_empty()).map(str::to_string),
         copies,
@@ -425,13 +623,25 @@ fn render_and_spool(doc: &Document, p: &Value, cmd: &str) -> Result<Value> {
     };
     let mut sent = false;
     let mut spool = Value::Null;
+    let mut backend = Value::Null;
     if send && !dry {
         require_printing_enabled()?;
-        spool = json!(craft_print::submit(&pdf, &job).map_err(other)?);
+        let print_job = PrintJob {
+            printer: job.printer.clone(),
+            copies,
+            title: doc.name.clone(),
+            server: p.get("printServer").and_then(Value::as_str).filter(|v| !v.is_empty()).map(str::to_string),
+            paper: (pw, ph),
+            landscape: p.get("orientation").and_then(Value::as_str) == Some("landscape"),
+            pdf,
+        };
+        let (where_, via) = spool_job(spooler, &print_job, &job)?;
+        spool = json!(where_);
+        backend = json!(via);
         sent = true;
     }
     Ok(
-        json!({"pdf": pdf_path, "bytes": pdf.len(), "paper": [pw, ph], "imageRect": [x, y, w, h], "emulsionDown": emulsion_down, "scale": scale * 100.0, "copies": copies, "command": command, "sent": sent, "spooler": spool, "color": color}),
+        json!({"pdf": pdf_path, "bytes": pdf_len, "paper": [pw, ph], "imageRect": [x, y, w, h], "emulsionDown": emulsion_down, "scale": scale * 100.0, "copies": copies, "command": command, "sent": sent, "spooler": spool, "backend": backend, "color": color}),
     )
 }
 
@@ -573,15 +783,6 @@ fn require_printing_enabled() -> Result<()> {
     }
 }
 
-/// The printers the system spooler knows (Print's Printer menu): CUPS queues and driverless
-/// destinations on macOS and Linux, `Win32_Printer` on Windows, none in the browser.
-fn system_printers(_: &mut Session, _: &Value) -> Result<Value> {
-    let list = craft_print::printers();
-    let default = list.iter().find(|p| p.default).map(|p| p.name.clone());
-    let printers: Vec<Value> = list.into_iter().map(|p| json!({"name": p.name, "default": p.default})).collect();
-    Ok(json!({"printers": printers, "default": default}))
-}
-
 fn print(s: &mut Session, p: &Value) -> Result<Value> {
     do_print(s, p, "file.print")
 }
@@ -602,8 +803,15 @@ fn print_one_copy(s: &mut Session, p: &Value) -> Result<Value> {
 fn package(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "file.package";
     let dir = p.get("dir").and_then(Value::as_str).filter(|v| !v.is_empty()).ok_or_else(|| bad(cmd, "missing \"dir\" (where to create the package folder)"))?;
+    // The copies are relinked by absolute path: a relative one would be resolved against the
+    // package document's folder, not the working directory `dir` is relative to.
+    // `folder`, `document` and `links` are built on it with `join`, so it is spelt the same way:
+    // `/` throughout, not a native prefix with `/` after it.
+    let dir = std::path::absolute(dir).map_or_else(|_| dir.to_string(), |d| d.to_string_lossy().into_owned());
+    let dir = crate::file_cmds::forward_slashes(dir);
     let d = s.active().ok_or(EngineError::NoDocument)?;
     let doc = (*d.doc).clone();
+    let document = d.path.clone();
     let name = stem(&d.path.clone().unwrap_or_else(|| doc.name.clone()));
     // The native format keeps external links; our PSD writer has no `lnkE` (external linked
     // file) support yet, so a PSD package would embed or flatten them.
@@ -612,7 +820,7 @@ fn package(s: &mut Session, p: &Value) -> Result<Value> {
         Some(f) => return Err(bad(cmd, format!("unknown package format `{f}` (pcraft|psd|psb)"))),
         None => "pcraft".into(),
     };
-    let folder = join(dir, &crate::file_cmds::sanitize(&name));
+    let folder = join(&dir, &crate::file_cmds::sanitize(&name));
     let links_dir = join(&folder, "Links");
     // Copy every linked file once; relink the copy of the document to the copies.
     let mut copied: Vec<(String, String)> = Vec::new();
@@ -629,7 +837,12 @@ fn package(s: &mut Session, p: &Value) -> Result<Value> {
                     fname = format!("{}-{}", copied.len(), fname);
                 }
                 let t = join(&links_dir, &fname);
-                match read_file(path) {
+                // A path that is not followed is packaged as missing, like a file that is gone.
+                let Ok(file) = crate::doc_path::resolve_in(path, document.as_deref().map(std::path::Path::new)) else {
+                    missing.push(path.clone());
+                    continue;
+                };
+                match read_file(&file.to_string_lossy()) {
                     Ok(bytes) => {
                         write_file(&t, &bytes)?;
                         copied.push((path.clone(), t.clone()));
@@ -750,7 +963,7 @@ pub fn specs() -> Vec<CommandSpec> {
             CommandSpec { id: $id, label: $label, menu: $menu, shortcut: $sc, params: $params, enabled: $enabled, journal: true, run: $run }
         };
     }
-    const PRINT_PARAMS: &str = r##"{"printerSettings":hex? (Windows driver settings),"printer":name? (default printer),"copies":1..999=1,"paper":"letter|legal|tabloid|a3|a4|a5|4x6|5x7"|[w,h] pt="letter","orientation":"portrait|landscape"="portrait","center":bool=true,"top":in?,"left":in?,"scale":%=100,"scaleToFit":bool=false,"colorHandling":"printerManages|photocraftManages|noColorManagement"="printerManages","printerProfile":profile? (photocraftManages),"intent":"perceptual|relative|saturation|absolute"="relative","bpc":bool=true,"cornerCropMarks":bool,"centerCropMarks":bool,"registrationMarks":bool,"description":bool,"labels":bool,"emulsionDown":bool=false (mirror the page left to right, for sublimation and other transfer printing),"output":pdf path? (print to PDF; then "send" defaults to false),"send":bool?,"dryRun":bool=false (render the PDF, report the backend command, don't spool; write a PDF only at an explicit output path)} → {pdf:path|null (null without explicit output), imageRect, command:diagnostic array|null, sent}"##;
+    const PRINT_PARAMS: &str = r##"{"printerSettings":hex? (Windows driver settings),"printer":name? (default printer),"copies":1..999=1,"paper":"letter|legal|tabloid|a3|a4|a5|4x6|5x7"|[w,h] pt="letter","orientation":"portrait|landscape"="portrait","center":bool=true,"top":in?,"left":in?,"scale":%=100,"scaleToFit":bool=false,"colorHandling":"printerManages|photocraftManages|noColorManagement"="printerManages","printerProfile":profile? (photocraftManages),"intent":"perceptual|relative|saturation|absolute"="relative","bpc":bool=true,"cornerCropMarks":bool,"centerCropMarks":bool,"registrationMarks":bool,"description":bool,"labels":bool,"emulsionDown":bool=false (mirror the page left to right, for sublimation and other transfer printing),"output":pdf path? (print to PDF; then "send" defaults to false),"send":bool?,"printServer":"host[:port]|socket path"? (default: the system's CUPS; a named server is always printed to over IPP),"dryRun":bool=false (render the PDF, report the backend command, don't spool; write a PDF only at an explicit output path)} → {pdf:path|null (null without explicit output), imageRect, command:diagnostic array|null, sent, spooler:where the job went|null, backend:"lp|windows|ipp|portal"|null}"##;
 
     vec![
         spec!("file.print", "Print…", &["File"], Some("Cmd+P"), PRINT_PARAMS, native_doc, print),
diff --git a/crates/engine/src/print_cmds/tests.rs b/crates/engine/src/print_cmds/tests.rs
index d012f6de41..ddd1a65a16 100644
--- a/crates/engine/src/print_cmds/tests.rs
+++ b/crates/engine/src/print_cmds/tests.rs
@@ -5,7 +5,9 @@ fn tmp(name: &str) -> String {
     let d = std::env::temp_dir().join(format!("photocraft-print-{}-{name}", std::process::id()));
     let _ = std::fs::remove_dir_all(&d);
     std::fs::create_dir_all(&d).unwrap();
-    d.to_string_lossy().into_owned()
+    // Spelt the way command results spell paths, so an expectation built with `/` matches on
+    // Windows too. Win32 takes `/` as a separator, so the directory is still usable as one.
+    d.to_string_lossy().replace('\\', "/")
 }
 
 fn session(mode: &str, depth: u32) -> Session {
@@ -254,7 +256,12 @@ fn package_copies_links_and_relinks() {
     let copied = format!("{dir}/pkg/Print Me/Links/art.png");
     assert_eq!(r["links"], json!([copied]));
     assert!(std::path::Path::new(&copied).is_file());
+    // Reported paths are `/`-spelt on every platform, not the native separator up to `dir` and
+    // `/` after it: a client hands them back to the control channel, which takes only `/`.
     let docp = r["document"].as_str().unwrap();
+    for p in [r["folder"].as_str().unwrap(), docp, r["links"][0].as_str().unwrap()] {
+        assert!(!p.contains('\\'), "{p}");
+    }
     assert!(docp.ends_with("Print Me/Print Me.pcraft"));
     let back = photocraft_io::import("Print Me.pcraft", &std::fs::read(docp).unwrap()).unwrap().document;
     let linked: Vec<String> = back
@@ -360,7 +367,7 @@ fn spool_transport_streams_pdf_and_propagates_refusal() {
         let printed = &s.documents().iter().find(|st| st.doc.id == source).unwrap().doc;
         assert_eq!((printed.size.width, printed.size.height), (150, 300), "print hook ran on the source document");
         assert_eq!(out["sent"], true);
-        assert_eq!(out["spooler"], "request id is Office-42");
+        assert_eq!((out["spooler"].as_str(), out["backend"].as_str()), (Some("request id is Office-42"), Some("lp")));
         assert!(out["pdf"].is_null(), "spool-only printing leaves no diagnostic PDF");
         let pdf = std::fs::read(format!("{dir}/received.pdf")).unwrap();
         assert!(pdf.starts_with(b"%PDF-1.4"));
@@ -434,3 +441,292 @@ fn printers_lists_the_spooler_destinations_without_a_document() {
         None => assert!(list.iter().all(|p| p["default"] == false)),
     }
 }
+
+/// Spooling tests run in a child process: `disable_printing` is process-wide and a test above
+/// sets it, and CI sets `PHOTOCRAFT_NO_PRINT` for the whole shell. True in the child, which runs
+/// the test body; the parent starts the child and checks that it passed.
+fn in_child(test: &str, envs: &[(&str, &str)]) -> bool {
+    const CHILD: &str = "PHOTOCRAFT_TEST_PRINT_CHILD";
+    if std::env::var_os(CHILD).is_some() {
+        return true;
+    }
+    let mut cmd = std::process::Command::new(std::env::current_exe().unwrap());
+    cmd.args(["--exact", test, "--nocapture"]).env(CHILD, "1").env_remove("PHOTOCRAFT_NO_PRINT");
+    for (k, v) in envs {
+        cmd.env(k, v);
+    }
+    // Bounded: a child stuck in a printer dialog or a driver must not hang the suite.
+    let mut child = cmd.stdout(std::process::Stdio::piped()).stderr(std::process::Stdio::piped()).spawn().unwrap();
+    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(120);
+    let status = loop {
+        if let Some(status) = child.try_wait().unwrap() {
+            break Some(status);
+        }
+        if std::time::Instant::now() > deadline {
+            let _ = child.kill();
+            break None;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(50));
+    };
+    let out = child.wait_with_output().unwrap();
+    assert!(
+        status.is_some_and(|s| s.success()),
+        "{}\nstdout: {}\nstderr: {}",
+        if status.is_none() { "the child did not finish within 120 s and was killed" } else { "the child failed" },
+        String::from_utf8_lossy(&out.stdout),
+        String::from_utf8_lossy(&out.stderr)
+    );
+    false
+}
+
+/// A spooler that keeps every job it gets.
+fn recording_spooler(preferred: bool, seen: &std::sync::Arc<std::sync::Mutex<Vec<PrintJob>>>) -> Spooler {
+    let seen = std::sync::Arc::clone(seen);
+    Spooler {
+        name: "test",
+        preferred,
+        run: std::sync::Arc::new(move |job: &PrintJob| {
+            seen.lock().unwrap().push(job.clone());
+            Ok("queued".into())
+        }),
+    }
+}
+
+#[test]
+fn a_preferred_app_spooler_takes_the_job() {
+    if !in_child("print_cmds::tests::a_preferred_app_spooler_takes_the_job", &[]) {
+        return;
+    }
+    let seen = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
+    let mut s = session("rgb", 8);
+    s.print_spooler = Some(recording_spooler(true, &seen));
+    let r = s.execute("file.print", json!({"copies": 2, "paper": "a4", "orientation": "landscape"})).unwrap();
+    assert_eq!((r["sent"].as_bool(), r["backend"].as_str(), r["spooler"].as_str()), (Some(true), Some("test"), Some("queued")));
+    assert!(r["pdf"].is_null(), "{r}");
+    let jobs = seen.lock().unwrap();
+    let job = &jobs[0];
+    assert!(job.pdf.starts_with(b"%PDF-1.4"));
+    assert_eq!((job.copies, job.title.as_str(), job.printer.as_deref(), job.landscape), (2, "Print Me.psd", None, true));
+    assert!((job.paper.0 - 841.89).abs() < 0.01 && (job.paper.1 - 595.28).abs() < 0.01);
+    drop(jobs);
+    // A named print server asks for the IPP route, preferred spooler or not.
+    let e = s.execute("file.print", json!({"printServer": "127.0.0.1:1"})).unwrap_err().to_string();
+    assert!(e.contains("no print server at 127.0.0.1:1") || e.contains("not available on Windows"), "{e}");
+    assert_eq!(seen.lock().unwrap().len(), 1);
+    // "output" keeps the file and does not spool unless asked.
+    let out = format!("{}/out.pdf", tmp("output"));
+    let r = s.execute("file.print", json!({"output": out})).unwrap();
+    assert_eq!((r["sent"].as_bool(), r["pdf"].as_str()), (Some(false), Some(out.as_str())));
+    assert!(std::path::Path::new(&out).exists());
+}
+
+#[cfg(not(target_os = "windows"))]
+mod cups {
+    use super::*;
+    use photocraft_ipp::{
+        Attribute, OP_CUPS_GET_CLASSES, OP_CUPS_GET_DEFAULT, OP_CUPS_GET_PRINTERS, OP_PRINT_JOB, Printer, Request, TAG_JOB_GROUP, TAG_NAME, TAG_PRINTER_GROUP,
+    };
+    use std::io::{BufRead, BufReader, Read, Write};
+    use std::sync::mpsc;
+
+    fn printer(name: &str, is_default: bool) -> Printer {
+        Printer { name: name.into(), info: String::new(), state: 3, accepting_jobs: true, is_default, is_class: false }
+    }
+
+    #[test]
+    fn the_printer_is_the_requested_one_else_the_default_else_the_only_one() {
+        let two = [printer("Office", false), printer("Lab", true)];
+        assert_eq!(resolve_printer(None, Some("Lab"), &two).ok(), Some("Lab".into()));
+        assert_eq!(resolve_printer(Some("office"), Some("Lab"), &two).ok(), Some("Office".into()));
+        assert_eq!(resolve_printer(None, None, &two[..1]).ok(), Some("Office".into()));
+        match resolve_printer(None, None, &two) {
+            Err(SpoolError::Failed(e)) => assert!(e.contains("no default printer") && e.contains("Office, Lab"), "{e}"),
+            _ => panic!("several printers and no default must fail"),
+        }
+        match resolve_printer(Some("Nope"), Some("Lab"), &two) {
+            Err(SpoolError::Failed(e)) => assert!(e.contains("`Nope`") && e.contains("Office, Lab"), "{e}"),
+            _ => panic!("an unknown printer must fail"),
+        }
+        match resolve_printer(None, None, &[]) {
+            Err(SpoolError::NoRoute(e)) => assert!(e.contains("no printer is set up"), "{e}"),
+            _ => panic!("no printers is no route"),
+        }
+        // A printer asked for by name on a server without any is a failure, not a missing route.
+        match resolve_printer(Some("Office"), None, &[]) {
+            Err(SpoolError::Failed(e)) => assert!(e.contains("`Office`") && e.contains("none"), "{e}"),
+            _ => panic!("a named printer never falls through"),
+        }
+        // A stale default that the server no longer lists falls through to the only printer.
+        assert_eq!(resolve_printer(None, Some("Gone"), &two[..1]).ok(), Some("Office".into()));
+    }
+
+    /// What the fake received per request: op, attributes, document.
+    type Seen = (u16, Vec<Attribute>, Vec<u8>);
+
+    /// A fake CUPS on a TCP port: lists `printers` and `classes`, names `default`, accepts jobs
+    /// as id 42. Answers for as long as the test process lives.
+    fn fake_cups(printers: &'static [&'static str], classes: &'static [&'static str], default: Option<&'static str>) -> (String, mpsc::Receiver<Seen>) {
+        let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+        let server = format!("127.0.0.1:{}", listener.local_addr().unwrap().port());
+        let (tx, rx) = mpsc::channel();
+        std::thread::spawn(move || {
+            for stream in listener.incoming() {
+                let Ok(stream) = stream else { break };
+                let mut reader = BufReader::new(stream);
+                let (mut first, mut line, mut len) = (String::new(), String::new(), 0usize);
+                loop {
+                    line.clear();
+                    if reader.read_line(&mut line).unwrap_or(0) == 0 || line == "\r\n" {
+                        break;
+                    }
+                    if first.is_empty() {
+                        first = line.clone();
+                    }
+                    if let Some(v) = line.to_ascii_lowercase().strip_prefix("content-length:") {
+                        len = v.trim().parse().unwrap();
+                    }
+                }
+                if first.is_empty() {
+                    continue; // a reachability probe
+                }
+                let mut body = vec![0u8; len];
+                reader.read_exact(&mut body).unwrap();
+                let (op, attrs, doc) = photocraft_ipp::parse_request(&body).unwrap();
+                let list = |names: &[&str]| {
+                    if names.is_empty() {
+                        return Request::new(0x0406, 1).end();
+                    }
+                    let mut r = Request::new(0, 1);
+                    for p in names {
+                        r.group(TAG_PRINTER_GROUP);
+                        r.attr(TAG_NAME, "printer-name", p.as_bytes());
+                    }
+                    r.end()
+                };
+                let reply = match op {
+                    OP_CUPS_GET_PRINTERS => list(printers),
+                    OP_CUPS_GET_CLASSES => list(classes),
+                    OP_CUPS_GET_DEFAULT => match default {
+                        Some(d) => {
+                            let mut r = Request::new(0, 1);
+                            r.group(TAG_PRINTER_GROUP);
+                            r.attr(TAG_NAME, "printer-name", d.as_bytes());
+                            r.end()
+                        }
+                        None => Request::new(0x0406, 1).end(),
+                    },
+                    OP_PRINT_JOB => {
+                        let mut r = Request::new(0, 1);
+                        r.group(TAG_JOB_GROUP);
+                        r.integer("job-id", 42);
+                        r.end()
+                    }
+                    _ => Request::new(0x0501, 1).end(),
+                };
+                let _ = tx.send((op, attrs, doc));
+                let mut out = reader.into_inner();
+                let _ = out.write_all(format!("HTTP/1.1 200 OK\r\nContent-Type: application/ipp\r\nContent-Length: {}\r\n\r\n", reply.len()).as_bytes());
+                let _ = out.write_all(&reply);
+                let _ = out.flush();
+            }
+        });
+        (server, rx)
+    }
+
+    #[test]
+    fn a_named_server_is_printed_to_over_ipp() {
+        if !in_child("print_cmds::tests::cups::a_named_server_is_printed_to_over_ipp", &[]) {
+            return;
+        }
+        let (server, rx) = fake_cups(&["Office"], &["Lab"], Some("Lab"));
+        let mut s = session("rgb", 8);
+        let r = s.execute("file.print", json!({"printServer": server, "copies": 3})).unwrap();
+        assert_eq!((r["sent"].as_bool(), r["backend"].as_str(), r["spooler"].as_str()), (Some(true), Some("ipp"), Some("job 42 on Lab")));
+        assert!(r["pdf"].is_null());
+        let job = std::iter::from_fn(|| rx.try_recv().ok()).find(|(op, _, _)| *op == OP_PRINT_JOB).expect("a Print-Job request");
+        let attr = |name: &str| job.1.iter().find(|a| a.name == name).unwrap_or_else(|| panic!("{name}"));
+        assert!(attr("printer-uri").text().ends_with("/classes/Lab"), "{}", attr("printer-uri").text());
+        assert_eq!(
+            (attr("copies").int(), attr("job-name").text().as_str(), attr("document-format").text().as_str()),
+            (Some(3), "Print Me.psd", "application/pdf")
+        );
+        assert!(job.2.starts_with(b"%PDF-1.4"));
+        // The requested printer, in any case; an unknown one names the choices.
+        let r = s.execute("file.print", json!({"printServer": server, "printer": "office"})).unwrap();
+        assert_eq!(r["spooler"], "job 42 on Office");
+        let job = std::iter::from_fn(|| rx.try_recv().ok()).filter(|(op, _, _)| *op == OP_PRINT_JOB).last().expect("the second Print-Job");
+        assert!(job.1.iter().any(|a| a.name == "printer-uri" && a.text().ends_with("/printers/Office")));
+        let e = s.execute("file.print", json!({"printServer": server, "printer": "Nope"})).unwrap_err().to_string();
+        assert!(e.contains("`Nope`") && e.contains("Office, Lab"), "{e}");
+        // Printers can be listed.
+        let r = s.execute("file.printers", json!({"printServer": server})).unwrap();
+        let names: Vec<&str> = r["printers"].as_array().unwrap().iter().map(|p| p["name"].as_str().unwrap()).collect();
+        assert_eq!((names, r["default"].as_str()), (vec!["Office", "Lab"], Some("Lab")));
+        assert_eq!(
+            (r["printers"][1]["default"].as_bool(), r["printers"][1]["class"].as_bool(), r["printers"][0]["class"].as_bool()),
+            (Some(true), Some(true), Some(false))
+        );
+    }
+
+    #[test]
+    fn without_a_printer_the_app_spooler_takes_over() {
+        if !in_child("print_cmds::tests::cups::without_a_printer_the_app_spooler_takes_over", &[]) {
+            return;
+        }
+        let (server, _rx) = fake_cups(&[], &[], None);
+        let mut s = session("gray", 8);
+        let e = s.execute("file.print", json!({"printServer": server})).unwrap_err().to_string();
+        assert!(e.contains("no printer is set up"), "{e}");
+        // Asking for a printer by name never falls through to another route.
+        let e = s.execute("file.print", json!({"printServer": server, "printer": "Office"})).unwrap_err().to_string();
+        assert!(e.contains("`Office`"), "{e}");
+        let seen = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
+        s.print_spooler = Some(recording_spooler(false, &seen));
+        let r = s.execute("file.print", json!({"printServer": server})).unwrap();
+        assert_eq!((r["backend"].as_str(), r["spooler"].as_str()), (Some("test"), Some("queued")));
+        assert_eq!(seen.lock().unwrap().len(), 1);
+        // An unreachable named server is a failure, not a missing route.
+        let e = s.execute("file.print", json!({"printServer": "127.0.0.1:1"})).unwrap_err().to_string();
+        assert!(e.contains("no print server at"), "{e}");
+        let r = s.execute("file.printers", json!({"printServer": "127.0.0.1:1"})).unwrap();
+        assert!(r["printers"].as_array().unwrap().is_empty() && r["note"].as_str().unwrap().contains("no print server"));
+    }
+
+    /// The Flatpak case: no `lp` on the path, so the job goes to the system's CUPS over IPP
+    /// (`CUPS_SERVER` names it here), and with no print server at all to the app's spooler.
+    /// Runs in a child process, since the path is process-wide.
+    #[test]
+    fn without_lp_the_job_goes_over_ipp_then_to_the_app_spooler() {
+        const CHILD: &str = "PHOTOCRAFT_TEST_PRINT_NO_LP";
+        if std::env::var_os(CHILD).is_some() {
+            let mut s = session("rgb", 8);
+            let r = s.execute("file.print", json!({"copies": 2})).unwrap();
+            assert_eq!((r["sent"].as_bool(), r["backend"].as_str(), r["spooler"].as_str()), (Some(true), Some("ipp"), Some("job 42 on Office")));
+            let seen = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
+            s.print_spooler = Some(recording_spooler(false, &seen));
+            // The IPP route first, then the app's spooler only when there is no server.
+            let r = s.execute("file.print", json!({})).unwrap();
+            assert_eq!(r["backend"], "ipp");
+            assert!(seen.lock().unwrap().is_empty());
+            // (CUPS_SERVER is read per job; an unreachable one is no route.)
+            let r = s.execute("file.print", json!({"printServer": "127.0.0.1:1"})).unwrap_err().to_string();
+            assert!(r.contains("no print server at"), "{r}");
+            println!("child ok");
+            return;
+        }
+        let (server, rx) = fake_cups(&["Office"], &[], Some("Office"));
+        let no_lp = tempfile::tempdir().unwrap();
+        let out = std::process::Command::new(std::env::current_exe().unwrap())
+            .args(["--exact", "print_cmds::tests::cups::without_lp_the_job_goes_over_ipp_then_to_the_app_spooler", "--nocapture"])
+            .env(CHILD, "1")
+            .env("PATH", no_lp.path())
+            .env("CUPS_SERVER", &server)
+            .env_remove("PHOTOCRAFT_NO_PRINT")
+            .output()
+            .unwrap();
+        let (stdout, stderr) = (String::from_utf8_lossy(&out.stdout), String::from_utf8_lossy(&out.stderr));
+        assert!(out.status.success() && stdout.contains("child ok"), "stdout: {stdout}\nstderr: {stderr}");
+        let jobs = std::iter::from_fn(|| rx.try_recv().ok()).filter(|(op, _, _)| *op == OP_PRINT_JOB).count();
+        assert_eq!(jobs, 2, "both prints reached the fake CUPS");
+    }
+}
diff --git a/crates/engine/src/sampler_cmds.rs b/crates/engine/src/sampler_cmds.rs
index 472ecb672a..0894ab72e1 100644
--- a/crates/engine/src/sampler_cmds.rs
+++ b/crates/engine/src/sampler_cmds.rs
@@ -377,6 +377,35 @@ mod tests {
         assert!((x - 40.0).abs() < 1e-6 && (y - 50.0).abs() < 1e-6, "{pos:?}");
     }
 
+    #[test]
+    fn flips_and_right_angle_turns_keep_points_on_their_pixel() {
+        use crate::canvas_geom::Turn;
+        for (id, turn) in [
+            ("image.imageRotation.flipCanvasHorizontal", Turn::FlipHorizontal),
+            ("image.imageRotation.flipCanvasVertical", Turn::FlipVertical),
+            ("image.imageRotation.180", Turn::Rotate180),
+            ("image.imageRotation.90cw", Turn::Cw90),
+            ("image.imageRotation.90ccw", Turn::Ccw90),
+        ] {
+            // A black pixel at (3, 3) of a white 100×80 document, with a point on it.
+            let mut s = session();
+            s.edit("paint", |doc, _| {
+                let surf = doc.layers[0].surface_mut().unwrap();
+                let black = photocraft_raster::from_rgba(&surf.format(), [0.0, 0.0, 0.0, 1.0]);
+                surf.fill_rect(Rect::new(3, 3, 4, 4), &black);
+                Ok(())
+            })
+            .unwrap();
+            s.execute("view.colorSamplers.add", json!({"x": 3, "y": 3})).unwrap();
+            s.execute(id, json!({})).unwrap();
+            let (x, y) = turn.pixel_map(100, 80)(3, 3);
+            let p = points(&mut s);
+            assert_eq!(p.len(), 1, "{id}");
+            assert_eq!(p[0]["position"], json!([f64::from(x), f64::from(y)]), "{id}");
+            assert_eq!(p[0]["rgb"], json!([0, 0, 0]), "{id}");
+        }
+    }
+
     #[test]
     fn a_rotated_crop_moves_points() {
         // The crop frame is centred on the point, so the point lands at the new canvas centre.
diff --git a/crates/engine/src/shell_commands.rs b/crates/engine/src/shell_commands.rs
new file mode 100644
index 0000000000..2bd765673f
--- /dev/null
+++ b/crates/engine/src/shell_commands.rs
@@ -0,0 +1,194 @@
+//! The commands the app's shell carries out itself (view, panels, windows: they change no
+//! document), and the tools, as data: what they're called and which keys they have by default.
+//! The shell implements them (`photocraft_ui_egui::menus::UI_COMMANDS`, its `Tool`); the engine
+//! knows them so a headless session sees every bindable command: Edit › Keyboard Shortcuts'
+//! list, conflicts, `.kys` import and export all work without the UI (the UI is a layer on
+//! top). The app's tests keep these tables equal to its own.
+
+/// Shell commands: id, label, menu path, default shortcut.
+pub const SHELL_COMMANDS: &[(&str, &str, &[&str], Option<&str>)] = &[
+    ("ui.symmetryTransform", "Transform Symmetry", &[], None),
+    // Right-click the options bar's tool icon (#2825); `tool.resetAll` asks first.
+    ("tool.reset", "Reset Tool", &[], None),
+    ("tool.resetAll", "Reset All Tools", &[], None),
+    ("window.panel.group", "Change Panel Group", &[], None),
+    ("window.panel.layout", "Change Panel Layout", &[], None),
+    ("window.panel.move", "Move Panel", &[], None),
+    ("window.panel.float", "Float Panel", &[], None),
+    ("window.panel.dock", "Dock Panel", &[], None),
+    ("window.panel.activate", "Activate Panel", &[], None),
+    ("window.panel.close", "Close Panel", &[], None),
+    ("file.open", "Open…", &["File"], Some("Cmd+O")),
+    ("file.save", "Save", &["File"], Some("Cmd+S")),
+    ("file.saveAs", "Save As…", &["File"], Some("Cmd+Shift+S")),
+    ("file.exit", "Exit", &["File"], Some("Cmd+Q")),
+    ("edit.freeTransform", "Free Transform", &["Edit"], Some("Cmd+T")),
+    ("file.export.exportAs", "Export As…", &["File", "Export"], Some("Cmd+Alt+Shift+W")),
+    ("file.export.quickExportAsPng", "Quick Export as PNG", &["File", "Export"], None),
+    ("edit.transform.scale", "Scale", &["Edit", "Transform"], None),
+    ("edit.transform.rotate", "Rotate", &["Edit", "Transform"], None),
+    ("edit.transform.skew", "Skew", &["Edit", "Transform"], None),
+    ("edit.transform.distort", "Distort", &["Edit", "Transform"], None),
+    ("edit.transform.perspective", "Perspective", &["Edit", "Transform"], None),
+    ("select.selectAndMask", "Select and Mask…", &["Select"], Some("Cmd+Alt+R")),
+    ("view.rulers", "Rulers", &["View"], Some("Cmd+R")),
+    ("view.show.grid", "Grid", &["View", "Show"], Some("Cmd+'")),
+    ("view.show.guides", "Guides", &["View", "Show"], Some("Cmd+;")),
+    ("view.snap", "Snap", &["View"], Some("Cmd+Shift+;")),
+    ("view.lockGuides", "Lock Guides", &["View"], Some("Cmd+Alt+;")),
+    ("view.extras", "Extras", &["View"], Some("Cmd+H")),
+    ("view.show.targetPath", "Target Path", &["View", "Show"], Some("Cmd+Shift+H")),
+    ("view.screenMode.cycle", "Cycle Screen Mode", &[], Some("F")),
+    // Photoshop's interface brightness shortcuts: step through the four Pro themes.
+    ("view.darkenInterface", "Darken Interface", &[], Some("Cmd+Shift+F1")),
+    ("view.lightenInterface", "Lighten Interface", &[], Some("Cmd+Shift+F2")),
+    ("edit.freeTransformCopy", "Free Transform a Copy", &[], Some("Cmd+Alt+T")),
+    ("type.editText", "Edit Type", &[], None),
+    ("view.zoomIn", "Zoom In", &["View"], Some("Cmd+=")),
+    ("view.zoomOut", "Zoom Out", &["View"], Some("Cmd+-")),
+    ("view.fitOnScreen", "Fit on Screen", &["View"], Some("Cmd+0")),
+    ("view.actualPixels", "100%", &["View"], Some("Cmd+1")),
+    ("view.rotateView", "Rotate View", &[], None),
+    ("view.resetView", "Reset View", &["View"], None),
+    ("window.newWindowForDocument", "New Window for Document", &["Window", "Arrange"], None),
+    ("window.toggle.layers", "Layers", &["Window"], Some("F7")),
+    ("window.toggle.history", "History", &["Window"], None),
+    ("window.toggle.properties", "Properties", &["Window"], None),
+    ("window.toggle.color", "Color", &["Window"], Some("F6")),
+    ("window.toggle.brushSettings", "Brush Settings", &["Window"], Some("F5")),
+    ("window.toggle.brushes", "Brushes", &["Window"], None),
+    ("window.toggle.navigator", "Navigator", &["Window"], None),
+    ("window.toggle.toolbar", "Tools", &["Window"], None),
+    // Photoshop's Tab and ⇧Tab: all panels (Tools, options bar and the dock), or only the dock.
+    ("window.togglePanels", "Show/Hide All Panels", &[], Some("Tab")),
+    ("window.toggle.dock", "Show/Hide Panels", &[], Some("Shift+Tab")),
+    ("window.toggle.options", "Options", &["Window"], None),
+    // Photoshop's Ctrl+Tab and Ctrl+Shift+Tab, on macOS too (⌘Tab belongs to the system, #2340).
+    ("window.nextDocument", "Next Document", &[], Some("Ctrl+Tab")),
+    ("window.previousDocument", "Previous Document", &[], Some("Ctrl+Shift+Tab")),
+    ("window.theme.toggle", "Next Appearance Mode", &["Window"], None),
+    ("window.theme.pro", "Pro Theme", &["Window", "Theme"], None),
+    ("window.theme.proMedium", "Pro Medium Gray Theme", &["Window", "Theme"], None),
+    ("window.theme.proLightGray", "Pro Light Gray Theme", &["Window", "Theme"], None),
+    ("window.theme.proLight", "Pro Light Theme", &["Window", "Theme"], None),
+    ("window.theme.studio", "Studio Theme", &["Window", "Theme"], None),
+    ("window.theme.studioLight", "Studio Light Theme", &["Window", "Theme"], None),
+    ("window.theme.classic", "Classic Theme", &["Window", "Theme"], None),
+    ("window.theme.solarizedDark", "Solarized Dark Theme", &["Window", "Theme"], None),
+    ("window.theme.adwaita", "Adwaita Light Theme", &["Window", "Theme"], None),
+    ("window.theme.adwaitaDark", "Adwaita Dark Theme", &["Window", "Theme"], None),
+    ("window.theme.breezeLight", "Breeze Light Theme", &["Window", "Theme"], None),
+    ("window.theme.breezeDark", "Breeze Dark Theme", &["Window", "Theme"], None),
+    ("window.theme.softLight", "Soft Light Theme", &["Window", "Theme"], None),
+    ("window.theme.softDark", "Soft Dark Theme", &["Window", "Theme"], None),
+    ("window.theme.system", "Sync with system", &["Window", "Theme"], None),
+    ("edit.search", "Search…", &["Edit"], Some("Cmd+F")),
+    ("help.discord", "Join the ArtCraft Discord…", &["Help"], None),
+    ("help.website", "PhotoCraft Website", &["Help"], None),
+    ("help.artcraftWebsite", "ArtCraft Website", &["Help"], None),
+    ("help.github", "PhotoCraft on GitHub", &["Help"], None),
+    ("help.reportIssue", "Report an Issue…", &["Help"], None),
+    ("help.systemInfo", "System Info…", &["Help"], None),
+    ("help.about", "About PhotoCraft", &["Help"], None),
+];
+
+/// The tools, in toolbar order: shortcut id (`tools.select.<tool>`), Photoshop's name for it
+/// (ours too), and its default key. Tools that share a key cycle with Shift (Photoshop's
+/// tool groups), so a shared default letter isn't a conflict.
+pub const TOOLS: &[(&str, &str, Option<&str>)] = &[
+    ("tools.select.move", "Move Tool", Some("V")),
+    ("tools.select.artboard", "Artboard Tool", Some("V")),
+    ("tools.select.rectMarquee", "Rectangular Marquee Tool", Some("M")),
+    ("tools.select.ellipseMarquee", "Elliptical Marquee Tool", Some("M")),
+    ("tools.select.singleRowMarquee", "Single Row Marquee Tool", None),
+    ("tools.select.singleColumnMarquee", "Single Column Marquee Tool", None),
+    ("tools.select.lasso", "Lasso Tool", Some("L")),
+    ("tools.select.polygonLasso", "Polygonal Lasso Tool", Some("L")),
+    ("tools.select.magneticLasso", "Magnetic Lasso Tool", Some("L")),
+    ("tools.select.magicWand", "Magic Wand Tool", Some("W")),
+    ("tools.select.crop", "Crop Tool", Some("C")),
+    ("tools.select.perspectiveCrop", "Perspective Crop Tool", Some("C")),
+    ("tools.select.eyedropper", "Eyedropper Tool", Some("I")),
+    ("tools.select.colorSampler", "Color Sampler Tool", Some("I")),
+    ("tools.select.ruler", "Ruler Tool", Some("I")),
+    ("tools.select.note", "Note Tool", Some("I")),
+    ("tools.select.count", "Count Tool", Some("I")),
+    ("tools.select.brush", "Brush Tool", Some("B")),
+    ("tools.select.pencil", "Pencil Tool", Some("B")),
+    ("tools.select.mixerBrush", "Mixer Brush Tool", Some("B")),
+    ("tools.select.colorReplacement", "Color Replacement Tool", Some("B")),
+    ("tools.select.eraser", "Eraser Tool", Some("E")),
+    ("tools.select.backgroundEraser", "Background Eraser Tool", Some("E")),
+    ("tools.select.magicEraser", "Magic Eraser Tool", Some("E")),
+    ("tools.select.gradient", "Gradient Tool", Some("G")),
+    ("tools.select.paintBucket", "Paint Bucket Tool", Some("G")),
+    ("tools.select.type", "Horizontal Type Tool", Some("T")),
+    ("tools.select.verticalType", "Vertical Type Tool", Some("T")),
+    ("tools.select.horizontalTypeMask", "Horizontal Type Mask Tool", Some("T")),
+    ("tools.select.verticalTypeMask", "Vertical Type Mask Tool", Some("T")),
+    ("tools.select.hand", "Hand Tool", Some("H")),
+    ("tools.select.rotateView", "Rotate View Tool", Some("R")),
+    ("tools.select.zoom", "Zoom Tool", Some("Z")),
+    ("tools.select.remove", "Remove Tool", Some("J")),
+    ("tools.select.spotHealing", "Spot Healing Brush Tool", Some("J")),
+    ("tools.select.healing", "Healing Brush Tool", Some("J")),
+    ("tools.select.patch", "Patch Tool", Some("J")),
+    ("tools.select.contentAwareMove", "Content-Aware Move Tool", Some("J")),
+    ("tools.select.redEye", "Red Eye Tool", Some("J")),
+    ("tools.select.cloneStamp", "Clone Stamp Tool", Some("S")),
+    ("tools.select.patternStamp", "Pattern Stamp Tool", Some("S")),
+    ("tools.select.historyBrush", "History Brush Tool", Some("Y")),
+    ("tools.select.blur", "Blur Tool", None),
+    ("tools.select.sharpen", "Sharpen Tool", None),
+    ("tools.select.smudge", "Smudge Tool", None),
+    ("tools.select.dodge", "Dodge Tool", Some("O")),
+    ("tools.select.burn", "Burn Tool", Some("O")),
+    ("tools.select.sponge", "Sponge Tool", Some("O")),
+    ("tools.select.quickSelection", "Quick Selection Tool", Some("W")),
+    ("tools.select.objectSelection", "Object Selection Tool", Some("W")),
+    ("tools.select.pen", "Pen Tool", Some("P")),
+    ("tools.select.freeformPen", "Freeform Pen Tool", Some("P")),
+    ("tools.select.curvaturePen", "Curvature Pen Tool", Some("P")),
+    ("tools.select.addAnchorPoint", "Add Anchor Point Tool", Some("P")),
+    ("tools.select.deleteAnchorPoint", "Delete Anchor Point Tool", Some("P")),
+    ("tools.select.convertPoint", "Convert Point Tool", Some("P")),
+    ("tools.select.pathSelection", "Path Selection Tool", Some("A")),
+    ("tools.select.directSelection", "Direct Selection Tool", Some("A")),
+    ("tools.select.rectangle", "Rectangle Tool", Some("U")),
+    ("tools.select.ellipseShape", "Ellipse Tool", Some("U")),
+    ("tools.select.triangle", "Triangle Tool", Some("U")),
+    ("tools.select.polygon", "Polygon Tool", Some("U")),
+    ("tools.select.line", "Line Tool", Some("U")),
+    ("tools.select.customShape", "Custom Shape Tool", Some("U")),
+    ("tools.select.slice", "Slice Tool", Some("C")),
+    ("tools.select.sliceSelect", "Slice Select Tool", Some("C")),
+    ("tools.select.frame", "Frame Tool", Some("K")),
+];
+
+/// The default key of tool shortcut `id`, if it's a tool.
+pub fn tool_default(id: &str) -> Option<Option<&'static str>> {
+    TOOLS.iter().find(|t| t.0 == id).map(|t| t.2)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn ids_are_unique_and_keys_are_valid() {
+        let mut ids: Vec<&str> = SHELL_COMMANDS.iter().map(|c| c.0).chain(TOOLS.iter().map(|t| t.0)).collect();
+        let n = ids.len();
+        ids.sort_unstable();
+        ids.dedup();
+        assert_eq!(ids.len(), n, "duplicate ids");
+        for (id, _, _, sc) in SHELL_COMMANDS {
+            assert!(sc.is_none_or(|k| crate::prefs::normalize_shortcut(k).is_some()), "{id}: {sc:?}");
+        }
+        for (id, name, key) in TOOLS {
+            assert!(id.starts_with("tools.select.") && name.ends_with("Tool"), "{id} {name}");
+            assert!(key.is_none_or(|k| k.len() == 1), "{id}: {key:?}");
+        }
+        assert_eq!(tool_default("tools.select.move"), Some(Some("V")));
+        assert_eq!(tool_default("edit.copy"), None);
+    }
+}
diff --git a/crates/engine/src/shortcut_sets.rs b/crates/engine/src/shortcut_sets.rs
index c5fc4993fe..26062def96 100644
--- a/crates/engine/src/shortcut_sets.rs
+++ b/crates/engine/src/shortcut_sets.rs
@@ -234,20 +234,28 @@ pub fn summarize(set: &str, sections: &[Section], mac: bool) -> String {
     out
 }
 
-/// Every engine command (and temporary tool) with a key under the bindings of `p`: (id,
-/// label, top-level menu, keys with the main one first). The app's dialog adds the commands
-/// only the shell knows (View › Zoom In, the tools).
-pub fn bound(p: &Preferences) -> Vec<(String, String, String, Vec<String>)> {
-    let temporary = crate::prefs::TEMPORARY_TOOLS.iter().map(|t| (t.0, t.1, "Tools", Some(t.2)));
-    crate::command_specs()
-        .iter()
-        .map(|c| (c.id, c.label, c.menu.first().copied().unwrap_or("Other"), c.shortcut))
-        .chain(temporary)
-        .filter_map(|(id, label, menu, def)| {
+/// A command (or tool) with a key under some bindings.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Bound {
+    pub id: String,
+    pub label: String,
+    /// Its top-level menu ("Tools" for tools).
+    pub menu: String,
+    /// Main key first, then the further keys.
+    pub keys: Vec<String>,
+    pub tool: bool,
+}
+
+/// Every bindable command with a key under the bindings of `p`: the engine's and the shell's
+/// commands, the tools and the temporary tools ([`crate::prefs::bindable_items`]).
+pub fn bound(p: &Preferences) -> Vec<Bound> {
+    crate::prefs::bindable_items()
+        .filter_map(|(id, label, menu, def, kind)| {
             let main = p.shortcut(id, def);
             let mut keys: Vec<String> = main.and_then(normalize_shortcut).into_iter().collect();
             keys.extend(p.alternates(id, main));
-            (!keys.is_empty()).then(|| (id.to_string(), label.to_string(), menu.to_string(), keys))
+            let menu = menu.first().copied().unwrap_or("Other").to_string();
+            (!keys.is_empty()).then(|| Bound { id: id.to_string(), label: label.to_string(), menu, keys, tool: kind == crate::prefs::BindKind::Tool })
         })
         .collect()
 }
@@ -340,8 +348,12 @@ mod tests {
     fn bound_lists_main_keys_then_alternates() {
         let p = prefs();
         let b = bound(&p);
-        let copy = b.iter().find(|(id, ..)| id == "edit.copy").expect("Copy has keys");
-        assert_eq!(copy.3, vec!["Cmd+C".to_string(), "F3".to_string()]);
-        assert!(b.iter().any(|(id, ..)| id == "tools.temporary.hand"));
+        let copy = b.iter().find(|x| x.id == "edit.copy").expect("Copy has keys");
+        assert_eq!(copy.keys, vec!["Cmd+C".to_string(), "F3".to_string()]);
+        assert!(b.iter().any(|x| x.id == "tools.temporary.hand"));
+        // The shell's commands and the tools too: a set saved headless is the whole set.
+        assert!(b.iter().any(|x| x.id == "view.zoomIn" && x.keys.len() >= 2), "Zoom In with its Cmd++");
+        let mv = b.iter().find(|x| x.id == "tools.select.move").expect("Move Tool");
+        assert!(mv.tool && mv.keys == ["V"] && mv.menu == "Tools");
     }
 }
diff --git a/crates/engine/src/smart_cmds.rs b/crates/engine/src/smart_cmds.rs
index e2c1cf2bfa..1f1cde7987 100644
--- a/crates/engine/src/smart_cmds.rs
+++ b/crates/engine/src/smart_cmds.rs
@@ -77,8 +77,13 @@ fn base_name(path: &str) -> String {
     path.rsplit(['/', '\\']).next().unwrap_or(path).to_string()
 }
 
+/// A linked file's bytes; `None` when it is missing or its path is not followed
+/// ([`crate::doc_path::resolve`]).
 fn read_file(path: &str) -> Option<Vec<u8>> {
-    if path.is_empty() { None } else { photocraft_format::read_file(std::path::Path::new(path)).ok() }
+    if path.is_empty() {
+        return None;
+    }
+    photocraft_format::read_file(&crate::doc_path::resolve(path).ok()?).ok()
 }
 
 /// The source file of a smart object: embedded bytes, the PSD's embedded linked-layer data (PSD
@@ -298,28 +303,35 @@ fn blend_surfaces(base: &Surface, top: &Surface, mode: BlendMode, opacity: f32)
     out
 }
 
-/// Runs the smart filter stack on the placed (unfiltered) content.
-pub fn apply_smart_filters(placed: &Surface, sm: &SmartObject, canvas: Rect) -> Surface {
+/// Runs the smart filter stack on the placed (unfiltered) content. A filter the session's
+/// authority denies surfaces its error (the trusted compositor path has no gate installed, so
+/// this reads ambiently only when the caller established one and it refuses).
+pub fn apply_smart_filters(placed: &Surface, sm: &SmartObject, canvas: Rect) -> Result<Surface> {
     if !sm.filters_enabled || !sm.smart_filters.iter().any(|f| f.visible) {
-        return placed.clone();
+        return Ok(placed.clone());
     }
     let mut cur = placed.clone();
     // Edge pixels repeat at the canvas ∪ placed-content edge, as for layer filters.
     let extent = canvas.union(&placed.content_bounds());
     for f in sm.smart_filters.iter().filter(|f| f.visible) {
-        cur = apply_smart_filter(f, &cur, canvas, extent);
+        cur = apply_smart_filter(f, &cur, canvas, extent)?;
     }
-    match sm.filter_mask.as_ref().filter(|m| m.enabled) {
+    Ok(match sm.filter_mask.as_ref().filter(|m| m.enabled) {
         Some(m) => photocraft_compose::filter_mask::mix(placed, &cur, m),
         None => cur,
-    }
+    })
 }
 
-/// One visible smart filter over `cur`, blended with its blend mode and opacity.
-fn apply_smart_filter(f: &SmartFilter, cur: &Surface, canvas: Rect, extent: Rect) -> Surface {
-    // Unknown ids (e.g. Photoshop filters we don't implement) leave the pixels alone.
-    let Some(out) = crate::filters::apply_filter_to_surface(&f.command, &f.params, cur, canvas, None, extent) else { return cur.clone() };
-    if f.blend == BlendMode::Normal && f.opacity >= 1.0 { out } else { blend_surfaces(cur, &out, f.blend, f.opacity.clamp(0.0, 1.0)) }
+/// One visible smart filter over `cur`, blended with its blend mode and opacity. `Err` when the
+/// requesting session's authority denies the filter's params: callers surface the error instead of
+/// rendering (and caching) unfiltered pixels.
+fn apply_smart_filter(f: &SmartFilter, cur: &Surface, canvas: Rect, extent: Rect) -> Result<Surface> {
+    let out = match crate::filters::apply_filter_to_surface(&f.command, &f.params, cur, canvas, None, extent)? {
+        // Unknown ids (e.g. Photoshop filters we don't implement) leave the pixels alone.
+        Some(out) => out,
+        None => cur.clone(),
+    };
+    if f.blend == BlendMode::Normal && f.opacity >= 1.0 { Ok(out) } else { Ok(blend_surfaces(cur, &out, f.blend, f.opacity.clamp(0.0, 1.0))) }
 }
 
 /// The source placed in document pixels, before any smart filter.
@@ -377,6 +389,11 @@ pub fn render(doc: &Document, sm: &SmartObject) -> Result<Option<Surface>> {
 /// is cancelled. Gives the same pixels as [`apply_smart_filters`] on the placed source, but
 /// starts from the deepest stage of the stack already rendered (see [`stack_cache`]).
 fn render_in(doc: &Document, sm: &SmartObject, ctx: &JobCtx) -> Result<Option<Surface>> {
+    // Stored filters can come from a file or another layer. Check before looking up cached
+    // stages too: a trusted UI render may have populated this process-wide cache earlier.
+    for filter in sm.smart_filters.iter().filter(|f| sm.filters_enabled && f.visible) {
+        crate::jobs::authorize_render_command(&filter.command, &filter.params)?;
+    }
     let Some((name, bytes)) = source_bytes(&doc.metadata, &sm.source) else { return Ok(None) };
     let (fmt, canvas) = (doc.pixel_format(), doc.bounds());
     let placed_key = stack_cache::placed_key(&bytes, fmt, sm, canvas);
@@ -410,7 +427,7 @@ fn render_in(doc: &Document, sm: &SmartObject, ctx: &JobCtx) -> Result<Option<Su
     for (i, (f, key)) in filters.iter().zip(&keys).enumerate().skip(done) {
         ctx.check()?;
         ctx.progress(i as f32 / n, "");
-        cur = Stage { surface: apply_smart_filter(f, &cur.surface, canvas, cur.extent), extent: cur.extent };
+        cur = Stage { surface: apply_smart_filter(f, &cur.surface, canvas, cur.extent)?, extent: cur.extent };
         stack_cache::put(*key, &cur);
     }
     ctx.progress(1.0, "");
@@ -480,10 +497,14 @@ fn refresh_or_fail(doc: &mut Document, id: LayerId) -> Result<()> {
 
 fn refresh_or_fail_in(doc: &mut Document, id: LayerId, ctx: &JobCtx) -> Result<()> {
     if refresh_in(doc, id, ctx)? {
-        Ok(())
-    } else {
-        Err(other("the smart object's contents are unavailable (missing linked file?), so it can't be re-rendered"))
+        return Ok(());
     }
+    if let SmartSource::Linked { path } = &smart(doc, id)?.source
+        && let Err(why @ crate::doc_path::NotFollowed::Refused(_)) = crate::doc_path::resolve(path)
+    {
+        return Err(crate::doc_path::refusal("the linked file", path, why));
+    }
+    Err(other("the smart object's contents are unavailable (missing linked file?), so it can't be re-rendered"))
 }
 
 fn smart(doc: &Document, id: LayerId) -> Result<&SmartObject> {
@@ -522,7 +543,7 @@ pub(crate) fn add_smart_filter(doc: &mut Document, id: LayerId, sf: photocraft_d
     }
     let bounds = selection.map(Surface::content_bounds).filter(|b| !b.is_empty()).unwrap_or(canvas);
     let cache = sm.cache.as_ref().ok_or_else(|| other("smart object has no pixels"))?;
-    let out = crate::filters::apply_filter_to_surface(&sf.command, &sf.params, cache, bounds, selection, canvas)
+    let out = crate::filters::apply_filter_to_surface(&sf.command, &sf.params, cache, bounds, selection, canvas)?
         .ok_or_else(|| other(format!("unknown filter {}", sf.command)))?;
     sm.cache = Some(out);
     sm.smart_filters.push(sf);
@@ -1000,6 +1021,7 @@ fn set_filter_visible(s: &mut Session, p: &Value) -> Result<Value> {
 fn set_filter_params(s: &mut Session, p: &Value) -> Result<Value> {
     const CMD: &str = "layer.smartFilter.setParams";
     let new = p.get("params").cloned().ok_or_else(|| bad(CMD, "pass `params` (merged into the filter's parameters)"))?;
+    let authorize = s.authorize;
     edit_filters(s, p, "Edit Smart Filter", |sm| {
         let i = filter_index(CMD, p, sm)?;
         let f = &mut sm.smart_filters[i];
@@ -1010,6 +1032,11 @@ fn set_filter_params(s: &mut Session, p: &Value) -> Result<Value> {
             (Value::Object(old), Value::Object(n)) => old.extend(n),
             (slot, n) => *slot = n,
         }
+        // Authorize the underlying command with the complete merged params, including paths
+        // already stored in the document, before committing the edit or starting a worker.
+        if let Some(gate) = authorize {
+            gate(&f.command, &f.params)?;
+        }
         Ok(())
     })
 }
diff --git a/crates/engine/src/smart_cmds/tests/stack_cache.rs b/crates/engine/src/smart_cmds/tests/stack_cache.rs
index 7675d71843..9465fb8387 100644
--- a/crates/engine/src/smart_cmds/tests/stack_cache.rs
+++ b/crates/engine/src/smart_cmds/tests/stack_cache.rs
@@ -17,7 +17,7 @@ fn uncached(s: &Session) -> Surface {
     let doc = &s.active().unwrap().doc;
     let sm = active_smart(s);
     let (name, bytes) = source_bytes(&doc.metadata, &sm.source).unwrap();
-    apply_smart_filters(&place(&name, &bytes, doc.pixel_format(), &sm).unwrap(), &sm, doc.bounds())
+    apply_smart_filters(&place(&name, &bytes, doc.pixel_format(), &sm).unwrap(), &sm, doc.bounds()).unwrap()
 }
 
 #[test]
diff --git a/crates/engine/src/snap.rs b/crates/engine/src/snap.rs
index 3ab1ad73bf..ef0e72f5db 100644
--- a/crates/engine/src/snap.rs
+++ b/crates/engine/src/snap.rs
@@ -89,10 +89,21 @@ pub fn layer_rect(doc: &Document, id: LayerId) -> Option<[f64; 4]> {
 }
 
 fn rect_of(doc: &Document, l: &photocraft_doc::Layer) -> Option<[f64; 4]> {
-    if l.is_group() || (matches!(l.content, LayerContent::Adjustment(_)) && l.mask.is_none()) {
-        return None;
-    }
-    let b = crate::transform_cmds::transform_bounds(doc, l);
+    snappable(l).then(|| crate::transform_cmds::transform_bounds(doc, l)).and_then(to_rect)
+}
+
+/// Bounds of a layer as a Snap To Layers target: all of its content, whatever the selection
+/// holds of it (#6290: clipped to the selection, every layer's edges and centre were the
+/// selection's, so a moved selection snapped back to where it started).
+fn target_rect_of(l: &photocraft_doc::Layer) -> Option<[f64; 4]> {
+    snappable(l).then(|| crate::transform_cmds::whole_layer_bounds(l)).and_then(to_rect)
+}
+
+fn snappable(l: &photocraft_doc::Layer) -> bool {
+    !(l.is_group() || (matches!(l.content, LayerContent::Adjustment(_)) && l.mask.is_none()))
+}
+
+fn to_rect(b: photocraft_geom::Rect) -> Option<[f64; 4]> {
     (!b.is_empty()).then_some([b.x0 as f64, b.y0 as f64, b.x1 as f64, b.y1 as f64])
 }
 
@@ -121,7 +132,7 @@ impl SnapTargets {
                 if !l.visible || exclude.contains(&l.id) {
                     continue;
                 }
-                if let Some(r) = rect_of(doc, l) {
+                if let Some(r) = target_rect_of(l) {
                     t.add_rect(r, SnapKind::LayerEdge, SnapKind::LayerCenter);
                 }
             }
@@ -365,6 +376,17 @@ mod tests {
         let t = SnapTargets::from_document(&doc, &SnapOptions { guides: false, ..opts }, &[id]);
         assert!(!t.x.iter().any(|t| t.kind == SnapKind::Guide || (t.kind == SnapKind::LayerEdge && t.pos == 30.0)));
         assert_eq!(layer_rect(&doc, id), Some([10.0, 20.0, 30.0, 60.0]));
+        // #6290: a selection doesn't move the layers' targets onto its own bounds.
+        let mut sel = photocraft_raster::Surface::new(photocraft_color::PixelFormat::GRAY8);
+        sel.fill_rect(photocraft_geom::Rect::new(64, 66, 124, 86), &[1.0]);
+        doc.selection = Some(sel);
+        let t = SnapTargets::from_document(&doc, &SnapOptions { selection: false, ..opts }, &[]);
+        assert!(t.x.iter().any(|t| t.kind == SnapKind::LayerEdge && t.pos == 30.0));
+        assert!(
+            !t.x.iter()
+                .chain(&t.y)
+                .any(|t| matches!(t.kind, SnapKind::LayerEdge | SnapKind::LayerCenter) && [64.0, 66.0, 76.0, 86.0, 94.0, 124.0].contains(&t.pos))
+        );
         assert_eq!(union([[0.0, 0.0, 1.0, 1.0], [2.0, -1.0, 3.0, 0.5]]), Some([0.0, -1.0, 3.0, 1.0]));
     }
 }
diff --git a/crates/engine/src/stamp_cmds.rs b/crates/engine/src/stamp_cmds.rs
index a525d138b5..85ac4078c7 100644
--- a/crates/engine/src/stamp_cmds.rs
+++ b/crates/engine/src/stamp_cmds.rs
@@ -1,7 +1,8 @@
 //! Stamping (#217): merge layers into a layer while keeping the originals.
 //!
 //! - **Stamp Visible** (⌘⌥⇧E, or ⌥ + Layer › Merge Visible): every visible layer composited into a
-//!   new layer above the active one.
+//!   new layer above the active one, or into the active layer when it is an empty pixel layer (as
+//!   in Photoshop, so a recorded New Layer + Stamp Visible leaves one layer, #6785).
 //! - **Stamp Down** (⌘⌥E, or ⌥ + Layer › Merge Down): a copy of the active layer merged into the
 //!   pixel layer below it; with several layers selected, a copy of them merged into a new layer
 //!   above the top one.
@@ -65,6 +66,13 @@ fn stamp_visible(s: &mut Session, p: &Value) -> Result<Value> {
         if !doc.walk().iter().any(|(path, _, l)| !l.is_group() && (1..=path.len()).all(|n| doc.layer_at(&path[..n]).is_some_and(|a| a.visible))) {
             return Err(EngineError::Other("there are no visible layers to stamp".into()));
         }
+        // Like Photoshop, an empty pixel layer that is active (Layer > New > Layer, then Stamp
+        // Visible, as recorded actions do) takes the stamp itself instead of getting a second layer.
+        if let Some(empty) = (*active).filter(|id| is_empty_pixel_layer(doc, *id)) {
+            let surf = photocraft_compose::flatten_to_surface(doc, with_alpha(doc), None);
+            *crate::pixels_mut(doc.layer_mut(empty).ok_or(EngineError::NoLayer(empty))?)? = surf;
+            return Ok(empty);
+        }
         let layer = stamp_layer(doc, doc.next_layer_name("Layer"))?;
         let id = doc.insert_above(*active, layer);
         *active = Some(id);
@@ -74,6 +82,18 @@ fn stamp_visible(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({ "layer": id.0 }))
 }
 
+/// A plain, unlocked pixel layer with no pixels, mask or clipping: safe to stamp into.
+fn is_empty_pixel_layer(doc: &Document, id: LayerId) -> bool {
+    let Some(l) = doc.layer(id) else { return false };
+    let locks = doc.effective_locks(id);
+    matches!(&l.content, LayerContent::Raster(s) if s.content_bounds().is_empty())
+        && l.visible
+        && l.mask.is_none()
+        && l.vector_mask.is_none()
+        && !l.clipped
+        && !(locks.all || locks.pixels || locks.transparency)
+}
+
 fn stamp_down(s: &mut Session, p: &Value) -> Result<Value> {
     object(p, "layer.stampDown")?;
     let sel = crate::layer_multi_cmds::selected(s);
@@ -148,7 +168,7 @@ pub fn specs() -> Vec<CommandSpec> {
             label: "Stamp Visible",
             menu: &[],
             shortcut: Some("Cmd+Alt+Shift+E"),
-            params: r##"{} → {layer} (every visible layer merged into a new layer above the active one; the originals stay)"##,
+            params: r##"{} → {layer} (visible layers merged into a new layer above the active one, or into the active one if it is an empty pixel layer)"##,
             enabled: has_doc,
             journal: true,
             run: stamp_visible,
@@ -235,6 +255,25 @@ mod tests {
         }
     }
 
+    /// Recorded actions do New Layer, then Stamp Visible: the stamp lands in the new empty layer.
+    #[test]
+    fn stamp_visible_fills_an_empty_active_layer_instead_of_adding_one() {
+        let (mut s, bg, hidden, blue) = session(8);
+        s.execute("layer.new.layer", json!({"name": "Empty"})).unwrap();
+        let empty = s.active().unwrap().active_layer.unwrap();
+        let r = s.execute("layer.stampVisible", json!({})).unwrap();
+        assert_eq!(r["layer"].as_u64(), Some(empty.0));
+        assert_eq!(ids(&s), [bg, hidden, blue, empty], "no extra layer");
+        let st = s.active().unwrap();
+        assert_eq!((st.active_layer, st.selected_layers.clone()), (Some(empty), vec![empty]));
+        assert!(close(rgba(&s, empty, 30, 30), [0.0, 0.0, 1.0, 1.0]));
+        assert!(close(rgba(&s, empty, 2, 2), [1.0, 0.0, 0.0, 1.0]));
+        // A second stamp: the layer now has pixels, so this one adds a layer.
+        let r2 = s.execute("layer.stampVisible", json!({})).unwrap();
+        assert_ne!(r2["layer"].as_u64(), Some(empty.0));
+        assert_eq!(ids(&s).len(), 5);
+    }
+
     #[test]
     fn stamp_visible_respects_opacity_blend_and_groups() {
         let (mut s, bg, _, blue) = session(8);
diff --git a/crates/engine/src/transform_cmds.rs b/crates/engine/src/transform_cmds.rs
index 1c0153a42e..2fafc222f7 100644
--- a/crates/engine/src/transform_cmds.rs
+++ b/crates/engine/src/transform_cmds.rs
@@ -1,6 +1,6 @@
 //! Edit › Free Transform / Transform: projective transforms of layers (and the selection).
 
-use photocraft_algo::transform::{Homography, Interp, warp_output_bounds, warp_surface, warp_surface_with};
+use photocraft_algo::transform::{Homography, Interp, warp_output_size, warp_surface, warp_surface_with};
 use photocraft_color::PixelFormat;
 use photocraft_doc::{Document, Layer, LayerContent, LayerId, Locks};
 use photocraft_geom::{Affine, Rect};
@@ -54,7 +54,7 @@ fn framed_by_selection(doc: &Document, bounds: Rect) -> Rect {
 }
 
 /// A group moves all its descendants, so its frame must not clip raster children to the selection.
-fn whole_layer_bounds(layer: &Layer) -> Rect {
+pub(crate) fn whole_layer_bounds(layer: &Layer) -> Rect {
     let content = match &layer.content {
         LayerContent::Group(g) => g.children.iter().map(whole_layer_bounds).fold(Rect::EMPTY, |a, b| a.union(&b)),
         _ => layer.surface().map_or(Rect::EMPTY, photocraft_compose::bounds::content_bounds),
@@ -273,10 +273,13 @@ const BUDGET: u64 = 1 << 20;
 /// Refuse a warp of the content inside `src` by `h` whose result would exceed the pixel budget,
 /// before anything is built. `what` names the surface in the message.
 pub(crate) fn check_budget(src: Rect, h: &Homography, what: &str) -> Result<()> {
-    let Some(b) = warp_output_bounds(src, h) else { return Ok(()) };
-    let (w, ht) = (u64::from(b.width()), u64::from(b.height()));
-    if w.saturating_mul(ht) > BUDGET {
-        let detail = format!("the transformed {what} would be {w} x {ht} px, more than the {BUDGET} px limit");
+    check_budget_with_limit(src, h, what, BUDGET)
+}
+
+fn check_budget_with_limit(src: Rect, h: &Homography, what: &str, budget: u64) -> Result<()> {
+    let Some((w, ht)) = warp_output_size(src, h) else { return Ok(()) };
+    if w.saturating_mul(ht) > budget {
+        let detail = format!("the transformed {what} would be {w} x {ht} px, more than the {budget} px limit");
         return Err(crate::allocation::error("transforming pixels", &detail));
     }
     Ok(())
@@ -735,6 +738,24 @@ mod tests {
 
     // ---- Pixel budget (#3773). Tests run with a 2²⁰ px budget, so nothing here comes near the real one. ----
 
+    #[test]
+    fn huge_transform_scales_exceed_the_production_budget_before_clipping() {
+        let src = Rect::new(0, 0, 24, 16);
+        for scale in [1e7, 1e28, 1e306] {
+            for (sx, sy) in [(scale, 1.0), (1.0, scale), (-scale, 1.0)] {
+                let h = Homography([sx, 0.0, 0.0, 0.0, sy, 0.0, 0.0, 0.0, 1.0]);
+                assert!(check_budget_with_limit(src, &h, "layer", MAX_TRANSFORM_PIXELS).is_err(), "{sx} x {sy} must be refused");
+            }
+        }
+    }
+
+    #[test]
+    fn an_ordinary_transform_remains_within_the_production_budget() {
+        let src = Rect::new(0, 0, 24, 16);
+        let h = Homography([10_000.0, 0.0, 900_000.0, 0.0, 1.0, -900_000.0, 0.0, 0.0, 1.0]);
+        assert!(check_budget_with_limit(src, &h, "layer", MAX_TRANSFORM_PIXELS).is_ok());
+    }
+
     /// A 16 x 16 document whose active layer is a 1 x 8 column at x = 10.
     fn column() -> Session {
         let mut s = Session::new();
diff --git a/crates/engine/src/trap_cmds.rs b/crates/engine/src/trap_cmds.rs
index 03d899472c..6bd99200ac 100644
--- a/crates/engine/src/trap_cmds.rs
+++ b/crates/engine/src/trap_cmds.rs
@@ -24,6 +24,7 @@ fn trap(s: &mut Session, p: &Value) -> Result<Value> {
     }
     s.edit("Trap", |doc, active| {
         let id = active.ok_or(EngineError::NoDocument)?;
+        crate::commands::check_pixels_unlocked(doc, id)?;
         let bounds = doc.bounds();
         let l = doc.layer_mut(id).ok_or(EngineError::NoLayer(id))?;
         let LayerContent::Raster(surf) = &mut l.content else {
@@ -63,11 +64,8 @@ mod tests {
     use super::*;
     use photocraft_geom::Rect;
 
-    #[test]
-    fn traps_a_cmyk_document() {
-        let mut s = Session::new();
-        s.execute("file.new", json!({"width": 8, "height": 4, "mode": "cmyk"})).unwrap();
-        // Paint cyan | magenta halves on the Background.
+    /// Paints cyan | magenta halves on the active layer.
+    fn paint_halves(s: &mut Session) {
         s.edit("paint", |doc, active| {
             let id = active.unwrap();
             let fmt = doc.pixel_format();
@@ -93,6 +91,13 @@ mod tests {
             Ok(())
         })
         .unwrap();
+    }
+
+    #[test]
+    fn traps_a_cmyk_document() {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 8, "height": 4, "mode": "cmyk"})).unwrap();
+        paint_halves(&mut s);
 
         let r = s.execute("image.trap", json!({"width": 1})).unwrap();
         assert_eq!(r["trapped"], true);
@@ -109,6 +114,35 @@ mod tests {
         assert_eq!(st.history.entries().last().map(|e| e.as_str()), Some("Trap"));
     }
 
+    #[test]
+    fn refuses_locked_layers() {
+        // Lock All or the pixel lock, on the layer itself or on its group: Trap refuses, leaving the
+        // pixels and the history as they were.
+        for lock in [json!({"all": true}), json!({"pixels": true})] {
+            for on_group in [false, true] {
+                let mut s = Session::new();
+                s.execute("file.new", json!({"width": 8, "height": 4, "mode": "cmyk"})).unwrap();
+                s.execute("layer.new.layer", json!({})).unwrap();
+                paint_halves(&mut s);
+                let layer = s.active().unwrap().active_layer.unwrap();
+                if on_group {
+                    s.execute("layer.new.groupFromLayers", json!({})).unwrap();
+                }
+                s.execute("layer.lockLayers", lock.clone()).unwrap();
+                s.execute("layer.select", json!({"layer": layer.0})).unwrap();
+                let locks = s.active().unwrap().doc.effective_locks(layer);
+                assert!(locks.all || locks.pixels, "the lock reaches the layer ({lock}, group: {on_group})");
+                let steps = s.active().unwrap().history.past_len();
+                let before = s.active().unwrap().doc.layer(layer).unwrap().surface().cloned();
+                let r = s.execute("image.trap", json!({"width": 1}));
+                assert!(r.is_err(), "trapped a layer locked with {lock} (group: {on_group}): {r:?}");
+                let st = s.active().unwrap();
+                assert_eq!(st.doc.layer(layer).unwrap().surface().cloned(), before, "{lock} group: {on_group}");
+                assert_eq!(st.history.past_len(), steps, "{lock} group: {on_group}: no history step");
+            }
+        }
+    }
+
     #[test]
     fn rejects_non_cmyk() {
         let mut s = Session::new();
diff --git a/crates/engine/src/type_caret_cmds.rs b/crates/engine/src/type_caret_cmds.rs
index 419d305ee6..3b9b244f70 100644
--- a/crates/engine/src/type_caret_cmds.rs
+++ b/crates/engine/src/type_caret_cmds.rs
@@ -482,7 +482,7 @@ mod tests {
         bad(&mut s, "type.navigate", json!({"layer": id, "index": 9, "move": "end"}));
         bad(&mut s, "type.navigate", json!({"layer": id, "index": 0, "move": "lineNext", "x": "no"}));
         bad(&mut s, "type.navigate", json!({"layer": pixel, "index": 0, "move": "start"}));
-        assert!(matches!(s.execute("type.caret", json!({"layer": u64::MAX, "index": 0})), Err(EngineError::NoLayer(_))));
+        assert!(matches!(s.execute("type.caret", json!({"layer": u64::MAX, "index": 0})), Err(EngineError::UnknownLayer { .. })));
         // A point on the named layer but outside its text still returns a caret, marked outside.
         let far = s.execute("type.hitTest", json!({"layer": id, "x": 390, "y": 290})).unwrap();
         assert_eq!(far["inside"], false);
diff --git a/crates/engine/src/type_cmds.rs b/crates/engine/src/type_cmds.rs
index d6b92e840c..cd4ca7a27b 100644
--- a/crates/engine/src/type_cmds.rs
+++ b/crates/engine/src/type_cmds.rs
@@ -89,6 +89,8 @@ pub const TYPE_SIZE_MIN_PT: f64 = 0.1;
 pub const TYPE_SIZE_MAX_PT: f64 = 1296.0;
 pub const TRACKING_MIN: f64 = -1000.0;
 pub const TRACKING_MAX: f64 = 10_000.0;
+/// Photoshop's horizontal and vertical scale range, in percent.
+pub const SCALE_MAX_PERCENT: f64 = 1000.0;
 
 /// Validates the `kerning` key of character params: a number in [`KERN_MIN`]..=[`KERN_MAX`] or
 /// `"metrics"`, `"optical"`, `"off"` (`"none"`, `"0"`).
@@ -104,7 +106,8 @@ pub fn check_kerning(p: &Value) -> std::result::Result<(), String> {
     }
 }
 
-/// Validates text metrics that can otherwise exceed the rasterizer's supported range.
+/// Validates text metrics (size, tracking, leading, baseline shift, scales) that can otherwise
+/// exceed the rasterizer's supported range or overflow `f32`, which a .pcraft manifest cannot hold.
 pub fn check_size_tracking(p: &Value) -> std::result::Result<(), String> {
     if let Some(v) = p.get("size") {
         match v.as_f64() {
@@ -118,6 +121,30 @@ pub fn check_size_tracking(p: &Value) -> std::result::Result<(), String> {
             _ => return Err(format!("tracking must be between {TRACKING_MIN} and {TRACKING_MAX} (1/1000 em)")),
         }
     }
+    if let Some(v) = p.get("leading") {
+        let (min, max) = (f64::from(LEADING_MIN_PT), f64::from(LEADING_MAX_PT));
+        match v {
+            Value::Null => {}
+            Value::String(a) if a == "auto" => {}
+            Value::Number(n) if n.as_f64().is_some_and(|x| x.is_finite() && (min..=max).contains(&x)) => {}
+            _ => return Err(format!("leading must be between {min} and {max} pt, or \"auto\"")),
+        }
+    }
+    if let Some(v) = p.get("baselineShift") {
+        let max = f64::from(BASELINE_SHIFT_MAX_PT);
+        match v.as_f64() {
+            Some(shift) if shift.is_finite() && shift.abs() <= max => {}
+            _ => return Err(format!("baselineShift must be between -{max} and {max} pt")),
+        }
+    }
+    for key in ["horizontalScale", "verticalScale"] {
+        if let Some(v) = p.get(key) {
+            match v.as_f64() {
+                Some(scale) if scale.is_finite() && (0.0..=SCALE_MAX_PERCENT).contains(&scale) => {}
+                _ => return Err(format!("{key} must be between 0 and {SCALE_MAX_PERCENT} %")),
+            }
+        }
+    }
     Ok(())
 }
 
diff --git a/crates/engine/src/type_extra_cmds.rs b/crates/engine/src/type_extra_cmds.rs
index efa2d791cc..91d75f033e 100644
--- a/crates/engine/src/type_extra_cmds.rs
+++ b/crates/engine/src/type_extra_cmds.rs
@@ -13,7 +13,7 @@ use photocraft_geom::Point;
 use photocraft_text::render::PathEl;
 use serde_json::{Value, json};
 
-use crate::commands::{CommandSpec, layer_param};
+use crate::commands::{CommandSpec, explicit_layer, layer_param};
 use crate::type_cmds::{
     check_text_unlocked, format_targets, has_format_target, is_auto_named, layer_name, refresh, replace_text, style_paragraphs, style_range, with_text_targets,
 };
@@ -477,7 +477,10 @@ fn toggle_opentype(s: &mut Session, p: &Value, tag: &'static str) -> Result<Valu
 // ---------- lorem ipsum / update / fonts / defaults ----------
 
 fn paste_lorem(s: &mut Session, p: &Value) -> Result<Value> {
-    if has_text(s).is_ok() && p.get("new").and_then(Value::as_bool) != Some(true) {
+    // Into the layer `with_text` edits: an explicit "layer" (an error unless it is a type layer),
+    // else the active layer when it is a type layer.
+    let new = p.get("new").and_then(Value::as_bool) == Some(true);
+    if !new && (explicit_layer(s, p)?.is_some() || has_text(s).is_ok()) {
         let caret = with_text(s, p, "Paste Lorem Ipsum", |t, _| {
             let at = p.get("at").and_then(Value::as_u64).map_or(t.text.len(), |c| byte_index(&t.text, c as usize));
             replace_text(t, at, at, LOREM_IPSUM);
diff --git a/crates/engine/src/type_extra_cmds/tests.rs b/crates/engine/src/type_extra_cmds/tests.rs
index 7386927bb7..687a56471a 100644
--- a/crates/engine/src/type_extra_cmds/tests.rs
+++ b/crates/engine/src/type_extra_cmds/tests.rs
@@ -329,6 +329,27 @@ fn all_locked_layer_rejects_paste_lorem_ipsum_without_history() {
     }
 }
 
+#[test]
+fn paste_lorem_ipsum_inserts_into_the_layer_param_not_the_active_layer() {
+    // #5659: with a pixel layer active, an explicit type "layer" got a new text box instead.
+    let mut s = session(8);
+    let id = text_layer(&mut s, "Hi");
+    s.execute("layer.new.layer", json!({})).unwrap();
+    let pixel = s.active().unwrap().active_layer.unwrap();
+    assert_ne!(pixel, id);
+    let count = s.active().unwrap().doc.walk().len();
+    let r = s.execute("type.pasteLoremIpsum", json!({"layer": id.0, "at": 0})).unwrap();
+    assert!(text(&s, id).text.starts_with(LOREM_IPSUM), "{}", text(&s, id).text);
+    assert!(text(&s, id).text.ends_with("Hi"));
+    assert_eq!(r["caret"], LOREM_IPSUM.chars().count());
+    assert_eq!(s.active().unwrap().doc.walk().len(), count);
+    // An explicit layer that is not a type layer is an error, not a new layer.
+    let history = s.active().unwrap().history.past_len();
+    assert!(s.execute("type.pasteLoremIpsum", json!({"layer": pixel.0})).is_err());
+    assert_eq!(s.active().unwrap().doc.walk().len(), count);
+    assert_eq!(s.active().unwrap().history.past_len(), history);
+}
+
 /// A type layer stored with a family label that is not installed, as a PSD keeps the family it
 /// guessed from a PostScript name whose face was absent when the file was opened.
 fn guessed_family_layer(s: &mut Session, text: &str, ps: Option<&str>) -> (LayerId, Value) {
@@ -399,3 +420,21 @@ fn exact_postscript_face_outside_the_guessed_family_is_not_missing() {
     assert!(!fonts.has_family(&photocraft_text::fonts::guess_from_postscript("UnrelatedPS30").family));
     assert_eq!((style_font_missing(&mut fonts, &style("UnrelatedPS30")), style_font_missing(&mut fonts, &style("UnrelatedPS31"))), (false, true));
 }
+
+/// #5044: PostScript names whose family has its space elsewhere (`BMDoHyeon`, family
+/// "BM DoHyeon") or an underscore style suffix (`Daum_SemiBold`). Guessing splits them as
+/// "BM Do Hyeon" and "Daum_Semi Bold", neither installed; the exact installed face resolves them.
+#[test]
+fn camel_case_and_underscore_postscript_names_resolve_to_their_installed_faces() {
+    let mut fonts = photocraft_text::FontDb::new();
+    fonts.register_font_data(renamed_face(&photocraft_text::fonts::INTER_REGULAR, "BM DoHyeon", "BMDoHyeon"));
+    fonts.register_font_data(renamed_face(&photocraft_text::fonts::INTER_REGULAR, "Daum", "Daum_SemiBold"));
+    for (ps, family) in [("BMDoHyeon", "BM DoHyeon"), ("Daum_SemiBold", "Daum")] {
+        let guess = photocraft_text::fonts::guess_from_postscript(ps).family;
+        assert!(!fonts.has_family(&guess), "{ps}: the guess {guess:?} is not an installed family");
+        let r = fonts.resolve_postscript(ps);
+        assert_eq!((r.family.as_str(), r.exact), (family, true), "{ps}");
+        let style = photocraft_doc::text::CharStyle { font_family: guess.clone(), postscript_name: Some(ps.into()), ..Default::default() };
+        assert!(!style_font_missing(&mut fonts, &style), "{ps} stored as {guess:?} is not missing");
+    }
+}
diff --git a/crates/engine/src/variables_cmds.rs b/crates/engine/src/variables_cmds.rs
index f42b744844..0a49d780d5 100644
--- a/crates/engine/src/variables_cmds.rs
+++ b/crates/engine/src/variables_cmds.rs
@@ -199,7 +199,9 @@ fn replace_pixels(doc: &mut Document, layer: LayerId, path: &str, method: PixelM
         return Ok(());
     }
     let fmt = doc.pixel_format();
-    let bytes = std::fs::read(path).map_err(|e| EngineError::Other(format!("read `{path}`: {e}")))?;
+    // The path is stored in the document's data sets.
+    let file = crate::doc_path::resolve(path).map_err(|why| crate::doc_path::refusal("the image", path, why))?;
+    let bytes = std::fs::read(&file).map_err(|e| EngineError::Other(format!("read `{path}`: {e}")))?;
     let src = crate::file_cmds::import(path, &bytes)?;
     let img = crate::file_cmds::flattened(&src, fmt);
     let (iw, ih) = (src.size.width.max(1) as f64, src.size.height.max(1) as f64);
@@ -284,6 +286,8 @@ fn import_data_sets(s: &mut Session, p: &Value) -> Result<Value> {
 /// file beneath its read root and hands the text over (#3216).
 pub fn import_data_sets_text(s: &mut Session, text: &str, p: &Value) -> Result<Value> {
     let delim = p.get("delimiter").and_then(Value::as_str).and_then(|d| d.bytes().next()).unwrap_or(b',');
+    // Excel's "CSV UTF-8" starts with a byte order mark that is not part of the first header cell.
+    let text = text.strip_prefix('\u{feff}').unwrap_or(text);
     let vars = s.active().ok_or(EngineError::NoDocument)?.doc.variables.clone();
     let mut records = csv_records(text).filter(|r| !r.trim().is_empty());
     let header: Vec<String> = records.next().map(|h| split_csv(h, delim)).unwrap_or_default();
diff --git a/crates/engine/src/variables_cmds/tests.rs b/crates/engine/src/variables_cmds/tests.rs
index c2a30cab68..8a0c591e71 100644
--- a/crates/engine/src/variables_cmds/tests.rs
+++ b/crates/engine/src/variables_cmds/tests.rs
@@ -136,6 +136,38 @@ fn csv_import_and_apply() {
     assert_eq!(text_of(&s, title), "On Sale");
 }
 
+#[test]
+fn csv_import_ignores_utf8_bom() {
+    let dir = tmp("csv-bom");
+    let csv = format!("{dir}/sets.csv");
+
+    // BOM before the `DataSet` name column: sets keep their names.
+    let (mut s, _p, badge, title) = session();
+    s.execute(
+        "image.variables.define",
+        json!({"defs": [
+            {"name": "showBadge", "layer": badge.0, "type": "visibility"},
+            {"name": "headline", "layer": title.0, "type": "textReplacement"},
+        ]}),
+    )
+    .unwrap();
+    std::fs::write(&csv, "\u{feff}DataSet,showBadge,headline\nrow-on,true,On Sale\n").unwrap();
+    let r = s.execute("file.import.variableDataSets", json!({"path": csv})).unwrap();
+    assert_eq!(r["imported"], 1);
+    s.execute("image.applyDataSet", json!({"name": "row-on"})).unwrap();
+    assert!(doc(&s).layer(badge).unwrap().visible);
+    assert_eq!(text_of(&s, title), "On Sale");
+
+    // BOM before a variable column (no name column): the variable is still imported.
+    let (mut s, _p, badge, title) = session();
+    s.execute("image.variables.define", json!({"defs": [{"name": "headline", "layer": title.0, "type": "textReplacement"}]})).unwrap();
+    let _ = badge;
+    let r = import_data_sets_text(&mut s, "\u{feff}headline\nHello\n", &json!({})).unwrap();
+    assert_eq!(r["imported"], 1);
+    s.execute("image.applyDataSet", json!({"index": 0})).unwrap();
+    assert_eq!(text_of(&s, title), "Hello");
+}
+
 #[test]
 fn csv_fields_preserve_unicode_and_quoting() {
     for (line, delimiter, expected) in [
diff --git a/crates/engine/src/video_cmds.rs b/crates/engine/src/video_cmds.rs
index 6fb9ab4574..820745fd38 100644
--- a/crates/engine/src/video_cmds.rs
+++ b/crates/engine/src/video_cmds.rs
@@ -365,7 +365,9 @@ fn reload_frame(s: &mut Session, _p: &Value) -> Result<Value> {
     let photocraft_doc::VideoSource::File { path } = src else {
         return Err(EngineError::BadParams { cmd: "layer.videoLayers.reloadFrame".into(), msg: "this layer has no file source to reload".into() });
     };
-    let frames = load_frames(&path, fmt)?.frames;
+    // The footage path is stored in the document.
+    let file = crate::doc_path::resolve(&path).map_err(|why| crate::doc_path::refusal("the footage", &path, why))?;
+    let frames = load_frames(&file.to_string_lossy(), fmt)?.frames;
     edit_video(s, "Reload Frame", move |v, _| {
         v.original_frames = Some(frames.clone());
         v.frames = frames;
diff --git a/crates/engine/src/web_cmds.rs b/crates/engine/src/web_cmds.rs
index 595ad21956..9f0e25574d 100644
--- a/crates/engine/src/web_cmds.rs
+++ b/crates/engine/src/web_cmds.rs
@@ -1024,27 +1024,48 @@ fn export_preferences(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"section": "export", "values": s.prefs().get("export").unwrap_or(Value::Null)}))
 }
 
+/// The Quick Export format's extension (Export Preferences › Format).
+fn quick_export_ext(s: &Session) -> String {
+    serde_json::to_value(s.prefs().export.quick_export_format).ok().and_then(|v| v.as_str().map(str::to_string)).unwrap_or_else(|| "png".into())
+}
+
+/// Where Quick Export writes the active document with no `path` given: `<name>.<format>` beside
+/// its file, when Export Preferences › Location is Same Folder and the document has a file.
+pub fn quick_export_target(s: &Session) -> Option<String> {
+    let same = s.prefs().export.quick_export_location == crate::prefs::ExportLocation::SameFolder;
+    let dp = s.active()?.path.as_deref().filter(|_| same)?;
+    let dir = std::path::Path::new(dp).parent().map(|d| d.to_string_lossy().into_owned()).unwrap_or_default();
+    Some(join(&dir, &format!("{}.{}", stem(dp), quick_export_ext(s))))
+}
+
+/// Whether [`quick_export_target`] is the active document's own file (a document opened from
+/// `photo.png` and exported as PNG), which Quick Export must not replace without asking (#6599).
+pub fn quick_export_target_is_own_file(s: &Session) -> bool {
+    let own = s.active().and_then(|d| d.path.as_deref());
+    quick_export_target(s).zip(own).is_some_and(|(target, own)| crate::file_cmds::same_file(&target, own))
+}
+
 /// File › Export › Quick Export as <format>: the format, quality, metadata, colour space and
 /// location from Export Preferences. `path` overrides the location ("ask" needs one).
 fn quick_export(s: &mut Session, p: &Value) -> Result<Value> {
     let cmd = "file.export.quickExport";
     let prefs = s.prefs().export.clone();
-    let fmt = serde_json::to_value(prefs.quick_export_format).ok().and_then(|v| v.as_str().map(str::to_string)).unwrap_or_else(|| "png".into());
-    let d = s.active().ok_or(EngineError::NoDocument)?;
-    let doc = d.doc.clone();
+    let fmt = quick_export_ext(s);
     let path = match p.get("path").and_then(Value::as_str).filter(|v| !v.is_empty()) {
         Some(v) => v.to_string(),
         None => {
-            let same = serde_json::to_value(prefs.quick_export_location).ok().and_then(|v| v.as_str().map(str::to_string)).is_some_and(|v| v == "sameFolder");
-            match (&d.path, same) {
-                (Some(dp), true) => {
-                    let dir = std::path::Path::new(dp).parent().map(|d| d.to_string_lossy().into_owned()).unwrap_or_default();
-                    join(&dir, &format!("{}.{fmt}", stem(dp)))
-                }
-                _ => return Err(bad(cmd, "missing `path` (Export Preferences › Location is \"ask\", or the document was never saved)")),
+            let Some(target) = quick_export_target(s) else {
+                return Err(bad(cmd, "missing `path` (Export Preferences › Location is \"ask\", or the document was never saved)"));
+            };
+            // The document's own file is never replaced by an export the user didn't name (#6599).
+            if quick_export_target_is_own_file(s) {
+                return Err(bad(cmd, format!("the export would replace the document's own file {target}; give a `path`")));
             }
+            target
         }
     };
+    let d = s.active().ok_or(EngineError::NoDocument)?;
+    let doc = d.doc.clone();
     let metadata = serde_json::to_value(prefs.metadata).ok().and_then(|v| v.as_str().map(str::to_string)).unwrap_or_default();
     let mut o = serde_json::Map::new();
     o.insert(
@@ -1168,8 +1189,12 @@ fn parse_size(item: &str, dpi: f64) -> (Option<f64>, Option<f64>, Option<f64>, &
         && toks[1].eq_ignore_ascii_case("x")
         && let (Some(w), Some(h)) = (unit_px(toks[0], dpi), unit_px(toks[2], dpi))
     {
-        let pos = item.find(toks[3]).unwrap_or(item.len());
-        return (None, w, h, &item[pos..]);
+        // Skip exactly the three size tokens; searching for the name's first word could match inside the size.
+        let mut rest = item;
+        for _ in 0..3 {
+            rest = rest.trim_start().trim_start_matches(|c: char| !c.is_whitespace());
+        }
+        return (None, w, h, rest.trim_start());
     }
     (None, None, None, item)
 }
@@ -1337,10 +1362,15 @@ fn asset_output_path(dir: &str, relative: &str) -> Result<(String, String)> {
 }
 
 /// Exports every asset named by `doc`'s layers into `dir`. Returns (files, errors).
+///
+/// Each file is written once per run (#6614): when two layers (or two default variants) name the
+/// same file, the one higher in the Layers panel keeps it and the other is reported in `errors`.
+/// Names are compared ignoring case, as `Logo.png` and `logo.png` are one file on Windows and
+/// macOS.
 pub fn generate_assets(doc: &Document, dir: &str) -> (Vec<String>, Vec<Value>) {
     let dpi = f64::from(doc.resolution_dpi.max(1.0));
     let mut defaults: Option<Vec<AssetDefault>> = None;
-    let mut jobs: Vec<(LayerId, AssetSpec)> = Vec::new();
+    let mut by_layer: Vec<Vec<(LayerId, AssetSpec)>> = Vec::new();
     for (_, _, l) in doc.walk() {
         if let Some(d) = parse_defaults(&l.name, dpi) {
             defaults = Some(d);
@@ -1349,22 +1379,26 @@ pub fn generate_assets(doc: &Document, dir: &str) -> (Vec<String>, Vec<Value>) {
         if matches!(l.content, LayerContent::Adjustment(_)) {
             continue;
         }
-        for spec in parse_asset_name(&l.name, dpi) {
-            jobs.push((l.id, spec));
-        }
+        by_layer.push(parse_asset_name(&l.name, dpi).into_iter().map(|spec| (l.id, spec)).collect());
     }
+    // Top layer first, as the Layers panel lists them (`walk` goes bottom to top).
+    let jobs: Vec<(LayerId, AssetSpec)> = by_layer.into_iter().rev().flatten().collect();
     let variants: Vec<AssetDefault> = match defaults {
         Some(d) if !d.is_empty() => d,
         _ => vec![AssetDefault::default()],
     };
     let mut files = Vec::new();
     let mut errors = Vec::new();
+    let mut written = std::collections::HashSet::new();
     for (id, spec) in &jobs {
         for v in &variants {
             let r = (|| -> Result<String> {
                 let (name_stem, ext) = spec.file.rsplit_once('.').unwrap_or((spec.file.as_str(), "png"));
                 let rel = format!("{}{}{}.{ext}", v.folder, name_stem, v.suffix);
-                asset_path_components(&rel)?;
+                let key = asset_path_components(&rel)?.join("/").to_lowercase();
+                if written.contains(&key) {
+                    return Err(other(format!("{rel}: another layer already writes this file; rename one of the layers")));
+                }
                 let mut one = crate::layer_menu_cmds::layer_document(doc, *id)?;
                 one.metadata = Default::default();
                 let (w0, h0) = (f64::from(one.size.width), f64::from(one.size.height));
@@ -1392,12 +1426,14 @@ pub fn generate_assets(doc: &Document, dir: &str) -> (Vec<String>, Vec<Value>) {
                 if spec.format == "webp" {
                     let (out, reported) = asset_output_path(dir, &rel)?;
                     crate::file_cmds::save_doc(&wdoc, &out, None)?;
+                    written.insert(key);
                     return Ok(reported);
                 }
                 let buf = photocraft_compose::flatten(&wdoc);
                 let o = optimize(&buf.px, wdoc.size.width as usize, wdoc.bounds(), &st, None, None, wdoc.resolution_dpi, false)?;
                 let (out, reported) = asset_output_path(dir, &rel)?;
                 write_file(&out, &o.bytes)?;
+                written.insert(key);
                 Ok(reported)
             })();
             match r {
diff --git a/crates/engine/src/web_cmds/tests.rs b/crates/engine/src/web_cmds/tests.rs
index c3ffe6edce..594fe8d496 100644
--- a/crates/engine/src/web_cmds/tests.rs
+++ b/crates/engine/src/web_cmds/tests.rs
@@ -437,6 +437,54 @@ fn export_preferences_drive_quick_export() {
     s.execute("prefs.reset", json!({"path": "export"})).unwrap();
 }
 
+/// #6599: with Location = Same Folder, a document opened from `photo.png` would be exported over
+/// `photo.png` itself. Without a `path` that is refused and the file is left alone; named
+/// explicitly (the save dialog's answer) it is written.
+#[test]
+fn quick_export_never_replaces_the_documents_own_file_unasked() {
+    let dir = tmp("quick_own_file");
+    let mut s = session(8);
+    s.execute("file.export.exportPreferences", json!({"quickExportLocation": "sameFolder", "quickExportFormat": "png"})).unwrap();
+    let own = format!("{dir}/photo.png");
+    std::fs::write(&own, b"original").unwrap();
+    s.active_mut().unwrap().path = Some(own.clone());
+    assert_eq!(quick_export_target(&s), Some(own.clone()));
+    assert!(quick_export_target_is_own_file(&s));
+    let e = s.execute("file.export.quickExport", json!({})).unwrap_err().to_string();
+    assert!(e.contains("own file"), "{e}");
+    assert_eq!(std::fs::read(&own).unwrap(), b"original", "the source is untouched");
+    s.execute("file.export.quickExport", json!({"path": own})).unwrap();
+    assert_eq!(decode(&own).dimensions(), (64, 48));
+    // Another format, or a PSD's earlier export beside it, is still written without asking.
+    s.execute("file.export.exportPreferences", json!({"quickExportFormat": "jpg"})).unwrap();
+    assert!(!quick_export_target_is_own_file(&s));
+    assert_eq!(s.execute("file.export.quickExport", json!({})).unwrap()["path"], json!(format!("{dir}/photo.jpg")));
+    s.execute("file.export.exportPreferences", json!({"quickExportFormat": "png"})).unwrap();
+    s.active_mut().unwrap().path = Some(format!("{dir}/photo.psd"));
+    assert!(!quick_export_target_is_own_file(&s));
+    assert_eq!(s.execute("file.export.quickExport", json!({})).unwrap()["path"], json!(own));
+    s.execute("prefs.reset", json!({"path": "export"})).unwrap();
+}
+
+#[test]
+fn same_file_sees_through_other_names_for_one_file() {
+    let dir = tmp("same_file");
+    let (a, b, c) = (format!("{dir}/a.png"), format!("{dir}/b.png"), format!("{dir}/c.png"));
+    std::fs::write(&a, b"a").unwrap();
+    std::fs::write(&c, b"c").unwrap();
+    assert!(crate::file_cmds::same_file(&a, &a));
+    assert!(crate::file_cmds::same_file(&a, &format!("{dir}/./a.png")));
+    assert!(!crate::file_cmds::same_file(&a, &c));
+    assert!(!crate::file_cmds::same_file(&a, &b), "a missing file is not the same file");
+    #[cfg(unix)]
+    {
+        std::fs::hard_link(&a, &b).unwrap();
+        assert!(crate::file_cmds::same_file(&a, &b), "a hard link is the same file");
+    }
+    #[cfg(windows)]
+    assert!(crate::file_cmds::same_file(&a, &format!("{dir}/A.PNG")), "NTFS names ignore case");
+}
+
 #[test]
 fn webp_export_preferences_select_lossless_or_lossy_output() {
     let dir = tmp("quick_webp_quality");
@@ -485,6 +533,20 @@ fn webp_export_preferences_select_lossless_or_lossy_output() {
     }
 }
 
+#[test]
+fn generator_spaced_size_keeps_only_the_file_name() {
+    for (name, w, h, file) in [
+        ("2 x 2 2 icon.png", 2.0, 2.0, "2 icon.png"),
+        ("1in x 1in in.png", 72.0, 72.0, "in.png"),
+        ("2px x 1px x.png", 2.0, 1.0, "x.png"),
+        ("2in  x  1in   label name.png", 144.0, 72.0, "label name.png"),
+    ] {
+        let a = parse_asset_name(name, 72.0);
+        assert_eq!(a.len(), 1, "{name}");
+        assert_eq!((a[0].width, a[0].height, a[0].file.as_str()), (Some(w), Some(h), file), "{name}");
+    }
+}
+
 #[test]
 fn generator_naming_grammar() {
     let a = parse_asset_name("200% foo@2x.png, 48x48 icons/bar.png8 + photo.jpg8", 72.0);
@@ -546,6 +608,47 @@ fn image_assets_are_generated_now_and_on_save() {
     assert_eq!(decode(&files[0]).dimensions(), (128, 80));
 }
 
+/// #6614: two layers, or two default variants, naming one file never overwrite each other: the
+/// layer higher in the Layers panel keeps the file, whatever the case of its name, and the
+/// others are reported.
+#[test]
+fn image_assets_never_write_one_file_twice() {
+    let dir = tmp("asset-collisions");
+    let mut s = session(8);
+    s.edit("paint", |doc, active| {
+        let fmt = doc.pixel_format();
+        let mut l = Layer::raster("Top", fmt);
+        l.surface_mut().unwrap().fill_rect(Rect::new(0, 0, 4, 4), &photocraft_raster::from_rgba(&fmt, [0.0, 0.0, 1.0, 1.0]));
+        let id = doc.insert_above(None, l);
+        *active = Some(id);
+        Ok(())
+    })
+    .unwrap();
+    let mut d = (*s.active().unwrap().doc).clone();
+    let id = |d: &photocraft_doc::Document, name: &str| d.walk().into_iter().find(|(_, _, l)| l.name == name).unwrap().2.id;
+    let (top, logo) = (id(&d, "Top"), id(&d, "Logo"));
+    d.layer_mut(top).unwrap().name = "Logo.PNG".into();
+    d.layer_mut(logo).unwrap().name = "logo.png, logo.png".into();
+    let (files, errors) = generate_assets(&d, &dir);
+    assert_eq!(files.iter().map(|p| std::path::PathBuf::from(p.as_str())).collect::<Vec<_>>(), vec![std::path::Path::new(&dir).join("Logo.png")]);
+    assert_eq!(decode(&files[0]).dimensions(), (4, 4), "the top layer keeps the file");
+    assert_eq!(errors.len(), 2, "{errors:?}");
+    assert!(errors.iter().all(|e| e["error"].as_str().unwrap().contains("another layer already writes this file")), "{errors:?}");
+    assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 1, "one file, not a second one under another case");
+
+    // Two default variants that land on one name: the first keeps it.
+    let dir = tmp("asset-variant-collisions");
+    d.layer_mut(top).unwrap().name = "icon.png".into();
+    d.layer_mut(logo).unwrap().name = "Logo".into();
+    d.layers
+        .push(Layer::new("default 50% + 200% + 200% @2x", LayerContent::Group(photocraft_doc::Group { children: vec![], expanded: false, artboard: None })));
+    let (files, errors) = generate_assets(&d, &dir);
+    let names: Vec<_> = files.iter().map(|p| std::path::Path::new(p).file_name().unwrap().to_string_lossy().into_owned()).collect();
+    assert_eq!(names, ["icon.png", "icon@2x.png"]);
+    assert_eq!(decode(&files[0]).dimensions(), (2, 2), "the 50% variant keeps icon.png");
+    assert_eq!(errors.len(), 1, "{errors:?}");
+}
+
 #[test]
 fn image_assets_reject_traversal_from_names_and_defaults() {
     let base = tmp("asset-path-guard");
diff --git a/crates/engine/tests/artboard_export_names.rs b/crates/engine/tests/artboard_export_names.rs
new file mode 100644
index 0000000000..f9c46f3eb7
--- /dev/null
+++ b/crates/engine/tests/artboard_export_names.rs
@@ -0,0 +1,103 @@
+//! #6613: each artboard must have its own output even when names collide on disk.
+#![cfg(not(target_arch = "wasm32"))]
+
+use std::collections::HashSet;
+use std::path::Path;
+
+use photocraft_engine::Session;
+use serde_json::json;
+
+struct Board {
+    id: u64,
+    width: u32,
+    color: [f32; 4],
+}
+
+fn fixture(depth: u32, names: &[&str]) -> (Session, Vec<Board>) {
+    let mut s = Session::new();
+    s.execute("file.new", json!({"name": "Board Export", "width": 96, "height": 32, "depth": depth})).unwrap();
+    let mut boards = Vec::new();
+    for (i, name) in names.iter().enumerate() {
+        let width = 3 + i as u32;
+        let color = if i % 2 == 0 { [1.0, 0.0, 0.0, 1.0] } else { [0.0, 0.0, 1.0, 1.0] };
+        let result = s.execute("layer.new.artboard", json!({"name": name, "rect": [12 * i, 0, width, 2], "background": "custom", "color": color})).unwrap();
+        boards.push(Board { id: result["layer"].as_u64().unwrap(), width, color });
+    }
+    (s, boards)
+}
+
+fn check_export(depth: u32, names: &[&str], prefix: Option<&str>, format: &str, selected: Option<&[usize]>) {
+    let (mut s, boards) = fixture(depth, names);
+    let dir = tempfile::tempdir().unwrap();
+    let mut params = json!({"dir": dir.path(), "format": format});
+    if let Some(prefix) = prefix {
+        params["prefix"] = json!(prefix);
+    }
+    if let Some(selected) = selected {
+        params["artboards"] = json!(selected.iter().map(|i| boards[*i].id).collect::<Vec<_>>());
+    }
+    let expected: Vec<_> = boards.iter().enumerate().rev().filter(|(i, _)| selected.is_none_or(|ids| ids.contains(i))).map(|(_, b)| b).collect();
+    let before = photocraft_format::save_to_bytes(&s.active().unwrap().doc, &Default::default()).unwrap();
+    let revision = s.active().unwrap().revision;
+    let history = s.active().unwrap().history.past_len();
+    let result = s.execute("file.export.artboardsToFiles", params).unwrap();
+    let files: Vec<_> = result["files"].as_array().unwrap().iter().map(|f| f.as_str().unwrap()).collect();
+    assert_eq!(files.len(), expected.len());
+    // Also require uniqueness on filesystems that compare names without letter case.
+    assert_eq!(files.iter().map(|f| f.to_lowercase()).collect::<HashSet<_>>().len(), files.len(), "export paths collide: {files:?}");
+    assert_eq!(std::fs::read_dir(dir.path()).unwrap().count(), files.len(), "one physical output per returned path");
+    for (file, board) in files.iter().zip(expected) {
+        assert_eq!(Path::new(file).parent(), Some(dir.path()));
+        let bytes = std::fs::read(file).unwrap();
+        let doc = photocraft_io::import(file, &bytes).unwrap().document;
+        assert_eq!((doc.size.width, doc.size.height), (board.width, 2), "wrong artboard in {file}");
+        let px = photocraft_compose::flatten(&doc).px[0];
+        for (actual, expected) in px.iter().zip(board.color) {
+            assert!((actual - expected).abs() < 1e-3, "wrong pixels in {file}: {px:?}");
+        }
+    }
+    let after = s.active().unwrap();
+    assert_eq!(photocraft_format::save_to_bytes(&after.doc, &Default::default()).unwrap(), before);
+    assert_eq!(after.revision, revision, "export must not edit the source document");
+    assert_eq!(after.history.past_len(), history);
+}
+
+#[test]
+fn duplicate_names_preserve_each_board_at_every_depth_and_prefix() {
+    for depth in [8, 16, 32] {
+        for prefix in [None, Some(""), Some("Launch/Run")] {
+            check_export(depth, &["Artboard 1", "Artboard 1"], prefix, "png", None);
+        }
+    }
+}
+
+#[test]
+fn sanitized_and_empty_names_preserve_each_tiff() {
+    check_export(16, &["Hero/1", "Hero:1", "Hero?1", ".", " ", "layer"], Some(""), "tiff", None);
+}
+
+#[test]
+fn case_only_and_index_like_names_remain_distinct() {
+    check_export(8, &["Logo", "logo", "Logo_0001", "0000_Logo", "Лого", "лого"], Some("site"), "png", None);
+}
+
+#[test]
+fn selected_duplicate_names_keep_their_psd_contents_in_stack_order() {
+    check_export(16, &["Same", "Skip", "Same"], Some("chosen"), "psd", Some(&[0, 2]));
+}
+
+#[test]
+fn distinct_names_keep_their_corresponding_contents() {
+    check_export(8, &["Red", "Blue"], None, "png", None);
+}
+
+#[test]
+fn invalid_export_params_fail_before_creating_files() {
+    let (mut s, _) = fixture(8, &["One", "Two"]);
+    let dir = tempfile::tempdir().unwrap();
+    for params in [json!({"dir": 3}), json!({"dir": dir.path(), "artboards": []}), json!({"dir": dir.path(), "artboards": [u64::MAX]})] {
+        assert!(s.execute("file.export.artboardsToFiles", params).is_err());
+        assert_eq!(std::fs::read_dir(dir.path()).unwrap().count(), 0);
+    }
+    assert!(Session::new().execute("file.export.artboardsToFiles", json!({"dir": dir.path()})).is_err());
+}
diff --git a/crates/engine/tests/camera_raw_exposure_clamp.rs b/crates/engine/tests/camera_raw_exposure_clamp.rs
new file mode 100644
index 0000000000..ee624f7e28
--- /dev/null
+++ b/crates/engine/tests/camera_raw_exposure_clamp.rs
@@ -0,0 +1,40 @@
+//! `filter.cameraRaw` must clamp `exposure` to its documented -5..5 range. Before the fix,
+//! `raw_params` passed it through, so an exposure of 128 or more overflowed `2^exposure` to
+//! infinity and a 32-bit layer was left with non-finite samples.
+
+use photocraft_engine::Session;
+use serde_json::json;
+
+#[test]
+fn camera_raw_clamps_exposure() {
+    let hi = photocraft_engine::lens_cmds::raw_params("filter.cameraRaw", &json!({"exposure": 255.0})).expect("params parse");
+    assert_eq!(hi.exposure, 5.0, "exposure 255 must clamp to 5");
+    let lo = photocraft_engine::lens_cmds::raw_params("filter.cameraRaw", &json!({"exposure": -255.0})).expect("params parse");
+    assert_eq!(lo.exposure, -5.0, "exposure -255 must clamp to -5");
+    let mid = photocraft_engine::lens_cmds::raw_params("filter.cameraRaw", &json!({"exposure": 1.5})).expect("params parse");
+    assert_eq!(mid.exposure, 1.5, "in-range exposure stays untouched");
+}
+
+#[test]
+fn camera_raw_out_of_range_exposure_keeps_32_bit_layer_finite() {
+    for exposure in [255.0, -255.0] {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 8, "height": 8, "depth": 32})).unwrap();
+        s.execute("layer.new.layer", json!({})).unwrap();
+        s.execute("edit.fill", json!({"contents": "color", "color": "#ff0000"})).unwrap();
+        s.execute("filter.cameraRaw", json!({"exposure": exposure})).unwrap();
+        let st = s.active().unwrap();
+        let layer = st.active_layer.and_then(|id| st.doc.layer(id)).unwrap();
+        let surf = layer.surface().unwrap();
+        let mut bad = Vec::new();
+        for y in 0..8 {
+            for x in 0..8 {
+                let px = surf.rgba(x, y);
+                if px.iter().any(|v| !v.is_finite()) {
+                    bad.push(px);
+                }
+            }
+        }
+        assert!(bad.is_empty(), "exposure {exposure}: {} non-finite pixels, e.g. {:?}", bad.len(), bad.first());
+    }
+}
diff --git a/crates/engine/tests/clipping_semantics.rs b/crates/engine/tests/clipping_semantics.rs
new file mode 100644
index 0000000000..1a4aa562a7
--- /dev/null
+++ b/crates/engine/tests/clipping_semantics.rs
@@ -0,0 +1,75 @@
+//! Clip groups through Release Clipping Mask, Merge Down, Merge Layers and Delete Hidden Layers,
+//! as in Photoshop (layers audit L2). The stack: Background, B, C1*, C2* (C1 and C2 clipped to B).
+
+use photocraft_engine::Session;
+use serde_json::json;
+
+fn stack() -> (Session, [u64; 3]) {
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 32, "height": 32, "background": "white"})).unwrap();
+    let mut ids = [0u64; 3];
+    for (i, color) in ["#ff0000", "#00ff00", "#0000ff"].iter().enumerate() {
+        ids[i] = s.execute("layer.new.layer", json!({})).unwrap()["layer"].as_u64().unwrap();
+        s.execute("select.rect", json!({"x": 4 * i, "y": 4, "width": 12, "height": 12})).unwrap();
+        s.execute("edit.fill", json!({"color": color})).unwrap();
+        s.execute("select.deselect", json!({})).unwrap();
+    }
+    for c in &ids[1..] {
+        s.execute("layer.setProps", json!({"layer": c, "clipped": true})).unwrap();
+    }
+    (s, ids)
+}
+
+fn clipped(s: &Session, id: u64) -> bool {
+    s.active().unwrap().doc.layer(photocraft_doc::LayerId(id)).unwrap().clipped
+}
+
+#[test]
+fn releasing_a_middle_layer_releases_the_ones_above_it() {
+    let (mut s, [_, c1, c2]) = stack();
+    let r = s.execute("layer.releaseClippingMask", json!({"layer": c1})).unwrap();
+    assert!(!clipped(&s, c1) && !clipped(&s, c2), "C2 isn't left clipped to the released C1: {r}");
+    // Releasing the top one leaves the one below it alone.
+    let (mut s, [_, c1, c2]) = stack();
+    s.execute("layer.releaseClippingMask", json!({"layer": c2})).unwrap();
+    assert!(clipped(&s, c1) && !clipped(&s, c2));
+}
+
+#[test]
+fn merging_clipped_layers_keeps_the_result_clipped() {
+    let (mut s, [_, c1, c2]) = stack();
+    s.execute("layer.select", json!({"layer": c2})).unwrap();
+    let r = s.execute("layer.mergeDown", json!({})).unwrap();
+    let merged = r["layer"].as_u64().unwrap_or(c1);
+    assert!(clipped(&s, merged), "C2 merged down into C1 stays clipped to B");
+    let (mut s, [_, c1, c2]) = stack();
+    s.execute("layer.select", json!({"layer": c1})).unwrap();
+    s.execute("layer.select", json!({"layer": c2, "mode": "add"})).unwrap();
+    let r = s.execute("layer.mergeLayers", json!({})).unwrap();
+    assert!(clipped(&s, r["layer"].as_u64().unwrap()), "C1 + C2 merged stay clipped");
+    // Clipped layers of two chains (Background, B, C1*, E, D*: C1 clipped to B, D to E) merge
+    // into an ordinary layer: kept clipped at D's slot, C1's pixels would clip to E.
+    let (mut s, [_, c1, e]) = stack();
+    s.execute("layer.setProps", json!({"layer": e, "clipped": false})).unwrap();
+    let d = s.execute("layer.new.layer", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("edit.fill", json!({"color": "#808080"})).unwrap();
+    s.execute("layer.setProps", json!({"layer": d, "clipped": true})).unwrap();
+    s.execute("layer.select", json!({"layer": c1})).unwrap();
+    s.execute("layer.select", json!({"layer": d, "mode": "add"})).unwrap();
+    let r = s.execute("layer.mergeLayers", json!({})).unwrap();
+    assert!(!clipped(&s, r["layer"].as_u64().unwrap()), "C1 + D come from two clip chains");
+    // Merging the base with its clipped layers gives an ordinary layer.
+    let (mut s, [b, _, c2]) = stack();
+    s.execute("layer.select", json!({"layer": b})).unwrap();
+    s.execute("layer.select", json!({"layer": c2, "mode": "add"})).unwrap();
+    let r = s.execute("layer.mergeLayers", json!({})).unwrap();
+    assert!(!clipped(&s, r["layer"].as_u64().unwrap()));
+}
+
+#[test]
+fn deleting_a_hidden_base_releases_its_clipped_layers() {
+    let (mut s, [b, c1, c2]) = stack();
+    s.execute("layer.setProps", json!({"layer": b, "visible": false})).unwrap();
+    s.execute("layer.delete.hiddenLayers", json!({})).unwrap();
+    assert!(!clipped(&s, c1) && !clipped(&s, c2), "they don't clip to the layer below the deleted base");
+}
diff --git a/crates/engine/tests/layer_props_several.rs b/crates/engine/tests/layer_props_several.rs
new file mode 100644
index 0000000000..beee852d1c
--- /dev/null
+++ b/crates/engine/tests/layer_props_several.rs
@@ -0,0 +1,72 @@
+//! `layer.setProps` on several layers at once (the Layers panel with several selected, as in
+//! Photoshop), and Photoshop's History names for each kind of change.
+
+use photocraft_engine::Session;
+use serde_json::json;
+
+fn doc() -> (Session, Vec<u64>) {
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 32, "height": 32, "background": "white"})).unwrap();
+    let ids = (0..3).map(|_| s.execute("layer.new.layer", json!({})).unwrap()["layer"].as_u64().unwrap()).collect();
+    (s, ids)
+}
+
+fn layer(s: &Session, id: u64) -> photocraft_doc::Layer {
+    s.active().unwrap().doc.layer(photocraft_doc::LayerId(id)).unwrap().clone()
+}
+
+fn last_step(s: &Session) -> String {
+    s.active().unwrap().history.entries().last().cloned().unwrap_or_default()
+}
+
+#[test]
+fn one_change_reaches_every_listed_layer_in_one_step() {
+    let (mut s, ids) = doc();
+    let steps = s.active().unwrap().history.entries().len();
+    s.execute("layer.setProps", json!({"layers": [ids[0], ids[2]], "opacity": 0.4})).unwrap();
+    assert_eq!(s.active().unwrap().history.entries().len(), steps + 1, "one step");
+    assert_eq!(last_step(&s), "Opacity Change");
+    assert_eq!((layer(&s, ids[0]).opacity, layer(&s, ids[1]).opacity, layer(&s, ids[2]).opacity), (0.4, 1.0, 0.4));
+    s.execute("layer.setProps", json!({"layers": ids, "blend": "Multiply"})).unwrap();
+    assert_eq!(last_step(&s), "Blending Change");
+    assert!(ids.iter().all(|id| layer(&s, *id).blend == photocraft_color::BlendMode::Multiply));
+    s.execute("layer.setProps", json!({"layers": [ids[1], ids[1], ids[2]], "locks": {"all": true}})).unwrap();
+    assert!(layer(&s, ids[1]).locks.all && layer(&s, ids[2]).locks.all && !layer(&s, ids[0]).locks.all, "duplicates are harmless");
+    s.execute("layer.setProps", json!({"layers": [ids[0]], "fill": 0.5})).unwrap();
+    assert_eq!(last_step(&s), "Fill Opacity Change");
+    s.execute("layer.setProps", json!({"layer": ids[0], "name": "Sky"})).unwrap();
+    assert_eq!(last_step(&s), "Rename Layer");
+    s.execute("layer.setProps", json!({"layer": ids[0], "opacity": 0.3, "fill": 0.3})).unwrap();
+    assert_eq!(last_step(&s), "Layer Properties", "a mix keeps the general name");
+}
+
+#[test]
+fn bad_layer_lists_change_nothing() {
+    let (mut s, ids) = doc();
+    let before = s.active().unwrap().doc.clone();
+    for p in [
+        json!({"layers": [], "opacity": 0.5}),
+        json!({"layers": "all", "opacity": 0.5}),
+        json!({"layers": ["x"], "opacity": 0.5}),
+        json!({"layers": [ids[0], 999_999], "opacity": 0.5}),
+        json!({"layers": [ids[0], ids[1]], "name": "Both"}),
+        json!({"layers": [ids[0], ids[1]], "opacity": 2.0}),
+    ] {
+        assert!(s.execute("layer.setProps", p.clone()).is_err(), "{p}");
+        assert_eq!(s.active().unwrap().doc.layers, before.layers, "{p}");
+    }
+}
+
+#[test]
+fn pass_through_is_for_groups_only() {
+    let (mut s, ids) = doc();
+    let g = s.execute("layer.new.group", json!({})).unwrap()["layer"].as_u64().unwrap();
+    // A pixel layer, alone or with a group, can't take Pass Through; nothing changes.
+    assert!(s.execute("layer.setProps", json!({"layer": ids[0], "blend": "Pass Through"})).is_err());
+    let before = (layer(&s, ids[0]).blend, layer(&s, g).blend);
+    assert!(s.execute("layer.setProps", json!({"layers": [g, ids[0]], "blend": "Pass Through"})).is_err());
+    assert_eq!((layer(&s, ids[0]).blend, layer(&s, g).blend), before);
+    s.execute("layer.setProps", json!({"layers": [g], "blend": "Normal"})).unwrap();
+    s.execute("layer.setProps", json!({"layer": g, "blend": "Pass Through"})).unwrap();
+    assert_eq!(layer(&s, g).blend, photocraft_color::BlendMode::PassThrough);
+}
diff --git a/crates/engine/tests/missing_layer_error.rs b/crates/engine/tests/missing_layer_error.rs
new file mode 100644
index 0000000000..5764f5d85c
--- /dev/null
+++ b/crates/engine/tests/missing_layer_error.rs
@@ -0,0 +1,68 @@
+//! A `"layer"` param that names no layer says which layers there are (#5058): ids are not
+//! positions (a freshly opened PNG's Background is layer 2), and an agent should be able to
+//! recover from the error alone. A name matches regardless of case as a fallback.
+
+use photocraft_engine::{EngineError, Session};
+use serde_json::json;
+
+fn session() -> (Session, u64) {
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 8, "height": 6})).unwrap();
+    let bg = s.active().unwrap().active_layer.unwrap().0;
+    (s, bg)
+}
+
+fn unused_id(s: &Session) -> u64 {
+    let doc = &s.active().unwrap().doc;
+    (1..).find(|id| doc.layer(photocraft_doc::LayerId(*id)).is_none()).unwrap()
+}
+
+#[test]
+fn an_unknown_layer_id_lists_the_documents_layers() {
+    let (mut s, bg) = session();
+    let layer = s.execute("layer.new.layer", json!({})).unwrap()["layer"].as_u64().unwrap();
+    let missing = unused_id(&s);
+    let err = s.execute("layer.setProps", json!({"layer": missing, "visible": false})).unwrap_err();
+    assert!(matches!(err, EngineError::UnknownLayer { id, .. } if id.0 == missing), "{err}");
+    let err = err.to_string();
+    assert!(err.contains(&format!("no such layer {missing};")), "{err}");
+    assert!(err.contains(&format!("{layer} \"Layer 1\", {bg} \"Background\"")), "top-down ids and names: {err}");
+}
+
+#[test]
+fn an_unknown_layer_name_lists_the_documents_layers() {
+    let (mut s, bg) = session();
+    let err = s.execute("layer.setProps", json!({"layer": "Nope", "visible": false})).unwrap_err().to_string();
+    assert!(err.contains("no layer named \"Nope\""), "{err}");
+    assert!(err.contains(&format!("{bg} \"Background\"")), "{err}");
+}
+
+#[test]
+fn a_layer_name_matches_regardless_of_case() {
+    let (mut s, bg) = session();
+    s.execute("layer.new.layer", json!({})).unwrap();
+    s.execute("layer.setProps", json!({"layer": "background", "name": "Base"})).unwrap();
+    assert_eq!(s.active().unwrap().doc.layer(photocraft_doc::LayerId(bg)).unwrap().name, "Base");
+}
+
+#[test]
+fn an_exact_name_wins_over_a_case_insensitive_one() {
+    let (mut s, _) = session();
+    let lower = s.execute("layer.new.layer", json!({"name": "shadow"})).unwrap()["layer"].as_u64().unwrap();
+    let upper = s.execute("layer.new.layer", json!({"name": "Shadow"})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setProps", json!({"layer": "shadow", "visible": false})).unwrap();
+    let doc = &s.active().unwrap().doc;
+    assert!(!doc.layer(photocraft_doc::LayerId(lower)).unwrap().visible);
+    assert!(doc.layer(photocraft_doc::LayerId(upper)).unwrap().visible);
+}
+
+#[test]
+fn a_long_layer_name_is_shortened_in_the_listing() {
+    let (mut s, _) = session();
+    let long = "é".repeat(500);
+    let layer = s.execute("layer.new.layer", json!({"name": long})).unwrap()["layer"].as_u64().unwrap();
+    let err = s.execute("layer.setProps", json!({"layer": "Nope", "visible": false})).unwrap_err().to_string();
+    let shown = format!("{layer} \"{}…\"", "é".repeat(64));
+    assert!(err.contains(&shown), "the name is cut at 64 characters: {err}");
+    assert!(err.chars().count() < 300, "{err}");
+}
diff --git a/crates/engine/tests/nonfinite_style.rs b/crates/engine/tests/nonfinite_style.rs
new file mode 100644
index 0000000000..994f3dbe6e
--- /dev/null
+++ b/crates/engine/tests/nonfinite_style.rs
@@ -0,0 +1,56 @@
+//! Character style numbers that overflow `f32` are refused, so the document stays saveable.
+
+use photocraft_engine::{EngineError, Session};
+use serde_json::json;
+
+fn fixture() -> (Session, u64) {
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 40, "height": 30, "background": "white"})).unwrap();
+    let id = s.execute("type.create", json!({"text": "Hi", "size": 24})).unwrap()["layer"].as_u64().unwrap();
+    (s, id)
+}
+
+#[test]
+fn out_of_range_style_numbers_are_refused() {
+    for key in ["leading", "baselineShift", "horizontalScale", "verticalScale"] {
+        let (mut s, id) = fixture();
+        let past = s.active().unwrap().history.past_len();
+        for value in [1e39, -1e39, 1e12] {
+            let r = s.execute("type.setStyle", json!({"layer": id, key: value}));
+            assert!(matches!(r, Err(EngineError::BadParams { .. })), "{key}={value}: {r:?}");
+        }
+        assert_eq!(s.active().unwrap().history.past_len(), past, "{key}: no history step");
+        let r = s.execute("type.create", json!({"text": "x", key: 1e39}));
+        assert!(matches!(r, Err(EngineError::BadParams { .. })), "create {key}: {r:?}");
+        let dir = std::env::temp_dir().join(format!("pc_nonfinite_style_{key}_{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("t.pcraft");
+        let saved = s.execute("file.saveACopy", json!({"path": path.to_string_lossy()}));
+        std::fs::remove_dir_all(&dir).ok();
+        saved.unwrap_or_else(|e| panic!("{key}: save failed: {e:?}"));
+    }
+}
+
+#[test]
+fn in_range_style_numbers_still_apply_and_save() {
+    let (mut s, id) = fixture();
+    s.execute("type.setStyle", json!({"layer": id, "leading": 30, "baselineShift": -4, "horizontalScale": 120, "verticalScale": 80})).unwrap();
+    s.execute("type.setStyle", json!({"layer": id, "leading": "auto"})).unwrap();
+    let dir = std::env::temp_dir().join(format!("pc_nonfinite_style_ok_{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("t.pcraft");
+    let saved = s.execute("file.saveACopy", json!({"path": path.to_string_lossy()}));
+    std::fs::remove_dir_all(&dir).ok();
+    saved.unwrap_or_else(|e| panic!("save failed: {e:?}"));
+}
+
+#[test]
+fn non_numeric_leading_is_refused() {
+    let (mut s, id) = fixture();
+    let past = s.active().unwrap().history.past_len();
+    for value in [json!("18pt"), json!("Auto "), json!(true), json!([12])] {
+        let r = s.execute("type.setStyle", json!({"layer": id, "leading": value}));
+        assert!(matches!(r, Err(EngineError::BadParams { .. })), "leading={value}: {r:?}");
+    }
+    assert_eq!(s.active().unwrap().history.past_len(), past, "no history step");
+}
diff --git a/crates/engine/tests/precheck.rs b/crates/engine/tests/precheck.rs
new file mode 100644
index 0000000000..f549fbb8c8
--- /dev/null
+++ b/crates/engine/tests/precheck.rs
@@ -0,0 +1,78 @@
+//! `Session::precheck` accepts what `execute` accepts for the commands it covers (all but the
+//! group nesting limit, which only the edit checks)
+//! (`PRECHECKED`): Free Transform applies its box before them only when they will run (#5859).
+
+use photocraft_engine::{PRECHECKED, Session};
+use serde_json::{Value, json};
+
+/// Documents in different states: a Background only, a pixel layer active, a group active, a
+/// selection, no document.
+fn states() -> Vec<(&'static str, Session)> {
+    let mut out = Vec::new();
+    out.push(("no document", Session::new()));
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 40, "height": 30, "background": "white"})).unwrap();
+    out.push(("background only", s));
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 40, "height": 30, "background": "white"})).unwrap();
+    s.execute("layer.new.layer", json!({})).unwrap();
+    s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+    out.push(("pixel layer", s));
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 40, "height": 30, "background": "transparent"})).unwrap();
+    s.execute("layer.new.group", json!({})).unwrap();
+    out.push(("group, no background", s));
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 40, "height": 30, "background": "white"})).unwrap();
+    s.execute("layer.new.layer", json!({})).unwrap();
+    s.execute("edit.fill", json!({"color": "#00ff00"})).unwrap();
+    s.execute("select.rect", json!({"x": 2, "y": 2, "width": 10, "height": 10})).unwrap();
+    out.push(("selection", s));
+    out
+}
+
+fn params() -> Vec<Value> {
+    vec![
+        Value::Null,
+        json!({}),
+        json!([1]),
+        json!("x"),
+        json!({"mode": "Bogus"}),
+        json!({"mode": "Multiply"}),
+        json!({"fillNeutral": true}),
+        json!({"mode": "Overlay", "fillNeutral": true}),
+        json!({"position": "x"}),
+        json!({"position": "below"}),
+        json!({"opacity": "half"}),
+        json!({"name": 5}),
+        json!({"name": "ok"}),
+        json!({"color": "chartreuse"}),
+        json!({"layer": 999_999}),
+        json!({"layer": 1}),
+        json!({"layer": 2}),
+        json!({"layer": null}),
+        json!({"layer": "Layer 1"}),
+        json!({"layer": "no such layer"}),
+        json!({"layer": true}),
+        json!({"ifPresent": true}),
+    ]
+}
+
+#[test]
+fn precheck_agrees_with_execute() {
+    let mut disagreements = Vec::new();
+    for id in PRECHECKED {
+        for p in params() {
+            for (state, _) in states() {
+                // A fresh copy of the state for each call: execute changes it.
+                let mut s = states().into_iter().find(|(n, _)| *n == state).map(|(_, s)| s).unwrap();
+                let pre = s.precheck(id, &p).is_ok();
+                let ran = s.execute(id, p.clone()).is_ok();
+                if pre != ran {
+                    disagreements.push(format!("{id} {p} on {state}: precheck {pre}, execute {ran}"));
+                }
+            }
+        }
+    }
+    assert!(disagreements.is_empty(), "{disagreements:#?}");
+}
diff --git a/crates/engine/tests/shortcuts_headless.rs b/crates/engine/tests/shortcuts_headless.rs
new file mode 100644
index 0000000000..2c8bbd2ca0
--- /dev/null
+++ b/crates/engine/tests/shortcuts_headless.rs
@@ -0,0 +1,146 @@
+//! Edit › Keyboard Shortcuts without the UI: the shell's commands and the tools are bindable,
+//! listed, imported and exported; tools share keys without conflicts; system keys are refused;
+//! sets read and write files by path.
+
+use photocraft_engine::Session;
+use serde_json::{Value, json};
+
+fn ks(s: &mut Session, p: Value) -> Value {
+    s.execute("edit.keyboardShortcuts", p).expect("edit.keyboardShortcuts")
+}
+
+fn listed<'a>(r: &'a Value, id: &str) -> &'a Value {
+    r["commands"].as_array().unwrap().iter().find(|c| c["id"] == id).unwrap_or_else(|| panic!("{id} listed"))
+}
+
+#[test]
+fn shell_commands_and_tools_are_bindable_without_the_ui() {
+    let mut s = Session::new();
+    let r = ks(&mut s, json!({"list": true}));
+    assert_eq!(listed(&r, "view.zoomIn")["alternates"], json!(["Cmd++"]), "the shell's View › Zoom In");
+    let mv = listed(&r, "tools.select.move");
+    assert_eq!((mv["tool"].clone(), mv["shortcut"].clone(), mv["menu"].clone()), (json!(true), json!("V"), json!(["Tools"])));
+    assert!(
+        r["conflicts"].as_array().unwrap().iter().all(|c| c["commands"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .any(|id| !id.as_str().unwrap().starts_with("tools.select."))),
+        "tools sharing a letter cycle, they don't conflict: {}",
+        r["conflicts"]
+    );
+    // No allowUnknown needed any more.
+    let r = ks(&mut s, json!({"set": {"tools.select.pencil": "F6", "view.zoomIn": "Cmd+Shift+Z"}}));
+    assert_eq!((r["overrides"]["tools.select.pencil"].clone(), r["overrides"]["view.zoomIn"].clone()), (json!("F6"), json!("Cmd+Shift+Z")));
+}
+
+#[test]
+fn tools_may_share_a_key_but_a_command_takes_it() {
+    let mut s = Session::new();
+    // Pencil joins the V group: Move and Artboard keep V.
+    let r = ks(&mut s, json!({"set": {"tools.select.pencil": "V"}}));
+    assert!(r["overrides"].get("tools.select.move").is_none(), "{}", r["overrides"]);
+    // A command taking V removes it from every tool that held it.
+    let r = ks(&mut s, json!({"set": {"edit.copy": "V"}}));
+    for t in ["tools.select.move", "tools.select.artboard", "tools.select.pencil"] {
+        assert_eq!(r["overrides"][t], json!(""), "{t}: {}", r["overrides"]);
+    }
+}
+
+#[test]
+fn system_keys_are_refused_and_dropped_from_imports() {
+    let mut s = Session::new();
+    let key = if cfg!(target_os = "macos") { "Cmd+Tab" } else { "Alt+F4" };
+    let before = s.prefs().clone();
+    assert!(s.execute("edit.keyboardShortcuts", json!({"set": {"edit.copy": key}})).is_err());
+    assert!(s.execute("edit.keyboardShortcuts", json!({"alternates": {"edit.copy": ["F9", key]}})).is_err());
+    assert_eq!(s.prefs(), &before);
+    let set = format!(
+        "<photoshop-keyboard-shortcuts><command name=\"Copy\"><shortcut>F9</shortcut><shortcut>{key}</shortcut></command><command name=\"Cut\"><shortcut>{key}</shortcut></command><tool name=\"Pencil Tool\">N</tool><tool name=\"Move Tool\">V</tool></photoshop-keyboard-shortcuts>"
+    );
+    let r = ks(&mut s, json!({"importKys": set}));
+    assert_eq!(r["overrides"]["edit.copy"], json!("F9"));
+    assert!(r["overrides"].get("edit.cut").is_none(), "the reserved key is left out: {}", r["overrides"]);
+    assert_eq!(r["import"]["reserved"].as_array().map(Vec::len), Some(1));
+    assert_eq!(r["overrides"]["tools.select.pencil"], json!("N"), "tool keys import headless");
+    assert!(r["overrides"].get("tools.select.move").is_none(), "Move's own V keeps its cycling");
+}
+
+#[test]
+fn sets_read_and_write_files_and_export_everything() {
+    let dir = std::env::temp_dir().join(format!("photocraft-shortcuts-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let kys = dir.join("mine.kys");
+    let html = dir.join("mine.html");
+    let mut s = Session::new();
+    ks(&mut s, json!({"set": {"tools.select.pencil": "F6", "edit.copy": "F9"}, "saveSet": "Mine"}));
+    let r = ks(&mut s, json!({"exportKys": {"path": kys.to_str().unwrap()}, "summarize": {"path": html.to_str().unwrap(), "mac": false}}));
+    assert!(r.get("kys").is_none() && r["kysPath"].is_string() && r["htmlPath"].is_string(), "{r}");
+    let text = std::fs::read_to_string(&kys).unwrap();
+    assert!(text.contains("pc-id=\"tools.select.pencil\">F6</tool>") && text.contains("pc-id=\"view.zoomIn\""), "the whole set: {text}");
+    assert!(std::fs::read_to_string(&html).unwrap().contains("<h2>Tools</h2>"));
+    // Back to the defaults, then the file restores the set, tools included.
+    ks(&mut s, json!({"useSet": ""}));
+    let r = ks(&mut s, json!({"reset": true, "importKys": {"path": kys.to_str().unwrap()}}));
+    assert_eq!((r["overrides"]["tools.select.pencil"].clone(), r["overrides"]["edit.copy"].clone()), (json!("F6"), json!("F9")));
+    // Bad paths and shapes are errors, not panics.
+    for p in [
+        json!({"importKys": {"path": dir.join("missing.kys").to_str().unwrap()}}),
+        json!({"importKys": {"path": ""}}),
+        json!({"importKys": 5}),
+        json!({"exportKys": "yes"}),
+        json!({"exportKys": {"path": 3}}),
+        json!({"summarize": {"path": ""}}),
+    ] {
+        assert!(s.execute("edit.keyboardShortcuts", p.clone()).is_err(), "{p}");
+    }
+    // A change paired with an export that fails (a folder that doesn't exist, a bad summarize
+    // value) changes nothing.
+    let before = ks(&mut s, json!({}))["overrides"].clone();
+    for p in [
+        json!({"set": {"edit.copy": "F10"}, "exportKys": {"path": dir.join("no").join("such").join("x.kys").to_str().unwrap()}}),
+        json!({"set": {"edit.copy": "F10"}, "summarize": 7}),
+        json!({"set": {"edit.copy": "F10"}, "saveSet": "Other", "summarize": {"path": dir.join("no").join("x.html").to_str().unwrap()}}),
+        // A good .kys path with a bad summarize: neither file is written.
+        json!({"set": {"edit.copy": "F10"}, "exportKys": {"path": dir.join("both.kys").to_str().unwrap()}, "summarize": {"path": dir.join("no").join("x.html").to_str().unwrap()}}),
+        json!({"exportKys": {"path": dir.join("both.kys").to_str().unwrap()}, "summarize": 7}),
+        json!({"exportKys": {"path": dir.join("both.kys").to_str().unwrap()}, "summarize": {"path": dir.to_str().unwrap()}}),
+    ] {
+        assert!(s.execute("edit.keyboardShortcuts", p.clone()).is_err(), "{p}");
+        let r = ks(&mut s, json!({}));
+        assert_eq!(r["overrides"], before, "{p}");
+        assert!(r["sets"].get("Other").is_none(), "{p}: {r}");
+        assert!(!dir.join("both.kys").exists(), "{p}: no file written");
+    }
+    // A second file that passes the checks but can't be written (a NUL in its name): the user's
+    // existing first file is left exactly as it was, and no staged file stays behind.
+    let mine = dir.join("existing.kys");
+    std::fs::write(&mine, "the user's own file").unwrap();
+    let html = format!("{}/a\u{0}.html", dir.to_str().unwrap());
+    let p = json!({"exportKys": {"path": mine.to_str().unwrap()}, "summarize": {"path": html}});
+    assert!(s.execute("edit.keyboardShortcuts", p.clone()).is_err(), "{p}");
+    assert_eq!(std::fs::read_to_string(&mine).unwrap(), "the user's own file");
+    let left: Vec<_> =
+        std::fs::read_dir(&dir).unwrap().filter_map(|e| e.ok()).map(|e| e.file_name()).filter(|n| n.to_string_lossy().contains("photocraft-tmp")).collect();
+    assert!(left.is_empty(), "{left:?}");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn a_read_only_target_is_refused_before_anything_is_written() {
+    let dir = std::env::temp_dir().join(format!("photocraft-readonly-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let ro = dir.join("locked.kys");
+    std::fs::write(&ro, "locked").unwrap();
+    let mut perms = std::fs::metadata(&ro).unwrap().permissions();
+    perms.set_readonly(true);
+    std::fs::set_permissions(&ro, perms.clone()).unwrap();
+    let mut s = Session::new();
+    let r = s.execute("edit.keyboardShortcuts", json!({"set": {"edit.copy": "F10"}, "exportKys": {"path": ro.to_str().unwrap()}}));
+    assert!(r.as_ref().is_err_and(|e| e.to_string().contains("read-only")), "{r:?}");
+    assert_eq!(std::fs::read_to_string(&ro).unwrap(), "locked");
+    #[allow(clippy::permissions_set_readonly_false)]
+    perms.set_readonly(false);
+    let _ = std::fs::set_permissions(&ro, perms);
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/engine/tests/style_and_align.rs b/crates/engine/tests/style_and_align.rs
new file mode 100644
index 0000000000..9af9bed0fa
--- /dev/null
+++ b/crates/engine/tests/style_and_align.rs
@@ -0,0 +1,115 @@
+//! Copy / Paste Layer Style carries the whole style, Blending Options included (Blend If and the
+//! channel restrictions); align with an active selection aligns to it however many layers are
+//! selected (layers audit L2).
+
+use photocraft_engine::Session;
+use serde_json::json;
+
+fn layer(s: &Session, id: u64) -> photocraft_doc::Layer {
+    s.active().unwrap().doc.layer(photocraft_doc::LayerId(id)).unwrap().clone()
+}
+
+fn new_doc(s: &mut Session, mode: &str) -> (u64, u64) {
+    s.execute("file.new", json!({"width": 64, "height": 64, "mode": mode, "background": "white"})).unwrap();
+    let a = s.execute("layer.new.layer", json!({})).unwrap()["layer"].as_u64().unwrap();
+    let b = s.execute("layer.new.layer", json!({})).unwrap()["layer"].as_u64().unwrap();
+    (a, b)
+}
+
+#[test]
+fn paste_layer_style_carries_blend_if_and_channels() {
+    let mut s = Session::new();
+    let (a, b) = new_doc(&mut s, "rgb");
+    s.execute(
+        "layer.layerStyle.blendingOptions",
+        json!({"layer": a, "blendIf": [{"channel": "gray", "underlying": [0, 128]}, {"channel": "red", "thisLayer": [10, 200]}]}),
+    )
+    .unwrap();
+    s.execute("layer.setProps", json!({"layer": a, "channels": [true, false, true]})).unwrap();
+    s.execute("layer.layerStyle.copyLayerStyle", json!({"layer": a})).unwrap();
+    s.execute("layer.layerStyle.pasteLayerStyle", json!({"layer": b})).unwrap();
+    let (la, lb) = (layer(&s, a), layer(&s, b));
+    assert_eq!(lb.blend_if, la.blend_if, "Blend If, Gray and channel ranges");
+    assert_eq!(lb.excluded_channels, la.excluded_channels, "the unchecked G channel");
+    // Into a CMYK document: only the Gray range carries over; channels reset to all.
+    let (c, _) = new_doc(&mut s, "cmyk");
+    s.execute("layer.layerStyle.pasteLayerStyle", json!({"layer": c})).unwrap();
+    let lc = layer(&s, c);
+    assert_eq!(lc.blend_if.get(0), la.blend_if.get(0));
+    assert_eq!(lc.blend_if.ranges.len(), 1, "no RGB channel range on CMYK");
+    assert_eq!(lc.excluded_channels, 0);
+}
+
+#[test]
+fn paste_layer_style_into_another_mode_keeps_blend_if_normalised() {
+    // A full Gray range and only a Red range: in CMYK nothing is left, so it is the default
+    // (which compares equal, so the paste isn't seen as a Blend If change).
+    let mut s = Session::new();
+    let (a, _) = new_doc(&mut s, "rgb");
+    s.execute("layer.layerStyle.blendingOptions", json!({"layer": a, "blendIf": [{"channel": "red", "thisLayer": [10, 200]}]})).unwrap();
+    s.execute("layer.layerStyle.copyLayerStyle", json!({"layer": a})).unwrap();
+    let (c, _) = new_doc(&mut s, "cmyk");
+    s.execute("layer.layerStyle.pasteLayerStyle", json!({"layer": c})).unwrap();
+    assert_eq!(layer(&s, c).blend_if, photocraft_doc::BlendIf::default());
+}
+
+#[test]
+fn paste_layer_style_on_several_layers_is_one_undo_step() {
+    // 16-bit, onto a pixel layer and a group: one History step, and one Undo restores both.
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 64, "height": 64, "depth": 16, "background": "white"})).unwrap();
+    let a = s.execute("layer.new.layer", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.layerStyle.blendingOptions", json!({"layer": a, "blendIf": [{"channel": "gray", "underlying": [0, 128]}]})).unwrap();
+    s.execute("layer.setProps", json!({"layer": a, "fill": 0.5, "blend": "multiply"})).unwrap();
+    s.execute("layer.layerStyle.copyLayerStyle", json!({"layer": a})).unwrap();
+    let b = s.execute("layer.new.layer", json!({})).unwrap()["layer"].as_u64().unwrap();
+    let g = s.execute("layer.new.group", json!({})).unwrap()["layer"].as_u64().unwrap();
+    let before = (layer(&s, b), layer(&s, g));
+    s.execute("layer.select", json!({"layer": b})).unwrap();
+    s.execute("layer.select", json!({"layer": g, "mode": "add"})).unwrap();
+    s.execute("layer.layerStyle.pasteLayerStyle", json!({})).unwrap();
+    let la = layer(&s, a);
+    for id in [b, g] {
+        let l = layer(&s, id);
+        assert_eq!((l.blend_if.clone(), l.fill_opacity, l.blend), (la.blend_if.clone(), la.fill_opacity, la.blend), "layer {id}");
+    }
+    s.execute("edit.undo", json!({})).unwrap();
+    let after = (layer(&s, b), layer(&s, g));
+    assert_eq!((after.0.blend_if, after.0.blend, after.1.blend_if, after.1.blend), (before.0.blend_if, before.0.blend, before.1.blend_if, before.1.blend));
+    assert_eq!((after.0.fill_opacity, after.1.fill_opacity), (before.0.fill_opacity, before.1.fill_opacity));
+}
+
+#[test]
+fn several_layers_align_to_an_active_selection() {
+    let mut s = Session::new();
+    let (a, b) = new_doc(&mut s, "rgb");
+    for (id, x) in [(a, 4), (b, 30)] {
+        s.execute("layer.select", json!({"layer": id})).unwrap();
+        s.execute("select.rect", json!({"x": x, "y": 10, "width": 8, "height": 8})).unwrap();
+        s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+    }
+    s.execute("select.rect", json!({"x": 40, "y": 40, "width": 20, "height": 20})).unwrap();
+    s.execute("layer.select", json!({"layer": a})).unwrap();
+    s.execute("layer.select", json!({"layer": b, "mode": "add"})).unwrap();
+    s.execute("layer.align.leftEdges", json!({})).unwrap();
+    for id in [a, b] {
+        let x0 = layer(&s, id).surface().unwrap().content_bounds().x0;
+        assert_eq!(x0, 40, "layer {id} aligned to the selection's left edge");
+    }
+}
+
+#[test]
+fn a_groups_pass_through_pastes_onto_a_pixel_layer_as_normal() {
+    let mut s = Session::new();
+    let (a, _) = new_doc(&mut s, "rgb");
+    let g = s.execute("layer.new.group", json!({})).unwrap()["layer"].as_u64().unwrap();
+    assert_eq!(layer(&s, g).blend, photocraft_color::BlendMode::PassThrough);
+    s.execute("layer.layerStyle.copyLayerStyle", json!({"layer": g})).unwrap();
+    s.execute("layer.layerStyle.pasteLayerStyle", json!({"layer": a})).unwrap();
+    assert_eq!(layer(&s, a).blend, photocraft_color::BlendMode::Normal, "Pass Through isn't a pixel layer's mode");
+    // Onto another group it stays Pass Through.
+    let g2 = s.execute("layer.new.group", json!({})).unwrap()["layer"].as_u64().unwrap();
+    s.execute("layer.setProps", json!({"layer": g2, "blend": "Multiply"})).unwrap();
+    s.execute("layer.layerStyle.pasteLayerStyle", json!({"layer": g2})).unwrap();
+    assert_eq!(layer(&s, g2).blend, photocraft_color::BlendMode::PassThrough);
+}
diff --git a/crates/engine/tests/transform_budget_unclamped.rs b/crates/engine/tests/transform_budget_unclamped.rs
new file mode 100644
index 0000000000..c603bee7b5
--- /dev/null
+++ b/crates/engine/tests/transform_budget_unclamped.rs
@@ -0,0 +1,49 @@
+//! #6430: integration tests use the production pixel budget, not the unit tests' reduced one.
+use photocraft_engine::Session;
+use photocraft_geom::Rect;
+use serde_json::{Value, json};
+
+fn painted() -> Session {
+    let mut session = Session::new();
+    session.execute("file.new", json!({"width": 24, "height": 16})).unwrap();
+    session.execute("layer.new.layer", json!({})).unwrap();
+    session
+        .edit("paint", |doc, active| {
+            doc.layer_mut(active.unwrap()).unwrap().surface_mut().unwrap().fill_rect(Rect::new(10, 2, 11, 10), &[1.0, 0.0, 0.0, 1.0]);
+            Ok(())
+        })
+        .unwrap();
+    session
+}
+
+fn assert_refused_without_changes(session: &mut Session, command: &str, params: Value) {
+    let state = session.active().unwrap();
+    let (document, revision, history) = (state.doc.clone(), state.revision, state.history.past_len());
+    let error = session.execute(command, params).unwrap_err().to_string();
+    assert!(error.contains("limit"), "{error}");
+    let state = session.active().unwrap();
+    assert!(state.doc == document, "refusal changed the document");
+    assert_eq!((state.revision, state.history.past_len()), (revision, history));
+}
+
+#[test]
+fn extreme_layer_scales_are_refused_before_a_clipped_strip_is_warped() {
+    let mut session = painted();
+    session.execute("filter.render.clouds", json!({})).unwrap();
+    for scale in [1e9, 1e30, 1e308, -1e308] {
+        for axis in ["scaleX", "scaleY"] {
+            assert_refused_without_changes(&mut session, "edit.transform", json!({(axis): scale}));
+        }
+    }
+}
+
+#[test]
+fn extreme_selection_scales_are_refused_without_losing_the_selection() {
+    let mut session = painted();
+    session.execute("select.rect", json!({"x": 10, "y": 2, "width": 1, "height": 8})).unwrap();
+    for scale in [1e30, 1e308] {
+        for axis in ["scaleX", "scaleY"] {
+            assert_refused_without_changes(&mut session, "select.transformSelection", json!({(axis): scale}));
+        }
+    }
+}
diff --git a/crates/format/Cargo.toml b/crates/format/Cargo.toml
index 45d7a4ccf3..113d9ba026 100644
--- a/crates/format/Cargo.toml
+++ b/crates/format/Cargo.toml
@@ -22,7 +22,7 @@ flate2 = { workspace = true }
 # Same IEEE CRC-32 the ZIP container needs; already in Cargo.lock through flate2.
 crc32fast = "1.5"
 blake3 = { version = "1.8", default-features = false, features = ["pure"] }
-ruzstd = "0.9"
+ruzstd = "0.9.1"
 
 # Unix directory cleanup uses no-follow descriptor-relative operations; the same
 # dependency provides the plain-fsync fallback on Apple file systems.
diff --git a/crates/format/src/atomic.rs b/crates/format/src/atomic.rs
index bf39fe2761..8a02ce5c78 100644
--- a/crates/format/src/atomic.rs
+++ b/crates/format/src/atomic.rs
@@ -13,6 +13,10 @@
 //!   if it does anyway, the save fails with a clear error. It never falls back to writing the
 //!   destination in place.
 //! - **Unwritable folder:** the save fails with a clear error instead of writing in place.
+//! - **Read-only file:** the save is refused before anything is written (#6600). A rename only
+//!   needs the folder to be writable, so without this check Linux and macOS would silently replace
+//!   a `chmod 444` file while Windows refuses; now every platform refuses, as Photoshop does, and
+//!   the user saves a copy with Save As.
 //! - **Network shares (macOS):** `sync_all` asks for a full flush to the disk's platters
 //!   (`F_FULLFSYNC`), which SMB shares and some virtual file systems refuse while a plain `fsync`
 //!   works. [`sync_file`] falls back to the plain one there (#1336).
@@ -30,6 +34,12 @@ use std::sync::atomic::{AtomicU64, Ordering};
 /// The file-system steps [`atomic_write_with`] performs. [`RealFs`] is the real thing; tests
 /// wrap it to inject failures.
 pub trait AtomicFs {
+    /// Whether the existing file at `path` is marked read-only (a missing file is not). A
+    /// read-only destination is never replaced (#6600). By default nothing is read-only.
+    fn is_readonly(&self, path: &Path) -> bool {
+        let _ = path;
+        false
+    }
     /// Create `tmp` (it must not exist), write all of `bytes` and flush it ([`sync_file`]).
     fn write_new(&self, tmp: &Path, bytes: &[u8]) -> io::Result<()>;
     /// [`write_new`](Self::write_new), reporting the fraction of `bytes` written so far to
@@ -91,6 +101,9 @@ impl AtomicFs for RealFs {
         let perms = std::fs::metadata(from)?.permissions();
         std::fs::set_permissions(to, perms)
     }
+    fn is_readonly(&self, path: &Path) -> bool {
+        std::fs::metadata(path).is_ok_and(|m| m.is_file() && m.permissions().readonly())
+    }
 }
 
 /// Flush `file` to stable storage (`sync_all`). On Apple platforms that is a full flush
@@ -162,13 +175,16 @@ pub fn atomic_write_with(fs: &dyn AtomicFs, retry: RenameRetry, path: &Path, byt
 
 /// [`atomic_write_with`] reporting write progress (see [`atomic_write_progress`]).
 pub fn atomic_write_with_progress(fs: &dyn AtomicFs, retry: RenameRetry, path: &Path, bytes: &[u8], progress: &dyn Fn(f32)) -> io::Result<()> {
-    let target = resolve_symlink(path);
+    let target = resolve_symlink(path).map_err(|e| context(e, format!("cannot save {}", path.display())))?;
     let name = target.file_name().ok_or_else(|| io::Error::new(io::ErrorKind::InvalidInput, format!("{}: not a file path", path.display())))?;
     let dir = match target.parent() {
         Some(d) if !d.as_os_str().is_empty() => d.to_path_buf(),
         _ => PathBuf::from("."),
     };
     std::fs::create_dir_all(&dir).map_err(|e| context(e, format!("cannot create the folder {}", dir.display())))?;
+    if fs.is_readonly(&target) {
+        return Err(io::Error::new(io::ErrorKind::PermissionDenied, format!("cannot save {}: the file is read-only; {UNCHANGED}", path.display())));
+    }
 
     // Create a fresh temporary file next to the target (same directory, so the rename never
     // crosses a device). The name is unique per process and call; retry a few on collisions.
@@ -229,12 +245,37 @@ fn sleep_ms(ms: u64) {
 #[cfg(target_arch = "wasm32")]
 fn sleep_ms(_ms: u64) {}
 
+/// How deep a symlink chain we follow before giving up, like the OS limit.
+const MAX_LINK_DEPTH: u32 = 40;
+
 /// Write through a symlink to the file it points at, instead of replacing the link.
-fn resolve_symlink(path: &Path) -> PathBuf {
-    match std::fs::symlink_metadata(path) {
-        Ok(m) if m.file_type().is_symlink() => std::fs::canonicalize(path).unwrap_or_else(|_| path.to_path_buf()),
-        _ => path.to_path_buf(),
+///
+/// A dangling link (its target, or a folder on the way to it, doesn't exist yet) resolves to its
+/// target too, so saving through one creates the target instead of silently turning the link
+/// into a regular file (#6605). A chain that never ends is an error, never a link replacement.
+fn resolve_symlink(path: &Path) -> io::Result<PathBuf> {
+    if !std::fs::symlink_metadata(path).is_ok_and(|m| m.file_type().is_symlink()) {
+        return Ok(path.to_path_buf());
     }
+    // A resolvable chain: canonicalize follows every link and relative target in one go.
+    if let Ok(real) = std::fs::canonicalize(path) {
+        return Ok(real);
+    }
+    // Dangling chain: walk the links lexically; the final target may not exist yet.
+    let mut current = path.to_path_buf();
+    for _ in 0..MAX_LINK_DEPTH {
+        let Ok(link) = std::fs::read_link(&current) else {
+            return Ok(current); // not (or no longer) a link: the chain ends here
+        };
+        let base = current.parent().unwrap_or(Path::new(".")).to_path_buf();
+        // `..` stays in the path for the OS to resolve: folding it by text is wrong when a folder
+        // on the way is itself a symlink.
+        current = if link.is_absolute() { link } else { base.join(link) };
+        if !std::fs::symlink_metadata(&current).is_ok_and(|m| m.file_type().is_symlink()) {
+            return Ok(current);
+        }
+    }
+    Err(io::Error::new(io::ErrorKind::InvalidInput, format!("{}: too many levels of symbolic links", path.display())))
 }
 
 /// A unique hidden temporary file name to write beside `file` before renaming over it.
diff --git a/crates/format/src/atomic/tests.rs b/crates/format/src/atomic/tests.rs
index 8e71bc7ce3..ce3ed1b7c6 100644
--- a/crates/format/src/atomic/tests.rs
+++ b/crates/format/src/atomic/tests.rs
@@ -176,6 +176,81 @@ fn lock_that_outlasts_the_retries_keeps_original() {
     assert_no_temp(&d.0);
 }
 
+/// A file system that reports the target as read-only and records every write and rename.
+#[derive(Default)]
+struct ReadOnlyTarget {
+    writes: Cell<u32>,
+    renames: Cell<u32>,
+}
+
+impl AtomicFs for ReadOnlyTarget {
+    fn is_readonly(&self, _path: &Path) -> bool {
+        true
+    }
+    fn write_new(&self, tmp: &Path, bytes: &[u8]) -> io::Result<()> {
+        self.writes.set(self.writes.get() + 1);
+        RealFs.write_new(tmp, bytes)
+    }
+    fn rename(&self, from: &Path, to: &Path) -> io::Result<()> {
+        self.renames.set(self.renames.get() + 1);
+        RealFs.rename(from, to)
+    }
+    fn remove(&self, path: &Path) -> io::Result<()> {
+        RealFs.remove(path)
+    }
+    fn sync_dir(&self, dir: &Path) -> io::Result<()> {
+        RealFs.sync_dir(dir)
+    }
+    fn copy_permissions(&self, from: &Path, to: &Path) -> io::Result<()> {
+        RealFs.copy_permissions(from, to)
+    }
+}
+
+/// #6600: a read-only destination is refused before anything is written, with an error that says
+/// so, instead of being replaced by the rename (which only needs the folder to be writable).
+#[test]
+fn read_only_target_is_refused_before_anything_is_written() {
+    let d = TempDir::new("rofake");
+    let p = d.0.join("a.psd");
+    std::fs::write(&p, ORIGINAL).unwrap();
+    let fs = ReadOnlyTarget::default();
+    let e = atomic_write_with(&fs, NO_RETRY, &p, b"new").unwrap_err();
+    assert_eq!(e.kind(), io::ErrorKind::PermissionDenied);
+    assert!(e.to_string().contains("a.psd") && e.to_string().contains("read-only") && e.to_string().contains("not changed"), "{e}");
+    assert_eq!((fs.writes.get(), fs.renames.get()), (0, 0), "nothing is written or renamed");
+    assert_eq!(std::fs::read(&p).unwrap(), ORIGINAL);
+    assert_no_temp(&d.0);
+}
+
+/// #6600 on the real file system: a file marked read-only (`chmod 444`, or the Windows read-only
+/// attribute) keeps its bytes and the save says why; a writable one still saves.
+#[test]
+fn read_only_file_on_disk_is_never_replaced() {
+    let d = TempDir::new("rofile");
+    let p = d.0.join("a.psd");
+    std::fs::write(&p, ORIGINAL).unwrap();
+    let mut perms = std::fs::metadata(&p).unwrap().permissions();
+    perms.set_readonly(true);
+    std::fs::set_permissions(&p, perms.clone()).unwrap();
+    let r = atomic_write(&p, b"new");
+    let unchanged = std::fs::read(&p).unwrap();
+    let still_readonly = std::fs::metadata(&p).unwrap().permissions().readonly();
+    // Make it writable again so the folder can be removed (Windows refuses to delete it otherwise).
+    #[allow(clippy::permissions_set_readonly_false)]
+    perms.set_readonly(false);
+    std::fs::set_permissions(&p, perms).unwrap();
+    let e = r.unwrap_err();
+    assert_eq!(e.kind(), io::ErrorKind::PermissionDenied);
+    assert!(e.to_string().contains("the file is read-only;"), "a clear reason, not a failed rename: {e}");
+    assert_eq!(unchanged, ORIGINAL);
+    assert!(still_readonly);
+    assert_no_temp(&d.0);
+    // New files and writable files are unaffected.
+    atomic_write(&p, b"new").unwrap();
+    assert_eq!(std::fs::read(&p).unwrap(), b"new");
+    atomic_write(&d.0.join("fresh.psd"), b"x").unwrap();
+}
+
 #[cfg(unix)]
 #[test]
 fn read_only_folder_errors_clearly_and_never_writes_in_place() {
@@ -221,6 +296,52 @@ fn writes_through_a_symlink() {
     assert_eq!(std::fs::read(&real).unwrap(), b"new");
 }
 
+/// #6605: saving onto a dangling symlink writes through to its target instead of replacing the
+/// link with a regular file, even when a folder on the way to the target doesn't exist yet.
+#[cfg(unix)]
+#[test]
+fn writes_through_a_dangling_symlink() {
+    let d = TempDir::new("dangling");
+    let real = d.0.join("missing/dir/a.psd");
+    let link = d.0.join("link.psd");
+    std::os::unix::fs::symlink(&real, &link).unwrap();
+    atomic_write(&link, b"new").unwrap();
+    assert!(std::fs::symlink_metadata(&link).unwrap().file_type().is_symlink(), "the link survives");
+    assert_eq!(std::fs::read(&real).unwrap(), b"new", "the bytes land at the target");
+    assert_no_temp(real.parent().unwrap_or(Path::new(".")));
+}
+
+/// A dangling link with a relative target resolves against the link's own folder.
+#[cfg(unix)]
+#[test]
+fn writes_through_a_dangling_relative_symlink() {
+    let d = TempDir::new("dangling-rel");
+    let here = d.0.join("here");
+    std::fs::create_dir(&here).unwrap();
+    let link = here.join("link.psd");
+    std::os::unix::fs::symlink("../elsewhere/real.psd", &link).unwrap();
+    atomic_write(&link, b"new").unwrap();
+    assert!(std::fs::symlink_metadata(&link).unwrap().file_type().is_symlink(), "the link survives");
+    assert_eq!(std::fs::read(d.0.join("elsewhere/real.psd")).unwrap(), b"new");
+    assert_no_temp(&d.0.join("elsewhere"));
+}
+
+/// A symlink loop is an error; it never replaces either link.
+#[cfg(unix)]
+#[test]
+fn symlink_loop_errors_without_replacing_the_links() {
+    let d = TempDir::new("loop");
+    let a = d.0.join("a.psd");
+    let b = d.0.join("b.psd");
+    std::os::unix::fs::symlink(&b, &a).unwrap();
+    std::os::unix::fs::symlink(&a, &b).unwrap();
+    let e = atomic_write(&a, b"new").unwrap_err();
+    assert!(e.to_string().contains("symbolic links"), "{e}");
+    assert!(std::fs::symlink_metadata(&a).unwrap().file_type().is_symlink());
+    assert!(std::fs::symlink_metadata(&b).unwrap().file_type().is_symlink());
+    assert_no_temp(&d.0);
+}
+
 #[test]
 fn directory_target_or_bare_root_is_an_error_not_a_panic() {
     let d = TempDir::new("dir");
diff --git a/crates/geom/src/lib.rs b/crates/geom/src/lib.rs
index 0e76736013..d95e4b847f 100644
--- a/crates/geom/src/lib.rs
+++ b/crates/geom/src/lib.rs
@@ -1,4 +1,4 @@
-//! Geometry primitives shared by every Photocraft crate.
+//! Geometry primitives shared by every PhotoCraft crate.
 //!
 //! Document space is integer pixels with the origin at the canvas top-left.
 //! Layers may extend beyond the canvas (negative coordinates are valid).
diff --git a/crates/gpu/src/compose.wgsl b/crates/gpu/src/compose.wgsl
index 2b9c1bbdf4..6457b1192c 100644
--- a/crates/gpu/src/compose.wgsl
+++ b/crates/gpu/src/compose.wgsl
@@ -1,4 +1,4 @@
-// Photocraft GPU compositor kernels.
+// PhotoCraft GPU compositor kernels.
 //
 // Every pass renders one chunk of the canvas into a straight-alpha RGBA32F accumulator, reading
 // its inputs with `textureLoad` at the same pixel. Effect-map kernels (`fs_m*`) render
diff --git a/crates/gpu/src/fx.rs b/crates/gpu/src/fx.rs
index 01e147d51a..53802c6f2b 100644
--- a/crates/gpu/src/fx.rs
+++ b/crates/gpu/src/fx.rs
@@ -682,6 +682,8 @@ pub(crate) fn group_key(layer: &Layer, light: &GlobalLight, pin: &mut dyn FnMut(
             surface_fp(&m.surface, h, pin);
         }
         format!("{:?}{:?}", l.vector_mask, l.effects).hash(h);
+        l.blend_if.hash(h);
+        l.advanced.hash(h);
         h.write_u8(0xfe);
     }
     let mut h = std::collections::hash_map::DefaultHasher::new();
@@ -695,6 +697,7 @@ pub(crate) fn group_key(layer: &Layer, light: &GlobalLight, pin: &mut dyn FnMut(
                 (m.enabled, m.density.to_bits(), m.feather.to_bits()).hash(&mut h);
                 surface_fp(&m.surface, &mut h, pin);
             }
+            format!("{:?}", layer.vector_mask).hash(&mut h);
         }
         _ => walk(layer, &mut h, pin),
     }
@@ -721,6 +724,36 @@ mod tests {
         assert_ne!(a.key, program(&Effect::DropShadow(s), &light, false).key);
     }
 
+    /// A styled group's effect shape follows its own vector mask and its children's Blend If and
+    /// Advanced Blending, so the cached shape must be rebuilt when any of them changes.
+    #[test]
+    fn group_key_follows_vector_mask_blend_if_and_advanced() {
+        use photocraft_doc::{BlendRange, Knockout, Path, PixelFormat, Subpath, VectorMask};
+        let light = GlobalLight::default();
+        let group = Layer::group("g", vec![Layer::raster("child", PixelFormat::RGBA8)]);
+        let base = group_key(&group, &light, &mut |_| {});
+
+        let mask = |x: f64| VectorMask::new(Path::new(vec![Subpath::polygon(&[(x, 0.0), (x + 10.0, 0.0), (x + 10.0, 10.0)])]));
+        let mut masked = group.clone();
+        masked.vector_mask = Some(mask(0.0));
+        let with_mask = group_key(&masked, &light, &mut |_| {});
+        assert_ne!(base, with_mask, "adding the group's vector mask");
+        masked.vector_mask = Some(mask(5.0));
+        assert_ne!(with_mask, group_key(&masked, &light, &mut |_| {}), "moving the group's vector mask");
+
+        fn child_mut(g: &mut Layer) -> &mut Layer {
+            let LayerContent::Group(gr) = &mut g.content else { unreachable!() };
+            &mut gr.children[0]
+        }
+        let mut blend_if = group.clone();
+        child_mut(&mut blend_if).blend_if.ranges = vec![[BlendRange { black: [128, 128], white: [255, 255] }, BlendRange::FULL]];
+        assert_ne!(base, group_key(&blend_if, &light, &mut |_| {}), "a child's Blend If");
+
+        let mut advanced = group.clone();
+        child_mut(&mut advanced).advanced.knockout = Knockout::Deep;
+        assert_ne!(base, group_key(&advanced, &light, &mut |_| {}), "a child's Advanced Blending");
+    }
+
     #[test]
     fn windows_grow_by_reach_and_temps_are_reused() {
         let light = GlobalLight::default();
diff --git a/crates/gpu/src/lib.rs b/crates/gpu/src/lib.rs
index 8f8839b9bd..3d60adaf1e 100644
--- a/crates/gpu/src/lib.rs
+++ b/crates/gpu/src/lib.rs
@@ -143,7 +143,9 @@ enum TexKind {
     Rgba16F,
     /// GRAY8 masks copied verbatim.
     R8Direct,
-    /// Other masks as R32F.
+    /// 16-bit masks as R16F (the precision 16-bit pixels get as RGBA16F).
+    R16F,
+    /// 32-bit masks as R32F.
     R32F,
 }
 
@@ -154,7 +156,8 @@ impl TexKind {
             Role::Content | Role::Stroke if f.sample == SampleType::U8 => TexKind::Rgba8,
             Role::Content | Role::Stroke => TexKind::Rgba16F,
             Role::Mask if f == PixelFormat::GRAY8 => TexKind::R8Direct,
-            Role::Mask => TexKind::R32F,
+            Role::Mask if f.sample == SampleType::F32 => TexKind::R32F,
+            Role::Mask => TexKind::R16F,
         }
     }
     fn format(self) -> wgpu::TextureFormat {
@@ -162,6 +165,7 @@ impl TexKind {
             TexKind::Rgba8Direct | TexKind::Rgba8 => wgpu::TextureFormat::Rgba8Unorm,
             TexKind::Rgba16F => wgpu::TextureFormat::Rgba16Float,
             TexKind::R8Direct => wgpu::TextureFormat::R8Unorm,
+            TexKind::R16F => wgpu::TextureFormat::R16Float,
             TexKind::R32F => wgpu::TextureFormat::R32Float,
         }
     }
@@ -170,6 +174,7 @@ impl TexKind {
             TexKind::Rgba8Direct | TexKind::Rgba8 => 4,
             TexKind::Rgba16F => 8,
             TexKind::R8Direct => 1,
+            TexKind::R16F => 2,
             TexKind::R32F => 4,
         }
     }
@@ -794,6 +799,11 @@ impl Compositor {
         total
     }
 
+    /// The GPU memory resident layer pages may hold (bytes; see [`Compositor::set_memory_budget`]).
+    pub fn resident_budget(&self) -> u64 {
+        self.resident_budget
+    }
+
     /// Whether a render of `region` keeps every layer page it needs within the budget; when it
     /// doesn't, each render re-uploads what was evicted.
     pub fn fits_budget(&self, doc: &Document, region: Rect) -> bool {
@@ -2198,6 +2208,7 @@ fn convert_tile(surface: &Surface, tile: Option<&Arc<Tile>>, kind: TexKind, c: T
                 }
             }
             TexKind::R8Direct => out.push((px[0].clamp(0.0, 1.0) * 255.0 + 0.5) as u8),
+            TexKind::R16F => out.extend(f32_to_f16(px[0]).to_le_bytes()),
             TexKind::R32F => out.extend(px[0].to_le_bytes()),
         }
     }
@@ -2527,6 +2538,28 @@ mod tests {
         assert_eq!(op_words(&p, None, None, None).len() as u64, OP_UNIFORM);
     }
 
+    /// #6534: a 16-bit mask (16-bit documents, feathered or vector combined masks) costs two
+    /// bytes per pixel on the GPU, twice an 8-bit mask, not four; 32-bit masks stay R32Float.
+    #[test]
+    fn sixteen_bit_masks_upload_at_two_bytes_per_pixel() {
+        let gray = |sample| PixelFormat { sample, ..PixelFormat::GRAY8 };
+        assert_eq!(TexKind::for_surface(Role::Mask, PixelFormat::GRAY8).bytes_per_pixel(), 1);
+        let k16 = TexKind::for_surface(Role::Mask, gray(SampleType::U16));
+        assert_eq!(k16.bytes_per_pixel(), 2, "{k16:?}");
+        assert_eq!(k16.format().block_copy_size(None), Some(2), "{k16:?}");
+        let k32 = TexKind::for_surface(Role::Mask, gray(SampleType::F32));
+        assert_eq!(k32.format(), wgpu::TextureFormat::R32Float);
+        // The texels hold the mask values (a half each), the default pixel included.
+        let mut s = Surface::with_default(gray(SampleType::U16), &[1.0]);
+        s.fill_rect(Rect::new(0, 0, 4, 1), &[0.25]);
+        let c = TileCoord::new(0, 0);
+        let bytes = convert_tile(&s, s.tile(c), k16, c);
+        assert_eq!(bytes.len(), (TILE_SIZE * TILE_SIZE) as usize * 2);
+        assert_eq!(bytes.get(..2), Some(f32_to_f16(0.25).to_le_bytes().as_slice()));
+        assert_eq!(bytes.get(8..10), Some(f32_to_f16(1.0).to_le_bytes().as_slice()));
+        assert_eq!(convert_tile(&s, None, k16, c).get(..2), Some(f32_to_f16(1.0).to_le_bytes().as_slice()));
+    }
+
     /// #1774: a solid fill shares one tile across every coordinate; it is converted once, and
     /// every coordinate (shared or not) still gets exactly the bytes `convert_tile` gives it, at
     /// every depth and texture kind.
@@ -2539,7 +2572,8 @@ mod tests {
             (PixelFormat::RGBA16, TexKind::Rgba16F),
             (PixelFormat::RGBA32F, TexKind::Rgba16F),
             (PixelFormat::GRAY8, TexKind::R8Direct),
-            (PixelFormat { sample: SampleType::U16, ..PixelFormat::GRAY8 }, TexKind::R32F),
+            (PixelFormat { sample: SampleType::U16, ..PixelFormat::GRAY8 }, TexKind::R16F),
+            (PixelFormat { sample: SampleType::F32, ..PixelFormat::GRAY8 }, TexKind::R32F),
         ] {
             let mut s = Surface::new(fmt);
             let px = [0.2, 0.4, 0.6, 1.0];
diff --git a/crates/gpu/src/prefix.rs b/crates/gpu/src/prefix.rs
index 34c70916e0..cf53a62850 100644
--- a/crates/gpu/src/prefix.rs
+++ b/crates/gpu/src/prefix.rs
@@ -18,15 +18,16 @@ use std::collections::HashMap;
 use photocraft_doc::{Document, Layer};
 use photocraft_geom::Rect;
 
-use crate::Tex;
 use crate::plan::{Checkpoint, Plan};
 
 pub(crate) const MAX_BYTES: u64 = 512 << 20;
 
 /// One whole grid chunk, with the document rectangles that hold valid pixels: a whole-chunk
 /// capture covers the cell in one entry, partial captures accumulate alongside each other.
+/// The texture is only copied to and from, so it has no view: Vulkan rejects a view on an image
+/// without a sampled/storage/attachment usage (VUID-VkImageViewCreateInfo-image-04441).
 pub(crate) struct Chunk {
-    tex: Tex,
+    tex: wgpu::Texture,
     covered: Vec<Rect>,
     /// The checkpoint the covered pixels hold.
     checkpoint: Checkpoint,
@@ -172,7 +173,7 @@ impl Prefix {
         let Some((chunk, (ox, oy))) = self.covered_by(rect) else { return false };
         encoder.copy_texture_to_texture(
             wgpu::TexelCopyTextureInfo {
-                texture: &chunk.tex.texture,
+                texture: &chunk.tex,
                 mip_level: 0,
                 origin: wgpu::Origin3d { x: ox.unsigned_abs(), y: oy.unsigned_abs(), z: 0 },
                 aspect: wgpu::TextureAspect::All,
@@ -198,8 +199,16 @@ impl Prefix {
             if cell_bytes == 0 || cell_bytes > self.budget.saturating_sub(self.bytes) {
                 return;
             }
-            let tex =
-                Tex::new(device, "pc_compose_prefix", cell.width(), cell.height(), src.format(), wgpu::TextureUsages::COPY_SRC | wgpu::TextureUsages::COPY_DST);
+            let tex = device.create_texture(&wgpu::TextureDescriptor {
+                label: Some("pc_compose_prefix"),
+                size: wgpu::Extent3d { width: cell.width().max(1), height: cell.height().max(1), depth_or_array_layers: 1 },
+                mip_level_count: 1,
+                sample_count: 1,
+                dimension: wgpu::TextureDimension::D2,
+                format: src.format(),
+                usage: wgpu::TextureUsages::COPY_SRC | wgpu::TextureUsages::COPY_DST,
+                view_formats: &[],
+            });
             self.bytes = self.bytes.saturating_add(cell_bytes);
             self.chunks.insert(cell, Chunk { tex, covered: Vec::new(), checkpoint, bytes: cell_bytes });
         }
@@ -221,7 +230,7 @@ impl Prefix {
         encoder.copy_texture_to_texture(
             wgpu::TexelCopyTextureInfo { texture: src, mip_level: 0, origin: wgpu::Origin3d::ZERO, aspect: wgpu::TextureAspect::All },
             wgpu::TexelCopyTextureInfo {
-                texture: &chunk.tex.texture,
+                texture: &chunk.tex,
                 mip_level: 0,
                 origin: wgpu::Origin3d { x: ox.unsigned_abs(), y: oy.unsigned_abs(), z: 0 },
                 aspect: wgpu::TextureAspect::All,
diff --git a/crates/io/Cargo.toml b/crates/io/Cargo.toml
index 9bd4c559c5..eb8c0b00d7 100644
--- a/crates/io/Cargo.toml
+++ b/crates/io/Cargo.toml
@@ -31,6 +31,7 @@ photocraft-text = { workspace = true }
 photocraft-paint = { workspace = true }
 photocraft-vector = { workspace = true }
 photocraft-format = { path = "../format" }
+craft-docpath = { workspace = true }
 thiserror = { workspace = true }
 serde_json = { workspace = true }
 blake3 = { version = "1.8", default-features = false, features = ["pure"] }
diff --git a/crates/io/src/doc_path.rs b/crates/io/src/doc_path.rs
new file mode 100644
index 0000000000..37e7daf214
--- /dev/null
+++ b/crates/io/src/doc_path.rs
@@ -0,0 +1,59 @@
+//! Files named by paths stored in a document: linked smart objects, the Displace map and Color
+//! Lookup file of a smart filter, data-set images, video footage.
+//!
+//! Such a path is followed only through [`resolve`]: a relative path is taken from the document's
+//! folder, and only local files, or files on the network share the document itself is on, are
+//! opened (see `craft_docpath`). A refused path is treated like a missing file.
+
+use std::fmt;
+use std::path::{Path, PathBuf};
+
+pub use craft_docpath::Refused;
+
+/// Why a stored path is not followed.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum NotFollowed {
+    /// The path is not a local file, or is not on the document's own share.
+    Refused(Refused),
+    /// The path is relative and the document has no file to take it from.
+    NoDocumentFolder,
+}
+
+impl fmt::Display for NotFollowed {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Refused(r) => r.fmt(f),
+            Self::NoDocumentFolder => f.write_str("the path is relative and the document has not been saved"),
+        }
+    }
+}
+
+impl std::error::Error for NotFollowed {}
+
+/// The file to open for `stored`, a path or `file:` URL stored in a document, or why it is not
+/// followed. `document` is the path of the document it is stored in, if the document has a file;
+/// a relative `document` is taken from the working directory, where it was opened from.
+pub fn resolve(stored: &str, document: Option<&Path>) -> Result<PathBuf, NotFollowed> {
+    let document = document.map(|d| if d.is_relative() { std::path::absolute(d).unwrap_or_else(|_| d.to_path_buf()) } else { d.to_path_buf() });
+    let path = craft_docpath::resolve(stored, document.as_deref()).map_err(NotFollowed::Refused)?;
+    // A path that is still relative would be taken from the working directory, which the
+    // document does not choose.
+    if path.is_relative() {
+        return Err(NotFollowed::NoDocumentFolder);
+    }
+    Ok(path)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn relative_paths_are_taken_from_the_document_folder() {
+        let doc = std::env::temp_dir().join("art").join("poster.pcraft");
+        assert_eq!(resolve("logo.png", Some(&doc)), Ok(std::env::temp_dir().join("art").join("logo.png")));
+        assert_eq!(resolve("logo.png", None), Err(NotFollowed::NoDocumentFolder));
+        assert_eq!(resolve(r"\\192.0.2.1\share\x.png", Some(&doc)), Err(NotFollowed::Refused(Refused::Network)));
+        assert_eq!(resolve("//192.0.2.1/share/x.png", None), Err(NotFollowed::Refused(Refused::Network)));
+    }
+}
diff --git a/crates/io/src/exr_parts.rs b/crates/io/src/exr_parts.rs
index 7e25feb984..3e9d2e1154 100644
--- a/crates/io/src/exr_parts.rs
+++ b/crates/io/src/exr_parts.rs
@@ -181,7 +181,8 @@ fn layer_surface(img: &Image, max: &mut (u32, u32)) -> Result<(Surface, ColorMod
 }
 
 /// Imports the chosen entries as the layers of one document: parts whole, groups from their
-/// own channels, F16 kept losslessly as F32, the linear-light EXR values tagged linear sRGB.
+/// own channels, F16 kept losslessly as F32, the linear-light EXR values tagged linear sRGB
+/// or linear gray.
 /// `precomp` adds the additive sum of the file's AOV groups as a top layer and fails,
 /// naming the missing AOVs, when the light-path set is incomplete.
 pub fn import(name: &str, bytes: &[u8], sel: &Selection) -> Result<ImportResult, IoError> {
@@ -270,10 +271,9 @@ pub fn import(name: &str, bytes: &[u8], sel: &Selection) -> Result<ImportResult,
     let mode = if gray_only { ColorMode::Grayscale } else { ColorMode::Rgb };
     let mut doc = Document::new(name, Size::new(max.0, max.1), mode, DocSample::F32);
     doc.layers = layers;
-    if mode == ColorMode::Rgb {
-        // OpenEXR holds linear, scene-referred values: tag them linear sRGB, as File › Open does.
-        doc.icc_profile = Some(Builtin::LinearSrgb.profile().to_bytes());
-    }
+    // OpenEXR holds linear, scene-referred values (Y is linear luminance): use the profile
+    // matching the selected parts' mode, as File › Open does.
+    doc.icc_profile = Some(if gray_only { photocraft_cms::builtin::linear_gray().to_bytes() } else { Builtin::LinearSrgb.profile().to_bytes() });
     Ok(ImportResult { document: doc, warnings, source_read_only: false, preview_only: false })
 }
 
diff --git a/crates/io/src/flat.rs b/crates/io/src/flat.rs
index f61c28a40b..674c605610 100644
--- a/crates/io/src/flat.rs
+++ b/crates/io/src/flat.rs
@@ -559,9 +559,10 @@ pub(crate) fn export_flat_with(doc: &Document, format: Format, opts: &ExportOpti
         } else if let Some(linear) = convert_gray(&img, photocraft_cms::builtin::linear_gray(), CSample::F32)? {
             img = linear;
         }
-    } else if !format.caps().icc {
-        // Untagged files read back as sRGB/sGray: convert to it (as Quick Export does) rather than
-        // write values that only mean something under the dropped profile.
+    } else if !format.caps().icc || (img.layout().is_gray() && !format.caps().layouts.iter().any(|l| l.is_gray())) {
+        // Untagged files read back as sRGB/sGray. Even an ICC-capable format like WebP loses a
+        // gray profile when the codec expands gray to RGB. Convert first (as Quick Export does)
+        // rather than write values that only mean something under the dropped profile.
         if let Some(srgb) = convert_rgb(&img, Builtin::Srgb.profile(), Intent::Perceptual, true, img.sample_type())? {
             img = srgb;
             warnings.push(format!("colours converted to sRGB; {format:?} can't embed the document's colour profile"));
@@ -809,14 +810,24 @@ fn export_mode_specific(doc: &Document, format: Format, opts: &ExportOptions) ->
     match doc.mode {
         ColorMode::Indexed if format == Format::Png => {
             let Some(table) = doc.color_table.as_ref().filter(|t| !t.colors.is_empty() && t.colors.len() <= 256) else { return Ok(None) };
+            // PNG transparency belongs to a palette index, not its RGB value. Keep the
+            // transparent entry out of opaque lookup, even when it duplicates an opaque colour.
+            let (opaque_indices, colors): (Vec<u8>, Vec<_>) =
+                table.colors.iter().copied().enumerate().filter(|(i, _)| Some(*i) != table.transparent.map(usize::from)).map(|(i, c)| (i as u8, c)).unzip();
+            let opaque = photocraft_doc::ColorTable { colors, transparent: None };
             let mut idx = try_buffer(doc.size.area() as usize, 1)?;
-            let _ = photocraft_compose::render_bands(doc, doc.bounds(), 0, |band| -> Result<(), ()> {
-                idx.extend(band.px.iter().map(|p| match table.transparent {
-                    Some(t) if p[3] < 0.5 => t,
-                    _ => table.nearest([p[0], p[1], p[2]]) as u8,
-                }));
+            photocraft_compose::render_bands(doc, doc.bounds(), 0, |band| -> Result<(), IoError> {
+                for p in &band.px {
+                    let i = match table.transparent {
+                        Some(t) if p[3] < 0.5 => t,
+                        _ => *opaque_indices
+                            .get(opaque.nearest([p[0], p[1], p[2]]))
+                            .ok_or_else(|| IoError::Unsupported("Indexed PNG palette has no opaque entry; add an opaque colour or convert to RGB".into()))?,
+                    };
+                    idx.push(i);
+                }
                 Ok(())
-            });
+            })?;
             // Same rule as the ordinary PNG encoder: the resolution goes into `pHYs` with the metadata.
             let dpi = opts.encode.embed_metadata.then_some((doc.resolution_dpi, doc.resolution_dpi));
             let bytes = codecs::encode_png_indexed(doc.size.width, doc.size.height, &idx, &table.colors, table.transparent, dpi)?;
diff --git a/crates/io/src/kra/tests.rs b/crates/io/src/kra/tests.rs
index 4316a74c10..92e951cdb8 100644
--- a/crates/io/src/kra/tests.rs
+++ b/crates/io/src/kra/tests.rs
@@ -28,7 +28,8 @@ fn tile_file(pixel_size: usize, tiles: &[(i32, i32, Vec<u8>)]) -> Vec<u8> {
                 planar[k * n + p] = px[p * pixel_size + k];
             }
         }
-        let body: Vec<u8> = if i % 2 == 1 { [vec![1], lzf_literal(&planar)].concat() } else { [vec![0], planar].concat() };
+        // Krita splits only LZF tiles into byte planes; raw tiles stay interleaved.
+        let body: Vec<u8> = if i % 2 == 1 { [vec![1], lzf_literal(&planar)].concat() } else { [&[0][..], px].concat() };
         out.extend(format!("{x},{y},LZF,{}\n", body.len()).into_bytes());
         out.extend(body);
     }
@@ -160,6 +161,22 @@ fn a_nonzero_default_pixel_fills_untouched_areas() {
     assert_eq!(s.to_interleaved(Rect::from_xywh(100, 100, 1, 1)), [0, 0, 255, 255]);
 }
 
+#[test]
+fn raw_tiles_hold_interleaved_pixels() {
+    // Krita writes a tile uncompressed (flag 0) when LZF can't shrink it, and then the pixels
+    // stay interleaved: only LZF tiles are split into byte planes.
+    let mut body = vec![0u8];
+    body.extend((0..T * T).flat_map(|_| [10u8, 20, 30, 255]));
+    let mut file = format!("VERSION 2\nTILEWIDTH {T}\nTILEHEIGHT {T}\nPIXELSIZE 4\nDATA 1\n0,0,LZF,{}\n", body.len()).into_bytes();
+    file.extend(body);
+    let doc = maindoc("RGBA", r#"<layer nodetype="paintlayer" name="L" colorspacename="RGBA" filename="l"/>"#);
+    let r = crate::import("a.kra", &archive(&doc, &[("img/layers/l", file)])).unwrap();
+    let s = layer(&r.document, "L").surface().unwrap();
+    for (x, y) in [(0, 0), (1, 0), (3, 3)] {
+        assert_eq!(s.to_interleaved(Rect::from_xywh(x, y, 1, 1)), [30, 20, 10, 255], "pixel {x},{y}");
+    }
+}
+
 fn merged_png() -> Vec<u8> {
     let img = Image::from_raw(12, 8, ChannelLayout::Rgba, CSample::U8, vec![90; 12 * 8 * 4]).unwrap();
     photocraft_codecs::encode(&img, Format::Png, &Default::default()).unwrap()
diff --git a/crates/io/src/kra/tiles.rs b/crates/io/src/kra/tiles.rs
index 8af6638aa8..67fd02fca5 100644
--- a/crates/io/src/kra/tiles.rs
+++ b/crates/io/src/kra/tiles.rs
@@ -231,19 +231,22 @@ impl<'a> TileFile<'a> {
         for &(x, y, data) in &self.tiles {
             ctl.check().map_err(|_| IoError::Cancelled)?;
             let (flag, payload) = data.split_first().ok_or_else(|| invalid("empty tile"))?;
-            let planar: std::borrow::Cow<'_, [u8]> = match flag {
-                1 => lzf_decompress(payload, expected)?.into(),
-                0 if payload.len() == expected => payload.into(),
-                0 => return Err(invalid("raw tile has the wrong size")),
-                f => return Err(invalid(format!("unknown tile compression flag {f}"))),
-            };
-            // Byte planes: byte k of pixel i is at k * n + i.
-            for (k, plane) in planar.chunks_exact(n).enumerate() {
-                for (i, b) in plane.iter().enumerate() {
-                    if let Some(slot) = interleaved.get_mut(i * self.pixel_size + k) {
-                        *slot = *b;
+            match flag {
+                1 => {
+                    // LZF tiles hold byte planes: byte k of pixel i is at k * n + i.
+                    let planar = lzf_decompress(payload, expected)?;
+                    for (k, plane) in planar.chunks_exact(n).enumerate() {
+                        for (i, b) in plane.iter().enumerate() {
+                            if let Some(slot) = interleaved.get_mut(i * self.pixel_size + k) {
+                                *slot = *b;
+                            }
+                        }
                     }
                 }
+                // Raw tiles (written when LZF doesn't shrink them) are already interleaved.
+                0 if payload.len() == expected => interleaved.copy_from_slice(payload),
+                0 => return Err(invalid("raw tile has the wrong size")),
+                f => return Err(invalid(format!("unknown tile compression flag {f}"))),
             }
             space.convert(&interleaved, fmt, &mut out);
             let (x0, y0) =
diff --git a/crates/io/src/lib.rs b/crates/io/src/lib.rs
index a620ddcf33..3543cd359c 100644
--- a/crates/io/src/lib.rs
+++ b/crates/io/src/lib.rs
@@ -40,6 +40,7 @@ pub mod blocks;
 pub mod camera_raw_xmp;
 mod channel_map;
 pub mod comps_map;
+pub mod doc_path;
 pub mod effects_map;
 pub mod exr_parts;
 mod flat;
@@ -187,6 +188,9 @@ pub struct ExportOptions {
     /// File Compatibility (see [`PsdExportOptions::maximize_compatibility`]). On by default, as
     /// Photoshop's Always.
     pub psd_maximize_compatibility: bool,
+    /// The path of the document's own file, which linked smart objects that PSD/PSB and layered
+    /// TIFF embed are resolved against ([`doc_path::resolve`]).
+    pub document_path: Option<std::path::PathBuf>,
 }
 
 impl Default for ExportOptions {
@@ -199,6 +203,7 @@ impl Default for ExportOptions {
             tga_bits: None,
             image_previews: true,
             psd_maximize_compatibility: true,
+            document_path: None,
         }
     }
 }
@@ -275,7 +280,11 @@ fn import_stages(name: &str, bytes: &[u8], ctl: &photocraft_raster::Interrupt, m
     }
     if is_psd(bytes) {
         // A merged image the import reads is decoded with the parse: a ZIP one is inflated once.
-        let (file, merged) = PsdFile::from_bytes_and_merged(bytes, |f| psd_import::check_group_depth(f).is_ok() && psd_import::merged_needed(f))?;
+        let (file, merged) = PsdFile::from_bytes_and_merged_recovering(
+            bytes,
+            |f| psd_import::check_group_depth(f).is_ok() && psd_import::merged_needed(f),
+            psd_import::can_recover_layers,
+        )?;
         // Nesting past the document model's cap could never be saved; reject the file with the
         // actionable limit.
         psd_import::check_group_depth(&file)?;
@@ -407,7 +416,12 @@ fn export_stages(doc: &Document, name_or_ext: &str, opts: &ExportOptions, ctl: &
         return Ok(ExportResult { bytes: photocraft_format::save_to_bytes(doc.as_ref(), &previews)?, warnings: Vec::new() });
     }
     if ext == "psd" || ext == "psb" {
-        let o = PsdExportOptions { force_psb: opts.force_psb || ext == "psb", maximize_compatibility: opts.psd_maximize_compatibility, ..Default::default() };
+        let o = PsdExportOptions {
+            force_psb: opts.force_psb || ext == "psb",
+            maximize_compatibility: opts.psd_maximize_compatibility,
+            document_path: opts.document_path.clone(),
+            ..Default::default()
+        };
         let (mut file, mut warnings) = with_span(ctl, 0.0, PSD_MODEL_DONE, |ctl| psd_export::document_to_psd_interruptible(doc, &o, ctl));
         // A cancelled conversion stops early with an incomplete model: never write it.
         ctl.check().map_err(|_| IoError::Cancelled)?;
diff --git a/crates/io/src/ora.rs b/crates/io/src/ora.rs
index 42b2ab7a33..6d1bcfd87f 100644
--- a/crates/io/src/ora.rs
+++ b/crates/io/src/ora.rs
@@ -258,9 +258,23 @@ fn props(node: roxmltree::Node<'_, '_>, layer: &mut Layer, index: usize, warning
     Ok(())
 }
 
+/// OpenRaster 0.0.6 defaults to isolated groups and makes `auto` explicitly pass-through.
+/// Older files used inference from the group's blend mode; keep that behavior when the
+/// version is absent or unrecognized, too. Compare the numeric core, not version strings.
+fn uses_explicit_group_isolation(version: Option<&str>) -> bool {
+    let Some(core) = version.and_then(|v| v.trim().split(['-', '+']).next()) else { return false };
+    let mut parts = core.split('.');
+    let number = |part: Option<&str>| part.and_then(|s| s.parse::<u32>().ok());
+    match (number(parts.next()), number(parts.next()), number(parts.next()), parts.next()) {
+        (Some(major), Some(minor), Some(patch), None) => [major, minor, patch] >= [0, 0, 6],
+        _ => false,
+    }
+}
+
 struct Reader<'a, 'c> {
     zip: ZipReader<'a>,
     ctl: &'c Interrupt<'c>,
+    explicit_group_isolation: bool,
     nodes: usize,
     budget: usize,
     warnings: Warnings,
@@ -325,10 +339,15 @@ impl Reader<'_, '_> {
                 "stack" => {
                     let mut layer = Layer::group("", Vec::new());
                     props(child, &mut layer, index, &mut self.warnings)?;
-                    // `auto` (the default) isolates only when something needs it: an
-                    // OpenRaster group without its own blend mode is a pass-through group.
-                    let isolate = child.attribute("isolation").map(str::trim) == Some("isolate");
-                    if !isolate && layer.blend == BlendMode::Normal {
+                    let isolation = child.attribute("isolation").map(str::trim);
+                    let pass_through = if self.explicit_group_isolation {
+                        // Since 0.0.6 only explicit `auto` passes through, ignoring the
+                        // group's composite-op. An omitted isolation means `isolate`.
+                        isolation == Some("auto")
+                    } else {
+                        isolation != Some("isolate") && layer.blend == BlendMode::Normal
+                    };
+                    if pass_through {
                         layer.blend = BlendMode::PassThrough;
                     }
                     let children = self.stack(child, depth + 1)?;
@@ -415,7 +434,15 @@ pub(crate) fn import(name: &str, bytes: &[u8], ctl: &Interrupt<'_>) -> Result<Im
         return Err(invalid("the canvas exceeds the 1 GiB pixel limit"));
     }
     let root = image.children().find(|n| n.has_tag_name("stack")).ok_or_else(|| invalid("stack.xml has no root <stack>"))?;
-    let mut reader = Reader { zip, ctl, nodes: 0, budget: MAX_PIXEL_BYTES, warnings: Warnings::default(), images: Vec::new() };
+    let mut reader = Reader {
+        zip,
+        ctl,
+        explicit_group_isolation: uses_explicit_group_isolation(image.attribute("version")),
+        nodes: 0,
+        budget: MAX_PIXEL_BYTES,
+        warnings: Warnings::default(),
+        images: Vec::new(),
+    };
     let nodes = reader.stack(root, 1)?;
     ctl.progress(0.8);
     let depth = document_depth(&reader.images);
@@ -539,6 +566,15 @@ impl Writer<'_> {
         if layer.locks.all || layer.locks.pixels {
             attrs.push_str(" edit-locked=\"true\"");
         }
+        // OpenRaster's one edit lock reopens as Lock All; it has no position lock (#7018).
+        if layer.locks.pixels && !layer.locks.all {
+            self.warnings.layer(&layer.name, "Lock Image Pixels was saved as OpenRaster's edit lock; it reopens as Lock All");
+        }
+        // The Background's position lock is part of being the Background, not one the user set:
+        // every new document has it, and OpenRaster has no Background to keep it on.
+        if layer.locks.position && !layer.locks.all && !self.doc.is_background(layer.id) {
+            self.warnings.layer(&layer.name, "Lock Position is not saved to OpenRaster");
+        }
         if layer.locks.transparency {
             attrs.push_str(" alpha-preserve=\"true\"");
         }
diff --git a/crates/io/src/ora/tests.rs b/crates/io/src/ora/tests.rs
index 319414a94d..c7c253ef29 100644
--- a/crates/io/src/ora/tests.rs
+++ b/crates/io/src/ora/tests.rs
@@ -205,6 +205,84 @@ fn gray16_png(w: u32, h: u32) -> Vec<u8> {
     codecs::encode(&Image::from_raw(w, h, ChannelLayout::Gray, CSample::U16, data).unwrap(), Format::Png, &Default::default()).unwrap()
 }
 
+/// A green Multiply layer over a red backdrop distinguishes isolation (green) from
+/// pass-through (black), even though both groups use Normal compositing by default.
+fn group_isolation_document(version: Option<&str>, attributes: &str, depth: SampleType) -> Document {
+    let version = version.map(|v| format!("version=\"{v}\"")).unwrap_or_default();
+    let xml = format!(
+        r#"<image {version} w="1" h="1"><stack>
+          <stack name="Group" {attributes}>
+            <layer name="Multiply" src="green.png" composite-op="svg:multiply"/>
+          </stack>
+          <layer name="Backdrop" src="red.png"/>
+        </stack></image>"#
+    );
+    let fmt = PixelFormat::new(ColorMode::Rgb, depth, true);
+    let png = |rgba| {
+        let image = Image::from_raw(1, 1, ChannelLayout::Rgba, csample(depth), px(fmt, rgba)).unwrap();
+        codecs::encode(&image, Format::Png, &Default::default()).unwrap()
+    };
+    let bytes = archive(&xml, &[("green.png", png([0.0, 1.0, 0.0, 1.0])), ("red.png", png([1.0, 0.0, 0.0, 1.0]))]);
+    let result = crate::import("isolation.ora", &bytes).unwrap();
+    assert!(result.warnings.is_empty(), "{:?}", result.warnings);
+    assert_eq!(result.document.depth, depth);
+    result.document
+}
+
+#[test]
+fn omitted_group_isolation_defaults_to_isolated_since_version_0_0_6() {
+    for depth in [SampleType::U8, SampleType::U16] {
+        for version in ["0.0.6", " 0.0.6 ", "0.0.6+app.1", "0.0.6-rc.1", "0.0.10", "0.1.0", "1.0.0"] {
+            let d = group_isolation_document(Some(version), "", depth);
+            assert_eq!(d.layers[1].blend, BlendMode::Normal, "{version}, {depth:?}");
+            assert_eq!(photocraft_compose::flatten(&d).px, [[0.0, 1.0, 0.0, 1.0]], "{version}, {depth:?}");
+        }
+    }
+}
+
+#[test]
+fn explicit_group_isolation_preserves_isolate_and_auto() {
+    for depth in [SampleType::U8, SampleType::U16] {
+        for version in ["0.0.3", "0.0.5", "0.0.6"] {
+            for (attributes, blend, expected) in [
+                ("isolation=' isolate '", BlendMode::Normal, [0.0, 1.0, 0.0, 1.0]),
+                ("isolation=' auto '", BlendMode::PassThrough, [0.0, 0.0, 0.0, 1.0]),
+                ("isolation='isolate' composite-op='svg:multiply'", BlendMode::Multiply, [0.0, 0.0, 0.0, 1.0]),
+            ] {
+                let d = group_isolation_document(Some(version), attributes, depth);
+                assert_eq!(d.layers[1].blend, blend, "{version}, {attributes}, {depth:?}");
+                assert_eq!(photocraft_compose::flatten(&d).px, [expected], "{version}, {attributes}, {depth:?}");
+            }
+        }
+    }
+}
+
+#[test]
+fn auto_group_ignores_its_composite_op_since_version_0_0_6() {
+    for depth in [SampleType::U8, SampleType::U16] {
+        let d = group_isolation_document(Some("0.0.6"), "isolation='auto' composite-op='svg:screen'", depth);
+        assert_eq!(d.layers[1].blend, BlendMode::PassThrough);
+        assert_eq!(photocraft_compose::flatten(&d).px, [[0.0, 0.0, 0.0, 1.0]], "{depth:?}");
+    }
+}
+
+#[test]
+fn legacy_group_isolation_keeps_inference_from_blend_mode() {
+    for depth in [SampleType::U8, SampleType::U16] {
+        for version in [None, Some("0.0.3"), Some("0.0.5"), Some("unknown"), Some("0.0"), Some("0.0.6.0")] {
+            for (attributes, blend, expected) in [
+                ("", BlendMode::PassThrough, [0.0, 0.0, 0.0, 1.0]),
+                ("composite-op='svg:screen'", BlendMode::Screen, [1.0, 1.0, 0.0, 1.0]),
+                ("isolation='auto' composite-op='svg:screen'", BlendMode::Screen, [1.0, 1.0, 0.0, 1.0]),
+            ] {
+                let d = group_isolation_document(version, attributes, depth);
+                assert_eq!(d.layers[1].blend, blend, "{version:?}, {attributes}, {depth:?}");
+                assert_eq!(photocraft_compose::flatten(&d).px, [expected], "{version:?}, {attributes}, {depth:?}");
+            }
+        }
+    }
+}
+
 #[test]
 fn reads_other_applications_stacks() {
     // The shapes Krita, MyPaint and GIMP write: a root stack with attributes, `auto`
@@ -416,6 +494,9 @@ fn lossy_documents() -> Vec<(&'static str, Document)> {
         }),
         ("clipped", with(&|d| d.layers[1].clipped = true)),
         ("fill opacity", with(&|d| d.layers[0].fill_opacity = 0.5)),
+        ("pixel lock", with(&|d| d.layers[0].locks.pixels = true)),
+        // Not the bottom layer: with its transparency lock, `Base` would become the Background.
+        ("position lock", with(&|d| d.layers[1].locks.position = true)),
         ("float", doc(SampleType::F32)),
         ("profile", with(&|d| d.icc_profile = Some(photocraft_cms::Builtin::DisplayP3.profile().to_bytes()))),
         ("metadata", with(&|d| d.metadata.xmp = Some("<x/>".into()))),
@@ -442,6 +523,15 @@ fn plain_documents_lose_nothing() {
         d.icc_profile = Some(photocraft_cms::Builtin::Srgb.profile().to_bytes());
         assert_eq!(losses(&d), Vec::<String>::new(), "{depth:?} tagged sRGB");
         assert_eq!(export(&d).unwrap().warnings, Vec::<String>::new());
+        // OpenRaster's edit-locked and alpha-preserve hold Lock All and Lock Transparent Pixels.
+        d.layers[0].locks.all = true;
+        d.layers[1].locks.transparency = true;
+        assert_eq!(losses(&d), Vec::<String>::new(), "{depth:?} locked");
+        // A Background (every new document's bottom layer) loses nothing for its position lock.
+        d.layers[0].locks.all = false;
+        d.layers[0].locks.position = true;
+        assert!(d.background().is_some());
+        assert_eq!(losses(&d), Vec::<String>::new(), "{depth:?} Background");
     }
     let mut cmyk = doc(SampleType::U8);
     cmyk.mode = ColorMode::Cmyk;
diff --git a/crates/io/src/psd_export.rs b/crates/io/src/psd_export.rs
index 8ba30d83c4..64a5e7073a 100644
--- a/crates/io/src/psd_export.rs
+++ b/crates/io/src/psd_export.rs
@@ -41,11 +41,14 @@ pub struct PsdExportOptions {
     /// readers that only show the merged image see white. A document without layer records always
     /// gets the real image, since its pixels live nowhere else.
     pub maximize_compatibility: bool,
+    /// The path of the document's own file: linked smart objects are resolved against it
+    /// ([`crate::doc_path::resolve`]) before they are read and embedded.
+    pub document_path: Option<std::path::PathBuf>,
 }
 
 impl Default for PsdExportOptions {
     fn default() -> Self {
-        PsdExportOptions { force_psb: false, merged_matte: true, merged_compression: Compression::Rle, maximize_compatibility: true }
+        PsdExportOptions { force_psb: false, merged_matte: true, merged_compression: Compression::Rle, maximize_compatibility: true, document_path: None }
     }
 }
 
@@ -53,6 +56,8 @@ struct Ex {
     fmt: PixelFormat,
     /// Document resolution (for generated type-layer data).
     dpi: f32,
+    /// The document's own file, which linked smart objects are resolved against.
+    document: Option<std::path::PathBuf>,
     /// Character/paragraph styles written into every type layer's engine data.
     text_styles: photocraft_doc::TextStyles,
     mask_fmt: PixelFormat,
@@ -929,7 +934,8 @@ impl Ex {
             SmartSource::Linked { path } => {
                 #[cfg(not(target_arch = "wasm32"))]
                 {
-                    let bytes = std::fs::read(path).map_err(|e| format!("the linked file {path} can't be read: {e}"))?;
+                    let file = crate::doc_path::resolve(path, self.document.as_deref()).map_err(|e| format!("the linked file {path} is not opened: {e}"))?;
+                    let bytes = std::fs::read(file).map_err(|e| format!("the linked file {path} can't be read: {e}"))?;
                     let name = path.rsplit(['/', '\\']).next().unwrap_or(path).to_string();
                     self.warnings.push(format!("the linked smart object {name} was embedded (PSD export keeps no external links)"));
                     self.embed(sm.contents_id, &name, &bytes)
@@ -998,8 +1004,12 @@ impl Ex {
                 return Err(format!("smart objects nest more than {MAX_NESTING} deep"));
             }
             let doc = photocraft_format::load_from_bytes(bytes).map_err(|e| format!("its contents can't be read: {e}"))?;
-            let (file, warnings) =
-                document_to_psd_nested(&doc, &PsdExportOptions { force_psb: true, ..Default::default() }, self.smart.depth + 1, &Interrupt::NONE);
+            let (file, warnings) = document_to_psd_nested(
+                &doc,
+                &PsdExportOptions { force_psb: true, document_path: self.document.clone(), ..Default::default() },
+                self.smart.depth + 1,
+                &Interrupt::NONE,
+            );
             let data = file.to_bytes().map_err(|e| format!("its contents can't be written: {e}"))?;
             let stem = file_name.rsplit_once('.').map_or(file_name, |(a, _)| a);
             self.warnings.extend(warnings.into_iter().map(|w| format!("smart object {stem}: {w}")));
@@ -1519,6 +1529,7 @@ fn document_to_psd_nested(doc: &Document, opts: &PsdExportOptions, depth: u32, c
     let mut ex = Ex {
         fmt,
         dpi: doc.resolution_dpi,
+        document: opts.document_path.clone(),
         text_styles: doc.text_styles.clone(),
         text_index: Default::default(),
         mask_fmt: PixelFormat::new(ColorMode::Grayscale, sample, false),
diff --git a/crates/io/src/psd_import.rs b/crates/io/src/psd_import.rs
index c20c1b7fe7..12307f32ba 100644
--- a/crates/io/src/psd_import.rs
+++ b/crates/io/src/psd_import.rs
@@ -764,6 +764,12 @@ pub(crate) fn merged_needed(file: &PsdFile) -> bool {
     !layered || file.layers().is_empty() || usize::from(h.channels) > mode.color_channels() + usize::from(file.merged_has_alpha())
 }
 
+/// A damaged merged preview need not prevent opening independently stored layers (#6152).
+/// Other modes are imported flattened, so their merged image cannot be discarded.
+pub(crate) fn can_recover_layers(file: &PsdFile) -> bool {
+    matches!(file.header.color_mode, PsdMode::Grayscale | PsdMode::Rgb | PsdMode::Cmyk | PsdMode::Lab) && file.header.depth != 1 && !file.layers().is_empty()
+}
+
 /// [`psd_to_document_with`] with the merged image already decoded (by
 /// [`PsdFile::from_bytes_and_merged`] with [`merged_needed`]), so it is not decoded again.
 pub(crate) fn psd_to_document_decoded(
@@ -901,9 +907,15 @@ pub(crate) fn psd_to_document_decoded(
         ctl.progress(0.1);
         if let Err(e) = &m {
             cx.warn(format!("merged image could not be decoded: {e}"));
+            if can_recover_layers(file) {
+                cx.warn("extra alpha/spot channels in the merged image could not be recovered");
+            }
         }
         Some(m)
     } else {
+        if let Some(Err(e)) = decoded {
+            cx.warn(format!("merged image could not be decoded; opened the available layers instead: {e}"));
+        }
         None
     };
 
diff --git a/crates/io/src/svg.rs b/crates/io/src/svg.rs
index 04fc4bee3a..72b2318675 100644
--- a/crates/io/src/svg.rs
+++ b/crates/io/src/svg.rs
@@ -337,6 +337,11 @@ impl Conv {
     /// `nodes` in paint order (first = bottom), as layers in the same order. `parent` is the
     /// absolute transform of the group holding them (what resvg needs to render one of them
     /// alone, since a node's own data is in its parent's space).
+    ///
+    /// Transforms are composed from `parent` down rather than read from `abs_transform()`: the
+    /// glyph outlines usvg builds for a text element (`Text::flattened`) keep identity absolute
+    /// transforms, so text placed by its own or an ancestor's `transform` (Illustrator writes
+    /// `matrix(1 0 0 1 x y)` on every text element) would lose it (#4806). Elsewhere the two agree.
     fn convert_children(&mut self, nodes: &[usvg::Node], depth: usize, rec: usize, parent: tiny_skia::Transform) -> Vec<Layer> {
         let mut out = Vec::new();
         for node in nodes {
@@ -350,7 +355,7 @@ impl Conv {
             usvg::Node::Group(g) => {
                 // A clip-path of one plain path becomes the group's vector mask (#4266); others
                 // are rasterised with the group.
-                let clip = g.clip_path().and_then(|cp| self.clip_mask(g, cp));
+                let clip = g.clip_path().and_then(|cp| self.clip_mask(parent.pre_concat(g.transform()), cp));
                 let dropped: [(bool, &'static str); 3] =
                     [(!g.filters().is_empty(), "filter"), (g.clip_path().is_some() && clip.is_none(), "clip-path"), (g.mask().is_some(), "mask")];
                 let too_deep = self.max_group_depth.is_some_and(|limit| depth >= limit) || depth >= MAX_GROUP_DEPTH || rec >= MAX_RECURSION;
@@ -370,7 +375,8 @@ impl Conv {
                 // A group that only carries a transform (baked into its paths by usvg) or that
                 // usvg inserted for its own bookkeeping adds nothing to the layer tree.
                 let plain = clip.is_none() && g.id().is_empty() && g.opacity().get() >= 1.0 && g.blend_mode() == usvg::BlendMode::Normal;
-                let children = self.convert_children(g.children(), if plain { depth } else { depth + 1 }, rec + 1, g.abs_transform());
+                let abs = parent.pre_concat(g.transform());
+                let children = self.convert_children(g.children(), if plain { depth } else { depth + 1 }, rec + 1, abs);
                 if children.is_empty() {
                     return;
                 }
@@ -404,7 +410,9 @@ impl Conv {
                 out.extend(self.raster_layer(node, name, parent));
             }
             usvg::Node::Text(t) => {
-                let children = self.convert_children(t.flattened().children(), depth + 1, rec + 1, t.flattened().abs_transform());
+                // The outlines are in the text element's own space.
+                let abs = t.abs_transform().pre_concat(t.flattened().transform());
+                let children = self.convert_children(t.flattened().children(), depth + 1, rec + 1, abs);
                 if children.is_empty() {
                     self.note("text", "SVG: text needs a font the drawing can use; none matched, so it was dropped".to_string());
                     return;
@@ -421,10 +429,10 @@ impl Conv {
         }
     }
 
-    /// The vector mask for group `g` clipped by `cp`, when the clip is one visible path with no
-    /// clip of its own: what resvg draws for the clip (the group's transform, then the clip's,
-    /// then the path), in canvas pixels, with the clip rule as its fill rule.
-    fn clip_mask(&self, g: &usvg::Group, cp: &usvg::ClipPath) -> Option<VectorMask> {
+    /// The vector mask for a group clipped by `cp`, when the clip is one visible path with no
+    /// clip of its own: what resvg draws for the clip (the group's absolute transform `abs`, then
+    /// the clip's, then the path), in canvas pixels, with the clip rule as its fill rule.
+    fn clip_mask(&self, abs: tiny_skia::Transform, cp: &usvg::ClipPath) -> Option<VectorMask> {
         if cp.clip_path().is_some() {
             return None;
         }
@@ -432,7 +440,7 @@ impl Conv {
         if !p.is_visible() {
             return None;
         }
-        let ts = g.abs_transform().pre_concat(cp.transform()).post_concat(self.global);
+        let ts = abs.pre_concat(cp.transform()).post_concat(self.global);
         let subpaths = knots(&(*p.data()).clone().transform(ts)?);
         if subpaths.is_empty() {
             return None;
@@ -455,7 +463,8 @@ impl Conv {
             let name = self.name(p.id(), 0);
             return self.raster_layer(node, name, parent);
         }
-        let ts = p.abs_transform().post_concat(self.global);
+        // A path has no transform of its own: its data is in its parent's space.
+        let ts = parent.post_concat(self.global);
         let data = (*p.data()).clone().transform(ts)?;
         let subpaths = knots(&data);
         if subpaths.is_empty() {
@@ -542,7 +551,14 @@ impl Conv {
     /// The node rendered by resvg into a pixel layer over its bounding box, clipped to the canvas.
     /// `parent` is the absolute transform of the node's parent group.
     fn raster_layer(&mut self, node: &usvg::Node, name: String, parent: tiny_skia::Transform) -> Option<Layer> {
-        let bb = node.abs_layer_bounding_box()?;
+        // Where the node lands, from its box in its parent's space (as usvg computes its absolute
+        // box, but through `parent`, which is right inside text too).
+        let bb = match node {
+            usvg::Node::Group(g) => g.layer_bounding_box().transform(parent.pre_concat(g.transform()))?,
+            _ => node.bounding_box().to_non_zero_rect()?.transform(parent)?,
+        };
+        // What resvg shifts the node by before drawing it.
+        let shift = node.abs_layer_bounding_box()?;
         let k = self.global.sx;
         let x0 = ((bb.x() * k).floor() as i32).max(self.canvas.x0);
         let y0 = ((bb.y() * k).floor() as i32).max(self.canvas.y0);
@@ -559,7 +575,7 @@ impl Conv {
         // to the origin: undo that shift, apply the parent's transform, then scale to the canvas
         // and shift so the pixmap starts at (x0, y0).
         let canvas = tiny_skia::Transform::from_row(k, 0.0, 0.0, k, -(x0 as f32), -(y0 as f32));
-        let ts = canvas.pre_concat(parent).pre_translate(bb.x(), bb.y());
+        let ts = canvas.pre_concat(parent).pre_translate(shift.x(), shift.y());
         resvg::render_node(node, ts, &mut pixmap.as_mut())?;
         Some(Layer::new(name, LayerContent::Raster(surface(&pixmap, Rect::new(x0, y0, x1, y1), self.fmt))))
     }
diff --git a/crates/io/src/tiff_layers.rs b/crates/io/src/tiff_layers.rs
index 3cd8de5b4c..628517b6f7 100644
--- a/crates/io/src/tiff_layers.rs
+++ b/crates/io/src/tiff_layers.rs
@@ -202,8 +202,13 @@ pub(crate) fn export_layered(doc: &Document, opts: &ExportOptions, ctl: &photocr
     let big = doc.size.width > 30_000 || doc.size.height > 30_000;
     // The PSD exporter renders the composite we need for the TIFF itself: unmatted (the TIFF
     // keeps straight alpha) and uncompressed (its planes are interleaved below).
-    let psd_opts =
-        PsdExportOptions { force_psb: opts.force_psb || big, merged_matte: false, merged_compression: Compression::Raw, maximize_compatibility: true };
+    let psd_opts = PsdExportOptions {
+        force_psb: opts.force_psb || big,
+        merged_matte: false,
+        merged_compression: Compression::Raw,
+        maximize_compatibility: true,
+        document_path: opts.document_path.clone(),
+    };
     let (file, w) = crate::with_span(ctl, 0.0, TIFF_MODEL_DONE, |ctl| crate::psd_export::document_to_psd_interruptible(doc, &psd_opts, ctl));
     // A cancelled conversion stops early with an incomplete model: never encode it.
     ctl.check().map_err(|_| IoError::Cancelled)?;
diff --git a/crates/io/tests/cmyk_composite_export.rs b/crates/io/tests/cmyk_composite_export.rs
index 9f537dabfd..31c0b6969f 100644
--- a/crates/io/tests/cmyk_composite_export.rs
+++ b/crates/io/tests/cmyk_composite_export.rs
@@ -1,8 +1,8 @@
 use photocraft_cms::{Builtin, Intent, Profile, Transform};
 use photocraft_codecs::{ChannelLayout, SampleType as CodecSample, decode};
-use photocraft_color::{ColorMode, SampleType};
-use photocraft_doc::{Document, Layer, LayerContent};
-use photocraft_geom::Size;
+use photocraft_color::{ColorMode, PixelFormat, SampleType};
+use photocraft_doc::{Document, Layer, LayerContent, LayerMask};
+use photocraft_geom::{Rect, Size};
 use photocraft_io::{ExportOptions, document_to_image, export};
 use photocraft_raster::Surface;
 
@@ -15,6 +15,32 @@ fn document(depth: SampleType, alpha: f32) -> Document {
     doc
 }
 
+/// Three bands exercise opaque, translucent and empty pixels in the same composite.
+fn mixed_region_document(depth: SampleType, opaque: bool) -> Document {
+    let mut doc = Document::new("CMYK regions", Size::new(48, 16), ColorMode::Cmyk, depth);
+    let mut bottom = Surface::new(doc.pixel_format());
+    bottom.fill_rect(Rect::new(0, 0, 16, 16), &[0.2, 0.6, 0.1, 0.15, 1.0]);
+    bottom.fill_rect(Rect::new(16, 0, 32, 16), &[0.1, 0.2, 0.7, 0.25, 0.5]);
+    if opaque {
+        bottom.fill_rect(doc.bounds(), &[0.2, 0.6, 0.1, 0.15, 1.0]);
+    }
+    doc.layers.push(Layer::new("Ink", LayerContent::Raster(bottom)));
+    let mut surface = Surface::new(doc.pixel_format());
+    surface.fill_rect(Rect::new(0, 0, 16, 16), &[0.7, 0.1, 0.3, 0.2, 1.0]);
+    let mut top = Layer::new("Masked ink", LayerContent::Raster(surface));
+    top.opacity = 0.5;
+    top.mask = Some(LayerMask {
+        surface: Surface::with_default(PixelFormat::new(ColorMode::Grayscale, depth, false), &[0.5]),
+        enabled: true,
+        linked: true,
+        density: 1.0,
+        feather: 0.0,
+    });
+    doc.layers.push(top);
+    doc.resolution_dpi = 300.0;
+    doc
+}
+
 fn tag(bytes: &[u8], id: u16) -> Option<u16> {
     assert_eq!(&bytes[..2], b"II");
     let start = usize::try_from(u32::from_le_bytes(bytes[4..8].try_into().unwrap())).unwrap();
@@ -71,6 +97,69 @@ fn tiff_keeps_true_zero_alpha_when_composited() {
     }
 }
 
+#[test]
+fn flat_and_layered_tiff_agree_for_mixed_cmyk_regions() {
+    let custom = photocraft_cms::synth::cmyk_profile(&photocraft_cms::synth::CmykParams {
+        description: "Mixed regions uncoated".into(),
+        tvi: [0.26, 0.26, 0.26, 0.3],
+        grid_a2b: 5,
+        grid_b2a: 9,
+        ..Default::default()
+    });
+    let coated = Builtin::CoatedCmyk.profile().to_bytes();
+    for (name, profile) in [("untagged", None), ("coated", Some(coated.clone())), ("uncoated", Some(custom.to_bytes()))] {
+        for (depth, sample) in [(SampleType::U8, CodecSample::U8), (SampleType::U16, CodecSample::U16), (SampleType::F32, CodecSample::F32)] {
+            for opaque in [false, true] {
+                let context = format!("{name}, {depth:?}, opaque={opaque}");
+                let mut doc = mixed_region_document(depth, opaque);
+                doc.icc_profile = profile.clone();
+                let flat = export(&doc, "tiff", &ExportOptions::default()).unwrap();
+                let layered = export(&doc, "tiff", &ExportOptions { tiff_layers: true, ..Default::default() }).unwrap();
+                let image = decode(&flat.bytes).unwrap();
+                let reference = decode(&layered.bytes).unwrap();
+                assert!(!flat.warnings.iter().any(|warning| warning.contains("sRGB")), "{context}: {:?}", flat.warnings);
+                // Flat composites embed the fallback profile; the layered path keeps the source tag.
+                assert_eq!(image.icc.as_deref(), Some(profile.as_ref().unwrap_or(&coated).as_slice()), "{context}");
+                assert_eq!(reference.icc.as_deref(), profile.as_deref().map(Vec::as_slice), "{context}");
+                assert!(image.meta.photoshop_layers.is_none(), "{context}");
+                assert!(reference.meta.photoshop_layers.is_some(), "{context}");
+                for (decoded, bytes) in [(&image, &flat.bytes), (&reference, &layered.bytes)] {
+                    assert_eq!(decoded.dimensions(), (48, 16), "{context}");
+                    assert_eq!(decoded.layout(), if opaque { ChannelLayout::Cmyk } else { ChannelLayout::CmykA }, "{context}");
+                    assert_eq!(decoded.sample_type(), sample, "{context}");
+                    assert_eq!(decoded.meta.dpi, Some((300.0, 300.0)), "{context}");
+                    assert_eq!(tag(bytes, 262), Some(5), "{context}");
+                    assert_eq!(tag(bytes, 277), Some(if opaque { 4 } else { 5 }), "{context}");
+                    assert_eq!(tag(bytes, 338), if opaque { None } else { Some(2) }, "{context}");
+                }
+                // The PSD-backed layered path inverts CMYK samples twice, so allow one stored level.
+                let tolerance = match depth {
+                    SampleType::U8 => 1.0 / 255.0,
+                    SampleType::U16 => 1.0 / 65535.0,
+                    SampleType::F32 => 1e-6,
+                };
+                let actual = image.to_normalized();
+                let expected = reference.to_normalized();
+                assert_eq!(actual.len(), expected.len(), "{context}");
+                let difference = actual.iter().zip(&expected).map(|(a, b)| (a - b).abs()).fold(0.0f32, f32::max);
+                assert!(difference <= tolerance + 1e-6, "{context}: maximum sample difference {difference}");
+                if !opaque {
+                    for (i, px) in actual.as_chunks::<5>().0.iter().enumerate() {
+                        match i % 48 {
+                            0..16 => assert_eq!(px[4], 1.0, "{context}: opaque region"),
+                            16..32 => assert!((px[4] - 0.5).abs() <= tolerance, "{context}: translucent region: {px:?}"),
+                            _ => assert_eq!(px[4], 0.0, "{context}: empty region"),
+                        }
+                    }
+                }
+                let back = photocraft_io::import("regions.tiff", &flat.bytes).unwrap().document;
+                assert_eq!((back.mode, back.depth), (ColorMode::Cmyk, depth), "{context}");
+                assert_eq!(back.resolution_dpi, 300.0, "{context}");
+            }
+        }
+    }
+}
+
 #[test]
 fn psd_keeps_cmyk_mode_depth_and_profile_when_composited() {
     for depth in [SampleType::U8, SampleType::U16, SampleType::F32] {
diff --git a/crates/io/tests/corpus.rs b/crates/io/tests/corpus.rs
index dd96d96c7f..710b2a8644 100644
--- a/crates/io/tests/corpus.rs
+++ b/crates/io/tests/corpus.rs
@@ -132,7 +132,7 @@ thread_local! {
 }
 
 /// Files known to be invalid upstream: their parse error is expected.
-const KNOWN_BAD: &[(&str, &str)] = &[("group-divider-blend-mode.psd", "psd-tools fixture stripped to 1906 bytes: merged image data missing")];
+const KNOWN_BAD: &[(&str, &str)] = &[("group-divider-blend-mode.psd", "malformed merged image data; recovery is tested in psd_damaged_merged.rs (#6152)")];
 
 /// One corpus directory with its own floors.
 struct Source {
diff --git a/crates/io/tests/exr_part_profile.rs b/crates/io/tests/exr_part_profile.rs
new file mode 100644
index 0000000000..9f6ccd8cf4
--- /dev/null
+++ b/crates/io/tests/exr_part_profile.rs
@@ -0,0 +1,117 @@
+//! Selecting an EXR part must interpret its linear samples like ordinary File > Open.
+
+use photocraft_cms::{Builtin, ColorSpace, Intent, Profile, Transform};
+use photocraft_codecs::{self as codecs, ChannelLayout, Format, Image, SampleType as CodecSample};
+use photocraft_color::{ColorMode, SampleType};
+use photocraft_doc::Document;
+use photocraft_io::{ExportOptions, ImportResult, export, exr_parts, import};
+
+fn exr(layout: ChannelLayout, depth: CodecSample) -> Vec<u8> {
+    // Exactly representable in half precision, including negative and HDR luminance.
+    let samples: Vec<f32> = [-0.25, 0.25, 0.5, 2.0]
+        .into_iter()
+        .zip([1.0, 0.5, 0.25, 0.0])
+        .flat_map(|(v, a)| match layout {
+            ChannelLayout::Gray => vec![v],
+            ChannelLayout::GrayA => vec![v, a],
+            ChannelLayout::Rgb => vec![v, 0.125, 0.75],
+            ChannelLayout::Rgba => vec![v, 0.125, 0.75, a],
+            _ => panic!("not an EXR layout"),
+        })
+        .collect();
+    let image = Image::from_f32(4, 1, layout, &samples).unwrap().convert(layout, depth);
+    codecs::encode(&image, Format::OpenExr, &Default::default()).unwrap()
+}
+
+fn selected_part(bytes: &[u8]) -> ImportResult {
+    let entries = exr_parts::entries(bytes).unwrap();
+    assert_eq!(entries.len(), 1);
+    assert_eq!(entries[0].kind, exr_parts::EntryKind::Part);
+    let selection = exr_parts::Selection { parts: vec![entries[0].name.clone()], groups: vec![], view: "both".into(), precomp: false };
+    exr_parts::import("selected", bytes, &selection).unwrap()
+}
+
+fn samples(doc: &Document) -> Vec<f32> {
+    assert_eq!(doc.layers.len(), 1);
+    doc.layers[0].surface().unwrap().read_region(doc.bounds())
+}
+
+#[test]
+fn selected_gray_exr_part_keeps_linear_profile_and_float_samples() {
+    for depth in [CodecSample::F16, CodecSample::F32] {
+        for layout in [ChannelLayout::Gray, ChannelLayout::GrayA] {
+            let bytes = exr(layout, depth);
+            let selected = selected_part(&bytes);
+            let ordinary = import("ordinary.exr", &bytes).unwrap();
+            let doc = &selected.document;
+            assert_eq!((doc.mode, doc.depth), (ColorMode::Grayscale, SampleType::F32));
+            assert_eq!(doc.size, ordinary.document.size);
+            assert_eq!(selected.warnings, ordinary.warnings);
+            assert_eq!(selected.warnings.len(), usize::from(depth == CodecSample::F16));
+            let expected = codecs::decode(&bytes).unwrap().convert(ChannelLayout::GrayA, CodecSample::F32).to_f32_samples().unwrap();
+            assert_eq!(samples(doc), expected, "{layout:?} {depth:?}: samples and alpha stay unchanged");
+            assert_eq!(samples(doc), samples(&ordinary.document));
+            assert_eq!(doc.icc_profile, Some(photocraft_cms::builtin::linear_gray().to_bytes()), "{layout:?} {depth:?}: linear luminance");
+            assert_eq!(doc.icc_profile, ordinary.document.icc_profile);
+
+            // The tagged samples convert to display gray, rather than being interpreted as sGray.
+            let profile = Profile::parse(doc.icc_profile.as_deref().unwrap()).unwrap();
+            assert_eq!(profile.color_space, ColorSpace::Gray);
+            let transform = Transform::new(&profile, Builtin::SGray.profile(), Intent::RelativeColorimetric, false).unwrap();
+            let mut display = samples(doc);
+            transform.apply(&mut display, 2);
+            for i in [1, 2] {
+                let expected_gray = photocraft_color::convert::linear_to_srgb(expected[i * 2]);
+                assert!((display[i * 2] - expected_gray).abs() < 1e-4, "{layout:?} {depth:?}: display gray");
+                assert_eq!(display[i * 2 + 1], expected[i * 2 + 1], "alpha is not gamma encoded");
+            }
+        }
+    }
+}
+
+#[test]
+fn selected_gray_exr_part_exports_like_ordinary_import() {
+    for depth in [CodecSample::F16, CodecSample::F32] {
+        for layout in [ChannelLayout::Gray, ChannelLayout::GrayA] {
+            let bytes = exr(layout, depth);
+            let selected = selected_part(&bytes).document;
+            let ordinary = import("ordinary.exr", &bytes).unwrap().document;
+            for ext in ["exr", "tga"] {
+                let output = export(&selected, ext, &ExportOptions::default()).unwrap();
+                let control = export(&ordinary, ext, &ExportOptions::default()).unwrap();
+                let output = codecs::decode(&output.bytes).unwrap();
+                let control = codecs::decode(&control.bytes).unwrap();
+                assert_eq!(output.layout(), control.layout());
+                assert_eq!(output.to_normalized(), control.to_normalized(), "{layout:?} {depth:?} {ext}: same colours as File > Open");
+                let output = output.convert(ChannelLayout::GrayA, CodecSample::F32).to_f32_samples().unwrap();
+                let original = samples(&selected);
+                if ext == "exr" {
+                    assert_eq!(output, original, "linear EXR samples, including negative/HDR and alpha, survive re-export");
+                } else {
+                    for i in [1, 2] {
+                        let expected = photocraft_color::convert::linear_to_srgb(original[i * 2]);
+                        assert!((output[i * 2] - expected).abs() <= 1.0 / 255.0, "TGA uses display-encoded gray");
+                        assert!((output[i * 2 + 1] - original[i * 2 + 1]).abs() <= 1.0 / 255.0, "TGA preserves alpha");
+                    }
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn selected_rgb_exr_part_keeps_linear_srgb() {
+    for depth in [CodecSample::F16, CodecSample::F32] {
+        for layout in [ChannelLayout::Rgb, ChannelLayout::Rgba] {
+            let bytes = exr(layout, depth);
+            let doc = selected_part(&bytes).document;
+            let ordinary = import("ordinary.exr", &bytes).unwrap().document;
+            assert_eq!((doc.mode, doc.depth), (ColorMode::Rgb, SampleType::F32));
+            assert_eq!(doc.icc_profile, Some(Builtin::LinearSrgb.profile().to_bytes()));
+            assert_eq!(doc.icc_profile, ordinary.icc_profile);
+            let expected = codecs::decode(&bytes).unwrap().convert(ChannelLayout::Rgba, CodecSample::F32).to_f32_samples().unwrap();
+            assert_eq!(samples(&doc), expected, "{layout:?} {depth:?}: RGB and alpha stay unchanged");
+            assert_eq!(samples(&doc), samples(&ordinary));
+        }
+    }
+}
diff --git a/crates/io/tests/flat.rs b/crates/io/tests/flat.rs
index b82b41ffc3..8cdecde369 100644
--- a/crates/io/tests/flat.rs
+++ b/crates/io/tests/flat.rs
@@ -610,6 +610,73 @@ fn linear_gray_export_preserves_alpha_and_embeddable_profiles() {
     }
 }
 
+/// WebP can embed RGB profiles, but expanding gray to RGB drops a gray profile. Its untagged
+/// RGB samples must use the sRGB transfer function, not the source gray encoding.
+#[test]
+fn linear_gray_webp_exports_use_display_encoding() {
+    use photocraft_codecs::{ChannelLayout, EncodeOptions};
+    for depth in [SampleType::U8, SampleType::U16, SampleType::F32] {
+        for alpha in [1.0, 0.5] {
+            let mut d = columns(ColorMode::Grayscale, depth, &[&[0.25, alpha], &[0.5, alpha]]);
+            d.icc_profile = Some(photocraft_cms::builtin::linear_gray().to_bytes());
+            let stored = column_pixels(&d, 2);
+            for lossless in [true, false] {
+                let opts = ExportOptions { encode: EncodeOptions { webp_lossless: lossless, webp_quality: 100, ..Default::default() }, ..Default::default() };
+                let r = export(&d, "webp", &opts).unwrap();
+                let img = photocraft_codecs::decode(&r.bytes).unwrap();
+                let what = format!("{depth:?}, alpha {alpha}, lossless {lossless}");
+                assert_eq!(img.layout(), if alpha == 1.0 { ChannelLayout::Rgb } else { ChannelLayout::Rgba }, "{what}");
+                assert_eq!(img.icc, None, "{what}: a gray ICC cannot describe RGB samples");
+                let values = img.to_normalized();
+                let stride = img.layout().channels();
+                let tolerance = if lossless { 1.5 / 255.0 } else { 3.0 / 255.0 };
+                for (i, src) in stored.iter().enumerate() {
+                    let offset = (8 * img.width() as usize + 16 * i + 8) * stride;
+                    let expected = photocraft_color::convert::linear_to_srgb(src[0]);
+                    for &value in &values[offset..offset + 3] {
+                        assert!((value - expected).abs() <= tolerance, "{what}, pixel {i}: got {value}, expected {expected}");
+                    }
+                    if img.layout().has_alpha() {
+                        assert!((values[offset + 3] - src[1]).abs() <= 1.0 / 255.0, "{what}: alpha changed");
+                    }
+                }
+                assert!(r.warnings.iter().any(|w| w.contains("converted to sGray")), "{what}: {:?}", r.warnings);
+            }
+        }
+    }
+}
+
+#[test]
+fn default_gray_webp_exports_keep_samples() {
+    for depth in [SampleType::U8, SampleType::U16, SampleType::F32] {
+        for icc in [None, Some(photocraft_cms::Builtin::SGray.profile().to_bytes())] {
+            let mut d = columns(ColorMode::Grayscale, depth, &[&[0.25, 0.5], &[0.5, 1.0]]);
+            d.icc_profile = icc;
+            let stored = column_pixels(&d, 2);
+            let r = export(&d, "webp", &ExportOptions::default()).unwrap();
+            let img = photocraft_codecs::decode(&r.bytes).unwrap();
+            assert_eq!(img.icc, None, "{depth:?}: a gray ICC cannot describe RGB samples");
+            let back = import("gray.webp", &r.bytes).unwrap().document;
+            let want: Vec<Vec<f32>> = stored.iter().map(|p| vec![p[0], p[0], p[0], p[1]]).collect();
+            assert_colors(&column_pixels(&back, 2), &want, 1.0 / 255.0, &format!("{depth:?}: sGray samples"));
+            assert!(!r.warnings.iter().any(|w| w.contains("converted to sGray")), "{depth:?}: {:?}", r.warnings);
+        }
+    }
+}
+
+#[test]
+fn rgb_webp_exports_keep_embeddable_profiles() {
+    for depth in [SampleType::U8, SampleType::U16, SampleType::F32] {
+        let mut d = columns(ColorMode::Rgb, depth, &[&[0.25, 0.5, 0.75, 0.5]]);
+        d.icc_profile = Some(photocraft_cms::Builtin::LinearSrgb.profile().to_bytes());
+        let r = export(&d, "webp", &ExportOptions::default()).unwrap();
+        let back = import("rgb.webp", &r.bytes).unwrap().document;
+        assert_eq!(back.icc_profile, d.icc_profile, "{depth:?}: WebP keeps RGB ICC");
+        assert_colors(&column_pixels(&back, 1), &column_pixels(&d, 1), 1.0 / 255.0, &format!("{depth:?}: RGB samples"));
+        assert!(!r.warnings.iter().any(|w| w.contains("converted to sRGB")), "{depth:?}: {:?}", r.warnings);
+    }
+}
+
 /// #518: a JPEG cut off inside its image data opens with a warning, never silently.
 #[test]
 fn truncated_jpeg_imports_with_a_warning() {
diff --git a/crates/io/tests/modes.rs b/crates/io/tests/modes.rs
index f33fe5927c..c166766215 100644
--- a/crates/io/tests/modes.rs
+++ b/crates/io/tests/modes.rs
@@ -25,6 +25,109 @@ fn indexed_png_is_palette_png() {
     assert!(!j.bytes.is_empty());
 }
 
+#[test]
+fn indexed_png_keeps_duplicate_palette_colors_opaque() {
+    // PLTE entries may have identical RGB but different tRNS alpha. RGB-only lookup used to
+    // choose the first red entry for both pixels, making the opaque one disappear on save.
+    let palette = [[255, 0, 0], [0, 255, 0], [255, 0, 0], [0, 0, 255]];
+    for transparent in [0, 2] {
+        let png = photocraft_codecs::encode_png_indexed(4, 1, &[0, 1, 2, 3], &palette, Some(transparent), None).unwrap();
+        let d = photocraft_io::import("in.png", &png).unwrap().document;
+        assert_eq!(d.mode, ColorMode::Indexed);
+        let before = d.color_table.clone();
+        let r = photocraft_io::export(&d, "out.png", &Default::default()).unwrap();
+        let table = photocraft_codecs::png_palette(&r.bytes).unwrap().unwrap();
+        assert_eq!(table.colors, palette, "palette order must not change");
+        assert_eq!(table.transparent, Some(transparent));
+        assert_eq!(photocraft_codecs::decode(&r.bytes).unwrap().data(), photocraft_codecs::decode(&png).unwrap().data());
+        let back = photocraft_io::import("out.png", &r.bytes).unwrap().document;
+        assert_eq!(back.color_table, before);
+        assert_eq!(d.color_table, before, "export must not edit the document's table");
+        for x in 0..4 {
+            assert_eq!(back.layers[0].surface().unwrap().rgba(x, 0)[3], if x == i32::from(transparent) { 0.0 } else { 1.0 });
+        }
+    }
+}
+
+#[test]
+fn indexed_png_uses_the_nearest_opaque_color() {
+    for depth in [SampleType::U8, SampleType::U16, SampleType::F32] {
+        for transparent in [0, 1, 2] {
+            let mut palette = vec![[0, 0, 255], [255, 128, 0]];
+            palette.insert(usize::from(transparent), [255, 0, 0]);
+            let mut d = Document::with_background("m", Size::new(1, 1), ColorMode::Rgb, depth, Color::rgba(1.0, 0.0, 0.0, 1.0));
+            d.mode = ColorMode::Indexed;
+            d.color_table = Some(ColorTable { colors: palette.clone(), transparent: Some(transparent) });
+            let r = photocraft_io::export(&d, "out.png", &Default::default()).unwrap();
+            let image = photocraft_codecs::decode(&r.bytes).unwrap();
+            assert_eq!(image.data(), &[255, 128, 0, 255], "{depth:?}, transparent = {transparent}");
+            let table = photocraft_codecs::png_palette(&r.bytes).unwrap().unwrap();
+            assert_eq!(table.colors, palette);
+            assert_eq!(table.transparent, Some(transparent));
+        }
+    }
+}
+
+#[test]
+fn indexed_png_breaks_opaque_color_ties_in_palette_order() {
+    // Both opaque entries are equally far from magenta; the transparent entry is an exact
+    // match. Filtering transparency must still choose the earlier original opaque entry.
+    for opaque in [[[255, 0, 0], [0, 0, 255]], [[0, 0, 255], [255, 0, 0]]] {
+        let mut d = Document::with_background("m", Size::new(1, 1), ColorMode::Rgb, SampleType::U8, Color::rgba(1.0, 0.0, 1.0, 1.0));
+        d.mode = ColorMode::Indexed;
+        d.color_table = Some(ColorTable { colors: vec![[255, 0, 255], opaque[0], opaque[1]], transparent: Some(0) });
+        let r = photocraft_io::export(&d, "out.png", &Default::default()).unwrap();
+        let image = photocraft_codecs::decode(&r.bytes).unwrap();
+        assert_eq!(image.data(), &[opaque[0][0], opaque[0][1], opaque[0][2], 255]);
+    }
+}
+
+#[test]
+fn indexed_png_keeps_the_alpha_threshold() {
+    for depth in [SampleType::U8, SampleType::U16, SampleType::F32] {
+        let mut d = Document::with_background("m", Size::new(3, 1), ColorMode::Rgb, depth, Color::rgba(1.0, 0.0, 0.0, 1.0));
+        d.mode = ColorMode::Indexed;
+        d.color_table = Some(ColorTable { colors: vec![[255, 0, 0], [255, 0, 0]], transparent: Some(0) });
+        let surface = d.layers[0].surface_mut().unwrap();
+        surface.write_pixel(0, 0, &[1.0, 0.0, 0.0, 0.49]);
+        surface.write_pixel(1, 0, &[1.0, 0.0, 0.0, 0.5]);
+        let r = photocraft_io::export(&d, "out.png", &Default::default()).unwrap();
+        assert_eq!(photocraft_codecs::decode(&r.bytes).unwrap().data(), &[255, 0, 0, 0, 255, 0, 0, 255, 255, 0, 0, 255], "{depth:?}");
+    }
+}
+
+#[test]
+fn indexed_png_keeps_the_last_palette_index() {
+    let mut palette = vec![[0, 0, 255]; 256];
+    palette[0] = [255, 0, 0];
+    palette[255] = [255, 0, 0];
+    for transparent in [0, 255] {
+        let png = photocraft_codecs::encode_png_indexed(2, 1, &[0, 255], &palette, Some(transparent), None).unwrap();
+        let d = photocraft_io::import("in.png", &png).unwrap().document;
+        let r = photocraft_io::export(&d, "out.png", &Default::default()).unwrap();
+        assert_eq!(photocraft_codecs::png_palette(&r.bytes).unwrap(), photocraft_codecs::png_palette(&png).unwrap());
+        assert_eq!(photocraft_codecs::decode(&r.bytes).unwrap().data(), photocraft_codecs::decode(&png).unwrap().data());
+    }
+}
+
+#[test]
+fn indexed_png_keeps_a_single_transparent_entry() {
+    let png = photocraft_codecs::encode_png_indexed(2, 1, &[0, 0], &[[255, 0, 0]], Some(0), None).unwrap();
+    let d = photocraft_io::import("in.png", &png).unwrap().document;
+    let r = photocraft_io::export(&d, "out.png", &Default::default()).unwrap();
+    assert_eq!(photocraft_codecs::png_palette(&r.bytes).unwrap(), photocraft_codecs::png_palette(&png).unwrap());
+    assert_eq!(photocraft_codecs::decode(&r.bytes).unwrap().data(), photocraft_codecs::decode(&png).unwrap().data());
+}
+
+#[test]
+fn indexed_png_rejects_opaque_pixels_without_an_opaque_entry() {
+    let mut d = doc(ColorMode::Indexed);
+    d.color_table = Some(ColorTable { colors: vec![[255, 0, 0]], transparent: Some(0) });
+    let err = photocraft_io::export(&d, "out.png", &Default::default()).unwrap_err();
+    assert!(matches!(err, photocraft_io::IoError::Unsupported(_)), "{err}");
+    assert!(err.to_string().contains("no opaque entry"), "{err}");
+}
+
 #[test]
 fn duotone_exports_the_inks_as_rgb() {
     // Mid gray background.
diff --git a/crates/io/tests/psd_damaged_merged.rs b/crates/io/tests/psd_damaged_merged.rs
new file mode 100644
index 0000000000..e3d0970dd9
--- /dev/null
+++ b/crates/io/tests/psd_damaged_merged.rs
@@ -0,0 +1,125 @@
+//! #6152: intact layers can be recovered when only the merged preview is damaged.
+
+use photocraft_color::{ColorMode, SampleType};
+use photocraft_doc::{Document, Layer};
+use photocraft_geom::Size;
+use photocraft_io::{ExportOptions, export, import};
+use photocraft_psd::{Compression, GroupSpec, PsdBuilder, PsdFile};
+
+fn layered(depth: SampleType, extension: &str) -> PsdFile {
+    layered_in_mode(ColorMode::Rgb, depth, extension)
+}
+
+fn layered_in_mode(mode: ColorMode, depth: SampleType, extension: &str) -> PsdFile {
+    let mut doc = Document::new("recovery", Size::new(3, 2), mode, depth);
+    let format = doc.pixel_format();
+    let mut layer = Layer::raster("red pixels", doc.pixel_format());
+    let mut pixel = vec![0.0; format.channels()];
+    photocraft_raster::from_rgba_into(&format, [1.0, 0.0, 0.0, 1.0], &mut pixel);
+    layer.surface_mut().unwrap().fill_rect(doc.bounds(), &pixel);
+    doc.layers.push(layer);
+    PsdFile::from_bytes(&export(&doc, extension, &ExportOptions::default()).unwrap().bytes).unwrap()
+}
+
+#[test]
+fn truncated_merged_image_keeps_layer_pixels_at_every_depth_and_compression() {
+    use ColorMode::{Cmyk, Grayscale, Lab, Rgb};
+    use SampleType::{F32, U8, U16};
+    for extension in ["x.psd", "x.psb"] {
+        for (mode, depth) in
+            [(Rgb, U8), (Rgb, U16), (Rgb, F32), (Grayscale, U8), (Grayscale, U16), (Grayscale, F32), (Cmyk, U8), (Cmyk, U16), (Lab, U8), (Lab, U16)]
+        {
+            for compression in Compression::ALL {
+                let mut file = layered_in_mode(mode, depth, extension);
+                let intact = import(extension, &file.to_bytes().unwrap()).unwrap();
+                let expected = photocraft_compose::flatten(&intact.document).px;
+                let pixels = file.decode_merged().unwrap();
+                file.image_data = photocraft_psd::ImageData::encode(compression, &pixels, &file.header).unwrap();
+                file.image_data.data.truncate(file.image_data.data.len() / 2);
+                let bytes = file.to_bytes().unwrap();
+                assert!(PsdFile::from_bytes(&bytes).is_err(), "strict parsing stays strict");
+                let result = import(extension, &bytes).expect("recover the intact layers");
+                assert_eq!(result.document.layer_count(), 1);
+                assert_eq!(result.document.depth, depth);
+                assert!(result.warnings.iter().any(|w| w.contains("merged image")), "{:?}", result.warnings);
+                let rendered = photocraft_compose::flatten(&result.document);
+                assert_eq!(rendered.px, expected, "{extension} {mode:?} {depth:?} {compression:?}");
+                // Saving the recovered document replaces the bad preview with a valid one.
+                let saved = export(&result.document, extension, &ExportOptions::default()).unwrap();
+                assert!(PsdFile::from_bytes(&saved.bytes).unwrap().decode_merged().is_ok());
+            }
+        }
+    }
+}
+
+#[test]
+fn corrupt_zip_merged_image_keeps_the_layers() {
+    let mut file = layered(SampleType::U8, "x.psd");
+    file.image_data = photocraft_psd::ImageData::encode(Compression::Zip, &file.decode_merged().unwrap(), &file.header).unwrap();
+    *file.image_data.data.last_mut().unwrap() ^= 0xff;
+    let result = import("x.psd", &file.to_bytes().unwrap()).unwrap();
+    assert_eq!(result.document.layer_count(), 1);
+    assert!(result.warnings.iter().any(|w| w.contains("merged image")));
+}
+
+#[test]
+fn an_empty_group_survives_a_truncated_preview() {
+    // The reported psd-tools fixture has only the two records of an empty group.
+    let mut builder = PsdBuilder::new(100, 100);
+    builder.begin_group(GroupSpec::new("empty group"));
+    builder.end_group().unwrap();
+    let mut file = builder.build().unwrap();
+    file.image_data.data.truncate(file.image_data.data.len() / 2);
+    let result = import("empty.psd", &file.to_bytes().unwrap()).unwrap();
+    assert_eq!(result.document.layer_count(), 1);
+    assert_eq!(result.document.layers[0].name, "empty group");
+    assert!(result.warnings.iter().any(|w| w.contains("merged image")));
+}
+
+#[test]
+fn a_flattened_file_with_no_recoverable_layers_still_fails() {
+    let mut file = layered(SampleType::U8, "x.psd");
+    file.layer_info = None;
+    file.image_data.data.truncate(file.image_data.data.len() / 2);
+    assert!(import("flat.psd", &file.to_bytes().unwrap()).is_err());
+}
+
+#[test]
+fn modes_imported_flattened_do_not_recover_from_unusable_layer_records() {
+    for mode in [photocraft_psd::ColorMode::Indexed, photocraft_psd::ColorMode::Multichannel, photocraft_psd::ColorMode::Duotone] {
+        let mut file = layered(SampleType::U8, "x.psd");
+        file.header.color_mode = mode;
+        file.image_data = photocraft_psd::ImageData { compression: Compression::Raw, data: Vec::new() };
+        assert!(import("flat-mode.psd", &file.to_bytes().unwrap()).is_err(), "{mode:?}");
+    }
+}
+
+#[test]
+fn lost_extra_channels_are_reported_while_layers_remain_usable() {
+    let mut file = layered(SampleType::U8, "x.psd");
+    file.header.channels = 5;
+    file.image_data = photocraft_psd::ImageData { compression: Compression::Raw, data: Vec::new() };
+    let result = import("extra-channel.psd", &file.to_bytes().unwrap()).unwrap();
+    assert_eq!(result.document.layer_count(), 1);
+    assert!(result.document.channels.is_empty());
+    assert!(result.warnings.iter().any(|w| w.contains("alpha/spot channels")), "{:?}", result.warnings);
+}
+
+#[test]
+fn truncated_layer_sections_are_not_recovered() {
+    let file = layered(SampleType::U8, "x.psd");
+    let mut bytes = file.to_bytes().unwrap();
+    bytes.truncate(bytes.len() - file.image_data.data.len() - 3);
+    assert!(import("broken-layers.psd", &bytes).is_err());
+}
+
+#[cfg(feature = "corpus")]
+#[test]
+fn reported_group_divider_fixture_opens_with_its_group() {
+    let path = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../corpus/psd-tools/blend-modes/group-divider-blend-mode.psd");
+    let bytes = std::fs::read(path).expect("run cargo xtask corpus --psd-tools");
+    let result = import("group-divider-blend-mode.psd", &bytes).expect("#6152 opens");
+    assert_eq!(result.document.layer_count(), 1);
+    assert!(matches!(result.document.layers[0].content, photocraft_doc::LayerContent::Group(_)));
+    assert!(result.warnings.iter().any(|w| w.contains("merged image")));
+}
diff --git a/crates/io/tests/svg.rs b/crates/io/tests/svg.rs
index d1baf418fa..4f21bd5dcb 100644
--- a/crates/io/tests/svg.rs
+++ b/crates/io/tests/svg.rs
@@ -221,6 +221,57 @@ fn text_becomes_outline_shapes_or_warns_without_a_font() {
     assert!(dark > 4, "glyph strokes cross the middle row: {dark}");
 }
 
+/// #4806: text placed by a `transform` (Illustrator writes `matrix(1 0 0 1 x y)` on every text
+/// element), on the text or on a group around it, lands where resvg draws it. usvg leaves the
+/// glyph outlines' absolute transforms at identity, so reading them dropped the transform: the
+/// text went off the canvas or kept its untransformed place and size.
+#[test]
+fn transformed_text_lands_where_resvg_draws_it() {
+    let font = "font-size=\"24\" font-family=\"DejaVu Sans, Arial, Helvetica, sans-serif\" fill=\"black\"";
+    let cases = [
+        format!("<text transform=\"translate(10 40)\" {font}>IHI</text>"),
+        format!("<text transform=\"matrix(1 0 0 1 10 40)\" {font}>IHI</text>"),
+        format!("<text transform=\"translate(10 0)\" x=\"20\" y=\"40\" {font}>IHI</text>"),
+        format!("<text transform=\"scale(2)\" x=\"5\" y=\"25\" {font}>IHI</text>"),
+        format!("<g transform=\"translate(10 40)\"><text {font}>IHI</text></g>"),
+        format!("<g transform=\"translate(60 0)\"><g transform=\"rotate(90)\"><text x=\"5\" y=\"20\" {font}>IHI</text></g></g>"),
+    ];
+    for c in cases {
+        let svg = format!("<svg {NS} width=\"120\" height=\"60\">{c}</svg>");
+        let r = open(&svg);
+        let d = &r.document;
+        if d.layers.is_empty() {
+            // No font at all on this machine: the import says so instead.
+            assert!(r.warnings.iter().any(|w| w.contains("font")), "{:?}", r.warnings);
+            return;
+        }
+        assert!(matches!(d.layers[0].content, LayerContent::Group(_)), "text stays outline shapes: {c}");
+        let imported = photocraft_compose::flatten(d);
+        let reference = svg::rasterize(svg.as_bytes(), 1.0).unwrap();
+        let (mut both, mut either) = (0usize, 0usize);
+        let (mut a_box, mut b_box) = ([i32::MAX, i32::MAX, i32::MIN, i32::MIN], [i32::MAX, i32::MAX, i32::MIN, i32::MIN]);
+        let grow = |bx: &mut [i32; 4], x: i32, y: i32| *bx = [bx[0].min(x), bx[1].min(y), bx[2].max(x), bx[3].max(y)];
+        for y in 0..60 {
+            for x in 0..120 {
+                let (a, b) = (imported.get(x, y)[3] > 0.5, reference.get(x, y)[3] > 0.5);
+                if a {
+                    grow(&mut a_box, x, y);
+                }
+                if b {
+                    grow(&mut b_box, x, y);
+                }
+                both += usize::from(a && b);
+                either += usize::from(a || b);
+            }
+        }
+        assert!(either > 50, "resvg draws the text on the canvas: {c}");
+        // Same place and size to the pixel; the outlines are filled by a different rasteriser, so
+        // the edges of thin stems may differ by half a pixel.
+        assert!(a_box.iter().zip(b_box).all(|(a, b)| (a - b).abs() <= 1), "imported {a_box:?}, resvg {b_box:?}: {c}");
+        assert!(both * 10 >= either * 7, "imported glyphs cover what resvg draws ({both} of {either} px): {c}");
+    }
+}
+
 #[test]
 fn size_comes_from_the_viewbox_and_huge_drawings_shrink_to_fit() {
     let r = open(&format!("<svg {NS} viewBox=\"0 0 300 150\"><rect width=\"300\" height=\"150\"/></svg>"));
diff --git a/crates/io/tests/text_corpus.rs b/crates/io/tests/text_corpus.rs
index a2efe1aec7..8597ac49d8 100644
--- a/crates/io/tests/text_corpus.rs
+++ b/crates/io/tests/text_corpus.rs
@@ -169,7 +169,7 @@ fn corpus_photoshop_txt2_survives_an_unedited_save() {
     println!("Txt2 kept byte-for-byte in {checked} Photoshop type files");
 }
 
-/// A text layer created in Photocraft (no PSD data) exports as an editable type layer and
+/// A text layer created in PhotoCraft (no PSD data) exports as an editable type layer and
 /// imports back with the same model.
 #[test]
 fn created_text_layer_roundtrips_through_psd() {
diff --git a/crates/ipp/Cargo.toml b/crates/ipp/Cargo.toml
new file mode 100644
index 0000000000..cc9f6aec31
--- /dev/null
+++ b/crates/ipp/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "photocraft-ipp"
+description = "A small IPP client for CUPS (list printers, default printer, print a PDF), pure Rust, no dependencies"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+
+[lints]
+workspace = true
diff --git a/crates/ipp/README.md b/crates/ipp/README.md
new file mode 100644
index 0000000000..a6c03d1113
--- /dev/null
+++ b/crates/ipp/README.md
@@ -0,0 +1,22 @@
+# photocraft-ipp
+
+A small IPP (Internet Printing Protocol, RFC 8010/8011) client for the local CUPS server, in pure
+Rust with no dependencies. It does in-process what `lp` does from the command line, so PhotoCraft
+can print where there is no `lp` binary (a Flatpak sandbox with `--socket=cups`, a minimal
+container) and can read the printer list and the default printer first instead of handing
+CUPS's errors to the user.
+
+```rust
+let ep = photocraft_ipp::Endpoint::detect().ok_or("no CUPS server")?;   // socket, then localhost:631
+let printers = photocraft_ipp::printers(&ep)?;                            // name, info, state, default
+let id = photocraft_ipp::print_job(&ep, &photocraft_ipp::Job { printer: "Office", title: "photo", user: "me", copies: 2, document: &pdf, format: "application/pdf" })?;
+```
+
+Three operations: `CUPS-Get-Printers`, `CUPS-Get-Default`, `Print-Job`. HTTP/1.1 over the CUPS
+domain socket (`/run/cups/cups.sock`, or `CUPS_SERVER` as a path) or TCP (`localhost:631`, or
+`CUPS_SERVER` as `host[:port]`), chunked replies included. Replies are capped at 16 MiB and
+parsed with bounds checks; an IPP error status becomes `Error::Status` with the server's own
+message. Tests run against an in-process fake server over TCP and a Unix socket.
+
+Standalone: it depends on no other PhotoCraft crate. Used by `photocraft-engine`'s print
+commands on Unix; Windows printing lives in `photocraft-winprint`.
diff --git a/crates/ipp/src/lib.rs b/crates/ipp/src/lib.rs
new file mode 100644
index 0000000000..9f1209df45
--- /dev/null
+++ b/crates/ipp/src/lib.rs
@@ -0,0 +1,600 @@
+//! `photocraft-ipp`: a small IPP client for CUPS, in pure Rust with no dependencies.
+//!
+//! Talks to the local print server the way `lp` does, but in-process: over the CUPS domain
+//! socket (`/run/cups/cups.sock`, or `CUPS_SERVER` when it names a path) or TCP (`localhost:631`,
+//! or `CUPS_SERVER` as `host[:port]`). Three operations, from RFC 8010 / 8011 and CUPS's own
+//! extensions: list the printers, read the default, and submit a PDF as a job.
+//!
+//! Never panics: every read is bounded and every malformed reply is an error. Works on any Unix
+//! and on Windows for TCP (CUPS rarely runs there; the Windows print path is separate).
+
+#![forbid(unsafe_code)]
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+use std::io::{Read, Write};
+use std::net::{TcpStream, ToSocketAddrs};
+use std::path::PathBuf;
+use std::time::Duration;
+
+/// Where the print server listens.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Endpoint {
+    /// A Unix domain socket (CUPS's default, also what a Flatpak sees with `--socket=cups`).
+    Unix(PathBuf),
+    /// A TCP host and port.
+    Tcp(String, u16),
+}
+
+/// Why a request failed.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Error {
+    /// No server could be reached.
+    Unreachable(String),
+    /// The HTTP or IPP reply could not be read.
+    Protocol(String),
+    /// The server answered with an IPP error status (the code and its message).
+    Status(u16, String),
+}
+
+impl std::fmt::Display for Error {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Error::Unreachable(m) => write!(f, "no print server: {m}"),
+            Error::Protocol(m) => write!(f, "print server reply: {m}"),
+            Error::Status(code, m) => write!(f, "print server refused ({code:#06x}): {m}"),
+        }
+    }
+}
+
+impl std::error::Error for Error {}
+
+type Result<T> = std::result::Result<T, Error>;
+
+/// A printer the server knows.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Printer {
+    pub name: String,
+    /// `printer-info`, the human description.
+    pub info: String,
+    /// `printer-state`: 3 idle, 4 printing, 5 stopped.
+    pub state: u32,
+    pub accepting_jobs: bool,
+    pub is_default: bool,
+    /// A CUPS class (a pool of printers) rather than one printer.
+    pub is_class: bool,
+}
+
+/// Timeouts: connecting, and each request (a Print-Job carries the whole PDF).
+const CONNECT: Duration = Duration::from_secs(3);
+const REQUEST: Duration = Duration::from_secs(60);
+/// Largest reply read.
+const MAX_REPLY: usize = 16 << 20;
+/// Largest number of attributes taken from a reply.
+const MAX_ATTRIBUTES: usize = 100_000;
+
+pub const OP_PRINT_JOB: u16 = 0x0002;
+pub const OP_CUPS_GET_DEFAULT: u16 = 0x4001;
+pub const OP_CUPS_GET_PRINTERS: u16 = 0x4002;
+pub const OP_CUPS_GET_CLASSES: u16 = 0x4005;
+
+pub const TAG_OPERATION_GROUP: u8 = 0x01;
+pub const TAG_JOB_GROUP: u8 = 0x02;
+pub const TAG_END: u8 = 0x03;
+pub const TAG_PRINTER_GROUP: u8 = 0x04;
+pub const TAG_INTEGER: u8 = 0x21;
+pub const TAG_BOOLEAN: u8 = 0x22;
+pub const TAG_ENUM: u8 = 0x23;
+pub const TAG_TEXT: u8 = 0x41;
+pub const TAG_NAME: u8 = 0x42;
+pub const TAG_KEYWORD: u8 = 0x44;
+pub const TAG_URI: u8 = 0x45;
+pub const TAG_CHARSET: u8 = 0x47;
+pub const TAG_LANGUAGE: u8 = 0x48;
+pub const TAG_MIME: u8 = 0x49;
+
+impl Endpoint {
+    /// The server this machine uses: `CUPS_SERVER` (a socket path, or `host[:port]`), else the
+    /// CUPS socket, else `localhost:631`. `None` when nothing answers.
+    pub fn detect() -> Option<Endpoint> {
+        if let Some(server) = std::env::var_os("CUPS_SERVER").filter(|v| !v.is_empty()) {
+            let ep = Endpoint::parse(&server.to_string_lossy());
+            return ep.reachable().then_some(ep);
+        }
+        [
+            Endpoint::Unix(PathBuf::from("/run/cups/cups.sock")),
+            Endpoint::Unix(PathBuf::from("/var/run/cups/cups.sock")),
+            // macOS
+            Endpoint::Unix(PathBuf::from("/private/var/run/cupsd")),
+            Endpoint::Tcp("localhost".into(), 631),
+        ]
+        .into_iter()
+        .find(Endpoint::reachable)
+    }
+
+    /// `server` as a socket path (starts with `/`) or `host[:port]` (port 631 by default).
+    pub fn parse(server: &str) -> Endpoint {
+        if server.starts_with('/') {
+            return Endpoint::Unix(PathBuf::from(server));
+        }
+        let (host, port) = server.rsplit_once(':').and_then(|(h, p)| p.parse().ok().map(|p| (h.to_string(), p))).unwrap_or((server.to_string(), 631));
+        Endpoint::Tcp(host, port)
+    }
+
+    /// Whether a connection opens.
+    pub fn reachable(&self) -> bool {
+        self.connect().is_ok()
+    }
+
+    fn connect(&self) -> Result<Stream> {
+        match self {
+            #[cfg(unix)]
+            Endpoint::Unix(path) => {
+                if !path.exists() {
+                    return Err(Error::Unreachable(format!("{} does not exist", path.display())));
+                }
+                let s = std::os::unix::net::UnixStream::connect(path).map_err(|e| Error::Unreachable(format!("{}: {e}", path.display())))?;
+                let _ = s.set_read_timeout(Some(REQUEST));
+                let _ = s.set_write_timeout(Some(REQUEST));
+                Ok(Stream::Unix(s))
+            }
+            #[cfg(not(unix))]
+            Endpoint::Unix(path) => Err(Error::Unreachable(format!("{}: Unix sockets are not available here", path.display()))),
+            Endpoint::Tcp(host, port) => {
+                let addr = (host.as_str(), *port).to_socket_addrs().map_err(|e| Error::Unreachable(format!("{host}:{port}: {e}")))?.next();
+                let addr = addr.ok_or_else(|| Error::Unreachable(format!("{host}:{port}: no address")))?;
+                let s = TcpStream::connect_timeout(&addr, CONNECT).map_err(|e| Error::Unreachable(format!("{host}:{port}: {e}")))?;
+                let _ = s.set_read_timeout(Some(REQUEST));
+                let _ = s.set_write_timeout(Some(REQUEST));
+                Ok(Stream::Tcp(s))
+            }
+        }
+    }
+
+    fn host(&self) -> String {
+        match self {
+            Endpoint::Unix(_) => "localhost".into(),
+            Endpoint::Tcp(host, port) => format!("{host}:{port}"),
+        }
+    }
+}
+
+impl std::fmt::Display for Endpoint {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Endpoint::Unix(p) => write!(f, "{}", p.display()),
+            Endpoint::Tcp(h, p) => write!(f, "{h}:{p}"),
+        }
+    }
+}
+
+enum Stream {
+    #[cfg(unix)]
+    Unix(std::os::unix::net::UnixStream),
+    Tcp(TcpStream),
+}
+
+impl Read for Stream {
+    fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
+        match self {
+            #[cfg(unix)]
+            Stream::Unix(s) => s.read(buf),
+            Stream::Tcp(s) => s.read(buf),
+        }
+    }
+}
+
+impl Write for Stream {
+    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+        match self {
+            #[cfg(unix)]
+            Stream::Unix(s) => s.write(buf),
+            Stream::Tcp(s) => s.write(buf),
+        }
+    }
+    fn flush(&mut self) -> std::io::Result<()> {
+        match self {
+            #[cfg(unix)]
+            Stream::Unix(s) => s.flush(),
+            Stream::Tcp(s) => s.flush(),
+        }
+    }
+}
+
+/// Builds an IPP request body.
+pub struct Request {
+    buf: Vec<u8>,
+}
+
+impl Request {
+    pub fn new(op: u16, id: u32) -> Self {
+        let mut buf = vec![2, 0];
+        buf.extend_from_slice(&op.to_be_bytes());
+        buf.extend_from_slice(&id.to_be_bytes());
+        buf.push(TAG_OPERATION_GROUP);
+        let mut r = Request { buf };
+        r.attr(TAG_CHARSET, "attributes-charset", b"utf-8");
+        r.attr(TAG_LANGUAGE, "attributes-natural-language", b"en");
+        r
+    }
+
+    /// Appends an attribute to the current group.
+    pub fn attr(&mut self, tag: u8, name: &str, value: &[u8]) {
+        // IPP lengths are 16-bit; longer names and values are cut, both the length and the bytes.
+        let name = name.as_bytes().get(..name.len().min(0xffff)).unwrap_or_default();
+        let value = value.get(..value.len().min(0xffff)).unwrap_or_default();
+        self.buf.push(tag);
+        self.buf.extend_from_slice(&(name.len() as u16).to_be_bytes());
+        self.buf.extend_from_slice(name);
+        self.buf.extend_from_slice(&(value.len() as u16).to_be_bytes());
+        self.buf.extend_from_slice(value);
+    }
+
+    /// An attribute with several values (the extra ones carry an empty name).
+    pub fn attr_many(&mut self, tag: u8, name: &str, values: &[&str]) {
+        for (i, v) in values.iter().enumerate() {
+            self.attr(tag, if i == 0 { name } else { "" }, v.as_bytes());
+        }
+    }
+
+    pub fn integer(&mut self, name: &str, v: i32) {
+        self.attr(TAG_INTEGER, name, &v.to_be_bytes());
+    }
+
+    /// Starts a new attribute group.
+    pub fn group(&mut self, tag: u8) {
+        self.buf.push(tag);
+    }
+
+    /// The message with its end tag.
+    pub fn end(mut self) -> Vec<u8> {
+        self.buf.push(TAG_END);
+        self.buf
+    }
+}
+
+/// One attribute of a reply: the group it sits in, its tag, name and values.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Attribute {
+    pub group: u8,
+    pub tag: u8,
+    pub name: String,
+    pub values: Vec<Vec<u8>>,
+}
+
+impl Attribute {
+    /// The first value as text.
+    pub fn text(&self) -> String {
+        self.values.first().map(|v| String::from_utf8_lossy(v).into_owned()).unwrap_or_default()
+    }
+    /// The first value as a big-endian integer.
+    pub fn int(&self) -> Option<i32> {
+        self.values.first().and_then(|v| <[u8; 4]>::try_from(v.as_slice()).ok()).map(i32::from_be_bytes)
+    }
+}
+
+/// A decoded reply.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Reply {
+    pub status: u16,
+    pub request_id: u32,
+    pub attributes: Vec<Attribute>,
+}
+
+impl Reply {
+    /// Parses an IPP message (RFC 8010 §3): header, then groups of attributes until the end tag.
+    pub fn parse(b: &[u8]) -> Result<Reply> {
+        Self::parse_at(b).map(|(r, _)| r)
+    }
+
+    /// Parses a message and returns where its attributes end (document data may follow).
+    fn parse_at(b: &[u8]) -> Result<(Reply, usize)> {
+        let bad = |m: &str| Error::Protocol(m.to_string());
+        if b.len() < 9 {
+            return Err(bad("reply shorter than an IPP header"));
+        }
+        let status = u16::from_be_bytes([b[2], b[3]]);
+        let request_id = u32::from_be_bytes([b[4], b[5], b[6], b[7]]);
+        let mut pos = 8;
+        let mut group = 0u8;
+        let mut attributes: Vec<Attribute> = Vec::new();
+        loop {
+            let tag = *b.get(pos).ok_or_else(|| bad("reply ends before the end-of-attributes tag"))?;
+            pos += 1;
+            if tag == TAG_END {
+                return Ok((Reply { status, request_id, attributes }, pos));
+            }
+            if tag < 0x10 {
+                group = tag;
+                continue;
+            }
+            let name_len =
+                usize::from(u16::from_be_bytes([*b.get(pos).ok_or_else(|| bad("cut attribute"))?, *b.get(pos + 1).ok_or_else(|| bad("cut attribute"))?]));
+            pos += 2;
+            let name = b.get(pos..pos + name_len).ok_or_else(|| bad("cut attribute name"))?;
+            pos += name_len;
+            let value_len =
+                usize::from(u16::from_be_bytes([*b.get(pos).ok_or_else(|| bad("cut attribute"))?, *b.get(pos + 1).ok_or_else(|| bad("cut attribute"))?]));
+            pos += 2;
+            let value = b.get(pos..pos + value_len).ok_or_else(|| bad("cut attribute value"))?.to_vec();
+            pos += value_len;
+            if name_len == 0 {
+                // An additional value of the previous attribute.
+                match attributes.last_mut() {
+                    Some(last) if last.group == group => last.values.push(value),
+                    _ => return Err(bad("an additional value with no attribute before it")),
+                }
+            } else {
+                attributes.push(Attribute { group, tag, name: String::from_utf8_lossy(name).into_owned(), values: vec![value] });
+            }
+            if attributes.len() > MAX_ATTRIBUTES {
+                return Err(bad("too many attributes"));
+            }
+        }
+    }
+
+    /// The server's own message for an error status, or a name for the code.
+    fn status_message(&self) -> String {
+        self.attributes.iter().find(|a| a.name == "status-message").map(Attribute::text).filter(|m| !m.is_empty()).unwrap_or_else(|| {
+            match self.status {
+                0x0400 => "bad request",
+                0x0401 => "forbidden",
+                0x0402 => "not authenticated",
+                0x0403 => "not authorized",
+                0x0406 => "not found",
+                0x0409 => "unsupported document format",
+                0x0500 => "internal server error",
+                0x0506 => "the printer is not accepting jobs",
+                _ => "error",
+            }
+            .to_string()
+        })
+    }
+}
+
+/// POSTs `body` (IPP, with any document data after it) to `path` and returns the reply.
+fn post(endpoint: &Endpoint, path: &str, body: &[u8]) -> Result<Reply> {
+    let mut stream = endpoint.connect()?;
+    let head = format!(
+        "POST {path} HTTP/1.1\r\nHost: {}\r\nContent-Type: application/ipp\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+        endpoint.host(),
+        body.len()
+    );
+    stream
+        .write_all(head.as_bytes())
+        .and_then(|()| stream.write_all(body))
+        .and_then(|()| stream.flush())
+        .map_err(|e| Error::Protocol(format!("sending: {e}")))?;
+    let raw = read_response(&mut stream)?;
+    let (status, headers, body) = http_response(&raw)?;
+    if status != 200 {
+        return Err(Error::Protocol(match status {
+            401 => "the print server asks for authentication (HTTP 401)".to_string(),
+            403 => "the print server forbids this request (HTTP 403)".to_string(),
+            s => format!("HTTP {s}"),
+        }));
+    }
+    let body = if headers.iter().any(|(k, v)| k == "transfer-encoding" && v.contains("chunked")) { dechunk(body)? } else { body.to_vec() };
+    let reply = Reply::parse(&body)?;
+    if reply.status >= 0x0400 {
+        return Err(Error::Status(reply.status, reply.status_message()));
+    }
+    Ok(reply)
+}
+
+/// Lowercase HTTP headers.
+type Headers = Vec<(String, String)>;
+
+/// Reads one HTTP response: the headers, then as much body as `Content-Length` says, or up to
+/// the last chunk, or to the end of the stream when the server says neither. A server that keeps
+/// the connection open would otherwise hold the reply until the read times out.
+fn read_response(stream: &mut Stream) -> Result<Vec<u8>> {
+    let mut raw = Vec::new();
+    let mut buf = [0u8; 16 * 1024];
+    let mut body_at = None;
+    let mut expected: Option<usize> = None;
+    let mut chunked = false;
+    loop {
+        let n = stream.read(&mut buf).map_err(|e| Error::Protocol(format!("reading: {e}")))?;
+        if n == 0 {
+            return Ok(raw);
+        }
+        raw.extend_from_slice(buf.get(..n).unwrap_or_default());
+        if raw.len() > MAX_REPLY {
+            return Err(Error::Protocol("the reply is larger than 16 MiB".into()));
+        }
+        if body_at.is_none()
+            && let Some(end) = raw.windows(4).position(|w| w == b"\r\n\r\n")
+        {
+            body_at = Some(end + 4);
+            let (_, headers, _) = http_response(&raw)?;
+            expected = headers.iter().find(|(k, _)| k == "content-length").and_then(|(_, v)| v.parse().ok());
+            chunked = headers.iter().any(|(k, v)| k == "transfer-encoding" && v.contains("chunked"));
+        }
+        let Some(at) = body_at else { continue };
+        let body = raw.get(at..).unwrap_or_default();
+        let complete = match expected {
+            Some(len) if !chunked => body.len() >= len,
+            _ if chunked => chunked_complete(body),
+            _ => false,
+        };
+        if complete {
+            if let Some(len) = expected.filter(|_| !chunked) {
+                raw.truncate(at + len);
+            }
+            return Ok(raw);
+        }
+    }
+}
+
+/// Splits an HTTP/1.1 response into status, lowercase headers and body.
+fn http_response(raw: &[u8]) -> Result<(u16, Headers, &[u8])> {
+    let end = raw.windows(4).position(|w| w == b"\r\n\r\n").ok_or_else(|| Error::Protocol("no HTTP header".into()))?;
+    let head = String::from_utf8_lossy(raw.get(..end).unwrap_or(&[]));
+    let mut lines = head.split("\r\n");
+    let status_line = lines.next().unwrap_or_default();
+    let status: u16 =
+        status_line.split_whitespace().nth(1).and_then(|s| s.parse().ok()).ok_or_else(|| Error::Protocol(format!("bad status line `{status_line}`")))?;
+    let headers = lines.filter_map(|l| l.split_once(':')).map(|(k, v)| (k.trim().to_ascii_lowercase(), v.trim().to_ascii_lowercase())).collect();
+    Ok((status, headers, raw.get(end + 4..).unwrap_or(&[])))
+}
+
+/// Whether a chunked body has reached its last (zero-size) chunk, walking the chunk sizes so a
+/// `0\r\n\r\n` inside a chunk's payload (an attribute value can hold it) does not count. A
+/// malformed or impossible size counts as complete, so [`dechunk`] reports it instead of
+/// waiting for more.
+fn chunked_complete(mut b: &[u8]) -> bool {
+    loop {
+        let Some(line_end) = b.windows(2).position(|w| w == b"\r\n") else { return false };
+        let size_str = String::from_utf8_lossy(b.get(..line_end).unwrap_or(&[]));
+        let Ok(size) = usize::from_str_radix(size_str.split(';').next().unwrap_or_default().trim(), 16) else { return true };
+        b = b.get(line_end + 2..).unwrap_or(&[]);
+        if size == 0 {
+            return true;
+        }
+        // A size past the reply cap can never be satisfied: complete, so `dechunk` rejects it
+        // (checked, so `ffffffffffffffff` cannot overflow the slice arithmetic).
+        let Some(end) = size.checked_add(2).filter(|_| size <= MAX_REPLY) else { return true };
+        let Some(rest) = b.get(end..) else { return false };
+        b = rest;
+    }
+}
+
+/// Joins the chunks of a chunked transfer encoding.
+fn dechunk(mut b: &[u8]) -> Result<Vec<u8>> {
+    let mut out = Vec::new();
+    loop {
+        let line_end = b.windows(2).position(|w| w == b"\r\n").ok_or_else(|| Error::Protocol("cut chunk size".into()))?;
+        let size_str = String::from_utf8_lossy(b.get(..line_end).unwrap_or(&[]));
+        let size = usize::from_str_radix(size_str.split(';').next().unwrap_or_default().trim(), 16).map_err(|_| Error::Protocol("bad chunk size".into()))?;
+        b = b.get(line_end + 2..).unwrap_or(&[]);
+        if size == 0 {
+            return Ok(out);
+        }
+        let chunk = b.get(..size).ok_or_else(|| Error::Protocol("cut chunk".into()))?;
+        out.extend_from_slice(chunk);
+        if out.len() > MAX_REPLY {
+            return Err(Error::Protocol("the reply is larger than 16 MiB".into()));
+        }
+        b = b.get(size + 2..).ok_or_else(|| Error::Protocol("cut chunk end".into()))?;
+    }
+}
+
+/// Where `/path` lands on the server: `/printers/<name>` or `/classes/<name>`.
+fn queue_path(name: &str, is_class: bool) -> String {
+    format!("/{}/{name}", if is_class { "classes" } else { "printers" })
+}
+
+/// The printers the server knows (CUPS-Get-Printers), then its classes (CUPS-Get-Classes, which
+/// `lp -d` accepts just the same), the default one flagged.
+pub fn printers(endpoint: &Endpoint) -> Result<Vec<Printer>> {
+    let mut out = queues(endpoint, OP_CUPS_GET_PRINTERS, false)?;
+    // A server without classes answers "not found"; an older server may not know the operation.
+    out.extend(queues(endpoint, OP_CUPS_GET_CLASSES, true).unwrap_or_default());
+    let default = default_printer(endpoint).unwrap_or(None);
+    for p in &mut out {
+        p.is_default = default.as_deref() == Some(p.name.as_str());
+    }
+    Ok(out)
+}
+
+fn queues(endpoint: &Endpoint, op: u16, is_class: bool) -> Result<Vec<Printer>> {
+    let mut r = Request::new(op, 1);
+    r.attr_many(TAG_KEYWORD, "requested-attributes", &["printer-name", "printer-info", "printer-state", "printer-is-accepting-jobs"]);
+    let reply = match post(endpoint, "/", &r.end()) {
+        Ok(reply) => reply,
+        // CUPS answers "not found" ("No destinations added.") when no printer is set up.
+        Err(Error::Status(0x0406, _)) => return Ok(Vec::new()),
+        Err(e) => return Err(e),
+    };
+    let mut out = Vec::new();
+    let mut current: Option<Printer> = None;
+    for a in reply.attributes.iter().filter(|a| a.group == TAG_PRINTER_GROUP) {
+        match a.name.as_str() {
+            "printer-name" => {
+                if let Some(p) = current.take() {
+                    out.push(p);
+                }
+                current = Some(Printer { name: a.text(), info: String::new(), state: 3, accepting_jobs: true, is_default: false, is_class });
+            }
+            "printer-info" => {
+                if let Some(p) = &mut current {
+                    p.info = a.text();
+                }
+            }
+            "printer-state" => {
+                if let Some(p) = &mut current {
+                    p.state = a.int().unwrap_or(3).clamp(0, 5) as u32;
+                }
+            }
+            "printer-is-accepting-jobs" => {
+                if let Some(p) = &mut current {
+                    p.accepting_jobs = a.values.first().is_none_or(|v| v.first() != Some(&0));
+                }
+            }
+            _ => {}
+        }
+    }
+    out.extend(current);
+    Ok(out)
+}
+
+/// The server's default printer (CUPS-Get-Default), `None` when there is none.
+pub fn default_printer(endpoint: &Endpoint) -> Result<Option<String>> {
+    let mut r = Request::new(OP_CUPS_GET_DEFAULT, 2);
+    r.attr_many(TAG_KEYWORD, "requested-attributes", &["printer-name"]);
+    match post(endpoint, "/", &r.end()) {
+        Ok(reply) => Ok(reply.attributes.iter().find(|a| a.name == "printer-name").map(Attribute::text).filter(|n| !n.is_empty())),
+        // CUPS answers "not found" when no default is set.
+        Err(Error::Status(0x0406, _)) => Ok(None),
+        Err(e) => Err(e),
+    }
+}
+
+/// What to print.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Job<'a> {
+    pub printer: &'a str,
+    /// `printer` names a class.
+    pub is_class: bool,
+    /// Shown in the queue.
+    pub title: &'a str,
+    pub user: &'a str,
+    pub copies: u32,
+    /// The document, as `format` (`application/pdf`).
+    pub document: &'a [u8],
+    pub format: &'a str,
+}
+
+/// Submits `job` (Print-Job) and returns the job id.
+pub fn print_job(endpoint: &Endpoint, job: &Job<'_>) -> Result<u32> {
+    let mut r = Request::new(OP_PRINT_JOB, 3);
+    let path = queue_path(job.printer, job.is_class);
+    r.attr(TAG_URI, "printer-uri", format!("ipp://{}{path}", endpoint.host()).as_bytes());
+    r.attr(TAG_NAME, "requesting-user-name", job.user.as_bytes());
+    r.attr(TAG_NAME, "job-name", job.title.as_bytes());
+    r.attr(TAG_MIME, "document-format", job.format.as_bytes());
+    if job.copies > 1 {
+        r.buf.push(TAG_JOB_GROUP);
+        r.integer("copies", job.copies.clamp(1, 999) as i32);
+    }
+    let mut body = r.end();
+    body.extend_from_slice(job.document);
+    let reply = post(endpoint, &path, &body)?;
+    reply
+        .attributes
+        .iter()
+        .find(|a| a.name == "job-id")
+        .and_then(Attribute::int)
+        .map(|id| id.max(0) as u32)
+        .ok_or_else(|| Error::Protocol("no job id in the reply".into()))
+}
+
+/// A request as a server sees it: the operation (the request's status field), its attributes
+/// and the document data after the end tag. For fakes in tests and tools.
+pub fn parse_request(b: &[u8]) -> Result<(u16, Vec<Attribute>, Vec<u8>)> {
+    let (reply, end) = Reply::parse_at(b)?;
+    Ok((reply.status, reply.attributes, b.get(end..).unwrap_or(&[]).to_vec()))
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/ipp/src/tests.rs b/crates/ipp/src/tests.rs
new file mode 100644
index 0000000000..ff3ccb6a49
--- /dev/null
+++ b/crates/ipp/src/tests.rs
@@ -0,0 +1,395 @@
+//! The client against an in-process fake CUPS: TCP and Unix socket, content-length and chunked
+//! replies, every operation, error statuses and broken replies.
+
+use super::*;
+use std::io::{BufRead, BufReader};
+use std::sync::mpsc;
+
+/// What the fake received: op, attributes, document.
+type Seen = (u16, Vec<Attribute>, Vec<u8>);
+
+/// A fake server answering one request with `reply_body` (IPP bytes), chunked or not, under an
+/// HTTP status. Returns the endpoint and a channel with what it received.
+fn fake(reply: Vec<u8>, chunked: bool, http_status: u16) -> (Endpoint, mpsc::Receiver<Seen>) {
+    let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+    let port = listener.local_addr().unwrap().port();
+    let (tx, rx) = mpsc::channel();
+    std::thread::spawn(move || {
+        let (stream, _) = listener.accept().unwrap();
+        serve(Stream::Tcp(stream), reply, chunked, http_status, &tx);
+    });
+    (Endpoint::Tcp("127.0.0.1".into(), port), rx)
+}
+
+fn serve(stream: Stream, reply: Vec<u8>, chunked: bool, http_status: u16, tx: &mpsc::Sender<Seen>) {
+    let mut reader = BufReader::new(stream);
+    let mut line = String::new();
+    let mut content_length = 0usize;
+    let mut first = String::new();
+    loop {
+        line.clear();
+        reader.read_line(&mut line).unwrap();
+        if first.is_empty() {
+            first = line.clone();
+        }
+        if line == "\r\n" || line.is_empty() {
+            break;
+        }
+        if let Some(v) = line.to_ascii_lowercase().strip_prefix("content-length:") {
+            content_length = v.trim().parse().unwrap();
+        }
+    }
+    if first.is_empty() {
+        return; // a reachability probe: connect and close
+    }
+    assert!(first.starts_with("POST "), "{first}");
+    let mut body = vec![0u8; content_length];
+    reader.read_exact(&mut body).unwrap();
+    let _ = tx.send(parse_request(&body).unwrap());
+    let mut out = reader.into_inner();
+    let status_text = if http_status == 200 { "OK" } else { "Nope" };
+    if chunked {
+        let mut resp = format!("HTTP/1.1 {http_status} {status_text}\r\nContent-Type: application/ipp\r\nTransfer-Encoding: chunked\r\n\r\n").into_bytes();
+        for chunk in reply.chunks(7) {
+            resp.extend_from_slice(format!("{:x}\r\n", chunk.len()).as_bytes());
+            resp.extend_from_slice(chunk);
+            resp.extend_from_slice(b"\r\n");
+        }
+        resp.extend_from_slice(b"0\r\n\r\n");
+        out.write_all(&resp).unwrap();
+    } else {
+        out.write_all(format!("HTTP/1.1 {http_status} {status_text}\r\nContent-Type: application/ipp\r\nContent-Length: {}\r\n\r\n", reply.len()).as_bytes())
+            .unwrap();
+        out.write_all(&reply).unwrap();
+    }
+    out.flush().unwrap();
+}
+
+/// An attribute to write: tag, name, values.
+type Attr<'a> = (u8, &'a str, &'a [&'a [u8]]);
+/// A group to write: tag and attributes.
+type Group<'a> = (u8, &'a [Attr<'a>]);
+
+/// An IPP reply body.
+fn ipp(status: u16, groups: &[Group<'_>]) -> Vec<u8> {
+    let mut b = vec![2, 0];
+    b.extend_from_slice(&status.to_be_bytes());
+    b.extend_from_slice(&1u32.to_be_bytes());
+    for (group, attrs) in groups {
+        b.push(*group);
+        for (tag, name, values) in *attrs {
+            for (i, v) in values.iter().enumerate() {
+                b.push(*tag);
+                let n = if i == 0 { name.as_bytes() } else { b"" };
+                b.extend_from_slice(&(n.len() as u16).to_be_bytes());
+                b.extend_from_slice(n);
+                b.extend_from_slice(&(v.len() as u16).to_be_bytes());
+                b.extend_from_slice(v);
+            }
+        }
+    }
+    b.push(TAG_END);
+    b
+}
+
+fn ok_header() -> Group<'static> {
+    (TAG_OPERATION_GROUP, &[(TAG_CHARSET, "attributes-charset", &[b"utf-8"]), (TAG_LANGUAGE, "attributes-natural-language", &[b"en"])])
+}
+
+#[test]
+fn printers_are_listed_with_state_and_default() {
+    let three = ipp(
+        0,
+        &[
+            ok_header(),
+            (
+                TAG_PRINTER_GROUP,
+                &[
+                    (TAG_NAME, "printer-name", &[b"Office"]),
+                    (TAG_TEXT, "printer-info", &[b"HP in the office"]),
+                    (TAG_ENUM, "printer-state", &[&3u32.to_be_bytes()]),
+                    (TAG_BOOLEAN, "printer-is-accepting-jobs", &[&[1]]),
+                ],
+            ),
+            (
+                TAG_PRINTER_GROUP,
+                &[
+                    (TAG_NAME, "printer-name", &[b"Stopped"]),
+                    (TAG_ENUM, "printer-state", &[&5u32.to_be_bytes()]),
+                    (TAG_BOOLEAN, "printer-is-accepting-jobs", &[&[0]]),
+                ],
+            ),
+        ],
+    );
+    for chunked in [false, true] {
+        let (ep, rx) = fake(three.clone(), chunked, 200);
+        // `printers` asks for the default too; that second request reaches a server that has
+        // closed, so the default is simply unknown here.
+        let list = printers(&ep).unwrap();
+        let (op, attrs, doc) = rx.recv().unwrap();
+        assert_eq!(op, OP_CUPS_GET_PRINTERS);
+        assert!(attrs.iter().any(|a| a.name == "requested-attributes" && a.values.len() == 4 && a.tag == TAG_KEYWORD));
+        assert!(doc.is_empty());
+        assert_eq!(list.len(), 2, "chunked {chunked}");
+        assert_eq!((list[0].name.as_str(), list[0].info.as_str(), list[0].state, list[0].accepting_jobs), ("Office", "HP in the office", 3, true));
+        assert_eq!((list[1].name.as_str(), list[1].state, list[1].accepting_jobs), ("Stopped", 5, false));
+        assert!(!list[0].is_default && !list[1].is_default);
+    }
+}
+
+#[test]
+fn default_printer_is_read_and_absence_is_not_an_error() {
+    let (ep, rx) = fake(ipp(0, &[ok_header(), (TAG_PRINTER_GROUP, &[(TAG_NAME, "printer-name", &[b"Office"])])]), false, 200);
+    assert_eq!(default_printer(&ep).unwrap(), Some("Office".into()));
+    assert_eq!(rx.recv().unwrap().0, OP_CUPS_GET_DEFAULT);
+    let (ep, _rx) = fake(ipp(0x0406, &[ok_header(), (TAG_OPERATION_GROUP, &[(TAG_TEXT, "status-message", &[b"No default printer"])])]), false, 200);
+    assert_eq!(default_printer(&ep).unwrap(), None);
+}
+
+#[test]
+fn a_print_job_carries_the_document_and_returns_its_id() {
+    let (ep, rx) = fake(ipp(0, &[ok_header(), (TAG_JOB_GROUP, &[(TAG_INTEGER, "job-id", &[&42u32.to_be_bytes()])])]), true, 200);
+    let pdf = b"%PDF-1.4 fake".to_vec();
+    let id =
+        print_job(&ep, &Job { printer: "Office", is_class: false, title: "photo.psd", user: "diego", copies: 2, document: &pdf, format: "application/pdf" })
+            .unwrap();
+    assert_eq!(id, 42);
+    let (op, attrs, doc) = rx.recv().unwrap();
+    assert_eq!(op, OP_PRINT_JOB);
+    assert_eq!(doc, pdf);
+    let get = |n: &str| attrs.iter().find(|a| a.name == n).cloned().unwrap_or_else(|| panic!("{n}"));
+    assert_eq!(get("printer-uri").values[0], format!("ipp://{}/printers/Office", ep.host()).as_bytes());
+    assert_eq!(get("job-name").values[0], b"photo.psd");
+    assert_eq!(get("requesting-user-name").values[0], b"diego");
+    assert_eq!(get("document-format").values[0], b"application/pdf");
+    let copies = get("copies");
+    assert_eq!((copies.group, copies.tag, copies.int()), (TAG_JOB_GROUP, TAG_INTEGER, Some(2)));
+    // One copy: no job attributes group at all.
+    let (ep, rx) = fake(ipp(0, &[ok_header(), (TAG_JOB_GROUP, &[(TAG_INTEGER, "job-id", &[&7u32.to_be_bytes()])])]), false, 200);
+    print_job(&ep, &Job { printer: "P", is_class: false, title: "t", user: "u", copies: 1, document: b"x", format: "application/pdf" }).unwrap();
+    assert!(!rx.recv().unwrap().1.iter().any(|a| a.name == "copies"));
+}
+
+#[test]
+fn error_statuses_and_broken_replies_are_errors() {
+    let (ep, _rx) = fake(ipp(0x0506, &[ok_header(), (TAG_OPERATION_GROUP, &[(TAG_TEXT, "status-message", &[b"Printer is not accepting jobs"])])]), false, 200);
+    let e = print_job(&ep, &Job { printer: "P", is_class: false, title: "t", user: "u", copies: 1, document: b"x", format: "application/pdf" }).unwrap_err();
+    assert_eq!(e, Error::Status(0x0506, "Printer is not accepting jobs".into()));
+    assert!(e.to_string().contains("0x0506"));
+    // A CUPS with no printer at all answers "not found": that is an empty list, not an error.
+    let (ep, _rx) = fake(ipp(0x0406, &[ok_header(), (TAG_OPERATION_GROUP, &[(TAG_TEXT, "status-message", &[b"No destinations added."])])]), false, 200);
+    assert_eq!(printers(&ep).unwrap(), Vec::<Printer>::new());
+    // HTTP 401, a reply cut short, garbage.
+    let (ep, _rx) = fake(ipp(0, &[ok_header()]), false, 401);
+    assert!(matches!(printers(&ep), Err(Error::Protocol(m)) if m.contains("401")));
+    let (ep, _rx) = fake(vec![2, 0, 0, 0, 0, 0, 0, 1, TAG_OPERATION_GROUP, TAG_NAME, 0, 5], true, 200);
+    assert!(matches!(printers(&ep), Err(Error::Protocol(_))));
+    let (ep, _rx) = fake(b"not ipp at all".to_vec(), false, 200);
+    assert!(matches!(printers(&ep), Err(Error::Protocol(_))));
+    // Nobody listening.
+    let e = printers(&Endpoint::Tcp("127.0.0.1".into(), 1)).unwrap_err();
+    assert!(matches!(e, Error::Unreachable(_)), "{e}");
+}
+
+#[test]
+fn reply_parsing_is_bounded() {
+    assert!(Reply::parse(&[]).is_err());
+    assert!(Reply::parse(&[2, 0, 0, 0, 0, 0, 0, 1]).is_err(), "no end tag");
+    let mut many = vec![2, 0, 0, 0, 0, 0, 0, 1, TAG_OPERATION_GROUP];
+    for _ in 0..MAX_ATTRIBUTES + 1 {
+        many.extend_from_slice(&[TAG_NAME, 0, 1, b'a', 0, 0]);
+    }
+    many.push(TAG_END);
+    assert!(matches!(Reply::parse(&many), Err(Error::Protocol(m)) if m.contains("too many")));
+    // An additional value before any attribute.
+    assert!(Reply::parse(&[2, 0, 0, 0, 0, 0, 0, 1, TAG_OPERATION_GROUP, TAG_NAME, 0, 0, 0, 1, b'x', TAG_END]).is_err());
+    assert!(dechunk(b"zz\r\n").is_err() && dechunk(b"5\r\nab").is_err());
+    assert_eq!(dechunk(b"3\r\nabc\r\n0\r\n\r\n").unwrap(), b"abc");
+}
+
+#[cfg(unix)]
+#[test]
+fn the_unix_socket_endpoint_works_and_detect_honours_cups_server() {
+    let dir = std::env::temp_dir().join(format!("pc-ipp-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let sock = dir.join("cups.sock");
+    let listener = std::os::unix::net::UnixListener::bind(&sock).unwrap();
+    let (tx, rx) = mpsc::channel();
+    let reply = ipp(0, &[ok_header(), (TAG_PRINTER_GROUP, &[(TAG_NAME, "printer-name", &[b"Sock"])])]);
+    std::thread::spawn(move || {
+        for _ in 0..3 {
+            let (stream, _) = listener.accept().unwrap();
+            serve(Stream::Unix(stream), reply.clone(), false, 200, &tx);
+        }
+    });
+    let ep = Endpoint::Unix(sock.clone());
+    assert!(ep.reachable());
+    assert_eq!(default_printer(&ep).unwrap(), Some("Sock".into()));
+    assert_eq!(rx.recv().unwrap().0, OP_CUPS_GET_DEFAULT);
+    assert!(!Endpoint::Unix(dir.join("missing.sock")).reachable());
+    assert_eq!(ep.to_string(), sock.display().to_string());
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[test]
+fn requests_start_with_the_mandatory_attributes() {
+    let r = Request::new(OP_PRINT_JOB, 9).end();
+    let (op, attrs, doc) = parse_request(&r).unwrap();
+    assert_eq!(op, OP_PRINT_JOB);
+    assert_eq!(Reply::parse(&r).unwrap().request_id, 9);
+    assert_eq!(attrs[0].name, "attributes-charset");
+    assert_eq!(attrs[1].name, "attributes-natural-language");
+    assert!(doc.is_empty());
+}
+
+/// A server that keeps the connection open after its reply (a printer reached directly, a proxy)
+/// must not hold the client until the read times out: the reply ends at Content-Length, or at
+/// the last chunk.
+#[test]
+fn replies_end_at_content_length_or_the_last_chunk_without_waiting_for_close() {
+    for chunked in [false, true] {
+        let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let one = ipp(0, &[ok_header(), (TAG_PRINTER_GROUP, &[(TAG_NAME, "printer-name", &[b"Office"])])]);
+        let none = ipp(0x0406, &[ok_header()]);
+        std::thread::spawn(move || {
+            for stream in listener.incoming() {
+                let Ok(stream) = stream else { return };
+                let mut reader = BufReader::new(stream);
+                let (mut line, mut len) = (String::new(), 0usize);
+                loop {
+                    line.clear();
+                    if reader.read_line(&mut line).unwrap_or(0) == 0 || line == "\r\n" {
+                        break;
+                    }
+                    if let Some(v) = line.to_ascii_lowercase().strip_prefix("content-length:") {
+                        len = v.trim().parse().unwrap_or(0);
+                    }
+                }
+                if len == 0 {
+                    continue;
+                }
+                let mut body = vec![0u8; len];
+                if reader.read_exact(&mut body).is_err() {
+                    continue;
+                }
+                let op = parse_request(&body).map(|r| r.0).unwrap_or(0);
+                let reply = if op == OP_CUPS_GET_PRINTERS { one.clone() } else { none.clone() };
+                let mut out = reader.into_inner();
+                let mut resp = Vec::new();
+                if chunked {
+                    resp.extend_from_slice(b"HTTP/1.1 200 OK\r\nContent-Type: application/ipp\r\nTransfer-Encoding: chunked\r\n\r\n");
+                    for chunk in reply.chunks(5) {
+                        resp.extend_from_slice(format!("{:x}\r\n", chunk.len()).as_bytes());
+                        resp.extend_from_slice(chunk);
+                        resp.extend_from_slice(b"\r\n");
+                    }
+                    resp.extend_from_slice(b"0\r\n\r\n");
+                } else {
+                    resp.extend_from_slice(format!("HTTP/1.1 200 OK\r\nContent-Type: application/ipp\r\nContent-Length: {}\r\n\r\n", reply.len()).as_bytes());
+                    resp.extend_from_slice(&reply);
+                }
+                if out.write_all(&resp).and_then(|()| out.flush()).is_err() {
+                    continue;
+                }
+                // Keep this connection open for a while, on its own thread, and go on serving.
+                std::thread::spawn(move || {
+                    std::thread::sleep(Duration::from_secs(10));
+                    drop(out);
+                });
+            }
+        });
+        let ep = Endpoint::Tcp("127.0.0.1".into(), port);
+        let started = std::time::Instant::now();
+        let list = printers(&ep).unwrap();
+        assert_eq!(list.len(), 1, "chunked {chunked}");
+        assert!(started.elapsed() < Duration::from_secs(5), "waited for the server to close (chunked {chunked}): {:?}", started.elapsed());
+    }
+}
+
+/// A chunked reply whose payload contains the bytes of a last chunk (`\r\n0\r\n\r\n`, here inside
+/// a printer name) and arrives split right after them: the reader must wait for the real last
+/// chunk instead of returning a cut reply.
+#[test]
+fn a_last_chunk_pattern_inside_a_value_does_not_end_the_reply() {
+    let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+    let port = listener.local_addr().unwrap().port();
+    let reply = ipp(0, &[ok_header(), (TAG_PRINTER_GROUP, &[(TAG_NAME, "printer-name", &[b"Of\r\n0\r\n\r\nfice"])])]);
+    let cut = reply.windows(7).position(|w| w == b"\r\n0\r\n\r\n").unwrap() + 7;
+    std::thread::spawn(move || {
+        let (stream, _) = listener.accept().unwrap();
+        let mut reader = BufReader::new(stream);
+        let (mut line, mut len) = (String::new(), 0usize);
+        loop {
+            line.clear();
+            if reader.read_line(&mut line).unwrap_or(0) == 0 || line == "\r\n" {
+                break;
+            }
+            if let Some(v) = line.to_ascii_lowercase().strip_prefix("content-length:") {
+                len = v.trim().parse().unwrap_or(0);
+            }
+        }
+        let mut body = vec![0u8; len];
+        reader.read_exact(&mut body).unwrap();
+        let mut out = reader.into_inner();
+        let (first, second) = reply.split_at(cut);
+        // Part one ends exactly on the pattern, inside the first chunk's payload.
+        let mut a = b"HTTP/1.1 200 OK\r\nContent-Type: application/ipp\r\nTransfer-Encoding: chunked\r\n\r\n".to_vec();
+        a.extend_from_slice(format!("{:x}\r\n", first.len()).as_bytes());
+        a.extend_from_slice(first);
+        out.write_all(&a).and_then(|()| out.flush()).unwrap();
+        std::thread::sleep(Duration::from_millis(400));
+        let mut b = b"\r\n".to_vec();
+        b.extend_from_slice(format!("{:x}\r\n", second.len()).as_bytes());
+        b.extend_from_slice(second);
+        b.extend_from_slice(b"\r\n0\r\n\r\n");
+        out.write_all(&b).and_then(|()| out.flush()).unwrap();
+    });
+    let ep = Endpoint::Tcp("127.0.0.1".into(), port);
+    let list = printers(&ep).unwrap();
+    assert_eq!(list.len(), 1);
+    assert_eq!(list[0].name, "Of\r\n0\r\n\r\nfice");
+    // The boundary walk itself: complete only at a zero-size chunk, never on payload bytes.
+    assert!(!chunked_complete(b"5\r\nab\r\n0"));
+    assert!(!chunked_complete(b"7\r\n\r\n0\r\n\r\nx\r\n"));
+    assert!(chunked_complete(b"7\r\n\r\n0\r\n\r\nx\r\n0\r\n\r\n"));
+    assert!(chunked_complete(b"zz\r\n") && dechunk(b"zz\r\n").is_err());
+}
+
+/// A chunk size that cannot be satisfied (`usize::MAX`, `usize::MAX - 1`, anything past the
+/// reply cap) is a protocol error, through the real reader, never an overflow panic.
+#[test]
+fn an_impossible_chunk_size_is_a_protocol_error_not_a_panic() {
+    for size_line in ["ffffffffffffffff", "fffffffffffffffe", "1000001"] {
+        assert!(chunked_complete(format!("{size_line}\r\n").as_bytes()));
+        assert!(dechunk(format!("{size_line}\r\nab\r\n").as_bytes()).is_err());
+        let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let line = size_line.to_string();
+        std::thread::spawn(move || {
+            let (stream, _) = listener.accept().unwrap();
+            let mut reader = BufReader::new(stream);
+            let (mut l, mut len) = (String::new(), 0usize);
+            loop {
+                l.clear();
+                if reader.read_line(&mut l).unwrap_or(0) == 0 || l == "\r\n" {
+                    break;
+                }
+                if let Some(v) = l.to_ascii_lowercase().strip_prefix("content-length:") {
+                    len = v.trim().parse().unwrap_or(0);
+                }
+            }
+            let mut body = vec![0u8; len];
+            reader.read_exact(&mut body).unwrap();
+            let mut out = reader.into_inner();
+            let resp = format!("HTTP/1.1 200 OK\r\nContent-Type: application/ipp\r\nTransfer-Encoding: chunked\r\n\r\n{line}\r\n");
+            let _ = out.write_all(resp.as_bytes()).and_then(|()| out.flush());
+        });
+        let ep = Endpoint::Tcp("127.0.0.1".into(), port);
+        match printers(&ep) {
+            Err(Error::Protocol(_)) => {}
+            other => panic!("{size_line}: expected a protocol error, got {other:?}"),
+        }
+    }
+}
diff --git a/crates/paint/src/brush.rs b/crates/paint/src/brush.rs
index d60412a58d..54e74e2e1f 100644
--- a/crates/paint/src/brush.rs
+++ b/crates/paint/src/brush.rs
@@ -678,7 +678,7 @@ impl BrushSettings {
 pub struct BrushPreset {
     pub name: String,
     pub brush: BrushSettings,
-    /// Shipped with Photocraft (built-ins can be deleted from a session but are regenerated on reset).
+    /// Shipped with PhotoCraft (built-ins can be deleted from a session but are regenerated on reset).
     #[serde(default)]
     pub builtin: bool,
     /// Preset group (folder) in the Brushes panel, e.g. "General" or an imported file's name.
diff --git a/crates/paint/src/brush_tests.rs b/crates/paint/src/brush_tests.rs
index 7a5e4dec43..9543215025 100644
--- a/crates/paint/src/brush_tests.rs
+++ b/crates/paint/src/brush_tests.rs
@@ -189,28 +189,61 @@ fn pencil_dabs_sit_on_the_pixel_grid() {
 
 #[test]
 fn pencil_1px_line_is_a_clean_8_connected_staircase() {
-    // #2139: a 1 px Pencil line is one pixel per column (or row, when steep) on the ideal line
-    // between the end pixels: no doubled pixels at the steps.
+    // #2139: a 1 px Pencil line is one pixel per column (or row, when steep) on the line: no
+    // doubled pixels at the steps.
     let b = BrushSettings { aliased: true, hardness: 1.0, size: 1.0, ..brush() };
     let cases = [((2.5, 2.5), (22.5, 9.5)), ((3.5, 30.5), (10.5, 5.5)), ((1.2, 1.7), (25.8, 4.1)), ((5.5, 5.5), (17.5, 17.5)), ((20.3, 3.6), (4.9, 12.2))];
     for ((ax, ay), (bx, by)) in cases {
         let s = paint(&b, &[StrokePoint::new(ax, ay, 1.0), StrokePoint::new(bx, by, 1.0)], 40, 40);
         let painted: Vec<(i32, i32)> = (0..40).flat_map(|y| (0..40).map(move |x| (x, y))).filter(|&(x, y)| s.rgba(x, y)[3] > 0.0).collect();
         let (a, e) = ((ax.floor(), ay.floor()), (bx.floor(), by.floor()));
-        let steep = (e.1 - a.1).abs() > (e.0 - a.0).abs();
+        let steep = (by - ay).abs() > (bx - ax).abs();
         let major = |p: (f64, f64)| if steep { (p.1, p.0) } else { (p.0, p.1) };
-        let ((m0, n0), (m1, n1)) = (major(a), major(e));
+        let ((m0, _), (m1, _)) = (major(a), major(e));
+        let ((am, an), (bm, bn)) = (major((ax, ay)), major((bx, by)));
         assert_eq!(painted.len() as f64, (m1 - m0).abs() + 1.0, "{a:?}->{e:?}: one pixel per step, got {painted:?}");
         for &(x, y) in &painted {
-            let (m, n) = major((f64::from(x), f64::from(y)));
-            let ideal = n0 + (n1 - n0) * (m - m0) / (m1 - m0);
-            assert!((n - ideal).abs() <= 0.5 + 1e-9, "{a:?}->{e:?}: ({x},{y}) is off the line");
+            if (f64::from(x), f64::from(y)) == a {
+                continue; // The pixel the stroke starts in.
+            }
+            // The pixel's centre is within half a pixel of the line where it crosses its column.
+            let (m, n) = major((f64::from(x) + 0.5, f64::from(y) + 0.5));
+            let on_line = an + (bn - an) * (m - am) / (bm - am);
+            assert!((n - on_line).abs() <= 0.5 + 1e-9, "{a:?}->{e:?}: ({x},{y}) is off the line");
         }
         let columns: std::collections::BTreeSet<i64> = painted.iter().map(|&(x, y)| major((f64::from(x), f64::from(y))).0 as i64).collect();
         assert_eq!(columns.len(), painted.len(), "{a:?}->{e:?}: a column holds two pixels");
     }
 }
 
+#[test]
+fn pencil_1px_line_is_the_same_whichever_way_and_however_smoothed() {
+    // #6336: a ⇧-click line between pixel centres painted different pixels depending on which end
+    // it started from, and Smoothing (which splits it into pieces along the line) bent it.
+    let pixels = |a: (f64, f64), e: (f64, f64), amount: f32| {
+        let mut b = BrushSettings { aliased: true, hardness: 1.0, size: 1.0, ..brush() };
+        b.smoothing.amount = amount;
+        let s = paint(&b, &[StrokePoint::new(a.0, a.1, 1.0), StrokePoint::new(e.0, e.1, 1.0)], 24, 24);
+        (0..24).flat_map(|y| (0..24).map(move |x| (x, y))).filter(|&(x, y)| s.rgba(x, y)[3] > 0.0).collect::<Vec<_>>()
+    };
+    for (a, e) in [((3.5, 3.5), (4.5, 5.5)), ((3.5, 3.5), (8.5, 5.5)), ((2.5, 20.5), (9.5, 17.5)), ((1.5, 1.5), (20.5, 9.5))] {
+        let line = pixels(a, e, 0.0);
+        assert_eq!(line, pixels(e, a, 0.0), "{a:?}->{e:?} differs from {e:?}->{a:?}");
+        for amount in [0.1, 0.5, 0.9] {
+            assert_eq!(pixels(a, e, amount), line, "{a:?}->{e:?} at Smoothing {amount}");
+            assert_eq!(pixels(e, a, amount), line, "{e:?}->{a:?} at Smoothing {amount}");
+        }
+    }
+    // One right and two down: three pixels, one per row.
+    assert_eq!(pixels((3.5, 3.5), (4.5, 5.5), 0.1), vec![(3, 3), (4, 4), (4, 5)]);
+    // A straight line fed as many pointer samples along it paints the line's pixels.
+    let b = BrushSettings { aliased: true, hardness: 1.0, size: 1.0, ..brush() };
+    let samples: Vec<StrokePoint> = (0..=37).map(|i| StrokePoint::new(1.5 + 19.0 * f64::from(i) / 37.0, 1.5 + 8.0 * f64::from(i) / 37.0, 1.0)).collect();
+    let s = paint(&b, &samples, 24, 24);
+    let sampled: Vec<(i32, i32)> = (0..24).flat_map(|y| (0..24).map(move |x| (x, y))).filter(|&(x, y)| s.rgba(x, y)[3] > 0.0).collect();
+    assert_eq!(sampled, pixels((1.5, 1.5), (20.5, 9.5), 0.0));
+}
+
 // ---------- spacing ----------
 
 #[test]
diff --git a/crates/paint/src/dynamics.rs b/crates/paint/src/dynamics.rs
index c0cad09460..0c535cf89c 100644
--- a/crates/paint/src/dynamics.rs
+++ b/crates/paint/src/dynamics.rs
@@ -27,6 +27,15 @@ const MIN_SPEED_STEP: f64 = 0.5;
 /// Maximum airbrush catch-up dabs for one input segment.
 const MAX_AIRBRUSH_DABS_PER_SEGMENT: usize = 512;
 
+/// The dab centre of the pixel-grid cell holding `v` (see [`PathWalker::pixel_grid`]): the
+/// pixel's centre for `offset` 0.5, the nearest pixel corner for 0. A value within rounding
+/// noise of a cell boundary counts as on it, so a line lands on the same pixels both ways.
+fn grid_cell(v: f64, offset: f64) -> f64 {
+    let w = v - offset + 0.5;
+    let w = if (w - w.round()).abs() < 1e-7 { w.round() } else { w };
+    w.floor() + offset
+}
+
 #[inline]
 fn lerp_pt(a: &StrokePoint, b: &StrokePoint, f: f64) -> StrokePoint {
     let ff = f as f32;
@@ -237,10 +246,14 @@ impl PathWalker {
     }
 
     /// Step pixel by pixel instead of by distance: one step per pixel along the segment's major
-    /// axis, on the line between the pixels holding its ends, each at the pixel's dab centre
-    /// (`offset` 0.5 for odd tip diameters, 0 for even ones, as `render::grid_center` snaps). A
-    /// small aliased tip (the Pencil) then draws a clean 8-connected staircase: stepping by
-    /// distance put two dabs in a row wherever the line crossed a pixel corner (#2139).
+    /// axis, each at the dab centre (`offset` 0.5 for odd tip diameters, 0 for even ones, as
+    /// `render::grid_center` snaps) of the pixel the segment's line crosses at that column (or
+    /// row, when steep). A small aliased tip (the Pencil) then draws a clean 8-connected
+    /// staircase: stepping by distance put two dabs in a row wherever the line crossed a pixel
+    /// corner (#2139). The line is sampled where it really runs, not between the pixels holding
+    /// the segment's ends, so a straight line split into pieces (by Smoothing, or the pointer
+    /// samples of a ⇧-drag) paints the pixels of the whole line, whichever end it starts from
+    /// (#6336).
     pub fn pixel_grid(mut self, offset: f64) -> Self {
         self.grid = Some(offset);
         self
@@ -249,19 +262,24 @@ impl PathWalker {
     /// Emits the pixel steps from `a` to `p` (see [`PathWalker::pixel_grid`]). False, emitting
     /// nothing, when the span is not finite or implausibly long: distance spacing takes over.
     fn grid_steps(&mut self, a: &StrokePoint, p: &StrokePoint, offset: f64, out: &mut impl FnMut(StepInput)) -> bool {
-        let cell = |v: f64| if offset > 0.0 { v.floor() } else { v.round() };
-        let (x0, y0) = (cell(a.x), cell(a.y));
-        let (dx, dy) = (cell(p.x) - x0, cell(p.y) - y0);
-        let n = dx.abs().max(dy.abs());
-        if !n.is_finite() || n > MAX_GRID_STEPS {
+        // The pieces of a 45° line differ in rounding noise: keep them all on one major axis.
+        let steep = (p.y - a.y).abs() > (p.x - a.x).abs() * (1.0 + 1e-9);
+        let (am, an, pm, pn) = if steep { (a.y, a.x, p.y, p.x) } else { (a.x, a.y, p.x, p.y) };
+        let (m0, m1) = (grid_cell(am, offset), grid_cell(pm, offset));
+        let (dm, dn) = (pm - am, pn - an);
+        let n = (m1 - m0).abs();
+        if !(n.is_finite() && dn.is_finite()) || n > MAX_GRID_STEPS || dm == 0.0 {
             return false;
         }
-        let steps = n as u64;
-        for i in 1..=steps {
-            let i = i as f64;
-            let mut q = lerp_pt(a, p, i / n);
-            q.x = x0 + (dx * i / n).round() + offset;
-            q.y = y0 + (dy * i / n).round() + offset;
+        let dir = (m1 - m0).signum();
+        for i in 1..=n as u64 {
+            let c = m0 + dir * i as f64;
+            // The last column's centre can sit up to half a pixel past `p`: the line goes on to
+            // it, so the next piece of a straight line picks up where this one left off.
+            let t = (c - am) / dm;
+            let mut q = lerp_pt(a, p, t.clamp(0.0, 1.0));
+            let cn = grid_cell(an + dn * t, offset);
+            (q.x, q.y) = if steep { (cn, c) } else { (c, cn) };
             self.emit(q, out);
         }
         true
diff --git a/crates/plugins/src/manifest.rs b/crates/plugins/src/manifest.rs
index ccabf47d55..52994bc740 100644
--- a/crates/plugins/src/manifest.rs
+++ b/crates/plugins/src/manifest.rs
@@ -122,10 +122,8 @@ impl Manifest {
                 return Err(Error::Manifest(format!("invalid parameter name {k:?}")));
             }
             match spec {
-                ParamSpec::Number { min, max, default } => {
-                    if !(min.is_finite() && max.is_finite() && default.is_finite()) || min > max {
-                        return Err(Error::Manifest(format!("parameter `{k}`: bad range")));
-                    }
+                ParamSpec::Number { min, max, default } if !(min.is_finite() && max.is_finite() && default.is_finite()) || min > max => {
+                    return Err(Error::Manifest(format!("parameter `{k}`: bad range")));
                 }
                 ParamSpec::Int { min, max, .. } if min > max => return Err(Error::Manifest(format!("parameter `{k}`: bad range"))),
                 ParamSpec::Choice { options, default } => {
diff --git a/crates/psd/src/ase.rs b/crates/psd/src/ase.rs
index 7433c4797e..f63db5481a 100644
--- a/crates/psd/src/ase.rs
+++ b/crates/psd/src/ase.rs
@@ -22,6 +22,8 @@ use crate::io::{Reader, WriteExt};
 pub const SIGNATURE: &[u8; 4] = b"ASEF";
 /// Most colour entries read from one file.
 pub const MAX_SWATCHES: usize = 100_000;
+/// Most groups read from one file.
+pub const MAX_GROUPS: usize = 10_000;
 /// Longest name read or written, in UTF-16 code units.
 pub const MAX_NAME_UNITS: usize = 1024;
 // `put_name` writes the name length as `units.len() as u16 + 1`, so the cap must leave room in a
@@ -172,9 +174,9 @@ fn read_color(body: &mut Reader<'_>) -> Result<AseSwatch> {
 }
 
 /// Parse an `.ase` file. A wrong signature or version, a truncated block, a block count beyond
-/// the data or more than [`MAX_SWATCHES`] colours is an error; never panics. Unknown block
-/// types are skipped, a group end without a start is ignored, and a group left open at the end
-/// (or a group started inside another) is closed.
+/// the data, more than [`MAX_SWATCHES`] colors or more than [`MAX_GROUPS`] groups is an error;
+/// never panics. Unknown block types are skipped, a group end without a start is ignored, and a
+/// group left open at the end (or a group started inside another) is closed.
 pub fn parse(data: &[u8]) -> Result<AseFile> {
     let mut r = Reader::new(data);
     let sig: [u8; 4] = r.array()?;
@@ -192,12 +194,17 @@ pub fn parse(data: &[u8]) -> Result<AseFile> {
     let mut entries = Vec::new();
     let mut open: Option<(String, Vec<AseSwatch>)> = None;
     let mut total = 0usize;
+    let mut groups = 0usize;
     for _ in 0..count {
         let kind = r.u16()?;
         let len = u64::from(r.u32()?);
         let mut body = r.sub(len)?;
         match kind {
             GROUP_START => {
+                groups += 1;
+                if groups > MAX_GROUPS {
+                    return Err(PsdError::LimitExceeded("too many groups in an .ase file"));
+                }
                 if let Some((name, swatches)) = open.take() {
                     entries.push(AseEntry::Group { name, swatches });
                 }
@@ -279,11 +286,15 @@ fn put_color(out: &mut Vec<u8>, s: &AseSwatch) -> Result<()> {
 }
 
 /// Write an `.ase` file (version 1.0). Fails only when a block or the block count overflows the
-/// format's 32-bit fields or there are more than [`MAX_SWATCHES`] colours.
+/// format's 32-bit fields or there are more than [`MAX_SWATCHES`] colors or more than
+/// [`MAX_GROUPS`] groups.
 pub fn write(file: &AseFile) -> Result<Vec<u8>> {
     if file.swatch_count() > MAX_SWATCHES {
         return Err(PsdError::LimitExceeded("too many swatches for an .ase file"));
     }
+    if file.entries.iter().filter(|e| matches!(e, AseEntry::Group { .. })).count() > MAX_GROUPS {
+        return Err(PsdError::LimitExceeded("too many groups for an .ase file"));
+    }
     let mut body = Vec::with_capacity(64 * file.swatch_count().max(1));
     let mut blocks = 0u64;
     for e in &file.entries {
@@ -415,4 +426,14 @@ mod tests {
         let f = AseFile { entries: vec![AseEntry::Group { name: "g".into(), swatches: vec![s; MAX_SWATCHES + 1] }] };
         assert!(write(&f).is_err());
     }
+
+    #[test]
+    fn too_many_groups() {
+        let g = AseEntry::Group { name: "g".into(), swatches: vec![] };
+        let mut f = AseFile { entries: vec![g; MAX_GROUPS + 1] };
+        assert!(write(&f).is_err());
+        // At the limit the file is written, and every group reads back.
+        f.entries.pop();
+        assert_eq!(parse(&write(&f).unwrap()).unwrap().entries.len(), MAX_GROUPS);
+    }
 }
diff --git a/crates/psd/src/file.rs b/crates/psd/src/file.rs
index 5a1ee15c1c..e14bc45aaf 100644
--- a/crates/psd/src/file.rs
+++ b/crates/psd/src/file.rs
@@ -102,6 +102,22 @@ impl PsdFile {
     /// Errors are those of [`Self::from_bytes`]; a merged image that passes the parse's check but
     /// cannot be decoded is the inner `Err`, as [`Self::decode_merged`] would return it.
     pub fn from_bytes_and_merged(data: &[u8], want: impl FnOnce(&PsdFile) -> bool) -> Result<(Self, Option<Result<Vec<u8>>>)> {
+        Self::from_bytes_and_merged_recovering(data, want, |_| false)
+    }
+
+    /// Parses like [`Self::from_bytes_and_merged`], but lets `recover` accept damage confined to
+    /// the merged image after all layer records and channel data have been read successfully.
+    /// Callers should opt in only when they can reconstruct the document from its layers.
+    ///
+    /// The original encoded image bytes are preserved and its parse error is returned as
+    /// `Some(Err(..))`, even when `want` did not request a decode. The caller must report that
+    /// error rather than silently discarding the merged image (which may hold extra channels).
+    /// Header/layer errors, missing compression fields and parse safety-limit errors stay fatal.
+    pub fn from_bytes_and_merged_recovering(
+        data: &[u8],
+        want: impl FnOnce(&PsdFile) -> bool,
+        recover: impl FnOnce(&PsdFile) -> bool,
+    ) -> Result<(Self, Option<Result<Vec<u8>>>)> {
         let mut r = Reader::new(data);
         let header = Header::read(&mut r)?;
         let psb = header.version.is_psb();
@@ -161,10 +177,30 @@ impl PsdFile {
         let image_data = ImageData { compression: Compression::Raw, data: Vec::new() };
         let mut file =
             PsdFile { header, color_mode_data, resources, layer_info, layer_info_placement, global_layer_mask, global_blocks, layer_mask_trailing, image_data };
-        let merged = if want(&file) { Some(file.read_merged_decoded(&mut r)?) } else { None };
-        if merged.is_none() {
-            file.image_data = ImageData::read(&mut r, &file.header)?;
-        }
+        let mut encoded = r.clone();
+        let merged = if want(&file) {
+            file.read_merged_decoded(&mut r).map(Some)
+        } else {
+            ImageData::read(&mut r, &file.header).map(|image| {
+                file.image_data = image;
+                None
+            })
+        };
+        let merged = match merged {
+            Ok(merged) => merged,
+            Err(error) => {
+                if matches!(error, PsdError::LimitExceeded(_)) || !recover(&file) {
+                    return Err(error);
+                }
+                let compression = Compression::from_u16(encoded.u16()?);
+                let source = encoded.peek_rest();
+                let mut data = Vec::new();
+                data.try_reserve_exact(source.len()).map_err(|_| PsdError::LimitExceeded("not enough memory to retain the damaged merged image"))?;
+                data.extend_from_slice(source);
+                file.image_data = ImageData { compression, data };
+                Some(Err(error))
+            }
+        };
         Ok((file, merged))
     }
 
diff --git a/crates/psd/src/pixels.rs b/crates/psd/src/pixels.rs
index d4948457f9..5af4903c55 100644
--- a/crates/psd/src/pixels.rs
+++ b/crates/psd/src/pixels.rs
@@ -180,6 +180,20 @@ fn color_channel_count(mode: ColorMode) -> Result<usize> {
     }
 }
 
+/// One 8-bit sample matted against white at alpha `a`, back to straight colour (rounded, at most
+/// 255). At `a == 0` there is no colour to recover and the sample is kept.
+fn unmatte_u8(c: u8, a: u8) -> u8 {
+    let a = u32::from(a);
+    ((u32::from(c) + a).saturating_sub(255) * 255 + a / 2).checked_div(a).map_or(c, |straight| straight.min(255) as u8)
+}
+
+/// [`unmatte_u8`] of every sample, one row per alpha: `table[a][c]`. Built per call (64 KiB, a
+/// division per entry) rather than per pixel, and not as a static, which would add 64 KiB to
+/// every binary that links this crate.
+fn unmatte_u8_table() -> Vec<[u8; 256]> {
+    (0..=255).map(|a| std::array::from_fn(|c| unmatte_u8(c as u8, a))).collect()
+}
+
 fn unmatte_to_u8(color: &[u8], alpha: &[u8], depth: u16) -> Result<Vec<u8>> {
     let convert = |c: f32, a: f32| {
         let straight = if a > 0.0 { (c + a - 1.0) / a } else { c };
@@ -341,12 +355,11 @@ impl PsdFile {
         let alpha = if self.merged_has_alpha() { Some(get(cc)?) } else { None };
         let mut data = interleave(h.color_mode, &color, alpha.as_deref(), &self.color_mode_data, n)?;
         if h.color_mode == ColorMode::Rgb && h.depth == 8 && alpha.is_some() {
+            let table = unmatte_u8_table();
             for pixel in data.as_chunks_mut::<4>().0 {
-                let a = u32::from(pixel[3]);
+                let row = &table[usize::from(pixel[3])];
                 for c in pixel.iter_mut().take(3) {
-                    if let Some(straight) = ((u32::from(*c) + a).saturating_sub(255) * 255 + a / 2).checked_div(a) {
-                        *c = straight.min(255) as u8;
-                    }
+                    *c = row[usize::from(*c)];
                 }
             }
         }
@@ -368,6 +381,29 @@ mod tests {
         assert_eq!(file.decode_merged().unwrap(), native);
     }
 
+    /// #5694: the 8-bit RGB composite unmattes through a table; every (sample, alpha) pair comes
+    /// out exactly as the per-pixel division it replaced (kept here as the reference).
+    #[test]
+    fn rgba8_composite_unmattes_every_sample_and_alpha_as_the_division_did() {
+        let mut file = crate::testgen::merged_only(Version::Psd, ColorMode::Rgb, 8, crate::Compression::Raw, 256, 256);
+        file.header.channels = 4;
+        // Pixel (x, y): red x, green 255 - x, blue x ^ y, alpha y.
+        let (x, y) = (|i: usize| (i % 256) as u8, |i: usize| (i / 256) as u8);
+        let plane = |f: &dyn Fn(usize) -> u8| (0..256 * 256).map(f).collect::<Vec<u8>>();
+        let planes = [plane(&|i| x(i)), plane(&|i| 255 - x(i)), plane(&|i| x(i) ^ y(i)), plane(&|i| y(i))];
+        file.image_data = crate::ImageData::encode(crate::Compression::Raw, &planes.concat(), &file.header).unwrap();
+        let mut expected: Vec<u8> = (0..256 * 256).flat_map(|i| planes.each_ref().map(|p| p[i])).collect();
+        for pixel in expected.as_chunks_mut::<4>().0 {
+            let a = u32::from(pixel[3]);
+            for c in pixel.iter_mut().take(3) {
+                if let Some(straight) = ((u32::from(*c) + a).saturating_sub(255) * 255 + a / 2).checked_div(a) {
+                    *c = straight.min(255) as u8;
+                }
+            }
+        }
+        assert_eq!(file.composite_rgba8().unwrap().data, expected);
+    }
+
     #[test]
     fn oversized_layer_preview_rejects_missing_channels_before_allocating() {
         let mut file = crate::testgen::small(Version::Psb, crate::Compression::Raw);
diff --git a/crates/psd/src/tiff.rs b/crates/psd/src/tiff.rs
index 67142921ba..31c85d4885 100644
--- a/crates/psd/src/tiff.rs
+++ b/crates/psd/src/tiff.rs
@@ -681,13 +681,12 @@ pub mod transcode {
             if !self.from.is_little() && TaggedBlock::is_foreign_order_signature(self.r.peek_rest()) {
                 let sig = self.r.array::<4>()?;
                 let mut key = self.r.array::<4>()?;
-                let long = uses_long_length(self.version, &{
-                    let mut k = key;
-                    if self.to.is_little() {
-                        k.reverse();
-                    }
-                    k
-                });
+                // Only reached with `from == Big`: the key is canonical here whatever the
+                // target order. `TaggedBlock::write` sizes the length field from that same key.
+                // Reversing it for the target order before the check
+                // asked about a key `PSB_LONG_KEYS` never contains, so a PSB long key's 8-byte
+                // length was read as 4 and every later block was copied unconverted.
+                let long = uses_long_length(self.version, &key);
                 let len = self.r.len_field(long)?;
                 let data = self.r.bytes_u64(len)?;
                 if self.to.is_little() {
@@ -2211,6 +2210,25 @@ mod tests {
         assert_eq!(ImageSourceData::from_bytes(&big).unwrap().0.global_blocks, back.global_blocks);
     }
 
+    /// A PSB keeps `Mt16`/`Mt32`/`Mtrn`/`Alph` blocks of unknown layout verbatim, and their
+    /// length field is 8 bytes (a PSB long key). Writing them into a little-endian TIFF must
+    /// read that width; the old code looked the key up after reversing it for the target
+    /// order, which never matches `PSB_LONG_KEYS`.
+    #[test]
+    fn psb_foreign_order_long_key_roundtrips() {
+        let d = ImageSourceData {
+            version: Version::Psb,
+            byte_order: ByteOrder::Little,
+            global_blocks: vec![TaggedBlock { signature: *b"MIB8", key: *b"Mt16", data: vec![9, 8, 7, 6, 5, 4], padding: None }],
+            ..Default::default()
+        };
+        let (little, w) = d.to_bytes(ByteOrder::Little).unwrap();
+        assert!(w.is_empty(), "{w:?}");
+        let (back, w) = ImageSourceData::from_bytes(&little).unwrap();
+        assert!(w.is_empty(), "{w:?}");
+        assert_eq!(back.global_blocks, d.global_blocks, "the 8-byte length and the bytes survive");
+    }
+
     #[test]
     fn rle_counts_follow_the_container_and_samples_do_not() {
         let file = testgen::layered(Version::Psd, ColorMode::Rgb, 16, Compression::Rle);
diff --git a/crates/psd/src/tree.rs b/crates/psd/src/tree.rs
index 75ea750e6a..606d9b2087 100644
--- a/crates/psd/src/tree.rs
+++ b/crates/psd/src/tree.rs
@@ -68,10 +68,28 @@ impl PsdFile {
 
     /// [`layer_tree`](Self::layer_tree) with at most `max_depth` levels of
     /// groups: a group nested `max_depth` or more groups deep (a root node is
-    /// at depth 0) keeps its node but not its children. Built iteratively, so
+    /// at depth 0) keeps its node but not its children. Layers under a divider
+    /// that is never closed sit at the enclosing level, as in `layer_tree`. Built iteratively, so
     /// no file can make it recurse, and the result is no deeper than
     /// `max_depth + 1` levels, so walking or dropping it recursively is bounded.
     pub fn layer_tree_max_depth(&self, max_depth: usize) -> Vec<LayerNode> {
+        let layers = self.layers();
+        // First pass: find the dividers a folder closes. A divider that is never closed opens no
+        // group; its layers belong to the enclosing level, so it opens no frame and every
+        // frame's depth is the final depth of its nodes (#5758).
+        let mut closed = vec![false; layers.len()];
+        let mut open: Vec<usize> = Vec::new();
+        for (i, rec) in layers.iter().enumerate() {
+            match rec.section_type() {
+                SectionType::BoundingDivider => open.push(i),
+                SectionType::OpenFolder | SectionType::ClosedFolder => {
+                    if let Some(slot) = open.pop().and_then(|d| closed.get_mut(d)) {
+                        *slot = true;
+                    }
+                }
+                _ => {}
+            }
+        }
         // Stack of (divider index, children); frame `k` holds the nodes at depth `k`. Frames
         // past `max_depth` are tracked (to match dividers to folders) but collect nothing.
         let mut stack: Vec<(Option<usize>, Vec<LayerNode>)> = vec![(None, Vec::new())];
@@ -82,9 +100,13 @@ impl PsdFile {
                 top.1.push(node);
             }
         };
-        for (i, rec) in self.layers().iter().enumerate() {
+        for (i, rec) in layers.iter().enumerate() {
             match rec.section_type() {
-                SectionType::BoundingDivider => stack.push((Some(i), Vec::new())),
+                SectionType::BoundingDivider => {
+                    if closed.get(i).copied().unwrap_or(false) {
+                        stack.push((Some(i), Vec::new()));
+                    }
+                }
                 SectionType::OpenFolder | SectionType::ClosedFolder => {
                     let (divider, children) = if stack.len() > 1 { stack.pop().unwrap_or_default() } else { (None, Vec::new()) };
                     push(&mut stack, LayerNode::Group { index: i, divider, children });
@@ -92,6 +114,7 @@ impl PsdFile {
                 _ => push(&mut stack, LayerNode::Layer { index: i }),
             }
         }
+        // Only closed dividers open frames, so none is left here; this just guards the invariant.
         while stack.len() > 1 {
             let (_, children) = stack.pop().unwrap_or_default();
             if let Some(top) = stack.last_mut() {
diff --git a/crates/psd/tests/corpus.rs b/crates/psd/tests/corpus.rs
index 19b1e56600..90abb4fefd 100644
--- a/crates/psd/tests/corpus.rs
+++ b/crates/psd/tests/corpus.rs
@@ -21,7 +21,8 @@ fn collect(dir: &Path, out: &mut Vec<PathBuf>) {
 
 /// Files known to be invalid upstream, with the reason. They are reported but
 /// do not fail the test.
-const KNOWN_BAD: &[(&str, &str)] = &[("group-divider-blend-mode.psd", "psd-tools fixture stripped to 1906 bytes: merged image data missing")];
+const KNOWN_BAD: &[(&str, &str)] =
+    &[("group-divider-blend-mode.psd", "malformed merged image data; strict parsing rejects it, but the importer recovers its group (#6152)")];
 
 #[test]
 fn corpus_parse_and_byte_stable() {
diff --git a/crates/psd/tests/merged_recovery.rs b/crates/psd/tests/merged_recovery.rs
new file mode 100644
index 0000000000..40e310d8a4
--- /dev/null
+++ b/crates/psd/tests/merged_recovery.rs
@@ -0,0 +1,43 @@
+//! Opt-in merged-image recovery must not weaken strict parsing or lose encoded bytes.
+
+use photocraft_psd::{Compression, PsdError, PsdFile, Version, compression, testgen};
+
+#[test]
+fn recovery_is_explicit_and_preserves_the_original_file() {
+    for version in [Version::Psd, Version::Psb] {
+        for compression in Compression::ALL {
+            let mut original = testgen::small(version, compression);
+            original.image_data.data.pop();
+            let bytes = original.to_bytes().unwrap();
+            let strict_error = PsdFile::from_bytes(&bytes).unwrap_err();
+            for want in [false, true] {
+                let rejected = PsdFile::from_bytes_and_merged_recovering(&bytes, |_| want, |_| false).unwrap_err();
+                assert_eq!(rejected, strict_error);
+                let (file, merged) = PsdFile::from_bytes_and_merged_recovering(&bytes, |_| want, |_| true).unwrap();
+                assert_eq!(merged.unwrap().unwrap_err(), strict_error);
+                assert_eq!(file, original);
+                assert_eq!(file.to_bytes().unwrap(), bytes, "{version:?} {compression:?}");
+            }
+        }
+    }
+}
+
+#[test]
+fn recovery_does_not_accept_missing_compression_or_incomplete_layers() {
+    let original = testgen::small(Version::Psd, Compression::Raw);
+    let bytes = original.to_bytes().unwrap();
+    let merged_offset = bytes.len() - original.image_data.data.len() - 2;
+    for cut in [merged_offset - 1, merged_offset, merged_offset + 1] {
+        assert!(PsdFile::from_bytes_and_merged_recovering(&bytes[..cut], |_| true, |_| true).is_err(), "cut {cut}");
+    }
+}
+
+#[test]
+fn recovery_never_suppresses_a_merged_stream_limit_error() {
+    let mut original = testgen::small(Version::Psd, Compression::Zip);
+    original.image_data.data = compression::zip_compress(&vec![0; (1 << 20) + 4096]);
+    let bytes = original.to_bytes().unwrap();
+    for want in [false, true] {
+        assert!(matches!(PsdFile::from_bytes_and_merged_recovering(&bytes, |_| want, |_| true), Err(PsdError::LimitExceeded(_))));
+    }
+}
diff --git a/crates/psd/tests/swatch_malformed.rs b/crates/psd/tests/swatch_malformed.rs
index 8fa88e7d68..91a83b4285 100644
--- a/crates/psd/tests/swatch_malformed.rs
+++ b/crates/psd/tests/swatch_malformed.rs
@@ -444,6 +444,32 @@ fn ase_swatch_cap_is_enforced_on_hostile_input() {
     assert!(ase::parse(&f).is_ok(), "a file exactly at MAX_SWATCHES must still parse");
 }
 
+/// A file with more group starts than [`ase::MAX_GROUPS`] must be refused. Each block here is an
+/// empty group start, six bytes long.
+#[test]
+fn ase_group_cap_is_enforced_on_hostile_input() {
+    let mut block = Vec::new();
+    block.extend_from_slice(&0xC001u16.to_be_bytes()); // block type: group start
+    block.extend_from_slice(&0u32.to_be_bytes()); // empty body: no name
+
+    let total = ase::MAX_GROUPS + 1;
+    let mut f = b"ASEF".to_vec();
+    f.extend_from_slice(&1u16.to_be_bytes()); // major
+    f.extend_from_slice(&0u16.to_be_bytes()); // minor
+    f.extend_from_slice(&(total as u32).to_be_bytes());
+    for _ in 0..total {
+        f.extend_from_slice(&block);
+    }
+    assert!(matches!(ase::parse(&f), Err(PsdError::LimitExceeded(_))), "a file over MAX_GROUPS must be refused");
+    // With one block fewer the file is exactly at the cap and parses.
+    f.truncate(f.len() - block.len());
+    let trimmed = total - 1;
+    // signature (4) + major (2) + minor (2) puts the block count at offset 8.
+    f[8..12].copy_from_slice(&(trimmed as u32).to_be_bytes());
+    let parsed = ase::parse(&f).expect("a file exactly at MAX_GROUPS must still parse");
+    assert_eq!(parsed.entries.len(), ase::MAX_GROUPS, "every group up to the cap is kept");
+}
+
 /// A name longer than [`ase::MAX_NAME_UNITS`] is truncated on read rather than refused: the file
 /// is legal, only the name is long, and `read_name` is the only thing standing between the declared
 /// length and the string it builds.
diff --git a/crates/psd/tests/tree.rs b/crates/psd/tests/tree.rs
index ea4eaeec2a..ef448651fc 100644
--- a/crates/psd/tests/tree.rs
+++ b/crates/psd/tests/tree.rs
@@ -137,6 +137,60 @@ fn layer_tree_max_depth_drops_deeper_children() {
     assert_eq!(names(&f, &f.layer_tree_max_depth(0)), "g0[],top");
 }
 
+fn depth(nodes: &[LayerNode]) -> usize {
+    // Iterative so a deep tree cannot overflow the test's stack.
+    let mut max = 0;
+    let mut todo: Vec<(&LayerNode, usize)> = nodes.iter().map(|n| (n, 1)).collect();
+    while let Some((n, d)) = todo.pop() {
+        max = max.max(d);
+        todo.extend(n.children().iter().map(|c| (c, d + 1)));
+    }
+    max
+}
+
+/// #5758: layers under a divider that is never closed are hoisted to the enclosing level, as
+/// `layer_tree` does, also when the cap is shallower than the unclosed divider.
+#[test]
+fn layer_tree_max_depth_hoists_unclosed_divider_children() {
+    let f = file_with(vec![rec("a", None), rec("</Layer group>", END), rec("b", None), rec("c", None)]);
+    assert_eq!(names(&f, &f.layer_tree()), "a,b,c");
+    assert_eq!(names(&f, &f.layer_tree_max_depth(1)), "a,b,c");
+    assert_eq!(names(&f, &f.layer_tree_max_depth(0)), "a,b,c");
+}
+
+/// #5758: a closed group inside unclosed dividers sits at the depth it ends up at after hoisting,
+/// so the cap keeps its node and drops only its deeper children.
+#[test]
+fn layer_tree_max_depth_keeps_closed_group_inside_unclosed_dividers() {
+    let mut v = vec![rec("</Layer group>", END), rec("</Layer group>", END)];
+    v.extend([rec("</Layer group>", END), rec("</Layer group>", END), rec("x", None), rec("g1", OPEN), rec("g0", OPEN)]);
+    let f = file_with(v);
+    assert_eq!(names(&f, &f.layer_tree()), "g0[g1[x]]");
+    assert_eq!(names(&f, &f.layer_tree_max_depth(1)), "g0[g1[]]");
+    assert_eq!(names(&f, &f.layer_tree_max_depth(0)), "g0[]");
+}
+
+/// #5758: thousands of unclosed dividers around a closed chain stay bounded by the cap and keep
+/// every layer the full tree has.
+#[test]
+fn layer_tree_max_depth_bounds_deep_unclosed_chain() {
+    let mut v = Vec::new();
+    for i in 0..16_000 {
+        v.push(rec("</Layer group>", END));
+        v.push(rec(&format!("l{i}"), None));
+    }
+    v.extend([rec("</Layer group>", END), rec("</Layer group>", END), rec("</Layer group>", END), rec("x", None)]);
+    v.extend([rec("g2", OPEN), rec("g1", OPEN), rec("g0", OPEN)]);
+    let f = file_with(v);
+    let full = f.layer_tree();
+    assert_eq!(full.len(), 16_001);
+    assert_eq!(depth(&full), 4);
+    let capped = f.layer_tree_max_depth(1);
+    assert!(depth(&capped) <= 2);
+    assert_eq!(capped.len(), 16_001);
+    assert_eq!(names(&f, &capped[16_000..]), "g0[g1[]]");
+    assert_eq!(names(&f, &capped[..2]), "l0,l1");
+}
 #[test]
 fn folder_without_divider_is_empty_group() {
     let f = file_with(vec![rec("a", None), rec("G", OPEN), rec("b", None)]);
diff --git a/crates/raw/src/cr3.rs b/crates/raw/src/cr3.rs
index bb2119e7d4..04e7e2ec5f 100644
--- a/crates/raw/src/cr3.rs
+++ b/crates/raw/src/cr3.rs
@@ -141,11 +141,7 @@ fn walk<'a>(raw: &'a [u8], b: &'a [u8], depth: usize, budget: &mut usize, found:
     }
     boxes(b, budget, |item, budget| match item.kind {
         b"moov" => walk(raw, item.body, depth + 1, budget, found),
-        b"trak" => {
-            if found.previews.len() < 128 {
-                found.previews.extend(track_preview(raw, item.body, budget, &found.media));
-            }
-        }
+        b"trak" if found.previews.len() < 128 => found.previews.extend(track_preview(raw, item.body, budget, &found.media)),
         b"uuid" => {
             if item.body.get(..16) == Some(META_UUID)
                 && let Some(children) = item.body.get(16..)
diff --git a/crates/tablet/tests/monitor_macos.rs b/crates/tablet/tests/monitor_macos.rs
index 0a32923aa1..82f371cdb1 100644
--- a/crates/tablet/tests/monitor_macos.rs
+++ b/crates/tablet/tests/monitor_macos.rs
@@ -14,6 +14,16 @@ fn main() {
     use photocraft_tablet::Sample;
     use photocraft_tablet::macos::Monitor;
 
+    // Answer cargo-nextest's `--list` (and nothing for `--ignored`), as tests/mac_menu_appkit.rs
+    // in apps/photocraft does; `monitor_macos --exact` falls through to the test.
+    let args: Vec<String> = std::env::args().collect();
+    if args.iter().any(|a| a == "--list") {
+        if !args.iter().any(|a| a == "--ignored") {
+            println!("monitor_macos: test");
+        }
+        return;
+    }
+
     let mtm = MainThreadMarker::new().expect("harness = false runs on the main thread");
     let app = NSApplication::sharedApplication(mtm);
     let event = |kind: CGEventType, pressure: f64, tilt: (f64, f64), subtype: CGEventMouseSubtype| {
diff --git a/crates/testkit/Cargo.toml b/crates/testkit/Cargo.toml
index 0d69300d90..3e8bbed919 100644
--- a/crates/testkit/Cargo.toml
+++ b/crates/testkit/Cargo.toml
@@ -14,5 +14,7 @@ photocraft-raster = { workspace = true }
 serde_json = { workspace = true }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
-# In-process resident memory for the benchmarks (`perf`; MIT OR Apache-2.0).
-memory-stats = "1.2"
+# In-process resident memory for the benchmarks (`perf`; MIT OR Apache-2.0). `always_use_statm`:
+# on Linux read /proc/self/statm, not /proc/self/smaps, which walks every mapping under the mmap
+# lock and made the 2 ms sampler thread a fifth of a large bench's CPU time.
+memory-stats = { version = "1.2", features = ["always_use_statm"] }
diff --git a/crates/text/src/fonts.rs b/crates/text/src/fonts.rs
index 5ce71e59ac..756ce87455 100644
--- a/crates/text/src/fonts.rs
+++ b/crates/text/src/fonts.rs
@@ -35,7 +35,7 @@ pub static INTER_MEDIUM: LazyLock<Vec<u8>> = LazyLock::new(|| inflate_font(bundl
 pub static INTER_SEMIBOLD: LazyLock<Vec<u8>> = LazyLock::new(|| inflate_font(bundled_font!("Inter-SemiBold.ttf")));
 pub static JETBRAINS_MONO_REGULAR: LazyLock<Vec<u8>> = LazyLock::new(|| inflate_font(bundled_font!("JetBrainsMono-Regular.ttf")));
 
-/// Fonts shipped with Photocraft (OFL; licences in `assets/fonts`).
+/// Fonts shipped with PhotoCraft (OFL; licences in `assets/fonts`).
 pub static BUNDLED: [(&str, &LazyLock<Vec<u8>>); 4] = [
     ("Inter-Regular.ttf", &INTER_REGULAR),
     ("Inter-Medium.ttf", &INTER_MEDIUM),
diff --git a/crates/text/src/layout.rs b/crates/text/src/layout.rs
index e2bd223b3b..ae1bd552af 100644
--- a/crates/text/src/layout.rs
+++ b/crates/text/src/layout.rs
@@ -442,6 +442,8 @@ struct KernSlot {
     blank: bool,
     /// Advance along the line (px, horizontal scale included).
     advance: f32,
+    /// What horizontal scale adds to the shaped advance (px; negative below 100%).
+    growth: f32,
     /// A tab, shaped as a space; it advances to the next tab stop.
     tab: bool,
     /// Vertical type, upright glyph (its outline doesn't run along the column).
@@ -586,6 +588,12 @@ impl Layouter {
                 for p in style_props(&out.styles[si0], k, &fallback, si0 as u32, small_caps[si0]) {
                     b.push_default(p);
                 }
+                // Paragraph text breaks a word wider than the box at the box edge, as Photoshop
+                // does (#6694): parley's default only breaks at UAX #14 opportunities and lets the
+                // word run out of the box. Point text has no width to overflow.
+                if is_box {
+                    b.push_default(StyleProperty::OverflowWrap(parley::style::OverflowWrap::BreakWord));
+                }
                 for (ri, st) in out.styles.iter().enumerate() {
                     let rs = run_starts[ri];
                     let (a, z) = (rs.max(prange.start), (rs + runs[ri].len).min(content_end));
@@ -640,11 +648,29 @@ impl Layouter {
             // Box extent along the lines: width, or height for vertical type (columns).
             let (line_origin, line_len) = if vertical { (box_rect.1, box_rect.3) } else { (box_rect.0, box_rect.2) };
             let avail = if is_box { Some((line_len - indent_start - indent_end).max(1.0)) } else { None };
+            // Horizontal scale is applied after shaping, so paragraph text breaks at the box
+            // width divided by it (#5565). Mixed scales break at the largest, so no line
+            // overflows the box.
+            let break_scale = if is_box {
+                let si0 = style_at(prange.start);
+                (0..out.styles.len())
+                    .filter(|&ri| {
+                        let rs = run_starts.get(ri).copied().unwrap_or(0);
+                        let end = rs.saturating_add(runs.get(ri).map_or(0, |r| r.len));
+                        ri == si0 || (rs.max(prange.start) < end.min(content_end))
+                    })
+                    .filter_map(|ri| out.styles.get(ri))
+                    .map(effective_horizontal_scale)
+                    .fold(0.0f32, f32::max)
+            } else {
+                1.0
+            };
+            let break_scale = if break_scale > 0.0 { break_scale } else { 1.0 };
             let break_lines = |layout: &mut Layout<RunBrush>| {
                 if first_indent != 0.0 {
-                    layout.set_text_indent(first_indent, IndentOptions::default());
+                    layout.set_text_indent(first_indent / break_scale, IndentOptions::default());
                 }
-                layout.break_all_lines(avail);
+                layout.break_all_lines(avail.map(|a| a / break_scale));
             };
             // Paragraph text: a tab is never wider than a space plus one tab interval, so breaking
             // lines at that width keeps the expanded tabs inside the box, but can wrap early.
@@ -773,6 +799,7 @@ impl Layouter {
                             blank: first.is_none() || c.is_space_or_nbsp() || c.text_range().end <= prefix.len(),
                             upright: vertical && c.first_style().brush.1 != VClass::Rotate as u8,
                             advance: c.advance() * hs,
+                            growth: c.advance() * (hs - 1.0),
                             tab: tabs.binary_search(&c.text_range().start).is_ok(),
                         });
                     }
@@ -817,10 +844,15 @@ impl Layouter {
                 // moves the whole line).
                 let mut pos = indent_start + if li == 0 { first_indent } else { 0.0 };
                 let mut trailing_tabs = 0.0f32;
+                let mut trailing_growth = 0.0f32;
                 for (j, s) in slots.iter().enumerate() {
+                    // Trailing whitespace is outside the line's extent (`adv`).
+                    let trailing = s.blank && slots[j + 1..].iter().all(|n| n.blank);
+                    if trailing {
+                        trailing_growth += s.growth;
+                    }
                     if s.tab {
                         kern_px[j] = next_tab_stop(pos, tab_px) - pos - s.advance;
-                        // Trailing whitespace is outside the line's extent (`adv`).
                         if slots[j + 1..].iter().all(|n| n.blank) {
                             trailing_tabs += kern_px[j];
                         }
@@ -858,15 +890,18 @@ impl Layouter {
                 };
                 let dx = if is_box {
                     let base = line_origin + indent_start - kern_align;
-                    let slack = avail.unwrap_or(0.0) - adv - line_kern;
+                    let slack = avail.unwrap_or(0.0) - adv * break_scale - line_kern;
+                    // Parley aligned the unscaled line in `avail / break_scale`: scale its
+                    // indent and alignment offset back to the box.
+                    let scaled_offset = m.offset * (break_scale - 1.0);
                     base + if last_line {
                         match ps.align {
                             TextAlign::JustifyCenter => slack * 0.5 - m.offset,
                             TextAlign::JustifyRight => slack - m.offset,
-                            _ => 0.0,
+                            _ => scaled_offset,
                         }
                     } else {
-                        0.0
+                        scaled_offset
                     }
                 } else {
                     let target = match ps.align {
@@ -1031,7 +1066,7 @@ impl Layouter {
                     range: map(lr.start)..map(lr.end).min(content_end),
                     baseline,
                     x0,
-                    x1: x0 + adv + extra - trailing_tabs,
+                    x1: x0 + adv + extra - trailing_tabs - trailing_growth,
                     ascent,
                     descent,
                     paragraph: pi,
@@ -1043,6 +1078,11 @@ impl Layouter {
     }
 }
 
+/// A style's horizontal scale; unset (zero or negative) is 100%.
+fn effective_horizontal_scale(st: &CharStyle) -> f32 {
+    if st.horizontal_scale > 0.0 && st.horizontal_scale.is_finite() { st.horizontal_scale } else { 1.0 }
+}
+
 /// The first tab stop after `pos` (px from the anchor or box edge); stops are `interval` apart.
 fn next_tab_stop(pos: f32, interval: f32) -> f32 {
     if interval > 0.0 && pos.is_finite() { ((pos + 1e-3) / interval).floor() * interval + interval } else { pos }
diff --git a/crates/text/src/lib.rs b/crates/text/src/lib.rs
index ad5e90ae35..af4de19f52 100644
--- a/crates/text/src/lib.rs
+++ b/crates/text/src/lib.rs
@@ -1,4 +1,4 @@
-//! Photocraft's type engine.
+//! PhotoCraft's type engine.
 //!
 //! * [`fonts::FontDb`]: bundled fonts (Inter, JetBrains Mono; always available, including on the
 //!   web), optional system fonts from platform directory scans plus Fontconfig's Linux file list,
diff --git a/crates/text/src/psd.rs b/crates/text/src/psd.rs
index 0092fcf92e..8c502c75af 100644
--- a/crates/text/src/psd.rs
+++ b/crates/text/src/psd.rs
@@ -351,11 +351,14 @@ pub fn text_layer_from_tysh(data: &[u8], dpi: f32) -> Option<TextLayer> {
     if let Some(w) = &t.warp {
         let style = enum_value(w, "warpStyle").unwrap_or_else(|| "warpNone".into());
         if style != "warpNone" {
+            // Bend and distortion are percentages in -100..100 (as `type.warpText` clamps them);
+            // clamping before the cast keeps a value beyond f32 from becoming inf.
+            let pct = |k: &str| dnum(w.get(k)).unwrap_or(0.0).clamp(-100.0, 100.0) as f32;
             layer.warp = Some(TextWarp {
                 style,
-                value: dnum(w.get("warpValue")).unwrap_or(0.0) as f32,
-                horizontal_distortion: dnum(w.get("warpPerspective")).unwrap_or(0.0) as f32,
-                vertical_distortion: dnum(w.get("warpPerspectiveOther")).unwrap_or(0.0) as f32,
+                value: pct("warpValue"),
+                horizontal_distortion: pct("warpPerspective"),
+                vertical_distortion: pct("warpPerspectiveOther"),
                 horizontal: enum_value(w, "warpRotate").as_deref() != Some("Vrtc"),
             });
         }
@@ -1362,6 +1365,19 @@ mod nonfinite_tests {
         assert_eq!(char_style(None, &d, &[], 1.0).size_pt, 24.0);
     }
 
+    #[test]
+    fn warp_values_beyond_f32_clamp_to_the_warp_range() {
+        let warp = Descriptor::new("warp")
+            .with("warpStyle", enumv("warpStyle", "warpArc"))
+            .with("warpValue", D::Double(1e39))
+            .with("warpPerspective", D::Double(-1e39))
+            .with("warpPerspectiveOther", D::Double(250.0))
+            .with("warpRotate", enumv("Ornt", "Hrzn"));
+        let tysh = write_tysh(&TySh { transform: Affine::IDENTITY, text: Descriptor::new("TxLr"), warp: Some(warp), bounds: [0.0; 4] });
+        let w = text_layer_from_tysh(&tysh, 72.0).and_then(|l| l.warp).unwrap();
+        assert_eq!((w.value, w.horizontal_distortion, w.vertical_distortion), (100.0, -100.0, 100.0));
+    }
+
     #[test]
     fn infinite_dpi_does_not_write_a_zero_size() {
         let layer =
diff --git a/crates/text/src/tests.rs b/crates/text/src/tests.rs
index 13de665ccd..894ecf4e4f 100644
--- a/crates/text/src/tests.rs
+++ b/crates/text/src/tests.rs
@@ -272,6 +272,44 @@ fn box_text_wraps_inside_width() {
     assert_eq!(l2.lines.len(), 2);
 }
 
+/// #5565: paragraph text breaks at its horizontally scaled width. At 60% it breaks like 100%
+/// text in a box 1/0.6 as wide, and the lines fill the box instead of wrapping early.
+#[test]
+fn horizontal_scale_breaks_paragraph_lines_at_the_scaled_width() {
+    let mut e = TextEngine::new();
+    let text = "The quick brown fox jumps over the lazy dog again and again until the paragraph wraps";
+    let boxed = |scale: f32, width: f32, align: TextAlign| {
+        let style = CharStyle { font_family: "Inter".into(), size_pt: 12.0, horizontal_scale: scale, ..Default::default() };
+        let t = TextLayer { shape: TextShape::Box { x: 10.0, y: 0.0, width, height: 1000.0 }, ..styled(text, style) };
+        with_para(t, ParagraphStyle { align, ..Default::default() })
+    };
+    let ranges = |l: &crate::TextLayout| l.lines.iter().map(|ln| ln.range.clone()).collect::<Vec<_>>();
+    for scale in [0.6f32, 1.5] {
+        let scaled = e.layout(&boxed(scale, 120.0, TextAlign::Left), 72.0);
+        let plain = e.layout(&boxed(1.0, 120.0 / scale, TextAlign::Left), 72.0);
+        assert!(scaled.lines.len() > 1, "{scale}");
+        assert_eq!(ranges(&scaled), ranges(&plain), "{scale}: same breaks as unscaled text in the widened box");
+        for (li, ln) in scaled.lines.iter().enumerate() {
+            assert!(ln.x0 >= 10.0 - 1e-3 && ln.x1 <= 130.0 + 1e-3, "{scale}: {ln:?}");
+            // The extent ends at the last glyph, not after the scaled trailing space.
+            let ink = scaled.clusters.iter().filter(|c| c.line == li && !text[c.range.clone()].trim().is_empty());
+            assert!((ink.map(|c| c.x + c.advance).fold(0.0, f32::max) - ln.x1).abs() < 0.01, "{scale}: {ln:?}");
+        }
+    }
+    // At 60% the lines use the box: the first would not fit at 100%.
+    let scaled = e.layout(&boxed(0.6, 120.0, TextAlign::Left), 72.0);
+    assert!(scaled.lines[0].x1 > 110.0, "{:?}", scaled.lines[0]);
+    // Centred and right-aligned lines are placed by their scaled width.
+    let c = e.layout(&boxed(0.6, 120.0, TextAlign::Center), 72.0);
+    for ln in &c.lines {
+        assert!(((ln.x0 + ln.x1) * 0.5 - 70.0).abs() < 0.5, "{ln:?}");
+    }
+    let r = e.layout(&boxed(0.6, 120.0, TextAlign::Right), 72.0);
+    for ln in &r.lines {
+        assert!((ln.x1 - 130.0).abs() < 0.5, "{ln:?}");
+    }
+}
+
 #[test]
 fn alignment_point_and_box() {
     let mut e = TextEngine::new();
@@ -2008,3 +2046,37 @@ fn hyphenless_postscript_names_split_trailing_styles() {
         assert_eq!((r.family.as_str(), r.weight, r.italic), (family, weight, italic), "{ps}");
     }
 }
+
+/// A word wider than its paragraph box wraps at the box edge instead of running past it (#6694);
+/// a normal break opportunity still wins, and a box that fits the word lays out exactly as before.
+#[test]
+fn a_word_wider_than_the_paragraph_box_breaks_at_the_box_edge() {
+    let mut e = TextEngine::new();
+    let word = "BLOQUEADO?!";
+    let alone = e.layout(&point(word, 12.0), 72.0);
+    assert_eq!(alone.lines.len(), 1, "{:?}", alone.lines);
+    let word_width = width(&alone);
+    let narrow = 30.0;
+    assert!(word_width > narrow * 2.0, "{word_width}");
+
+    let mut t = point(word, 12.0);
+    t.shape = TextShape::Box { x: 0.0, y: 0.0, width: narrow, height: 200.0 };
+    let l = e.layout(&t, 72.0);
+    assert!(l.lines.len() >= 2, "{:?}", l.lines);
+    for line in &l.lines {
+        assert!(line.x1 <= narrow + 0.5, "{line:?}");
+    }
+    let joined: String = l.lines.iter().map(|l| &word[l.range.clone()]).collect();
+    assert_eq!(joined, word);
+
+    t.shape = TextShape::Box { x: 0.0, y: 0.0, width: word_width + 20.0, height: 200.0 };
+    let fits = e.layout(&t, 72.0);
+    assert_eq!(fits.lines.len(), 1, "{:?}", fits.lines);
+    assert!((width(&fits) - word_width).abs() < 0.01, "{} vs {word_width}", width(&fits));
+
+    let mut spaced = point("ab cd", 12.0);
+    spaced.shape = TextShape::Box { x: 0.0, y: 0.0, width: narrow, height: 200.0 };
+    let l = e.layout(&spaced, 72.0);
+    assert_eq!(l.lines.len(), 2, "{:?}", l.lines);
+    assert_eq!(l.lines[1].range.start, 3, "{:?}", l.lines);
+}
diff --git a/crates/ui-egui/Cargo.toml b/crates/ui-egui/Cargo.toml
index aeefacaf2f..e5bf497c81 100644
--- a/crates/ui-egui/Cargo.toml
+++ b/crates/ui-egui/Cargo.toml
@@ -35,6 +35,8 @@ eframe = { workspace = true, features = ["wgpu", "accesskit"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
+# Display order of right-to-left labels (`bidi_text.rs`); already linked through usvg.
+unicode-bidi = "0.3"
 base64 = "0.22"
 # Inflating the translation catalogs, stored deflated (build.rs); already linked through photocraft-io.
 flate2 = { workspace = true }
@@ -47,7 +49,7 @@ sys-locale = "=0.3.2"
 # Installed RAM for the GPU memory budget (`gpu_canvas::physical_memory`): the safe binding the
 # desktop app already uses, pinned to the same version.
 [target.'cfg(target_os = "windows")'.dependencies]
-winsafe = { version = "=0.0.29", default-features = false, features = ["kernel"] }
+winsafe = { version = "=0.0.29", default-features = false, features = ["kernel", "dxgi"] }
 
 [dev-dependencies]
 # egui's own default fonts in tests: the oracle for egui_fonts.rs, and contexts made with
diff --git a/crates/ui-egui/examples/huge_doc_bench.rs b/crates/ui-egui/examples/huge_doc_bench.rs
index 0454aefc3f..3ddbc5afab 100644
--- a/crates/ui-egui/examples/huge_doc_bench.rs
+++ b/crates/ui-egui/examples/huge_doc_bench.rs
@@ -200,9 +200,17 @@ fn main() {
         .map(|s| s.tiles().map(|(_, t)| t.bytes().len() as u64).sum::<u64>())
         .sum();
     let ram = photocraft_ui_egui::gpu_canvas::physical_memory();
-    let budget = photocraft_ui_egui::gpu_canvas::memory_budget(allowance, pixels, ram);
+    let vram = g.video_memory();
+    let budget = photocraft_ui_egui::gpu_canvas::memory_budget(allowance, pixels, ram, vram, 0);
     g.set_memory_budget(budget);
-    println!("RAM {} MB, document pixels {} MB, Memory Usage {} MB -> GPU budget {} MB", ram.unwrap_or(0) >> 20, pixels >> 20, allowance >> 20, budget >> 20);
+    println!(
+        "RAM {} MB, VRAM {} MB, document pixels {} MB, Memory Usage {} MB -> GPU budget {} MB",
+        ram.unwrap_or(0) >> 20,
+        vram.unwrap_or(0) >> 20,
+        pixels >> 20,
+        allowance >> 20,
+        budget >> 20
+    );
     let first_view = Rect::from_xywh((w as f32 * 0.1) as i32, (h as f32 * 0.1) as i32, 2560, 1440);
     g.set_focus(Some(if op == "view" { first_view } else { doc.bounds() }));
 
diff --git a/crates/ui-egui/examples/perf_scenarios.rs b/crates/ui-egui/examples/perf_scenarios.rs
index 1b71258473..72808cfabc 100644
--- a/crates/ui-egui/examples/perf_scenarios.rs
+++ b/crates/ui-egui/examples/perf_scenarios.rs
@@ -242,6 +242,8 @@ struct Sizes {
     big_layer: (u32, u32),
     /// Layers in the "150-layer document".
     many_layers: usize,
+    /// The full-canvas layers document (L3): size and layer count.
+    full_layers: (u32, u32, usize),
     /// The 16-bit document (15000 × 10000).
     huge16: (u32, u32),
     /// The 32-bit document with 20 layers.
@@ -258,6 +260,7 @@ const FULL: Sizes = Sizes {
     layered: (5472, 3648),
     big_layer: (4243, 2828),
     many_layers: 150,
+    full_layers: (3000, 2000, 150),
     huge16: (15000, 10000),
     float32: (4000, 3000),
     ten_mp: (3872, 2592),
@@ -269,6 +272,7 @@ const QUICK: Sizes = Sizes {
     layered: (1600, 1066),
     big_layer: (1200, 800),
     many_layers: 40,
+    full_layers: (800, 600, 20),
     huge16: (2400, 1600),
     float32: (1200, 900),
     ten_mp: (1200, 800),
@@ -357,9 +361,10 @@ fn main() {
     // A panic in one group (a crash the scenario found) is reported against the row that was
     // running, and the other groups still run.
     type Group = fn(&mut Bench, &Sizes);
-    let groups: [(&str, Group); 5] = [
+    let groups: [(&str, Group); 6] = [
         ("layered", layered_scenarios),
         ("many layers", many_layer_scenarios),
+        ("full-canvas layers", full_canvas_layer_scenarios),
         ("bit depths", depth_scenarios),
         ("long operations", job_scenarios),
         ("algorithms", algorithm_scenarios),
@@ -538,6 +543,67 @@ fn layered_scenarios(b: &mut Bench, sz: &Sizes) {
     });
 }
 
+/// Layers overhaul L3: edits that redraw the whole document (a layer's opacity, hiding it) with
+/// many full-canvas layers, under the app's own GPU memory budget (Memory Usage at its default,
+/// the adapter's kind; `gpu_canvas::memory_budget`). Past what the budget holds, each one went to
+/// the CPU compositor (2.6 s at 150 layers of 6 MP on a discrete card).
+fn full_canvas_layer_scenarios(b: &mut Bench, sz: &Sizes) {
+    let opacity = "opacity of a layer among many full-canvas layers + refresh";
+    let hide = "hide a layer among many full-canvas layers + refresh";
+    if !b.wanted(opacity) && !b.wanted(hide) {
+        return;
+    }
+    b.current = Some(opacity.to_string());
+    let (w, h, n) = sz.full_layers;
+    let mut s = Session::new();
+    let built = (|| -> Res<u64> {
+        exec(&mut s, "file.new", json!({"width": w, "height": h, "background": "white"}))?;
+        let mut mid = 0;
+        for i in 0..n as u32 {
+            exec(&mut s, "layer.new.layer", json!({"name": format!("full {i}")}))?;
+            exec(&mut s, "edit.fill", json!({"color": format!("#{:02x}{:02x}80", (i * 37) % 256, (i * 91) % 256), "opacity": 3}))?;
+            if i % 7 == 3 {
+                exec(&mut s, "layer.layerStyle.dropShadow", json!({"distance": 6, "size": 8}))?;
+            }
+            if i as usize == n / 2 {
+                mid = active_layer(&s)?;
+            }
+        }
+        Ok(mid)
+    })();
+    let mid = match built {
+        Ok(v) => v,
+        Err(e) => {
+            b.errors.push((opacity.to_string(), e));
+            return;
+        }
+    };
+    if let (Some((g, _)), Some(st)) = (&b.gpu, s.active()) {
+        // As the app counts it (`canvas::gpu_budget`).
+        let pixels = st.memory_bytes() as u64;
+        let allowance = u64::from(photocraft_engine::prefs::Performance::default().memory_usage_mb) << 20;
+        g.set_memory_budget(photocraft_ui_egui::gpu_canvas::memory_budget(
+            allowance,
+            pixels,
+            photocraft_ui_egui::gpu_canvas::physical_memory(),
+            g.video_memory(),
+            0,
+        ));
+    }
+    let _ = b.refresh(&s, true);
+    let reps = b.reps;
+    b.time(opacity, &mut s, reps, true, |b, s, i| {
+        let t = Instant::now();
+        exec(s, "layer.setProps", json!({"layer": mid, "opacity": if i % 2 == 0 { 0.5 } else { 1.0 }}))?;
+        Ok(ms(t) + b.refresh(s, false)?)
+    });
+    b.time(hide, &mut s, reps, true, |b, s, i| {
+        let t = Instant::now();
+        exec(s, "layer.setProps", json!({"layer": mid, "visible": i % 2 == 1}))?;
+        Ok(ms(t) + b.refresh(s, false)?)
+    });
+}
+
 /// #209: arrow-key nudge in the 150-layer document; #1771: a new layer there.
 fn many_layer_scenarios(b: &mut Bench, sz: &Sizes) {
     // Row names stay stable across modes: the layer count is in the mode, not the key.
diff --git a/crates/ui-egui/examples/snapshot.rs b/crates/ui-egui/examples/snapshot.rs
index 31e4c60301..0d227255db 100644
--- a/crates/ui-egui/examples/snapshot.rs
+++ b/crates/ui-egui/examples/snapshot.rs
@@ -1,4 +1,4 @@
-//! Render the full Photocraft UI offscreen (no window, no focus stealing) and save a PNG.
+//! Render the full PhotoCraft UI offscreen (no window, no focus stealing) and save a PNG.
 //!
 //! ```sh
 //! cargo run --release -p photocraft-ui-egui --example snapshot -- \
diff --git a/crates/ui-egui/src/adjust_preview.rs b/crates/ui-egui/src/adjust_preview.rs
index d94d58bff6..f74afc8595 100644
--- a/crates/ui-egui/src/adjust_preview.rs
+++ b/crates/ui-egui/src/adjust_preview.rs
@@ -436,6 +436,9 @@ pub(crate) fn retain_documents(app: &mut PhotocraftApp) {
     if app.adjust_preview.as_ref().is_some_and(|p| !app.session.documents().iter().any(|st| st.doc.id == p.doc)) {
         app.adjust_preview = None;
     }
+    if app.live_adjust_preview.as_ref().is_some_and(|p| !app.session.documents().iter().any(|st| st.doc.id == p.doc)) {
+        app.live_adjust_preview = None;
+    }
 }
 
 /// GPU texture keys the preview uses besides the documents' own (keep them alive).
@@ -444,6 +447,108 @@ pub fn gpu_keys(app: &PhotocraftApp) -> Option<u64> {
     p.proxy.as_ref().map(|g| g.base.id.0)
 }
 
+// ---------------------------------------------------------------------------------------------
+// The Properties panel's live adjustment-layer preview (`canvas::display_doc`'s `live_adjust`).
+//
+// Dragging a control there shows the document with that layer's adjustment replaced. Unlike the
+// dialog above it needs no temporary layer: the layer is already in the document. What it did
+// lack was a damage region, so every parameter value recomposited the whole document — on the
+// GPU canvas at 100 % zoom that is the full size, measured at about 7 ms per megapixel, which
+// made #5778 a latency regression (#6839). These give that path the same treatment the dialog
+// gets: a session-tagged key, the layer's area as the damage, and of that only what the view
+// shows, catching up as the view moves.
+
+/// Tag of the Properties-panel live-adjust preview keys. Distinct from [`TAG`], so a key is
+/// never mistaken for the dialog's.
+pub const LIVE_TAG: u64 = 1 << 58;
+/// Bits of a live-adjust key that identify the session (document, revision, layer); below them
+/// the settings hash. The session occupies bits 40..58, under [`LIVE_TAG`].
+const LIVE_SESSION_SHIFT: u32 = 40;
+/// Mask of the session part of a live-adjust key (18 bits).
+const LIVE_SESSION_MASK: u64 = (1 << 18) - 1;
+
+/// One Properties-panel drag: which layer of which document revision, the area its adjustment
+/// can change, and what the canvas has composited of it so far.
+pub struct LiveAdjust {
+    doc: DocId,
+    revision: u64,
+    session: u64,
+    region: Rect,
+    /// The main canvas texture shows preview `key` only within this rect; elsewhere in the
+    /// region it is older (see [`live_uncovered`]).
+    covered: Option<(u64, Rect)>,
+}
+
+/// The area an adjustment layer can change: the whole document.
+///
+/// It is deliberately not narrowed by the layer's mask. A mask's coverage can live entirely in
+/// its surface's *default pixel* with no tiles written — [`LayerMask::reveal_all`], which is what
+/// `layer.newAdjustmentLayer` gives every adjustment layer — and such a mask reports an empty
+/// `content_bounds()`. Intersecting with that emptied the region, so the damage was empty and the
+/// compositor drew nothing at all for the whole drag. A mask only bounds the effect when it hides
+/// outside its content (default pixel 0); that narrowing is worth little here, since the damage is
+/// clipped to the view anyway ([`live_switch_damage`]), and is not worth the risk of showing stale
+/// pixels. Too large only costs pixels; too small freezes the preview.
+fn live_region(doc: &Document, layer: LayerId) -> Rect {
+    if doc.layer(layer).is_none() {
+        return Rect::EMPTY;
+    }
+    doc.bounds()
+}
+
+/// The preview key for `params` on `layer` of `doc` at `revision`, starting a session (and
+/// measuring its region) when the document, revision or layer changes.
+pub fn live_key(app: &mut PhotocraftApp, doc: &Document, revision: u64, layer: LayerId, params: &Value) -> u64 {
+    let session = hash(&[&doc.id.0.to_le_bytes(), &revision.to_le_bytes(), &layer.0.to_le_bytes()]);
+    if app.live_adjust_preview.as_ref().is_none_or(|p| p.session != session) {
+        app.live_adjust_preview = Some(LiveAdjust { doc: doc.id, revision, session, region: live_region(doc, layer), covered: None });
+    }
+    let h = hash(&[params.to_string().as_bytes()]);
+    LIVE_TAG | ((session & LIVE_SESSION_MASK) << LIVE_SESSION_SHIFT) | (h & ((1 << LIVE_SESSION_SHIFT) - 1))
+}
+
+/// The canvas area to recomposite when document `doc` (at `revision`) switches between two of
+/// this drag's previews, or between one and the committed document (0).
+pub fn live_switch_region(app: &PhotocraftApp, doc: DocId, revision: u64, from: u64, to: u64) -> Option<Rect> {
+    let p = app.live_adjust_preview.as_ref()?;
+    if p.doc != doc || p.revision != revision {
+        return None;
+    }
+    let prefix = LIVE_TAG | ((p.session & LIVE_SESSION_MASK) << LIVE_SESSION_SHIFT);
+    let ours = |k: u64| k == 0 || k >> LIVE_SESSION_SHIFT == prefix >> LIVE_SESSION_SHIFT;
+    (ours(from) && ours(to) && (from != 0 || to != 0)).then_some(p.region)
+}
+
+/// The part of a switch's region to composite now: to a preview, only what the view shows,
+/// remembered so [`live_uncovered`] catches up as the view moves; back to the committed
+/// document (key 0), the whole region.
+pub fn live_switch_damage(app: &mut PhotocraftApp, to: u64, region: Rect, visible: Rect) -> Rect {
+    let Some(p) = app.live_adjust_preview.as_mut() else { return region };
+    if to == 0 {
+        p.covered = None;
+        return region;
+    }
+    let shown = region.intersect(&visible);
+    p.covered = Some((to, shown));
+    shown
+}
+
+/// Where the main canvas texture (showing preview `key`) is out of date within `visible`: the
+/// region's visible part when the view moved past what was composited. Marks it covered.
+pub fn live_uncovered(app: &mut PhotocraftApp, doc: DocId, key: u64, visible: Rect) -> Option<Rect> {
+    let p = app.live_adjust_preview.as_mut().filter(|p| p.doc == doc)?;
+    let (k, cov) = p.covered?;
+    if k != key {
+        return None;
+    }
+    let want = p.region.intersect(&visible);
+    if want.is_empty() || cov.contains_rect(&want) {
+        return None;
+    }
+    p.covered = Some((k, want));
+    Some(want)
+}
+
 #[cfg(test)]
 #[path = "adjust_preview_tests.rs"]
 mod tests;
diff --git a/crates/ui-egui/src/adjust_preview_tests.rs b/crates/ui-egui/src/adjust_preview_tests.rs
index f3e33a723b..0b5337da7a 100644
--- a/crates/ui-egui/src/adjust_preview_tests.rs
+++ b/crates/ui-egui/src/adjust_preview_tests.rs
@@ -333,3 +333,60 @@ fn proxy_preview_has_its_own_ids() {
     }
     assert!(proxy_with_settings(&proxy, "levels", &json!({"gamma": "x"})).is_err());
 }
+
+/// A Properties-panel drag damages the layer's area and only the part of it the view shows,
+/// catching up as the view moves; a new document revision ends the session (#6839).
+#[test]
+fn a_live_adjust_drag_damages_only_the_visible_part_of_its_layer() {
+    let (doc, target) = document(ColorMode::Rgb, SampleType::U8, false);
+    let (id, bounds) = (doc.id, doc.bounds());
+    let mut app = app_with(doc.clone(), target);
+
+    let k1 = live_key(&mut app, &doc, 7, target, &json!({"gamma": 1.1}));
+    let k2 = live_key(&mut app, &doc, 7, target, &json!({"gamma": 1.4}));
+    assert_ne!(k1, k2, "a different setting is a different key");
+    assert_eq!(k1 & LIVE_TAG, LIVE_TAG, "keys carry the live tag");
+    assert_eq!(k1 >> LIVE_SESSION_SHIFT, k2 >> LIVE_SESSION_SHIFT, "the same drag is one session");
+    assert_ne!(k1 >> LIVE_SESSION_SHIFT, TAG >> LIVE_SESSION_SHIFT, "never the dialog's tag");
+
+    // Between two of the drag's previews, and between one and the committed document.
+    let region = live_switch_region(&app, id, 7, k1, k2).expect("same session");
+    assert_eq!(region, bounds, "the region is the whole document");
+    assert!(live_switch_region(&app, id, 7, 0, k2).is_some(), "from the committed document");
+    assert!(live_switch_region(&app, id, 7, k1, 0).is_some(), "back to the committed document");
+    assert!(live_switch_region(&app, id, 7, 0, 0).is_none(), "the document to itself is no switch");
+    assert!(live_switch_region(&app, id, 8, k1, k2).is_none(), "another revision is another session");
+
+    // Only the visible part is composited now; moving the view asks for the rest.
+    let mid = region.x0 + region.width() as i32 / 2;
+    let left = Rect::new(region.x0, region.y0, mid, region.y1);
+    assert_eq!(live_switch_damage(&mut app, k2, region, left), region.intersect(&left));
+    assert!(live_uncovered(&mut app, id, k2, left).is_none(), "what was just composited is covered");
+    let right = Rect::new(mid, region.y0, region.x1, region.y1);
+    assert_eq!(live_uncovered(&mut app, id, k2, right), Some(region.intersect(&right)), "the view moved");
+    assert!(live_uncovered(&mut app, id, k2, right).is_none(), "and is covered once composited");
+    assert!(live_uncovered(&mut app, id, k1, right).is_none(), "another preview's coverage is not this one's");
+
+    // Switching back to the document composites the whole region, not just the view.
+    assert_eq!(live_switch_damage(&mut app, 0, region, left), region);
+}
+
+/// A reveal-all mask stores its coverage in the surface's default pixel and reports an empty
+/// `content_bounds()`. Narrowing the region by it emptied the damage and the canvas drew nothing
+/// for a whole drag — every adjustment layer `layer.newAdjustmentLayer` creates has one (#6839).
+#[test]
+fn a_reveal_all_mask_does_not_empty_the_damage_region() {
+    let (mut doc, target) = document(ColorMode::Rgb, SampleType::U8, false);
+    let bounds = doc.bounds();
+    let mask = photocraft_doc::LayerMask::reveal_all();
+    assert!(mask.surface.content_bounds().is_empty(), "a reveal-all mask has no written content");
+    doc.layer_mut(target).expect("target").mask = Some(mask);
+    let id = doc.id;
+    let mut app = app_with(doc.clone(), target);
+
+    let k1 = live_key(&mut app, &doc, 3, target, &json!({"gamma": 1.1}));
+    let k2 = live_key(&mut app, &doc, 3, target, &json!({"gamma": 1.4}));
+    let region = live_switch_region(&app, id, 3, k1, k2).expect("same session");
+    assert_eq!(region, bounds, "the whole document, not the mask's empty content");
+    assert!(!live_switch_damage(&mut app, k2, region, bounds).is_empty(), "something is composited");
+}
diff --git a/crates/ui-egui/src/analysis_ui.rs b/crates/ui-egui/src/analysis_ui.rs
index 09aaf17670..527d58eda0 100644
--- a/crates/ui-egui/src/analysis_ui.rs
+++ b/crates/ui-egui/src/analysis_ui.rs
@@ -281,7 +281,8 @@ pub fn pointer(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers) ->
             set_ruler(app, r);
         }
         (Tool::Ruler, ToolEvent::Up { .. }) => {
-            if app.ui.analysis.drag.take() == Some(Drag::RulerNew) && doc.measurement.ruler.is_some_and(|r| dist(r.start, r.end) < 0.5) {
+            let drag = app.ui.analysis.drag.take();
+            if drag == Some(Drag::RulerNew) && doc.measurement.ruler.is_some_and(|r| dist(r.start, r.end) < 0.5) {
                 let _ = app.run("image.analysis.rulerTool", json!({"clear": true}));
             }
         }
@@ -743,7 +744,8 @@ pub fn windows(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 }
             }
             Some((id, p)) => {
-                if app.run(id, p).is_ok() {
+                let result = app.run(id, p);
+                if result.is_ok() {
                     app.ui.analysis.log_selected.clear();
                 }
             }
diff --git a/crates/ui-egui/src/anchor_tools.rs b/crates/ui-egui/src/anchor_tools.rs
index 9dc8b6cfe5..e6f9ac72d3 100644
--- a/crates/ui-egui/src/anchor_tools.rs
+++ b/crates/ui-egui/src/anchor_tools.rs
@@ -7,9 +7,10 @@
 //! * Delete Anchor Point: hovering an anchor highlights it; a click removes it
 //!   (`path.deleteAnchor`), joining its neighbours.
 //! * ⌥ swaps the two tools and ⌘/Ctrl is Direct Selection (`direct_select`) while held.
-//! * The Pen does both with Auto Add/Delete on (its options bar, on by default, #4144), on the
-//!   active path only and while no path is being drawn: a click on a segment adds, a click on an
-//!   anchor deletes, except an open subpath's end points; ⇧ turns it off while held.
+//! * The Pen does both with Auto Add/Delete on (its options bar, on by default, #4144): a click on
+//!   a segment adds, a click on an anchor deletes, except an open subpath's end points; ⇧ turns it
+//!   off while held. It edits the active path, or while a path is being drawn that path (#6140),
+//!   and drawing carries on from its last anchor.
 //!
 //! Each click is one command and one history step; a click on nothing it can edit does nothing.
 
@@ -48,16 +49,26 @@ fn target(app: &PhotocraftApp, tool: Tool, p: [f64; 2]) -> Option<(PathRef, Path
 
 /// The Pen's Auto Add/Delete (#4144): what a Pen click at `p` does to the active path instead of
 /// starting a new one, as the anchor tool that does it (Add Anchor Point on a segment, Delete
-/// Anchor Point on an anchor), the path and the hit. `None` when the option is off, ⇧, ⌥ or ⌘ is
-/// held, a path is being drawn, or the click hits nothing it edits. The end points of an open
-/// subpath are left to the Pen, as in Photoshop.
+/// Anchor Point on an anchor), the path and the hit. While a path is being drawn it edits that
+/// path only (#6140): a click anywhere else places the next anchor. `None` when the option is off,
+/// ⇧, ⌥ or ⌘ is held, an anchor's handles are being pulled out, or the click hits nothing it edits.
+/// The end points of an open subpath are left to the Pen, as in Photoshop: on the path being
+/// drawn, the first closes it and the last breaks its handle.
 pub fn pen_auto(app: &PhotocraftApp, tool: Tool, mods: Modifiers, p: [f64; 2]) -> Option<(Tool, PathRef, Path, Hit)> {
-    if tool != Tool::Pen || !app.ui.tool_options.pen_auto_add_delete || app.ui.pen.is_some() || mods.shift || mods.alt || mods.command {
+    if tool != Tool::Pen || !app.ui.tool_options.pen_auto_add_delete || mods.shift || mods.alt || mods.command {
         return None;
     }
     let tol = 6.0 / f64::from(app.point_zoom().max(0.01));
-    let (r, path, hit) =
-        crate::direct_select::active_paths(app).into_iter().find_map(|(r, path)| edit::hit(&path, Point::new(p[0], p[1]), tol, &[]).map(|h| (r, path, h)))?;
+    let at = Point::new(p[0], p[1]);
+    let (r, path, hit) = match app.ui.pen.as_ref() {
+        Some(pen) if pen.dragging || pen.curvature => return None,
+        Some(pen) => {
+            let path = crate::vector_ui::pen_path(pen);
+            let hit = edit::hit(&path, at, tol, &[])?;
+            (PathRef::Pen, path, hit)
+        }
+        None => crate::direct_select::active_paths(app).into_iter().find_map(|(r, path)| edit::hit(&path, at, tol, &[]).map(|h| (r, path, h)))?,
+    };
     let tool = match hit {
         Hit::Segment(..) => Tool::AddAnchorPoint,
         Hit::Anchor([s, k]) => {
@@ -76,10 +87,14 @@ pub fn pen_auto(app: &PhotocraftApp, tool: Tool, mods: Modifiers, p: [f64; 2]) -
 /// when they aren't theirs.
 pub fn pointer(app: &mut PhotocraftApp, ev: ToolEvent, mods: Modifiers) -> bool {
     if let ToolEvent::Down { x, y, .. } = ev
-        && let Some((_, r, _, hit)) = pen_auto(app, app.ui.tool, mods, [x, y])
+        && let Some((_, r, path, hit)) = pen_auto(app, app.ui.tool, mods, [x, y])
     {
-        // The release finds no Pen path to finish, so the Pen draws nothing.
-        apply(app, r, hit);
+        // The release finds no Pen drag to finish, so the Pen draws nothing.
+        if r == PathRef::Pen {
+            edit_pen(app, path, hit);
+        } else {
+            apply(app, r, hit);
+        }
         return true;
     }
     let Some(tool) = effective(app.ui.tool, mods) else { return false };
@@ -90,23 +105,28 @@ pub fn pointer(app: &mut PhotocraftApp, ev: ToolEvent, mods: Modifiers) -> bool
 }
 
 fn click(app: &mut PhotocraftApp, tool: Tool, p: [f64; 2]) {
-    let Some((r, mut path, hit)) = target(app, tool, p) else { return };
+    let Some((r, path, hit)) = target(app, tool, p) else { return };
     if r == PathRef::Pen {
-        // The Pen path being drawn isn't in the document yet: it takes the edit directly.
-        let edited = match hit {
-            Hit::Segment(k, t) => edit::add_anchor(&mut path, k, t).is_ok(),
-            Hit::Anchor(k) => edit::delete_anchor(&mut path, k).is_ok(),
-            Hit::Handle(..) => false,
-        };
-        if edited {
-            app.ui.direct_selection = DirectSelection { target: Some(r), ..Default::default() };
-            crate::vector_ui::pen_replace(app, &path);
-        }
+        edit_pen(app, path, hit);
         return;
     }
     apply(app, r, hit);
 }
 
+/// Add or delete an anchor of the Pen path being drawn (`path`, from `pen_path`). It isn't in the
+/// document yet, so it takes the edit directly; drawing carries on from its last anchor.
+fn edit_pen(app: &mut PhotocraftApp, mut path: Path, hit: Hit) {
+    let edited = match hit {
+        Hit::Segment(k, t) => edit::add_anchor(&mut path, k, t).is_ok(),
+        Hit::Anchor(k) => edit::delete_anchor(&mut path, k).is_ok(),
+        Hit::Handle(..) => false,
+    };
+    if edited {
+        app.ui.direct_selection = DirectSelection { target: Some(PathRef::Pen), ..Default::default() };
+        crate::vector_ui::pen_replace(app, &path);
+    }
+}
+
 /// Add an anchor where `hit` is on a segment of `r`, or delete the anchor it is on: one command.
 fn apply(app: &mut PhotocraftApp, r: PathRef, hit: Hit) {
     let (id, mut params) = match hit {
diff --git a/crates/ui-egui/src/anchor_tools_tests.rs b/crates/ui-egui/src/anchor_tools_tests.rs
index 87c045eba9..c21cc5aaf6 100644
--- a/crates/ui-egui/src/anchor_tools_tests.rs
+++ b/crates/ui-egui/src/anchor_tools_tests.rs
@@ -230,3 +230,67 @@ fn the_pen_cursor_shows_what_auto_add_delete_would_do() {
     app.ui.tool_options.pen_auto_add_delete = false;
     assert_eq!(badge(&app, Tool::Pen, Modifiers::NONE), None);
 }
+
+fn pen_anchors(app: &PhotocraftApp) -> Vec<[f64; 2]> {
+    app.ui.pen.as_ref().map(|p| p.knots.iter().map(|k| k[0]).collect()).unwrap_or_default()
+}
+
+/// #6140: while drawing, a Pen click on the path being drawn adds an anchor on a segment or
+/// deletes a middle anchor, and drawing carries on from the last anchor. Nothing reaches History.
+#[test]
+fn the_pen_adds_and_deletes_anchors_on_the_path_being_drawn() {
+    let mut app = app(Tool::Pen);
+    let before = steps(&app);
+    for at in [[40.0, 40.0], [120.0, 40.0], [120.0, 120.0]] {
+        click(&mut app, at, Modifiers::NONE);
+    }
+    click(&mut app, [80.0, 40.0], Modifiers::NONE);
+    assert_eq!(pen_anchors(&app), vec![[40.0, 40.0], [80.0, 40.0], [120.0, 40.0], [120.0, 120.0]], "added on the first segment");
+    click(&mut app, [40.0, 120.0], Modifiers::NONE);
+    assert_eq!(pen_anchors(&app).last(), Some(&[40.0, 120.0]), "the next click carries on from the last anchor");
+    assert_eq!(pen_anchors(&app).len(), 5);
+
+    click(&mut app, [120.0, 40.0], Modifiers::NONE);
+    assert_eq!(pen_anchors(&app), vec![[40.0, 40.0], [80.0, 40.0], [120.0, 120.0], [40.0, 120.0]], "a middle anchor is deleted");
+    assert_eq!(steps(&app), before, "the path being drawn is not in the document yet");
+}
+
+/// The path being drawn keeps its end points (the first closes it, the last breaks its handle), ⇧
+/// or the option turned off places an anchor on its segment, and another path takes no edit.
+#[test]
+fn the_pen_draws_on_the_path_being_drawn_where_auto_add_delete_does_not_apply() {
+    let mut app = app(Tool::Pen);
+    with_path(&mut app);
+    let work_before = work(&app);
+    for at in [[20.0, 160.0], [180.0, 160.0], [180.0, 180.0]] {
+        click(&mut app, at, Modifiers::NONE);
+    }
+    click(&mut app, [180.0, 180.0], Modifiers::NONE);
+    assert_eq!(pen_anchors(&app).len(), 3, "a click on the last anchor breaks its handle");
+    click(&mut app, [100.0, 160.0], Modifiers::SHIFT);
+    assert_eq!(pen_anchors(&app).len(), 4, "⇧ places an anchor");
+    app.ui.tool_options.pen_auto_add_delete = false;
+    click(&mut app, [100.0, 160.0], Modifiers::NONE);
+    assert_eq!(pen_anchors(&app).len(), 5, "with the option off the Pen places an anchor");
+    app.ui.tool_options.pen_auto_add_delete = true;
+    click(&mut app, [80.0, 120.0], Modifiers::NONE);
+    assert_eq!((pen_anchors(&app).len(), work(&app)), (6, work_before), "another path takes no edit while drawing");
+    click(&mut app, [20.0, 160.0], Modifiers::NONE);
+    assert!(app.ui.pen.is_none(), "the first anchor closes the path");
+}
+
+#[test]
+fn the_pen_cursor_shows_auto_add_delete_on_the_path_being_drawn() {
+    use crate::tool_feedback::{Badge, badge};
+    let mut app = app(Tool::Pen);
+    for at in [[40.0, 40.0], [120.0, 40.0], [120.0, 120.0]] {
+        click(&mut app, at, Modifiers::NONE);
+    }
+    let cases = [([80.0, 40.0], Some(Badge::Add)), ([120.0, 40.0], Some(Badge::Subtract)), ([40.0, 40.0], None), ([120.0, 120.0], None), ([60.0, 100.0], None)];
+    for (at, want) in cases {
+        app.hover_doc = Some(at);
+        assert_eq!(badge(&app, Tool::Pen, Modifiers::NONE), want, "{at:?}");
+    }
+    app.hover_doc = Some([80.0, 40.0]);
+    assert_eq!(badge(&app, Tool::Pen, Modifiers::SHIFT), None);
+}
diff --git a/crates/ui-egui/src/background_redraw_tests.rs b/crates/ui-egui/src/background_redraw_tests.rs
index df5d467e10..650fccaa33 100644
--- a/crates/ui-egui/src/background_redraw_tests.rs
+++ b/crates/ui-egui/src/background_redraw_tests.rs
@@ -41,16 +41,21 @@ fn gpu_app() -> Option<Gpu> {
     let observer = Arc::new(std::sync::Mutex::new(None));
     let observer_out = observer.clone();
     let built = std::panic::catch_unwind(std::panic::AssertUnwindSafe(move || {
-        egui_kittest::Harness::builder().with_size(egui::vec2(1000.0, 700.0)).with_pixels_per_point(1.0).with_max_steps(64).wgpu().build_eframe(move |cc| {
-            PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
-            let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
-            if let Some(rs) = cc.wgpu_render_state.as_ref() {
-                *observer_out.lock().expect("observer") = Some(GpuCanvas::new(rs));
-                app.set_wgpu(rs.clone());
-            }
-            app.background_jobs = true;
-            app
-        })
+        egui_kittest::Harness::builder()
+            .with_size(egui::vec2(1000.0, 700.0))
+            .with_pixels_per_point(1.0)
+            .with_max_steps(64)
+            .wgpu_setup(crate::gpu_canvas::wgpu_setup())
+            .build_eframe(move |cc| {
+                PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
+                let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+                if let Some(rs) = cc.wgpu_render_state.as_ref() {
+                    *observer_out.lock().expect("observer") = Some(GpuCanvas::new(rs));
+                    app.set_wgpu(rs.clone());
+                }
+                app.background_jobs = true;
+                app
+            })
     }));
     let Ok(harness) = built else {
         eprintln!("skipping: no GPU adapter");
diff --git a/crates/ui-egui/src/bidi_text.rs b/crates/ui-egui/src/bidi_text.rs
new file mode 100644
index 0000000000..babb0d0c48
--- /dev/null
+++ b/crates/ui-egui/src/bidi_text.rs
@@ -0,0 +1,203 @@
+//! Right-to-left text in labels that egui draws (#5159).
+//!
+//! egui shapes text in runs of one font face and places the runs left to right. An Arabic or
+//! Hebrew word is one run, which the shaper draws right to left, but the space between two words
+//! comes from another font, so a phrase came out with every word correct and the word order
+//! reversed ("THIS IS A TEXT" read as "TEXT A IS THIS"). [`visual`] puts a label into display
+//! order with the Unicode Bidirectional Algorithm before egui lays it out: words of a
+//! right-to-left script stay in logical order (the shaper reverses them itself), and everything
+//! else in a right-to-left run is reversed around them, with brackets mirrored.
+//!
+//! For display only: never store the result or put it in an editable field.
+
+use std::borrow::Cow;
+
+use unicode_bidi::{BidiClass, BidiInfo, Level, bidi_class};
+
+/// `text` in the order egui should lay it out from left to right. Text without right-to-left
+/// characters comes back unchanged, without allocating.
+pub fn visual(text: &str) -> Cow<'_, str> {
+    visual_at(text, None)
+}
+
+/// [`visual`] for a line that reads left to right as a whole even when it starts with a
+/// right-to-left name, such as the title bar's "*صورة.psd — PhotoCraft": with the paragraph
+/// direction taken from the name, the "— PhotoCraft" tail moved to the left.
+pub fn visual_ltr(text: &str) -> Cow<'_, str> {
+    visual_at(text, Some(Level::ltr()))
+}
+
+/// Whether `text` reads right to left as a paragraph: its first strong letter is Hebrew, Arabic…
+pub fn is_rtl_paragraph(text: &str) -> bool {
+    text.chars()
+        .find_map(|c| match bidi_class(c) {
+            BidiClass::L => Some(false),
+            BidiClass::R | BidiClass::AL => Some(true),
+            _ => None,
+        })
+        .unwrap_or(false)
+}
+
+/// `text` in display order, cut with "…" where it doesn't fit (`fits` measures a display-order
+/// string). A right-to-left name is cut in logical order before it is reordered, so its *start*
+/// stays and the "…" lands at the left, the end of a right-to-left line; cutting after the
+/// reordering lost the start of the name instead. `None`: `text` fits as it is (or a
+/// left-to-right one, which the caller elides at its right end as usual).
+pub fn elide(text: &str, fits: impl Fn(&str) -> bool) -> Option<String> {
+    if !is_rtl_paragraph(text) || fits(&visual(text)) {
+        return None;
+    }
+    // The longest logical prefix (whole characters) that fits with "…" after it.
+    let ends: Vec<usize> = text.char_indices().map(|(i, _)| i).skip(1).chain(std::iter::once(text.len())).collect();
+    let cut = |n: usize| -> String {
+        let end = if n == 0 { 0 } else { ends.get(n - 1).copied().unwrap_or(text.len()) };
+        visual(&format!("{}…", text.get(..end).unwrap_or_default().trim_end())).into_owned()
+    };
+    let (mut lo, mut hi) = (0usize, ends.len());
+    while lo < hi {
+        let mid = (lo + hi).div_ceil(2);
+        if fits(&cut(mid)) { lo = mid } else { hi = mid - 1 }
+    }
+    Some(cut(lo))
+}
+
+fn visual_at(text: &str, level: Option<Level>) -> Cow<'_, str> {
+    if !text.chars().any(is_rtl) {
+        return Cow::Borrowed(text);
+    }
+    let info = BidiInfo::new(text, level);
+    let mut out = String::with_capacity(text.len());
+    for para in &info.paragraphs {
+        let (levels, runs) = info.visual_runs(para, para.range.clone());
+        for run in runs {
+            let Some(slice) = text.get(run.clone()) else { continue };
+            if levels.get(run.start).is_some_and(|level| level.is_rtl()) {
+                push_reversed(slice, &mut out);
+            } else {
+                out.push_str(slice);
+            }
+        }
+    }
+    Cow::Owned(out)
+}
+
+/// A strong right-to-left letter, or any character of a right-to-left script block (Arabic
+/// punctuation such as "،" belongs with the word it follows: the same font shapes both).
+fn is_rtl(c: char) -> bool {
+    matches!(bidi_class(c), BidiClass::R | BidiClass::AL) || matches!(c, '\u{0590}'..='\u{08FF}' | '\u{FB1D}'..='\u{FDFF}' | '\u{FE70}'..='\u{FEFC}')
+}
+
+/// Characters that stay inside a right-to-left word: its letters, combining marks, and joiners.
+fn keeps_with_word(c: char) -> bool {
+    is_rtl(c) || matches!(bidi_class(c), BidiClass::NSM | BidiClass::BN)
+}
+
+/// Append a right-to-left run in left-to-right display order: right-to-left words stay whole and
+/// in logical order, every other character is reversed around them, and brackets are mirrored.
+fn push_reversed(run: &str, out: &mut String) {
+    let mut units: Vec<&str> = Vec::new();
+    let mut word: Option<usize> = None;
+    for (i, c) in run.char_indices() {
+        if keeps_with_word(c) {
+            word.get_or_insert(i);
+            continue;
+        }
+        if let Some(start) = word.take()
+            && let Some(w) = run.get(start..i)
+        {
+            units.push(w);
+        }
+        if let Some(single) = run.get(i..i + c.len_utf8()) {
+            units.push(single);
+        }
+    }
+    if let Some(start) = word
+        && let Some(w) = run.get(start..)
+    {
+        units.push(w);
+    }
+    for unit in units.into_iter().rev() {
+        let mut chars = unit.chars();
+        match (chars.next(), chars.next()) {
+            (Some(c), None) if !keeps_with_word(c) => out.push(mirror(c)),
+            _ => out.push_str(unit),
+        }
+    }
+}
+
+/// The mirrored form of a bracket shown in right-to-left text.
+fn mirror(c: char) -> char {
+    match c {
+        '(' => ')',
+        ')' => '(',
+        '[' => ']',
+        ']' => '[',
+        '{' => '}',
+        '}' => '{',
+        '<' => '>',
+        '>' => '<',
+        '«' => '»',
+        '»' => '«',
+        other => other,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn left_to_right_text_is_untouched_and_not_copied() {
+        for text in ["PhotoCraft", "Layer 1", "", "Background copy (2)", "日本語のレイヤー"] {
+            assert!(matches!(visual(text), Cow::Borrowed(t) if t == text), "{text}");
+        }
+    }
+
+    /// #5159: the reported layer name. Each word stays as typed; the word order flips so that
+    /// egui, placing words left to right, shows the first word at the right.
+    #[test]
+    fn arabic_words_are_placed_right_to_left() {
+        assert_eq!(visual("لاشي مكتوب هنا"), "هنا مكتوب لاشي");
+        assert_eq!(visual("שלום עולם"), "עולם שלום");
+    }
+
+    #[test]
+    fn numbers_and_latin_keep_their_own_order() {
+        // A number inside right-to-left text reads left to right, at the start of the line.
+        assert_eq!(visual("طبقة 2"), "2 طبقة");
+        assert_eq!(visual("طبقة 12"), "12 طبقة");
+        // A left-to-right name with an Arabic word at the end is left as it is.
+        assert_eq!(visual("Layer 1 نص"), "Layer 1 نص");
+        // Latin inside an Arabic name stays readable.
+        assert_eq!(visual("نص PhotoCraft هنا"), "هنا PhotoCraft نص");
+    }
+
+    /// #5385 review: the title bar's line is left to right as a whole, so a right-to-left
+    /// document name keeps "— PhotoCraft" after it, at the right.
+    #[test]
+    fn the_title_line_stays_left_to_right_around_a_right_to_left_name() {
+        assert_eq!(visual_ltr("*صورة.psd — PhotoCraft"), "*صورة.psd — PhotoCraft");
+        assert_eq!(visual_ltr("لاشي مكتوب.png — PhotoCraft"), "مكتوب لاشي.png — PhotoCraft");
+        assert!(matches!(visual_ltr("Untitled-1 — PhotoCraft"), Cow::Borrowed(_)));
+    }
+
+    /// #5385 review: a right-to-left name that doesn't fit keeps its first words and ends with
+    /// "…" at the left; a left-to-right or fitting name is left to the caller.
+    #[test]
+    fn right_to_left_names_are_cut_at_their_logical_end() {
+        let fits = |n: usize| move |s: &str| s.chars().count() <= n;
+        // Cut anywhere, as egui elides: the first word and the start of the second.
+        assert_eq!(elide("لاشي مكتوب هنا", fits(8)).as_deref(), Some("…مك لاشي"));
+        assert_eq!(elide("לשלום עולם גדול", fits(11)).as_deref(), Some("…עולם לשלום"));
+        assert_eq!(elide("لاشي مكتوب هنا", fits(40)), None, "fits");
+        assert_eq!(elide("Layer copy 12", fits(4)), None, "left to right: elided by egui at its end");
+        assert_eq!(elide("نص", fits(0)).as_deref(), Some("…"), "nothing fits: just the ellipsis");
+        assert!(is_rtl_paragraph("12 نص") && !is_rtl_paragraph("Layer نص") && !is_rtl_paragraph("123"));
+    }
+
+    #[test]
+    fn brackets_mirror_and_arabic_punctuation_stays_with_its_word() {
+        assert_eq!(visual("نص (1)"), "(1) نص");
+        assert_eq!(visual("مرحبا، عالم"), "عالم مرحبا،");
+    }
+}
diff --git a/crates/ui-egui/src/blend_preview.rs b/crates/ui-egui/src/blend_preview.rs
index e9f010613a..a466e2f375 100644
--- a/crates/ui-egui/src/blend_preview.rs
+++ b/crates/ui-egui/src/blend_preview.rs
@@ -1,5 +1,5 @@
-//! Layers panel: hovering a mode in the open blend-mode list previews it on the active layer
-//! (Photoshop's live blend-mode preview, #970). Hovering records nothing: leaving the list, or
+//! Layers panel: hovering a mode in the open blend-mode list previews it on the layers it would
+//! change, the active one or every selected one (Photoshop's live blend-mode preview, #970). Hovering records nothing: leaving the list, or
 //! closing it without a choice, shows the document again, and choosing a mode commits it through
 //! `layer.setProps` (one history step). The canvas re-renders once per hovered mode, and only
 //! where the layer's blending can change pixels.
@@ -15,17 +15,17 @@ use crate::PhotocraftApp;
 /// Preview keys (`canvas::display_doc`) are `BASE` plus a hash of the revision and the mode.
 const BASE: u64 = 1 << 37;
 
-/// A blend mode hovered for a layer of a document at a revision.
+/// A blend mode hovered for layers of a document at a revision.
 pub(crate) struct BlendPreview {
     doc: DocId,
     revision: u64,
-    layer: LayerId,
+    layers: Vec<LayerId>,
     /// The mode under the pointer; `None` once it left the list (the rest stays for the
     /// canvas's damage on its way back to the document).
     mode: Option<BlendMode>,
     /// The frame the list was last drawn in: a list no longer drawn previews nothing.
     frame: u64,
-    /// Where the layer's blending can change pixels; `None` for anywhere.
+    /// Where the layers' blending can change pixels; `None` for anywhere.
     area: Option<Rect>,
     /// The document shown for `mode`, with its key.
     shown: Option<(u64, Arc<Document>)>,
@@ -33,11 +33,11 @@ pub(crate) struct BlendPreview {
 
 /// The Layers panel, each frame it draws `layer`'s blend-mode dropdown: the mode under the
 /// pointer in its open list, if any.
-pub(crate) fn hover(app: &mut PhotocraftApp, layer: LayerId, mode: Option<BlendMode>) {
+pub(crate) fn hover(app: &mut PhotocraftApp, layers: &[LayerId], mode: Option<BlendMode>) {
     let frame = app.frame;
     let Some(st) = app.session.active() else { return };
     let (doc, revision) = (st.doc.id, st.revision);
-    if let Some(p) = app.blend_preview.as_mut().filter(|p| p.doc == doc && p.revision == revision && p.layer == layer) {
+    if let Some(p) = app.blend_preview.as_mut().filter(|p| p.doc == doc && p.revision == revision && p.layers == layers) {
         p.frame = frame;
         if mode.is_none() {
             p.shown = None;
@@ -46,8 +46,15 @@ pub(crate) fn hover(app: &mut PhotocraftApp, layer: LayerId, mode: Option<BlendM
         return;
     }
     app.blend_preview = mode.and_then(|mode| {
-        let area = photocraft_compose::change_bounds(st.doc.layer(layer)?, st.doc.bounds());
-        Some(BlendPreview { doc, revision, layer, mode: Some(mode), frame, area, shown: None })
+        // Anywhere when any layer can change anything; else the union of their areas.
+        let mut area: Option<Rect> = Some(Rect::EMPTY);
+        for &id in layers {
+            area = match (area, photocraft_compose::change_bounds(st.doc.layer(id)?, st.doc.bounds())) {
+                (Some(a), Some(b)) => Some(if a.is_empty() { b } else { a.union(&b) }),
+                _ => None,
+            };
+        }
+        Some(BlendPreview { doc, revision, layers: layers.to_vec(), mode: Some(mode), frame, area, shown: None })
     });
 }
 
@@ -57,15 +64,23 @@ pub(crate) fn display_doc(app: &mut PhotocraftApp, idx: usize) -> Option<(Arc<Do
     let st = app.session.documents().get(idx)?;
     let p = app.blend_preview.as_mut().filter(|p| p.doc == st.doc.id && p.revision == st.revision && p.frame + 1 >= frame)?;
     let mode = p.mode?;
-    let key = preview_key(p.revision, p.layer, mode);
+    let key = preview_key(p.revision, &p.layers, mode);
     if let Some((k, shown)) = &p.shown
         && *k == key
     {
         return Some((shown.clone(), key));
     }
     let mut doc = (*st.doc).clone();
-    let l = doc.layer_mut(p.layer).filter(|l| l.blend != mode)?;
-    l.blend = mode;
+    let mut changed = false;
+    for &id in &p.layers {
+        if let Some(l) = doc.layer_mut(id).filter(|l| l.blend != mode) {
+            l.blend = mode;
+            changed = true;
+        }
+    }
+    if !changed {
+        return None;
+    }
     // Duotone documents display through their inks.
     let doc = Arc::new(photocraft_engine::mode_cmds::display_document(&doc).unwrap_or(doc));
     p.shown = Some((key, doc.clone()));
@@ -73,7 +88,7 @@ pub(crate) fn display_doc(app: &mut PhotocraftApp, idx: usize) -> Option<(Arc<Do
 }
 
 /// What changed between preview (or document) key `seen` and `now` of document `doc` at
-/// `revision`: the hovered layer's area. `None` when either key is another kind of preview, or
+/// `revision`: the hovered layers' area. `None` when either key is another kind of preview, or
 /// the layer can change anything (the canvas then recomposites everything).
 pub(crate) fn damage(app: &PhotocraftApp, doc: DocId, revision: u64, seen: u64, now: u64) -> Option<Rect> {
     let p = app.blend_preview.as_ref().filter(|p| p.doc == doc && p.revision == revision)?;
@@ -85,8 +100,9 @@ fn is_preview_key(key: u64) -> bool {
     (BASE..BASE << 1).contains(&key)
 }
 
-fn preview_key(revision: u64, layer: LayerId, mode: BlendMode) -> u64 {
-    let h = mode.label().bytes().fold(revision.wrapping_mul(0x9e37_79b9_7f4a_7c15) ^ layer.0, |h, b| h.wrapping_mul(31).wrapping_add(u64::from(b)));
+fn preview_key(revision: u64, layers: &[LayerId], mode: BlendMode) -> u64 {
+    let seed = layers.iter().fold(revision.wrapping_mul(0x9e37_79b9_7f4a_7c15), |h, id| h.wrapping_mul(0x100_0000_01b3) ^ id.0);
+    let h = mode.label().bytes().fold(seed, |h, b| h.wrapping_mul(31).wrapping_add(u64::from(b)));
     (h & (BASE - 1)) | BASE
 }
 
diff --git a/crates/ui-egui/src/blend_preview/tests.rs b/crates/ui-egui/src/blend_preview/tests.rs
index 4eb407aad0..22908ac248 100644
--- a/crates/ui-egui/src/blend_preview/tests.rs
+++ b/crates/ui-egui/src/blend_preview/tests.rs
@@ -36,7 +36,7 @@ fn a_hovered_mode_shows_on_the_canvas_until_the_pointer_leaves() {
     let (s, top) = session();
     let mut app = PhotocraftApp::new(s, crate::Services::default());
     let (undo, revision) = (steps(&app), app.session.active().unwrap().revision);
-    hover(&mut app, top, Some(BlendMode::Multiply));
+    hover(&mut app, &[top], Some(BlendMode::Multiply));
     let (shown, key) = display_doc(&mut app, 0).expect("previewed");
     assert_eq!(shown.layer(top).unwrap().blend, BlendMode::Multiply);
     let (again, same) = display_doc(&mut app, 0).unwrap();
@@ -45,17 +45,17 @@ fn a_hovered_mode_shows_on_the_canvas_until_the_pointer_leaves() {
     // From the document to the preview and between previews: only the layer's area redraws.
     let doc = app.session.active().unwrap().doc.id;
     assert_eq!(damage(&app, doc, revision, 0, key).map(|r| r.width()), Some(16));
-    hover(&mut app, top, Some(BlendMode::Screen));
+    hover(&mut app, &[top], Some(BlendMode::Screen));
     let (_, screen) = display_doc(&mut app, 0).unwrap();
     assert_ne!(screen, key);
     assert!(damage(&app, doc, revision, key, screen).is_some());
     // The current mode, or no mode, shows the document; and so does a list no longer drawn.
-    hover(&mut app, top, Some(BlendMode::Normal));
+    hover(&mut app, &[top], Some(BlendMode::Normal));
     assert!(display_doc(&mut app, 0).is_none());
-    hover(&mut app, top, None);
+    hover(&mut app, &[top], None);
     assert!(display_doc(&mut app, 0).is_none());
     assert!(damage(&app, doc, revision, screen, 0).is_some(), "back to the document: the layer's area");
-    hover(&mut app, top, Some(BlendMode::Multiply));
+    hover(&mut app, &[top], Some(BlendMode::Multiply));
     app.frame += 2;
     assert!(display_doc(&mut app, 0).is_none(), "a stale hover previews nothing");
 }
@@ -124,3 +124,17 @@ fn moving_between_modes_keeps_a_preview_across_the_gaps_between_them() {
     }
     assert_eq!(previewed(&mut h), Some(BlendMode::Multiply));
 }
+
+#[test]
+fn a_hovered_mode_previews_on_every_selected_layer() {
+    let (mut s, top) = session();
+    let other = LayerId(s.execute("layer.new.layer", json!({})).unwrap()["layer"].as_u64().unwrap());
+    s.execute("edit.fill", json!({"color": "#3366cc"})).unwrap();
+    let mut app = PhotocraftApp::new(s, crate::Services::default());
+    hover(&mut app, &[top, other], Some(BlendMode::Multiply));
+    let (shown, key) = display_doc(&mut app, 0).expect("previewed");
+    assert_eq!((shown.layer(top).unwrap().blend, shown.layer(other).unwrap().blend), (BlendMode::Multiply, BlendMode::Multiply));
+    // A different set of layers is a different preview.
+    hover(&mut app, &[top], Some(BlendMode::Multiply));
+    assert_ne!(display_doc(&mut app, 0).unwrap().1, key);
+}
diff --git a/crates/ui-egui/src/caf_ui.rs b/crates/ui-egui/src/caf_ui.rs
new file mode 100644
index 0000000000..747e9d4bcf
--- /dev/null
+++ b/crates/ui-egui/src/caf_ui.rs
@@ -0,0 +1,1972 @@
+//! Edit › Content-Aware Fill…: Photoshop's Content-Aware Fill workspace, a full-window dialog
+//! like Liquify's.
+//!
+//! Measured on Photoshop 25.4 (black box) and laid out the same way: the tools on the left
+//! (Sampling Brush, Lasso, Hand, Zoom) with their options bar above, the document in the middle
+//! with the sampling area tinted (green, 50 %) and the fill area outlined, a Preview panel, and
+//! the Content-Aware Fill panel (Sampling Area Overlay, Sampling Area Options, Fill Settings,
+//! Output Settings) with OK, Apply and Cancel.
+//!
+//! * **Sampling Brush**: a hard round brush. In Auto and Rectangular it subtracts from the
+//!   sampling area, in Custom (which starts empty) it adds; Alt reverses. Painting keeps the
+//!   sampling option, and added strokes may reach past the sampling window. Its starting size is
+//!   a tenth of the window's side (20 px for a 50 px selection).
+//! * **Lasso**: edits the fill area itself (New, Add, Subtract, Intersect; Expand and Contract by
+//!   a few pixels). The window and the Auto area follow the new fill area; brush strokes stay.
+//! * **Preview**: the fill computed in the background after each change, opening framed on the
+//!   sampling window.
+//! * **Apply** fills (one history step) and keeps the workspace open; **OK** fills and closes;
+//!   **Cancel** closes, keeping what was applied. Ctrl+Z undoes the last stroke or lasso edit.
+//!
+//! What the workspace holds is plain data (the sampling option, brush strokes, lasso edits and
+//! fill settings); OK and Apply run `edit.contentAwareFill` with it, and the preview runs the same
+//! plan ([`photocraft_engine::edit_menu_cmds::content_aware_plan`]), so the preview is exactly
+//! what gets written. The settings are remembered for the next time (`prefs.dialogs`).
+
+use egui::{Align2, Color32, FontId, Pos2, Rect as ERect, Sense, Stroke, TextureHandle, pos2, vec2};
+use photocraft_algo::content_aware::{SamplingStroke, paint_strokes};
+use photocraft_doc::LayerId;
+use photocraft_engine::edit_menu_cmds::{MAX_CAF_EDITS, MAX_CAF_POINTS};
+use photocraft_geom::Rect;
+use serde_json::{Value, json};
+
+use crate::PhotocraftApp;
+use crate::canvas::ToolEvent;
+use crate::theme::Tokens;
+use crate::widgets;
+
+/// Longest side of the document proxy shown in the view (px).
+const PROXY_SIDE: usize = 1600;
+const LEFT_W: f32 = 48.0;
+const BAR_H: f32 = 36.0;
+const PANEL_W: f32 = 300.0;
+const PREVIEW_W: f32 = 380.0;
+const UNDO_LIMIT: usize = 100;
+/// Outlines with more edges than this are drawn at the proxy's resolution.
+const MAX_OUTLINE_EDGES: usize = 200_000;
+/// Photoshop's overlay colour as it shows (a 50 % tint of grey 200 reads 171, 204, 153).
+const OVERLAY_COLOR: [u8; 3] = [142, 208, 106];
+/// The `prefs.dialogs` key under which the settings are remembered.
+const REMEMBERED: &str = "edit.contentAwareFill.workspace";
+const CMD: &str = "edit.contentAwareFill";
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum CafTool {
+    Brush,
+    Lasso,
+    Hand,
+    Zoom,
+}
+
+impl CafTool {
+    fn name(self) -> &'static str {
+        match self {
+            CafTool::Brush => "brush",
+            CafTool::Lasso => "lasso",
+            CafTool::Hand => "hand",
+            CafTool::Zoom => "zoom",
+        }
+    }
+    fn from_name(s: &str) -> Option<CafTool> {
+        Some(match s {
+            "brush" => CafTool::Brush,
+            "lasso" => CafTool::Lasso,
+            "hand" => CafTool::Hand,
+            "zoom" => CafTool::Zoom,
+            _ => return None,
+        })
+    }
+}
+
+/// The lasso's selection modes, in options-bar order.
+const LASSO_OPS: [&str; 4] = ["new", "add", "subtract", "intersect"];
+
+/// The panel's settings (remembered between uses).
+#[derive(Clone, Debug, PartialEq)]
+pub struct CafOpts {
+    pub show_overlay: bool,
+    /// Overlay opacity, 0..100.
+    pub opacity: f32,
+    pub color: [u8; 3],
+    /// The overlay marks what is left out (Indicates: Excluded Area) rather than the sampling area.
+    pub excluded: bool,
+    /// auto | rectangular | custom
+    pub sampling: String,
+    pub sample_all: bool,
+    /// default | none | high | veryHigh
+    pub color_adaptation: String,
+    /// none | low | medium | high | full
+    pub rotation: String,
+    pub scale: bool,
+    pub mirror: bool,
+    /// current | new | duplicate (Photoshop opens on New Layer)
+    pub output: String,
+}
+
+impl Default for CafOpts {
+    fn default() -> Self {
+        CafOpts {
+            show_overlay: true,
+            opacity: 50.0,
+            color: OVERLAY_COLOR,
+            excluded: false,
+            sampling: "auto".into(),
+            sample_all: false,
+            color_adaptation: "default".into(),
+            rotation: "none".into(),
+            scale: false,
+            mirror: false,
+            output: "new".into(),
+        }
+    }
+}
+
+impl CafOpts {
+    /// Applies the settings named in `v` (control channel and remembered keys); others stay.
+    pub fn apply(&mut self, v: &Value) -> Result<(), String> {
+        let flag = |k: &str| v.get(k).and_then(Value::as_bool);
+        let text = |k: &str| v.get(k).and_then(Value::as_str);
+        for (k, slot) in [
+            ("showOverlay", &mut self.show_overlay),
+            ("excluded", &mut self.excluded),
+            ("sampleAllLayers", &mut self.sample_all),
+            ("scale", &mut self.scale),
+            ("mirror", &mut self.mirror),
+        ] {
+            if let Some(b) = flag(k) {
+                *slot = b;
+            }
+        }
+        if let Some(n) = v.get("opacity").and_then(Value::as_f64).filter(|n| n.is_finite()) {
+            self.opacity = (n as f32).clamp(0.0, 100.0);
+        }
+        if let Some(c) = v.get("color").and_then(Value::as_array).filter(|c| c.len() == 3) {
+            let ch = |i: usize| c[i].as_u64().map(|v| v.min(255) as u8);
+            if let (Some(r), Some(g), Some(b)) = (ch(0), ch(1), ch(2)) {
+                self.color = [r, g, b];
+            }
+        }
+        let pick = |k: &str, allowed: &[&str]| -> Result<Option<String>, String> {
+            match text(k) {
+                None => Ok(None),
+                Some(s) if allowed.contains(&s) => Ok(Some(s.to_string())),
+                Some(s) => Err(format!("bad {k} `{s}` ({})", allowed.join("|"))),
+            }
+        };
+        if let Some(s) = pick("sampling", &["auto", "rectangular", "custom"])? {
+            self.sampling = s;
+        }
+        if let Some(s) = pick("colorAdaptation", &["none", "default", "high", "veryHigh"])? {
+            self.color_adaptation = s;
+        }
+        if let Some(s) = pick("rotationAdaptation", &["none", "low", "medium", "high", "full"])? {
+            self.rotation = s;
+        }
+        if let Some(s) = pick("output", &["current", "new", "duplicate"])? {
+            self.output = s;
+        }
+        Ok(())
+    }
+
+    /// The settings as [`CafOpts::apply`] reads them.
+    pub fn to_json(&self) -> Value {
+        json!({
+            "showOverlay": self.show_overlay,
+            "opacity": self.opacity,
+            "color": self.color,
+            "excluded": self.excluded,
+            "sampling": self.sampling,
+            "sampleAllLayers": self.sample_all,
+            "colorAdaptation": self.color_adaptation,
+            "rotationAdaptation": self.rotation,
+            "scale": self.scale,
+            "mirror": self.mirror,
+            "output": self.output,
+        })
+    }
+}
+
+/// One undoable step.
+#[derive(Clone, Debug)]
+enum Step {
+    Stroke(SamplingStroke),
+    Fill(Value),
+    /// A change of the sampling option (or a reset), with what it replaced.
+    State {
+        sampling: String,
+        strokes: Vec<SamplingStroke>,
+        fill_edits: Vec<Value>,
+    },
+}
+
+fn stroke_json(s: &SamplingStroke) -> Value {
+    json!({"mode": if s.add { "add" } else { "subtract" }, "size": s.size, "points": s.points})
+}
+
+/// What the plan (without the brush strokes) says: the window, the fill area and the sampling
+/// option's area, over `rect`.
+struct Base {
+    window: Rect,
+    rect: Rect,
+    hole: Vec<bool>,
+    base: Vec<bool>,
+}
+
+impl Base {
+    /// The index into `hole` and `base` of document point `(x, y)`, when it is inside `rect`.
+    fn index(&self, x: f64, y: f64) -> Option<usize> {
+        let (xi, yi) = (x.floor() as i32, y.floor() as i32);
+        self.rect.contains(xi, yi).then(|| (yi - self.rect.y0) as usize * self.rect.width() as usize + (xi - self.rect.x0) as usize)
+    }
+}
+
+/// A computed preview: the filled rectangle as an image, or why it failed.
+#[cfg(not(target_arch = "wasm32"))]
+type PreviewResult = Result<(Rect, egui::ColorImage), String>;
+
+/// The preview being computed or shown.
+#[derive(Default)]
+struct Preview {
+    /// Bumped whenever the state changes; a result for an older generation is dropped.
+    want: u64,
+    #[cfg(not(target_arch = "wasm32"))]
+    running: Option<(u64, std::sync::mpsc::Receiver<PreviewResult>, photocraft_engine::jobs::JobCtx)>,
+    shown: u64,
+    /// A finished preview waiting to be uploaded (on the UI thread, which has the context).
+    pending_image: Option<(Rect, egui::ColorImage)>,
+    tex: Option<(TextureHandle, Rect)>,
+    /// Screen px per document px (0 = frame the window on the next frame) and the view centre.
+    zoom: f32,
+    center: [f64; 2],
+    error: Option<String>,
+}
+
+impl Preview {
+    /// Takes the result of the preview of state `generation`: an image to upload, or the error,
+    /// which stands for that state until it changes (the same preview is not started again).
+    fn finish(&mut self, generation: u64, r: Result<(Rect, egui::ColorImage), String>) {
+        self.shown = generation;
+        self.tex = None;
+        match r {
+            Ok(img) => {
+                self.pending_image = Some(img);
+                self.error = None;
+            }
+            Err(e) => {
+                self.pending_image = None;
+                self.error = Some(e);
+            }
+        }
+    }
+}
+
+pub struct CafWorkspace {
+    pub layer: LayerId,
+    layer_name: String,
+    canvas: Rect,
+    /// The document revision the textures and the base were made from.
+    revision: u64,
+    pub opts: CafOpts,
+    pub tool: CafTool,
+    pub brush_add: bool,
+    pub brush_size: f64,
+    pub lasso_op: usize,
+    pub expand_by: f32,
+    pub strokes: Vec<SamplingStroke>,
+    pub fill_edits: Vec<Value>,
+    undo: Vec<Step>,
+    redo: Vec<Step>,
+    cur: Option<SamplingStroke>,
+    /// The lasso polygon being drawn and its selection mode.
+    lasso: Option<(usize, Vec<[f64; 2]>)>,
+    base: Base,
+    /// Fill-area outline edges (document px), or `None` when there are too many.
+    outline: Option<Vec<[[f32; 2]; 2]>>,
+    /// Document px per proxy px, and the proxy size.
+    k: usize,
+    pw: usize,
+    ph: usize,
+    /// Per proxy pixel: the sampling option's area (before the strokes), the fill area, and the
+    /// sampling area after the strokes so far (the first painted with them in order, as the
+    /// engine's `paint_strokes` paints the full-resolution one).
+    base_px: Vec<bool>,
+    hole_px: Vec<bool>,
+    mask: Vec<bool>,
+    /// The pointer is down on the view with a tool: one press is one `Down`, egui's drag (which
+    /// starts a few pixels later) continues it.
+    pressed: bool,
+    /// The device's texture side limit, as the context reports it each frame.
+    texture_limit: usize,
+    image_tex: Option<TextureHandle>,
+    overlay_tex: Option<TextureHandle>,
+    overlay_dirty: bool,
+    zoom: f32,
+    center: [f64; 2],
+    hover: Option<[f64; 2]>,
+    preview: Preview,
+    pub error: Option<String>,
+}
+
+/// The plan of the current state (without strokes when `strokes` is false).
+fn plan_params(w: &CafWorkspace, strokes: bool) -> Value {
+    let o = &w.opts;
+    let mut p = json!({
+        "sampling": o.sampling,
+        "sampleAllLayers": o.sample_all,
+        "colorAdaptation": o.color_adaptation,
+        "rotationAdaptation": o.rotation,
+        "scale": o.scale,
+        "mirror": o.mirror,
+        "output": o.output,
+        "layer": w.layer.0,
+        "fillEdits": w.fill_edits,
+    });
+    if strokes && !w.strokes.is_empty() {
+        p["samplingStrokes"] = Value::Array(w.strokes.iter().map(stroke_json).collect());
+    }
+    p
+}
+
+impl CafWorkspace {
+    pub fn describe(&self) -> Value {
+        let sampled = self.mask.iter().zip(&self.hole_px).filter(|(m, h)| **m && !**h).count();
+        json!({
+            "layer": self.layer.0,
+            "tool": self.tool.name(),
+            "brushSize": self.brush_size,
+            "brushMode": if self.brush_add { "add" } else { "subtract" },
+            "lassoMode": LASSO_OPS[self.lasso_op],
+            "expandBy": self.expand_by,
+            "strokes": self.strokes.len() + usize::from(self.cur.is_some()),
+            "fillEdits": self.fill_edits.len(),
+            "undo": self.undo.len(),
+            "redo": self.redo.len(),
+            "window": [self.base.window.x0, self.base.window.y0, self.base.window.width(), self.base.window.height()],
+            "fillArea": self.base.hole.iter().filter(|h| **h).count(),
+            "sampledProxyPixels": sampled,
+            "proxyScale": self.k,
+            "settings": self.opts.to_json(),
+            "previewReady": self.preview.tex.is_some() && self.preview.shown == self.preview.want,
+            "previewError": self.preview.error,
+            "error": self.error,
+        })
+    }
+
+    /// The proxy, in proxy px.
+    fn proxy_area(&self) -> Rect {
+        Rect::new(0, 0, self.pw as i32, self.ph as i32)
+    }
+
+    /// `s` in proxy coordinates: proxy pixel `(px, py)` is centred on document point
+    /// `canvas.x0 + (px + 0.5) k`, so the stroke's points and size scale by `1 / k`.
+    fn proxy_stroke(&self, s: &SamplingStroke) -> SamplingStroke {
+        let k = self.k as f64;
+        let (ox, oy) = (f64::from(self.canvas.x0), f64::from(self.canvas.y0));
+        SamplingStroke { add: s.add, size: s.size / k, points: s.points.iter().map(|p| [(p[0] - ox) / k, (p[1] - oy) / k]).collect() }
+    }
+
+    /// Paints `s` (a stroke, or one segment of the one being drawn) into the proxy's sampling
+    /// area: only the pixels within the brush of its path are visited, whatever came before.
+    fn paint(&mut self, s: &SamplingStroke) {
+        let (s, area) = (self.proxy_stroke(s), self.proxy_area());
+        paint_strokes(&mut self.mask, area, &[s]);
+        self.overlay_dirty = true;
+    }
+
+    /// Takes a new base: its option's area and fill area at the proxy's pixel centres, then the
+    /// strokes over it.
+    fn set_base(&mut self, b: Base) {
+        self.outline = outline(&b);
+        let k = self.k as f64;
+        for py in 0..self.ph {
+            for px in 0..self.pw {
+                let (x, y) = (f64::from(self.canvas.x0) + (px as f64 + 0.5) * k, f64::from(self.canvas.y0) + (py as f64 + 0.5) * k);
+                let i = b.index(x, y);
+                let at = |v: &[bool]| i.is_some_and(|i| v.get(i).copied().unwrap_or(false));
+                self.base_px[py * self.pw + px] = at(&b.base);
+                self.hole_px[py * self.pw + px] = at(&b.hole);
+            }
+        }
+        self.base = b;
+        self.restate_all();
+    }
+
+    /// Rebuilds the proxy's sampling area: the base painted with every stroke in order. Each
+    /// stroke costs its own pixels, so this is linear in the strokes, not strokes × pixels.
+    fn restate_all(&mut self) {
+        self.mask.clone_from(&self.base_px);
+        let strokes: Vec<SamplingStroke> = self.strokes.iter().chain(self.cur.iter()).map(|s| self.proxy_stroke(s)).collect();
+        let area = self.proxy_area();
+        paint_strokes(&mut self.mask, area, &strokes);
+        self.overlay_dirty = true;
+    }
+
+    /// Points in the strokes and lasso edits so far, against the engine's budget.
+    fn points_used(&self) -> usize {
+        let strokes: usize = self.strokes.iter().chain(self.cur.iter()).map(|s| s.points.len()).sum();
+        let lassos: usize = self.fill_edits.iter().map(|e| e.get("points").and_then(Value::as_array).map_or(0, Vec::len)).sum();
+        strokes + lassos
+    }
+
+    /// The preview is out of date.
+    fn stale(&mut self) {
+        self.preview.want += 1;
+    }
+
+    fn begin_stroke(&mut self, p: [f64; 2], alt: bool) {
+        // The engine takes at most MAX_CAF_EDITS strokes and MAX_CAF_POINTS points in all: the
+        // brush stops there, so Apply and the preview never fail on what was painted.
+        if self.strokes.len() >= MAX_CAF_EDITS {
+            self.error = Some(format!("at most {MAX_CAF_EDITS} sampling strokes: undo some, or reset the sampling area"));
+            return;
+        }
+        if self.points_used() >= MAX_CAF_POINTS {
+            self.error = Some(points_limit());
+            return;
+        }
+        self.error = None;
+        let add = self.brush_add != alt;
+        let s = SamplingStroke { add, size: self.brush_size, points: vec![p] };
+        self.paint(&s);
+        self.cur = Some(s);
+    }
+
+    fn extend_stroke(&mut self, p: [f64; 2]) {
+        if self.cur.is_none() {
+            return;
+        }
+        if self.points_used() >= MAX_CAF_POINTS {
+            self.error = Some(points_limit());
+            return;
+        }
+        let Some(s) = self.cur.as_mut() else { return };
+        if s.points.last().is_some_and(|l| l[0] == p[0] && l[1] == p[1]) {
+            return;
+        }
+        let last = *s.points.last().unwrap_or(&p);
+        s.points.push(p);
+        let seg = SamplingStroke { add: s.add, size: s.size, points: vec![last, p] };
+        self.paint(&seg);
+    }
+
+    fn end_stroke(&mut self) {
+        if let Some(s) = self.cur.take() {
+            self.strokes.push(s.clone());
+            self.push(Step::Stroke(s));
+            self.stale();
+        }
+    }
+
+    fn push(&mut self, s: Step) {
+        self.redo.clear();
+        if self.undo.len() == UNDO_LIMIT {
+            self.undo.remove(0);
+        }
+        self.undo.push(s);
+    }
+}
+
+fn points_limit() -> String {
+    format!("at most {MAX_CAF_POINTS} points in all sampling strokes and lasso edits: undo some, or reset")
+}
+
+/// The plan without strokes: the window, fill area and the option's area. Custom starts empty
+/// (the window and fill area are those of Rectangular).
+fn compute_base(app: &PhotocraftApp, w: &CafWorkspace) -> Result<Base, String> {
+    let st = app.session.active().ok_or("no document")?;
+    let mut p = plan_params(w, false);
+    let custom = w.opts.sampling == "custom";
+    if custom {
+        p["sampling"] = json!("rectangular");
+    }
+    let plan = photocraft_engine::edit_menu_cmds::content_aware_plan(&st.doc, w.layer, &p, CMD).map_err(|e| e.to_string())?;
+    let base = if custom { vec![false; plan.base.len()] } else { plan.base };
+    Ok(Base { window: plan.window, rect: plan.rect, hole: plan.hole, base })
+}
+
+/// Unit edges between the fill area and the rest, in document px.
+fn outline(b: &Base) -> Option<Vec<[[f32; 2]; 2]>> {
+    let (w, h) = (b.rect.width() as usize, b.rect.height() as usize);
+    let (ox, oy) = (b.rect.x0 as f32, b.rect.y0 as f32);
+    let at = |x: i64, y: i64| x >= 0 && y >= 0 && (x as usize) < w && (y as usize) < h && b.hole.get(y as usize * w + x as usize).copied().unwrap_or(false);
+    let mut out = Vec::new();
+    for y in 0..h as i64 {
+        for x in 0..w as i64 {
+            if !at(x, y) {
+                continue;
+            }
+            let (fx, fy) = (ox + x as f32, oy + y as f32);
+            if !at(x - 1, y) {
+                out.push([[fx, fy], [fx, fy + 1.0]]);
+            }
+            if !at(x + 1, y) {
+                out.push([[fx + 1.0, fy], [fx + 1.0, fy + 1.0]]);
+            }
+            if !at(x, y - 1) {
+                out.push([[fx, fy], [fx + 1.0, fy]]);
+            }
+            if !at(x, y + 1) {
+                out.push([[fx, fy + 1.0], [fx + 1.0, fy + 1.0]]);
+            }
+            if out.len() > MAX_OUTLINE_EDGES {
+                return None;
+            }
+        }
+    }
+    Some(out)
+}
+
+/// Recompute the base after a change of the fill area, the sampling option or the document.
+fn rebase(app: &mut PhotocraftApp) {
+    let Some(w) = app.distort.caf.as_ref() else { return };
+    let r = compute_base(app, w);
+    let Some(w) = app.distort.caf.as_mut() else { return };
+    match r {
+        Ok(b) => {
+            w.set_base(b);
+            w.error = None;
+        }
+        Err(e) => {
+            w.error = Some(e);
+            w.restate_all();
+        }
+    }
+    w.stale();
+}
+
+/// Opens the workspace on the active layer and its selection.
+pub fn open(app: &mut PhotocraftApp) -> Result<(), String> {
+    if !app.session.is_enabled(CMD) {
+        return Err("Content-Aware Fill needs a selection on a pixel layer".into());
+    }
+    let st = app.session.active().ok_or("no document")?;
+    let layer = st.active_layer.ok_or("no active layer")?;
+    let canvas = st.doc.bounds();
+    let revision = st.revision;
+    let name = st.doc.layer(layer).map(|l| l.name.clone()).unwrap_or_default();
+    let k = (canvas.width().max(canvas.height()) as usize).div_ceil(PROXY_SIDE).max(1);
+    let (pw, ph) = ((canvas.width() as usize).div_ceil(k), (canvas.height() as usize).div_ceil(k));
+    let mut opts = CafOpts::default();
+    if let Some(saved) = app.session.prefs().dialogs.get(REMEMBERED) {
+        let _ = opts.apply(saved);
+    }
+    let mut w = CafWorkspace {
+        layer,
+        layer_name: name,
+        canvas,
+        revision,
+        opts,
+        tool: CafTool::Brush,
+        brush_add: false,
+        brush_size: 20.0,
+        lasso_op: 0,
+        expand_by: 3.0,
+        strokes: Vec::new(),
+        fill_edits: Vec::new(),
+        undo: Vec::new(),
+        redo: Vec::new(),
+        cur: None,
+        lasso: None,
+        base: Base { window: Rect::EMPTY, rect: Rect::EMPTY, hole: Vec::new(), base: Vec::new() },
+        outline: None,
+        k,
+        pw,
+        ph,
+        base_px: vec![false; pw * ph],
+        hole_px: vec![false; pw * ph],
+        mask: vec![false; pw * ph],
+        pressed: false,
+        texture_limit: 2048,
+        image_tex: None,
+        overlay_tex: None,
+        overlay_dirty: true,
+        zoom: 0.0,
+        center: [f64::from(canvas.x0 + canvas.x1) / 2.0, f64::from(canvas.y0 + canvas.y1) / 2.0],
+        hover: None,
+        preview: Preview::default(),
+        error: None,
+    };
+    w.brush_add = w.opts.sampling == "custom";
+    let base = compute_base(app, &w)?;
+    w.brush_size = photocraft_algo::content_aware::default_brush_size(bounds(&base));
+    w.set_base(base);
+    w.stale();
+    app.distort.caf = Some(w);
+    Ok(())
+}
+
+/// Bounds of the fill area.
+fn bounds(b: &Base) -> Rect {
+    let w = b.rect.width() as usize;
+    b.hole.iter().enumerate().filter(|(_, h)| **h).fold(Rect::EMPTY, |r, (i, _)| {
+        let (x, y) = (b.rect.x0 + (i % w) as i32, b.rect.y0 + (i / w) as i32);
+        r.union(&Rect::new(x, y, x + 1, y + 1))
+    })
+}
+
+fn remember(app: &mut PhotocraftApp, opts: &CafOpts) {
+    let v = opts.to_json();
+    app.session.prefs.edit(|p| p.dialogs.insert(REMEMBERED.into(), v));
+}
+
+/// Apply: fill with the current state (one history step); the workspace stays open.
+pub fn apply(app: &mut PhotocraftApp) -> Result<Value, String> {
+    let Some(w) = app.distort.caf.as_mut() else { return Err("Content-Aware Fill is not open".into()) };
+    w.end_stroke();
+    let p = plan_params(w, true);
+    let opts = w.opts.clone();
+    remember(app, &opts);
+    let r = app.run(CMD, p);
+    if r.is_ok() {
+        refresh(app);
+    }
+    r
+}
+
+/// OK: fill and close.
+pub fn commit(app: &mut PhotocraftApp) {
+    let ok = apply(app);
+    if let Err(e) = ok {
+        app.ui.status = e;
+        app.ui.status_error = true;
+    }
+    close(app);
+}
+
+/// Cancel (button, Esc): closes; what was applied stays. The settings are kept.
+pub fn cancel(app: &mut PhotocraftApp) {
+    if let Some(w) = app.distort.caf.as_ref() {
+        let opts = w.opts.clone();
+        remember(app, &opts);
+    }
+    close(app);
+}
+
+fn close(app: &mut PhotocraftApp) {
+    if let Some(w) = app.distort.caf.take() {
+        cancel_preview(w);
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn cancel_preview(w: CafWorkspace) {
+    if let Some((_, _, job)) = w.preview.running {
+        job.cancel();
+    }
+}
+
+#[cfg(target_arch = "wasm32")]
+fn cancel_preview(_: CafWorkspace) {}
+
+/// The document changed under the workspace (an Apply): new textures, a new base.
+fn refresh(app: &mut PhotocraftApp) {
+    let rev = app.session.active().map(|s| s.revision);
+    if let Some(w) = app.distort.caf.as_mut() {
+        w.image_tex = None;
+        w.revision = rev.unwrap_or(w.revision);
+    }
+    rebase(app);
+}
+
+fn undo(app: &mut PhotocraftApp) {
+    let Some(w) = app.distort.caf.as_mut() else { return };
+    w.end_stroke();
+    let Some(step) = w.undo.pop() else { return };
+    let rebuild = match &step {
+        Step::Stroke(_) => {
+            w.strokes.pop();
+            w.redo.push(step);
+            w.restate_all();
+            w.stale();
+            false
+        }
+        Step::Fill(_) => {
+            w.fill_edits.pop();
+            w.redo.push(step);
+            true
+        }
+        Step::State { sampling, strokes, fill_edits } => {
+            let now = Step::State { sampling: w.opts.sampling.clone(), strokes: w.strokes.clone(), fill_edits: w.fill_edits.clone() };
+            w.opts.sampling = sampling.clone();
+            w.strokes = strokes.clone();
+            w.fill_edits = fill_edits.clone();
+            w.brush_add = w.opts.sampling == "custom";
+            w.redo.push(now);
+            true
+        }
+    };
+    if rebuild {
+        rebase(app);
+    }
+}
+
+fn redo(app: &mut PhotocraftApp) {
+    let Some(w) = app.distort.caf.as_mut() else { return };
+    w.end_stroke();
+    let Some(step) = w.redo.pop() else { return };
+    let rebuild = match &step {
+        Step::Stroke(s) => {
+            w.strokes.push(s.clone());
+            w.undo.push(step);
+            w.restate_all();
+            w.stale();
+            false
+        }
+        Step::Fill(e) => {
+            w.fill_edits.push(e.clone());
+            w.undo.push(step);
+            true
+        }
+        Step::State { sampling, strokes, fill_edits } => {
+            let now = Step::State { sampling: w.opts.sampling.clone(), strokes: w.strokes.clone(), fill_edits: w.fill_edits.clone() };
+            w.opts.sampling = sampling.clone();
+            w.strokes = strokes.clone();
+            w.fill_edits = fill_edits.clone();
+            w.brush_add = w.opts.sampling == "custom";
+            w.undo.push(now);
+            true
+        }
+    };
+    if rebuild {
+        rebase(app);
+    }
+}
+
+/// A lasso edit of the fill area (or Expand / Contract), undoable.
+fn fill_edit(app: &mut PhotocraftApp, edit: Value) {
+    let Some(w) = app.distort.caf.as_mut() else { return };
+    w.end_stroke();
+    // The engine's limits, kept here (see `begin_stroke`).
+    if w.fill_edits.len() >= MAX_CAF_EDITS {
+        w.error = Some(format!("at most {MAX_CAF_EDITS} lasso edits: undo some, or reset the fill area"));
+        return;
+    }
+    if w.points_used() + edit.get("points").and_then(Value::as_array).map_or(0, Vec::len) > MAX_CAF_POINTS {
+        w.error = Some(points_limit());
+        return;
+    }
+    w.fill_edits.push(edit.clone());
+    w.push(Step::Fill(edit));
+    rebase(app);
+    // An edit that empties the fill area is refused (the plan says so): undo it.
+    if app.distort.caf.as_ref().is_some_and(|w| w.error.is_some()) {
+        let msg = app.distort.caf.as_ref().and_then(|w| w.error.clone());
+        undo(app);
+        if let Some(w) = app.distort.caf.as_mut() {
+            w.redo.clear();
+            w.error = msg;
+        }
+    }
+}
+
+/// A new sampling option (Auto, Rectangular, Custom): the brush strokes start over and the brush
+/// takes the option's mode (Custom adds, the others subtract).
+fn set_sampling(app: &mut PhotocraftApp, sampling: &str) {
+    let Some(w) = app.distort.caf.as_mut() else { return };
+    if w.opts.sampling == sampling && w.strokes.is_empty() {
+        return;
+    }
+    w.end_stroke();
+    let prev = Step::State { sampling: w.opts.sampling.clone(), strokes: std::mem::take(&mut w.strokes), fill_edits: w.fill_edits.clone() };
+    w.push(prev);
+    w.opts.sampling = sampling.to_string();
+    w.brush_add = sampling == "custom";
+    rebase(app);
+}
+
+/// Reset buttons: the sampling options, the fill settings, or everything.
+fn reset(app: &mut PhotocraftApp, what: &str) {
+    let Some(w) = app.distort.caf.as_mut() else { return };
+    let d = CafOpts::default();
+    match what {
+        "fill" => {
+            w.opts.color_adaptation = d.color_adaptation;
+            w.opts.rotation = d.rotation;
+            w.opts.scale = d.scale;
+            w.opts.mirror = d.mirror;
+            w.stale();
+        }
+        "sampling" => {
+            w.opts.sample_all = false;
+            set_sampling(app, "auto");
+        }
+        "lasso" => {
+            if !w.fill_edits.is_empty() {
+                let prev = Step::State { sampling: w.opts.sampling.clone(), strokes: w.strokes.clone(), fill_edits: std::mem::take(&mut w.fill_edits) };
+                w.push(prev);
+                rebase(app);
+            }
+        }
+        _ => {
+            let prev =
+                Step::State { sampling: w.opts.sampling.clone(), strokes: std::mem::take(&mut w.strokes), fill_edits: std::mem::take(&mut w.fill_edits) };
+            w.push(prev);
+            w.opts = CafOpts::default();
+            w.brush_add = false;
+            rebase(app);
+        }
+    }
+}
+
+/// Control channel: `edit.contentAwareFill {"ui": {...}}` while the workspace is open.
+pub fn control(app: &mut PhotocraftApp, ui: &Value) -> Result<Value, String> {
+    let flag = |k: &str| ui.get(k).and_then(Value::as_bool) == Some(true);
+    if flag("cancel") {
+        cancel(app);
+        return Ok(json!({"cancelled": true}));
+    }
+    let before = app.distort.caf.as_ref().ok_or("Content-Aware Fill is not open")?.opts.clone();
+    {
+        let w = app.distort.caf.as_mut().ok_or("Content-Aware Fill is not open")?;
+        let mut o = w.opts.clone();
+        o.apply(ui)?;
+        // The sampling option goes through `set_sampling` (it resets the strokes).
+        let sampling = std::mem::replace(&mut o.sampling, w.opts.sampling.clone());
+        w.opts = o;
+        if let Some(t) = ui.get("tool").and_then(Value::as_str) {
+            w.tool = CafTool::from_name(t).ok_or(format!("bad tool `{t}` (brush|lasso|hand|zoom)"))?;
+        }
+        if let Some(n) = ui.get("brushSize").and_then(Value::as_f64).filter(|n| n.is_finite()) {
+            w.brush_size = n.clamp(1.0, 5000.0);
+        }
+        if let Some(m) = ui.get("brushMode").and_then(Value::as_str) {
+            w.brush_add = m == "add";
+        }
+        if let Some(m) = ui.get("lassoMode").and_then(Value::as_str) {
+            w.lasso_op = LASSO_OPS.iter().position(|o| *o == m).ok_or(format!("bad lassoMode `{m}`"))?;
+        }
+        if let Some(n) = ui.get("expandBy").and_then(Value::as_f64).filter(|n| n.is_finite()) {
+            w.expand_by = (n as f32).clamp(1.0, 100.0);
+        }
+        if sampling != w.opts.sampling {
+            set_sampling(app, &sampling);
+        }
+    }
+    let after = app.distort.caf.as_ref().map(|w| w.opts.clone());
+    if after.as_ref().is_some_and(|a| a.sample_all != before.sample_all) {
+        rebase(app);
+    } else if after.as_ref().is_some_and(|a| *a != before)
+        && let Some(w) = app.distort.caf.as_mut()
+    {
+        w.stale();
+        w.restate_all();
+    }
+    if let Some(s) = ui.get("stroke") {
+        let pts: Vec<[f64; 2]> = serde_json::from_value(s.get("points").cloned().unwrap_or(Value::Null)).map_err(|e| format!("bad stroke points: {e}"))?;
+        let w = app.distort.caf.as_mut().ok_or("Content-Aware Fill is not open")?;
+        if let Some(n) = s.get("size").and_then(Value::as_f64) {
+            w.brush_size = n.clamp(1.0, 5000.0);
+        }
+        let alt = s.get("alt").and_then(Value::as_bool).unwrap_or(false);
+        if let Some(first) = pts.first() {
+            w.begin_stroke(*first, alt);
+            for p in &pts[1..] {
+                w.extend_stroke(*p);
+            }
+            w.end_stroke();
+        }
+    }
+    if let Some(l) = ui.get("lasso") {
+        let pts: Vec<[f64; 2]> = serde_json::from_value(l.get("points").cloned().unwrap_or(Value::Null)).map_err(|e| format!("bad lasso points: {e}"))?;
+        let op = match l.get("op").and_then(Value::as_str) {
+            Some(o) if LASSO_OPS.contains(&o) => o.to_string(),
+            Some(o) => return Err(format!("bad lasso op `{o}`")),
+            None => LASSO_OPS[app.distort.caf.as_ref().map_or(0, |w| w.lasso_op)].to_string(),
+        };
+        fill_edit(app, json!({"op": op, "points": pts}));
+    }
+    for k in ["expand", "contract"] {
+        if let Some(n) = ui.get(k).and_then(Value::as_f64) {
+            fill_edit(app, json!({"op": k, "by": n.clamp(1.0, 100.0)}));
+        }
+    }
+    if let Some(r) = ui.get("reset").and_then(Value::as_str) {
+        reset(app, r);
+    }
+    if flag("undo") {
+        undo(app);
+    }
+    if flag("redo") {
+        redo(app);
+    }
+    if flag("apply") {
+        apply(app)?;
+    }
+    if flag("waitPreview") {
+        wait_preview(app)?;
+    }
+    // OK last, with the settings given alongside.
+    if flag("commit") {
+        let r = apply(app);
+        close(app);
+        return r.map(|v| json!({"committed": true, "result": v}));
+    }
+    Ok(app.distort.caf.as_ref().map(CafWorkspace::describe).unwrap_or(Value::Null))
+}
+
+/// Computes the preview now, on this thread (tests and the control channel).
+fn wait_preview(app: &mut PhotocraftApp) -> Result<(), String> {
+    let (doc, layer, p, want, limit) = {
+        let w = app.distort.caf.as_ref().ok_or("Content-Aware Fill is not open")?;
+        let st = app.session.active().ok_or("no document")?;
+        (st.doc.clone(), w.layer, plan_params(w, true), w.preview.want, w.texture_limit)
+    };
+    let r = compute_preview(&doc, layer, &p, &photocraft_raster::Interrupt::NONE, limit);
+    let w = app.distort.caf.as_mut().ok_or("Content-Aware Fill is not open")?;
+    let err = r.as_ref().err().cloned();
+    w.preview.finish(want, r);
+    err.map_or(Ok(()), Err)
+}
+
+/// The filled rectangle as an image (what Apply would write there), as a texture no wider than
+/// `max_side`: past the device's limit it is box-averaged to fit (the rectangle it is drawn over
+/// stays the plan's).
+fn compute_preview(
+    doc: &photocraft_doc::Document,
+    layer: LayerId,
+    p: &Value,
+    ctl: &photocraft_raster::Interrupt,
+    max_side: usize,
+) -> Result<(Rect, egui::ColorImage), String> {
+    let plan = photocraft_engine::edit_menu_cmds::content_aware_plan_with(doc, layer, p, CMD, ctl).map_err(|e| match e {
+        photocraft_engine::EngineError::Cancelled => "cancelled".to_string(),
+        e => e.to_string(),
+    })?;
+    let (w, h) = (plan.rect.width() as usize, plan.rect.height() as usize);
+    let n = plan.fmt.channels();
+    let filled =
+        photocraft_algo::content_aware::fill_with(w, h, n, &plan.img, &plan.hole, &plan.source, &plan.opts, ctl).map_err(|_| "cancelled".to_string())?;
+    let own = plan.layer_pixels();
+    // Pixel `i`: the fill over the fill area (a partly selected pixel by its coverage), the
+    // layer's own pixels elsewhere.
+    let pixel = |i: usize| -> [f32; 4] {
+        let src = if plan.hole[i] { &filled[i * n..(i + 1) * n] } else { &own[i * n..(i + 1) * n] };
+        let mut c = photocraft_raster::to_rgba(&plan.fmt, src);
+        if plan.hole[i] {
+            let k = plan.cover[i];
+            let under = photocraft_raster::to_rgba(&plan.fmt, &own[i * n..(i + 1) * n]);
+            for j in 0..4 {
+                c[j] = under[j] + (c[j] - under[j]) * k;
+            }
+        }
+        c
+    };
+    let b = |v: f32| (v.clamp(0.0, 1.0) * 255.0).round() as u8;
+    let color = |c: [f32; 4]| Color32::from_rgba_unmultiplied(b(c[0]), b(c[1]), b(c[2]), b(c[3]));
+    let f = crate::filter_preview_ui::texture_factor(w as u32, h as u32, max_side) as usize;
+    if f == 1 {
+        let px = (0..w * h).map(|i| color(pixel(i))).collect();
+        return Ok((plan.rect, egui::ColorImage::new([w, h], px)));
+    }
+    let (tw, th) = (w.div_ceil(f), h.div_ceil(f));
+    let mut px = Vec::with_capacity(tw * th);
+    for ty in 0..th {
+        for tx in 0..tw {
+            // The block's premultiplied average.
+            let (mut acc, mut count) = ([0.0f32; 4], 0.0f32);
+            for y in ty * f..((ty + 1) * f).min(h) {
+                for x in tx * f..((tx + 1) * f).min(w) {
+                    let c = pixel(y * w + x);
+                    for j in 0..3 {
+                        acc[j] += c[j] * c[3];
+                    }
+                    acc[3] += c[3];
+                    count += 1.0;
+                }
+            }
+            let c = if acc[3] > 0.0 { [acc[0] / acc[3], acc[1] / acc[3], acc[2] / acc[3], acc[3] / count] } else { [0.0; 4] };
+            px.push(color(c));
+        }
+    }
+    Ok((plan.rect, egui::ColorImage::new([tw, th], px)))
+}
+
+/// Starts a background preview when the shown one is out of date (and the pointer is up), and
+/// collects a finished one.
+#[cfg(not(target_arch = "wasm32"))]
+fn drive_preview(app: &mut PhotocraftApp, ctx: &egui::Context, dragging: bool) {
+    let doc = app.session.active().map(|s| s.doc.clone());
+    let Some(w) = app.distort.caf.as_mut() else { return };
+    let pv = &mut w.preview;
+    if let Some((generation, rx, _)) = &pv.running {
+        match rx.try_recv() {
+            Ok(r) => {
+                let generation = *generation;
+                pv.running = None;
+                if generation == pv.want {
+                    match r {
+                        Err(e) if e == "cancelled" => {}
+                        r => pv.finish(generation, r),
+                    }
+                }
+            }
+            Err(std::sync::mpsc::TryRecvError::Empty) => {
+                // Superseded: stop it, a new one starts when it has gone.
+                if *generation != pv.want
+                    && let Some((_, _, job)) = &pv.running
+                {
+                    job.cancel();
+                }
+                ctx.request_repaint_after(std::time::Duration::from_millis(50));
+                return;
+            }
+            Err(std::sync::mpsc::TryRecvError::Disconnected) => pv.running = None,
+        }
+    }
+    if pv.running.is_some() || pv.shown == pv.want || dragging {
+        return;
+    }
+    let Some(doc) = doc else { return };
+    let (layer, p, generation, limit) = (w.layer, plan_params(w, true), w.preview.want, w.texture_limit);
+    let (tx, rx) = std::sync::mpsc::sync_channel(1);
+    let job = photocraft_engine::jobs::JobCtx::new();
+    let work = job.clone();
+    let repaint = ctx.clone();
+    let spawned = std::thread::Builder::new().name("caf-preview".into()).spawn(move || {
+        let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| work.stage(0.0, 1.0, "", |ctl| compute_preview(&doc, layer, &p, ctl, limit))))
+            .unwrap_or_else(|_| Err("the preview failed".into()));
+        let _ = tx.send(r);
+        repaint.request_repaint();
+    });
+    match spawned {
+        Ok(_) => w.preview.running = Some((generation, rx, job)),
+        Err(e) => w.preview.error = Some(format!("could not start the preview: {e}")),
+    }
+}
+
+/// The web build has no threads: the preview is computed when the pointer comes up.
+#[cfg(target_arch = "wasm32")]
+fn drive_preview(app: &mut PhotocraftApp, _ctx: &egui::Context, dragging: bool) {
+    let stale = app.distort.caf.as_ref().is_some_and(|w| w.preview.shown != w.preview.want);
+    if stale && !dragging {
+        let _ = wait_preview(app);
+    }
+}
+
+/// Pointer in document coordinates (from the view or the control channel).
+pub fn pointer(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers) {
+    let Some(w) = app.distort.caf.as_mut() else { return };
+    match (w.tool, ev) {
+        (CafTool::Brush, ToolEvent::Down { x, y, .. }) => w.begin_stroke([x, y], mods.alt),
+        (CafTool::Brush, ToolEvent::Move { x, y, .. }) => {
+            w.hover = Some([x, y]);
+            w.extend_stroke([x, y]);
+        }
+        (CafTool::Brush, ToolEvent::Up { x, y }) => {
+            w.extend_stroke([x, y]);
+            w.end_stroke();
+        }
+        (CafTool::Lasso, ToolEvent::Down { x, y, .. }) => {
+            // Shift adds, Alt subtracts, both intersect (as Photoshop's selection tools).
+            let op = match (mods.shift, mods.alt) {
+                (true, true) => 3,
+                (true, false) => 1,
+                (false, true) => 2,
+                _ => w.lasso_op,
+            };
+            w.lasso = Some((op, vec![[x, y]]));
+        }
+        (CafTool::Lasso, ToolEvent::Move { x, y, .. }) => {
+            if let Some((_, pts)) = &mut w.lasso
+                && pts.last().is_none_or(|l| l[0] != x || l[1] != y)
+            {
+                pts.push([x, y]);
+            }
+        }
+        (CafTool::Lasso, ToolEvent::Up { .. }) => {
+            if let Some((op, pts)) = w.lasso.take()
+                && pts.len() >= 3
+            {
+                fill_edit(app, json!({"op": LASSO_OPS[op], "points": pts}));
+            }
+        }
+        (CafTool::Zoom, ToolEvent::Down { x, y, .. }) => {
+            let f = if mods.alt { 0.5 } else { 2.0 };
+            w.zoom = (w.zoom * f).clamp(0.01, 32.0);
+            w.center = [x, y];
+        }
+        _ => {}
+    }
+}
+
+pub fn keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    let cmd_shift = egui::Modifiers::COMMAND | egui::Modifiers::SHIFT;
+    if ctx.input_mut(|i| i.consume_key(cmd_shift, egui::Key::Z)) {
+        redo(app);
+        return;
+    }
+    if ctx.input_mut(|i| i.consume_key(egui::Modifiers::COMMAND, egui::Key::Z)) {
+        undo(app);
+        return;
+    }
+    let Some(w) = app.distort.caf.as_mut() else { return };
+    // Ctrl+H hides the overlay (Hide Extras).
+    if ctx.input_mut(|i| i.consume_key(egui::Modifiers::COMMAND, egui::Key::H)) {
+        w.opts.show_overlay = !w.opts.show_overlay;
+        w.overlay_dirty = true;
+    }
+    if ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::OpenBracket)) {
+        w.brush_size = (w.brush_size * 0.9).max(1.0).round();
+    }
+    if ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::CloseBracket)) {
+        w.brush_size = (w.brush_size * 1.1).min(5000.0).round().max(w.brush_size + 1.0);
+    }
+    for (k, t) in [(egui::Key::B, CafTool::Brush), (egui::Key::L, CafTool::Lasso), (egui::Key::H, CafTool::Hand), (egui::Key::Z, CafTool::Zoom)] {
+        if ctx.input_mut(|i| i.consume_key(egui::Modifiers::NONE, k)) {
+            w.tool = t;
+        }
+    }
+}
+
+fn tool_icon(t: CafTool) -> &'static str {
+    match t {
+        CafTool::Brush => "brush",
+        CafTool::Lasso => "lasso",
+        CafTool::Hand => "hand",
+        CafTool::Zoom => "zoom-in",
+    }
+}
+
+fn tool_tip(t: CafTool) -> String {
+    match t {
+        CafTool::Brush => format!("{} (B)", tl!("Sampling Brush Tool")),
+        CafTool::Lasso => format!("{} (L)", tl!("Lasso Tool")),
+        CafTool::Hand => format!("{} (H)", tl!("Hand Tool")),
+        CafTool::Zoom => format!("{} (Z)", tl!("Zoom Tool")),
+    }
+}
+
+/// A view: screen px per document px and the document point at the centre of `area`.
+#[derive(Clone, Copy)]
+struct View {
+    area: ERect,
+    zoom: f32,
+    center: [f64; 2],
+}
+
+impl View {
+    fn to_screen(self, p: [f64; 2]) -> Pos2 {
+        let c = self.area.center();
+        pos2(c.x + ((p[0] - self.center[0]) as f32) * self.zoom, c.y + ((p[1] - self.center[1]) as f32) * self.zoom)
+    }
+    fn to_doc(self, s: Pos2) -> [f64; 2] {
+        let c = self.area.center();
+        [self.center[0] + f64::from((s.x - c.x) / self.zoom), self.center[1] + f64::from((s.y - c.y) / self.zoom)]
+    }
+    fn rect(self, r: Rect) -> ERect {
+        ERect::from_min_max(self.to_screen([f64::from(r.x0), f64::from(r.y0)]), self.to_screen([f64::from(r.x1), f64::from(r.y1)]))
+    }
+}
+
+/// Upload what changed: the document proxy, the overlay, a finished preview.
+fn upload(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    let need_image = app.distort.caf.as_ref().is_some_and(|w| w.image_tex.is_none());
+    if need_image {
+        let img = view_image(app);
+        if let (Some(w), Some(img)) = (app.distort.caf.as_mut(), img) {
+            w.image_tex = Some(ctx.load_texture("caf-image", img, egui::TextureOptions::LINEAR));
+        }
+    }
+    let Some(w) = app.distort.caf.as_mut() else { return };
+    if w.overlay_dirty || w.overlay_tex.is_none() {
+        w.overlay_dirty = false;
+        let [r, g, b] = w.opts.color;
+        let a = (w.opts.opacity / 100.0 * 255.0).round() as u8;
+        let tint = Color32::from_rgba_unmultiplied(r, g, b, a);
+        // The tint marks the sampling area (with Indicates: Excluded Area, what is left out);
+        // the fill area is never tinted.
+        let px: Vec<Color32> =
+            w.mask.iter().zip(&w.hole_px).map(|(m, h)| if w.opts.show_overlay && !*h && *m != w.opts.excluded { tint } else { Color32::TRANSPARENT }).collect();
+        let img = egui::ColorImage::new([w.pw, w.ph], px);
+        match &mut w.overlay_tex {
+            Some(t) => t.set(img, egui::TextureOptions::NEAREST),
+            None => w.overlay_tex = Some(ctx.load_texture("caf-overlay", img, egui::TextureOptions::NEAREST)),
+        }
+    }
+    if let Some((rect, img)) = w.preview.pending_image.take() {
+        w.preview.tex = Some((ctx.load_texture("caf-preview", img, egui::TextureOptions::LINEAR), rect));
+    }
+}
+
+/// The document as the view shows it: the visible layers composited, as on the canvas (so an
+/// Apply to a new layer shows), reduced to the proxy.
+fn view_image(app: &PhotocraftApp) -> Option<egui::ColorImage> {
+    let w = app.distort.caf.as_ref()?;
+    let st = app.session.active()?;
+    let buf = photocraft_compose::render_reduced(&st.doc, w.pw as u32, w.ph as u32);
+    let (display, _) = crate::canvas::canvas_display(app, &st.doc, None);
+    Some(crate::canvas::display_image(display.as_deref(), &buf))
+}
+
+/// Draws the workspace (a full-window layer over the app).
+pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    // An Apply (or anything else) changed the document: refresh.
+    let rev = app.session.active().map(|s| s.revision);
+    if app.distort.caf.as_ref().is_some_and(|w| Some(w.revision) != rev) {
+        refresh(app);
+    }
+    upload(app, ctx);
+    let t = Tokens::get(ctx);
+    let screen = ctx.content_rect();
+    let mut action: Option<&str> = None;
+    let mut events: Vec<ToolEvent> = Vec::new();
+    let mut mods = egui::Modifiers::NONE;
+    let mut new_sampling: Option<&str> = None;
+    let mut fill_btn: Option<Value> = None;
+    let mut reset_what: Option<&str> = None;
+    let mut rebase_needed = false;
+    let mut dragging = false;
+    egui::Area::new(egui::Id::new("caf-workspace")).order(egui::Order::Foreground).fixed_pos(screen.min).show(ctx, |ui| {
+        let Some(w) = app.distort.caf.as_mut() else { return };
+        let before = w.opts.clone();
+        w.texture_limit = ctx.input(|i| i.max_texture_side);
+        let (full, _) = ui.allocate_exact_size(screen.size(), Sense::hover());
+        let painter = ui.painter().clone();
+        painter.rect_filled(full, 0.0, t.chrome);
+        // Title strip.
+        let title = ERect::from_min_size(full.min, vec2(full.width(), 30.0));
+        painter.rect_filled(title, 0.0, t.dock);
+        painter.line_segment([title.left_bottom(), title.right_bottom()], Stroke::new(1.0, t.separator));
+        let pct = if w.zoom > 0.0 { w.zoom * 100.0 } else { 100.0 };
+        painter.text(
+            title.center(),
+            Align2::CENTER_CENTER,
+            format!("{} ({}, {:.0}%)", tl!("Content-Aware Fill…").trim_end_matches('…'), w.layer_name, pct),
+            FontId::proportional(13.0),
+            t.text,
+        );
+        // Options bar.
+        let bar = ERect::from_min_size(pos2(full.left(), title.bottom()), vec2(full.width(), BAR_H));
+        painter.rect_filled(bar, 0.0, t.dock);
+        painter.line_segment([bar.left_bottom(), bar.right_bottom()], Stroke::new(1.0, t.separator));
+        let mut bui =
+            ui.new_child(egui::UiBuilder::new().max_rect(bar.shrink2(vec2(LEFT_W + 8.0, 4.0))).layout(egui::Layout::left_to_right(egui::Align::Center)));
+        match w.tool {
+            CafTool::Brush => {
+                if crate::icons::button(&mut bui, "plus", 26.0, w.brush_add, tl!("Add")).clicked() {
+                    w.brush_add = true;
+                }
+                if crate::icons::button(&mut bui, "minus", 26.0, !w.brush_add, tl!("Subtract")).clicked() {
+                    w.brush_add = false;
+                }
+                bui.add_space(8.0);
+                bui.label(tl!("Size:"));
+                let mut size = w.brush_size as f32;
+                if widgets::value_field(&mut bui, &mut size, 1.0..=5000.0, " px", 64.0).changed() {
+                    w.brush_size = f64::from(size);
+                }
+            }
+            CafTool::Lasso => {
+                // The selection tools' mode buttons (the lasso here edits the fill area).
+                let tips = [
+                    tl!("New selection").to_string(),
+                    crate::i18n::fmt(tl!("Add to selection  ({key})"), &[("key", &crate::shortcuts::pretty("Shift"))]),
+                    crate::i18n::fmt(tl!("Subtract from selection  ({key})"), &[("key", &crate::shortcuts::pretty("Alt"))]),
+                    crate::i18n::fmt(tl!("Intersect with selection  ({key})"), &[("key", &crate::shortcuts::pretty("Shift+Alt"))]),
+                ];
+                for (i, (icon, tip)) in ["square", "plus", "minus", "squares-subtract"].into_iter().zip(tips.iter()).enumerate() {
+                    if crate::icons::button(&mut bui, icon, 26.0, w.lasso_op == i, tip).clicked() {
+                        w.lasso_op = i;
+                    }
+                }
+                bui.add_space(8.0);
+                if widgets::secondary_button(&mut bui, tl!("Expand"), 70.0).clicked() {
+                    fill_btn = Some(json!({"op": "expand", "by": w.expand_by}));
+                }
+                if widgets::secondary_button(&mut bui, tl!("Contract"), 70.0).clicked() {
+                    fill_btn = Some(json!({"op": "contract", "by": w.expand_by}));
+                }
+                widgets::value_field(&mut bui, &mut w.expand_by, 1.0..=100.0, " px", 56.0);
+                if crate::icons::button(&mut bui, "undo-2", 26.0, false, tl!("Reset")).clicked() {
+                    reset_what = Some("lasso");
+                }
+            }
+            _ => {}
+        }
+        let body = ERect::from_min_max(pos2(full.left(), bar.bottom()), full.max);
+        // Left tool strip.
+        let left = ERect::from_min_size(pos2(full.left(), title.bottom()), vec2(LEFT_W, full.height() - title.height()));
+        painter.rect_filled(left, 0.0, t.dock);
+        painter.line_segment([left.right_top(), left.right_bottom()], Stroke::new(1.0, t.separator));
+        let mut strip = ui.new_child(egui::UiBuilder::new().max_rect(left.shrink2(vec2(6.0, 8.0))));
+        strip.spacing_mut().item_spacing.y = 4.0;
+        for tool in [CafTool::Brush, CafTool::Lasso, CafTool::Hand, CafTool::Zoom] {
+            if crate::icons::button(&mut strip, tool_icon(tool), 34.0, w.tool == tool, &tool_tip(tool)).clicked() {
+                w.tool = tool;
+            }
+        }
+        // Right: the Content-Aware Fill panel.
+        let right = ERect::from_min_size(pos2(body.right() - PANEL_W, body.top()), vec2(PANEL_W, body.height()));
+        painter.rect_filled(right, 0.0, t.dock);
+        painter.line_segment([right.left_top(), right.left_bottom()], Stroke::new(1.0, t.separator));
+        let mut props =
+            ui.new_child(egui::UiBuilder::new().max_rect(ERect::from_min_max(right.min + vec2(14.0, 12.0), pos2(right.right() - 14.0, right.bottom() - 60.0))));
+        egui::ScrollArea::vertical().id_salt("caf-props").show(&mut props, |ui| {
+            ui.spacing_mut().item_spacing.y = 6.0;
+            egui::CollapsingHeader::new(tl!("Sampling Area Overlay")).id_salt("caf-overlay").default_open(false).show(ui, |ui| {
+                widgets::checkbox(ui, &mut w.opts.show_overlay, tl!("Show Sampling Area"));
+                widgets::slider_row(ui, tl!("Opacity"), &mut w.opts.opacity, 0.0..=100.0, "%", None);
+                ui.horizontal(|ui| {
+                    ui.label(tl!("Color"));
+                    widgets::color_edit_button_srgb(ui, &mut w.opts.color);
+                    ui.add_space(8.0);
+                    ui.label(tl!("Indicates"));
+                    widgets::dropdown(ui, "caf-indicates", &mut w.opts.excluded, &[(false, tl!("Sampling Area")), (true, tl!("Excluded Area"))], 120.0);
+                });
+            });
+            widgets::hairline(ui);
+            ui.horizontal(|ui| {
+                widgets::section_label(ui, tl!("Sampling Area Options"));
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    if crate::icons::button(ui, "undo-2", 22.0, false, tl!("Reset")).clicked() {
+                        reset_what = Some("sampling");
+                    }
+                });
+            });
+            ui.horizontal(|ui| {
+                for (k, l) in [("auto", tl!("Auto")), ("rectangular", tl!("Rectangular")), ("custom", tl!("Custom"))] {
+                    if ui.selectable_label(w.opts.sampling == k, l).clicked() && w.opts.sampling != k {
+                        new_sampling = Some(k);
+                    }
+                }
+            });
+            if widgets::checkbox(ui, &mut w.opts.sample_all, tl!("Sample All Layers")).changed() {
+                rebase_needed = true;
+            }
+            widgets::hairline(ui);
+            ui.horizontal(|ui| {
+                widgets::section_label(ui, tl!("Fill Settings"));
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    if crate::icons::button(ui, "undo-2", 22.0, false, tl!("Reset")).clicked() {
+                        reset_what = Some("fill");
+                    }
+                });
+            });
+            ui.horizontal(|ui| {
+                ui.label(tl!("Color Adaptation"));
+                let o = [
+                    ("none".to_string(), tl!("None")),
+                    ("default".to_string(), tl!("Default")),
+                    ("high".to_string(), tl!("High")),
+                    ("veryHigh".to_string(), tl!("Very High")),
+                ];
+                widgets::dropdown(ui, "caf-color", &mut w.opts.color_adaptation, &o, 110.0);
+            });
+            ui.horizontal(|ui| {
+                ui.label(tl!("Rotation Adaptation"));
+                let o = [
+                    ("none".to_string(), tl!("None")),
+                    ("low".to_string(), tl!("Low")),
+                    ("medium".to_string(), tl!("Medium")),
+                    ("high".to_string(), tl!("High")),
+                    ("full".to_string(), tl!("Full")),
+                ];
+                widgets::dropdown(ui, "caf-rotation", &mut w.opts.rotation, &o, 110.0);
+            });
+            ui.horizontal(|ui| {
+                widgets::checkbox(ui, &mut w.opts.scale, tl!("Scale"));
+                widgets::checkbox(ui, &mut w.opts.mirror, tl!("Mirror"));
+            });
+            widgets::hairline(ui);
+            widgets::section_label(ui, tl!("Output Settings"));
+            ui.horizontal(|ui| {
+                ui.label(tl!("Output To"));
+                let o =
+                    [("current".to_string(), tl!("Current Layer")), ("new".to_string(), tl!("New Layer")), ("duplicate".to_string(), tl!("Duplicate Layer"))];
+                widgets::dropdown(ui, "caf-output", &mut w.opts.output, &o, 140.0);
+            });
+            if let Some(e) = w.error.as_ref().or(w.preview.error.as_ref()) {
+                ui.label(egui::RichText::new(e.as_str()).color(t.danger).size(11.0));
+            }
+        });
+        // Footer, in Photoshop's order on every platform: reset all at the left, then OK, Apply,
+        // Cancel against the right edge.
+        let foot = ERect::from_min_size(pos2(right.left() + 10.0, right.bottom() - 48.0), vec2(PANEL_W - 20.0, 32.0));
+        let mut fb = ui.new_child(egui::UiBuilder::new().max_rect(foot).layout(egui::Layout::right_to_left(egui::Align::Center)));
+        if widgets::secondary_button(&mut fb, tl!("Cancel"), 70.0).clicked() {
+            action = Some("cancel");
+        }
+        if widgets::secondary_button(&mut fb, tl!("Apply"), 70.0).clicked() {
+            action = Some("apply");
+        }
+        if widgets::primary_button(&mut fb, tl!("OK"), 64.0).clicked() {
+            action = Some("ok");
+        }
+        if crate::icons::button(&mut fb, "undo-2", 24.0, false, tl!("Reset")).clicked() {
+            reset_what = Some("all");
+        }
+        // The Preview panel.
+        let pv_rect = ERect::from_min_size(pos2(right.left() - PREVIEW_W, body.top()), vec2(PREVIEW_W, body.height()));
+        painter.rect_filled(pv_rect, 0.0, t.dock);
+        painter.line_segment([pv_rect.left_top(), pv_rect.left_bottom()], Stroke::new(1.0, t.separator));
+        painter.text(pv_rect.left_top() + vec2(12.0, 10.0), Align2::LEFT_TOP, tl!("Preview"), FontId::proportional(12.0), t.text);
+        let pv_area = ERect::from_min_max(pv_rect.min + vec2(0.0, 30.0), pv_rect.max - vec2(0.0, 44.0));
+        painter.rect_filled(pv_area, 0.0, t.canvas);
+        if w.preview.zoom <= 0.0 {
+            // Opens framed on the sampling window, as Photoshop's.
+            let win = w.base.window;
+            if !win.is_empty() {
+                w.preview.zoom = (pv_area.width() / win.width().max(win.height()) as f32).clamp(0.01, 32.0);
+                w.preview.center = [f64::from(win.x0 + win.x1) / 2.0, f64::from(win.y0 + win.y1) / 2.0];
+            }
+        }
+        let pv = View { area: pv_area, zoom: w.preview.zoom.max(0.01), center: w.preview.center };
+        let pclip = painter.with_clip_rect(pv_area);
+        let uv = ERect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0));
+        let img_rect = pv.rect(w.canvas);
+        widgets::checker(&pclip, img_rect.intersect(pv_area), 8.0);
+        if let Some(tex) = &w.image_tex {
+            pclip.image(tex.id(), img_rect, uv, Color32::WHITE);
+        }
+        if let Some((tex, r)) = &w.preview.tex {
+            pclip.image(tex.id(), pv.rect(*r), uv, Color32::WHITE);
+        }
+        if w.preview.shown != w.preview.want {
+            // Being recomputed: a spinner in the corner.
+            let sp = ERect::from_min_size(pv_area.right_bottom() - vec2(26.0, 26.0), vec2(18.0, 18.0));
+            ui.put(sp, egui::Spinner::new().size(16.0));
+        }
+        let presp = ui.interact(pv_area, egui::Id::new("caf-preview-view"), Sense::click_and_drag());
+        if presp.dragged() {
+            let d = presp.drag_delta();
+            w.preview.center = [w.preview.center[0] - f64::from(d.x / pv.zoom), w.preview.center[1] - f64::from(d.y / pv.zoom)];
+        }
+        if presp.hovered() {
+            let scroll = ui.input(|i| i.smooth_scroll_delta.y);
+            if scroll != 0.0 {
+                w.preview.zoom = (w.preview.zoom * (scroll / 200.0).exp()).clamp(0.01, 32.0);
+            }
+        }
+        let zrow = ERect::from_min_size(pos2(pv_rect.left() + 10.0, pv_rect.bottom() - 38.0), vec2(PREVIEW_W - 20.0, 30.0));
+        let mut zr = ui.new_child(egui::UiBuilder::new().max_rect(zrow).layout(egui::Layout::left_to_right(egui::Align::Center)));
+        let mut pct = (w.preview.zoom * 100.0).round();
+        if widgets::value_field(&mut zr, &mut pct, 1.0..=3200.0, "%", 64.0).changed() {
+            w.preview.zoom = pct / 100.0;
+        }
+        let mut lz = pct.max(1.0).ln();
+        if zr.add(egui::Slider::new(&mut lz, 0.0..=3200f32.ln()).show_value(false)).changed() {
+            w.preview.zoom = lz.exp() / 100.0;
+        }
+        // The document view.
+        let area = ERect::from_min_max(pos2(left.right(), body.top()), pos2(pv_rect.left(), body.bottom()));
+        painter.rect_filled(area, 0.0, t.canvas);
+        let (cw, chh) = (w.canvas.width() as f32, w.canvas.height() as f32);
+        if w.zoom <= 0.0 {
+            w.zoom = ((area.width() - 40.0) / cw).min((area.height() - 40.0) / chh).clamp(0.01, 4.0);
+        }
+        let resp = ui.interact(area, egui::Id::new("caf-view"), Sense::click_and_drag());
+        if resp.hovered() {
+            let scroll = ui.input(|i| i.smooth_scroll_delta.y);
+            if scroll != 0.0
+                && let Some(hp) = resp.hover_pos()
+            {
+                let v = View { area, zoom: w.zoom, center: w.center };
+                let before = v.to_doc(hp);
+                w.zoom = (w.zoom * (scroll / 200.0).exp()).clamp(0.01, 32.0);
+                let after = View { area, zoom: w.zoom, center: w.center }.to_doc(hp);
+                w.center = [w.center[0] + before[0] - after[0], w.center[1] + before[1] - after[1]];
+            }
+        }
+        let v = View { area, zoom: w.zoom, center: w.center };
+        let clip = painter.with_clip_rect(area);
+        let img = v.rect(w.canvas);
+        widgets::checker(&clip, img.intersect(area), 8.0);
+        if let Some(tex) = &w.image_tex {
+            clip.image(tex.id(), img, uv, Color32::WHITE);
+        }
+        if let Some(tex) = &w.overlay_tex {
+            // The proxy's blocks are `k` document px; its last row and column may reach past the
+            // canvas, so the overlay is clipped to it.
+            let pr = ERect::from_min_size(img.min, vec2((w.pw * w.k) as f32 * v.zoom, (w.ph * w.k) as f32 * v.zoom));
+            clip.with_clip_rect(img.intersect(area)).image(tex.id(), pr, uv, Color32::WHITE);
+        }
+        // The fill area's outline (marching ants: black dashes on white).
+        let phase = (ui.input(|i| i.time) * 8.0) as usize;
+        match &w.outline {
+            Some(edges) => {
+                for e in edges {
+                    let (a, b) = (v.to_screen([f64::from(e[0][0]), f64::from(e[0][1])]), v.to_screen([f64::from(e[1][0]), f64::from(e[1][1])]));
+                    let dark = ((e[0][0] + e[0][1]) as usize / 4 + phase).is_multiple_of(2);
+                    clip.line_segment([a, b], Stroke::new(1.0, if dark { Color32::BLACK } else { Color32::WHITE }));
+                }
+            }
+            None => {
+                let b = v.rect(bounds(&w.base));
+                clip.rect_stroke(b, 0.0, Stroke::new(1.0, Color32::WHITE), egui::StrokeKind::Outside);
+            }
+        }
+        ctx.request_repaint_after(std::time::Duration::from_millis(120));
+        if let Some((_, pts)) = &w.lasso
+            && pts.len() > 1
+        {
+            let line: Vec<Pos2> = pts.iter().map(|p| v.to_screen(*p)).collect();
+            clip.add(egui::Shape::line(line, Stroke::new(1.0, t.accent)));
+        }
+        if let Some(hp) = resp.hover_pos() {
+            if w.tool == CafTool::Brush {
+                let r = w.brush_size as f32 * 0.5 * v.zoom;
+                clip.circle_stroke(hp, r, Stroke::new(1.5, Color32::BLACK));
+                clip.circle_stroke(hp, r, Stroke::new(0.75, Color32::WHITE));
+            }
+            w.hover = Some(v.to_doc(hp));
+        }
+        clip.rect_stroke(img, 0.0, Stroke::new(1.0, t.separator), egui::StrokeKind::Outside);
+        // Mouse → tools (Space, the middle button or the Hand pan).
+        let pan = ui.input(|i| i.key_down(egui::Key::Space) || i.pointer.middle_down()) || w.tool == CafTool::Hand;
+        if pan && resp.dragged() {
+            let dl = resp.drag_delta();
+            w.center = [w.center[0] - f64::from(dl.x / w.zoom), w.center[1] - f64::from(dl.y / w.zoom)];
+        } else if !pan
+            && resp.is_pointer_button_down_on()
+            && let Some(pp) = resp.interact_pointer_pos()
+        {
+            // The press is the first point; the frames before egui's drag threshold and the drag
+            // itself continue it (a second `Down` would start the stroke over, dropping them).
+            let q = v.to_doc(pp);
+            mods = ui.input(|i| i.modifiers);
+            if w.pressed {
+                events.push(ToolEvent::Move { x: q[0], y: q[1], pressure: 1.0 });
+                ctx.request_repaint();
+            } else {
+                w.pressed = true;
+                events.push(ToolEvent::Down { x: q[0], y: q[1], pressure: 1.0 });
+            }
+            dragging = true;
+        }
+        if w.pressed && !resp.is_pointer_button_down_on() {
+            w.pressed = false;
+            let q = w.hover.unwrap_or(w.center);
+            events.push(ToolEvent::Up { x: q[0], y: q[1] });
+            dragging = false;
+        }
+        // Settings changed in the panel: the overlay and the preview follow.
+        if w.opts != before {
+            w.overlay_dirty = true;
+            w.stale();
+        }
+    });
+    if let Some(s) = new_sampling {
+        set_sampling(app, s);
+    }
+    if let Some(r) = reset_what {
+        reset(app, r);
+    }
+    if let Some(e) = fill_btn {
+        fill_edit(app, e);
+    }
+    if rebase_needed {
+        rebase(app);
+    }
+    for ev in events {
+        pointer(app, ev, mods);
+    }
+    drive_preview(app, ctx, dragging);
+    match action {
+        Some("ok") => commit(app),
+        Some("cancel") => cancel(app),
+        Some("apply") => {
+            if let Err(e) = apply(app) {
+                app.ui.status = e;
+                app.ui.status_error = true;
+            }
+        }
+        _ => {}
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A textured layer (a checker of two colours over a gradient) with a 20 px square selected.
+    fn app_with_selection() -> PhotocraftApp {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+        app.session.execute("file.new", json!({"width": 200, "height": 160, "depth": 8})).unwrap();
+        app.session.execute("layer.new.layer", json!({})).unwrap();
+        app.session
+            .edit("paint", |doc, active| {
+                let s = doc.layer_mut(active.unwrap()).unwrap().surface_mut().unwrap();
+                for y in 0..160 {
+                    for x in 0..200 {
+                        let v = ((x / 6 + y / 6) % 2) as f32 * 0.5 + x as f32 / 400.0;
+                        s.write_pixel(x, y, &[v, 0.3, 1.0 - v, 1.0]);
+                    }
+                }
+                // A red blemish to remove.
+                for y in 72..88 {
+                    for x in 92..108 {
+                        s.write_pixel(x, y, &[1.0, 0.0, 0.0, 1.0]);
+                    }
+                }
+                Ok(())
+            })
+            .unwrap();
+        app.session.execute("select.rect", json!({"x": 90, "y": 70, "width": 20, "height": 20})).unwrap();
+        app.sync_views();
+        app
+    }
+
+    fn px(app: &PhotocraftApp, layer: LayerId, x: i32, y: i32) -> Vec<f32> {
+        app.session.active().unwrap().doc.layer(layer).unwrap().surface().unwrap().pixel(x, y)
+    }
+
+    fn ws(app: &PhotocraftApp) -> &CafWorkspace {
+        app.distort.caf.as_ref().unwrap()
+    }
+
+    /// Photoshop opens the workspace with the Sampling Brush subtracting at a tenth of the
+    /// window's side, Auto sampling, output to a new layer.
+    #[test]
+    fn opens_like_photoshop() {
+        let mut app = app_with_selection();
+        app.session.prefs.edit(|p| {
+            p.dialogs.remove(REMEMBERED);
+        });
+        open(&mut app).unwrap();
+        let d = ws(&app).describe();
+        assert_eq!(d["window"], json!([0, 0, 200, 160]), "a 200 px window, clipped to the 200 × 160 canvas");
+        assert_eq!((d["tool"].as_str(), d["brushMode"].as_str(), d["brushSize"].as_f64()), (Some("brush"), Some("subtract"), Some(20.0)));
+        assert_eq!((d["settings"]["sampling"].as_str(), d["settings"]["output"].as_str()), (Some("auto"), Some("new")));
+        assert_eq!(d["fillArea"], json!(400));
+        assert!(d["sampledProxyPixels"].as_u64().unwrap() > 1000);
+    }
+
+    #[test]
+    fn brush_strokes_change_the_sampling_area_and_undo() {
+        let mut app = app_with_selection();
+        open(&mut app).unwrap();
+        control(&mut app, &json!({"sampling": "rectangular"})).unwrap();
+        let all = ws(&app).describe()["sampledProxyPixels"].as_u64().unwrap();
+        assert_eq!(all, 200 * 160 - 400, "Rectangular: the whole window but the fill area");
+        // Subtracting (the default): a 10 px stroke takes about 10 × 60 px away.
+        let d = control(&mut app, &json!({"stroke": {"points": [[20.0, 20.0], [80.0, 20.0]], "size": 10}})).unwrap();
+        let less = d["sampledProxyPixels"].as_u64().unwrap();
+        assert!((all - less).abs_diff(10 * 60 + 79) < 120, "{all} → {less}");
+        // Undo brings it back; redo takes it again.
+        assert_eq!(control(&mut app, &json!({"undo": true})).unwrap()["sampledProxyPixels"].as_u64(), Some(all));
+        assert_eq!(control(&mut app, &json!({"redo": true})).unwrap()["sampledProxyPixels"].as_u64(), Some(less));
+        // Custom starts empty and the brush adds; Alt reverses it.
+        let d = control(&mut app, &json!({"sampling": "custom"})).unwrap();
+        assert_eq!((d["sampledProxyPixels"].as_u64(), d["brushMode"].as_str(), d["strokes"].as_u64()), (Some(0), Some("add"), Some(0)));
+        let d = control(&mut app, &json!({"stroke": {"points": [[20.0, 120.0], [60.0, 120.0]], "size": 8}})).unwrap();
+        assert!(d["sampledProxyPixels"].as_u64().unwrap() > 300);
+        let d = control(&mut app, &json!({"stroke": {"points": [[20.0, 120.0], [60.0, 120.0]], "size": 8, "alt": true}})).unwrap();
+        assert_eq!(d["sampledProxyPixels"].as_u64(), Some(0));
+        // Undoing the change of option restores Rectangular with its stroke.
+        control(&mut app, &json!({"undo": true})).unwrap();
+        control(&mut app, &json!({"undo": true})).unwrap();
+        let d = control(&mut app, &json!({"undo": true})).unwrap();
+        assert_eq!((d["settings"]["sampling"].as_str(), d["strokes"].as_u64(), d["brushMode"].as_str()), (Some("rectangular"), Some(1), Some("subtract")));
+    }
+
+    #[test]
+    fn the_lasso_edits_the_fill_area_and_the_window_follows() {
+        let mut app = app_with_selection();
+        open(&mut app).unwrap();
+        let d = control(&mut app, &json!({"lasso": {"op": "add", "points": [[130.0, 70.0], [150.0, 70.0], [150.0, 90.0], [130.0, 90.0]]}})).unwrap();
+        assert_eq!(d["fillArea"], json!(800));
+        let d = control(&mut app, &json!({"expand": 2})).unwrap();
+        assert!(d["fillArea"].as_u64().unwrap() > 900);
+        let d = control(&mut app, &json!({"undo": true, "lassoMode": "subtract"})).unwrap();
+        assert_eq!((d["fillArea"].as_u64(), d["lassoMode"].as_str()), (Some(800), Some("subtract")));
+        // Subtracting everything is refused: the fill area can't be empty.
+        let d = control(&mut app, &json!({"lasso": {"points": [[0.0, 0.0], [200.0, 0.0], [200.0, 160.0], [0.0, 160.0]]}})).unwrap();
+        assert_eq!(d["fillArea"], json!(800));
+        assert!(d["error"].as_str().is_some_and(|e| e.contains("empty")), "{d}");
+        // The reset button goes back to the selection.
+        let d = control(&mut app, &json!({"reset": "lasso"})).unwrap();
+        assert_eq!(d["fillArea"], json!(400));
+    }
+
+    #[test]
+    fn apply_fills_and_stays_open_ok_closes_cancel_keeps_what_was_applied() {
+        let mut app = app_with_selection();
+        let layer = app.session.active().unwrap().active_layer.unwrap();
+        open(&mut app).unwrap();
+        // The preview is what Apply writes.
+        control(&mut app, &json!({"output": "current", "colorAdaptation": "none", "waitPreview": true})).unwrap();
+        let (rect, img) = ws(&app).preview.pending_image.clone().unwrap();
+        control(&mut app, &json!({"apply": true})).unwrap();
+        assert!(app.distort.caf.is_some(), "Apply keeps the workspace open");
+        let after = px(&app, layer, 100, 80);
+        assert!(after[0] < 0.9 || after[1] > 0.1, "the blemish is filled: {after:?}");
+        let i = ((80 - rect.y0) * rect.width() as i32 + (100 - rect.x0)) as usize;
+        let shown = img.pixels[i];
+        assert!(
+            (f32::from(shown.r()) / 255.0 - after[0]).abs() < 0.01 && (f32::from(shown.b()) / 255.0 - after[2]).abs() < 0.01,
+            "preview {shown:?} vs {after:?}"
+        );
+        let steps = app.session.active().unwrap().history.past_len();
+        cancel(&mut app);
+        assert!(app.distort.caf.is_none());
+        assert_eq!(app.session.active().unwrap().history.past_len(), steps, "Cancel keeps the applied fill");
+        // OK with New Layer: a new layer holds the fill; the original stays.
+        app.session.execute("edit.undo", json!({})).unwrap();
+        open(&mut app).unwrap();
+        control(&mut app, &json!({"output": "new", "commit": true})).unwrap();
+        assert!(app.distort.caf.is_none());
+        assert_eq!(px(&app, layer, 100, 80)[0], 1.0, "the original layer keeps its blemish");
+        let top = app.session.active().unwrap().active_layer.unwrap();
+        assert_ne!(top, layer);
+        assert!(px(&app, top, 100, 80)[3] > 0.99, "the new layer holds the fill");
+    }
+
+    /// #5092: the workspace left open does not follow the user to another document, and closing
+    /// the document it was opened on closes it.
+    #[test]
+    fn the_workspace_is_dropped_when_another_document_becomes_active() {
+        let mut app = app_with_selection();
+        open(&mut app).unwrap();
+        crate::distort_ui::drop_foreign(&mut app);
+        assert!(app.distort.caf.is_some());
+        app.session.execute("file.new", json!({"width": 32, "height": 32, "depth": 8})).unwrap();
+        crate::distort_ui::drop_foreign(&mut app);
+        assert!(app.distort.caf.is_none());
+        assert!(app.session.set_active(0));
+        open(&mut app).unwrap();
+        crate::distort_ui::drop_foreign(&mut app);
+        assert!(app.distort.caf.is_some());
+        assert!(app.session.close(0).is_some());
+        crate::distort_ui::drop_foreign(&mut app);
+        assert!(app.distort.caf.is_none());
+    }
+
+    #[test]
+    fn settings_are_remembered_and_the_menu_opens_the_workspace() {
+        let ctx = egui::Context::default();
+        let mut app = app_with_selection();
+        let r = crate::menus::invoke(&mut app, &ctx, "edit.contentAwareFill", json!({})).unwrap();
+        assert!(r["contentAwareFill"]["window"].is_array(), "{r}");
+        let set = json!({"opacity": 30, "color": [200, 40, 40], "excluded": true, "colorAdaptation": "high", "rotationAdaptation": "low", "mirror": true, "output": "duplicate"});
+        crate::menus::invoke(&mut app, &ctx, "edit.contentAwareFill", json!({"ui": set})).unwrap();
+        crate::menus::invoke(&mut app, &ctx, "edit.contentAwareFill", json!({"ui": {"cancel": true}})).unwrap();
+        open(&mut app).unwrap();
+        let mut want = CafOpts::default();
+        want.apply(&set).unwrap();
+        assert_eq!(ws(&app).opts, want);
+        // Bad values are errors; the engine command with params still runs directly.
+        assert!(control(&mut app, &json!({"sampling": "everywhere"})).is_err());
+        assert!(control(&mut app, &json!({"tool": "pencil"})).is_err());
+        cancel(&mut app);
+        let r = crate::menus::invoke(&mut app, &ctx, "edit.contentAwareFill", json!({"colorAdaptation": "none"})).unwrap();
+        assert_eq!(r["filled"], json!(400));
+        assert!(app.distort.caf.is_none());
+    }
+
+    /// The engine's sampling area over the plan's rectangle (what the fill samples) and its fill
+    /// area.
+    fn engine_source(app: &PhotocraftApp) -> (Rect, Vec<bool>, Vec<bool>) {
+        let w = ws(app);
+        let st = app.session.active().unwrap();
+        let plan = photocraft_engine::edit_menu_cmds::content_aware_plan(&st.doc, w.layer, &plan_params(w, true), CMD).unwrap();
+        (plan.rect, plan.source, plan.hole)
+    }
+
+    /// Each stroke is painted into the proxy once, over its own pixels: 400 strokes of 50 points
+    /// and the undo and redo that rebuild the proxy stay cheap (they used to test every proxy
+    /// pixel against every segment), and the overlay is exactly what the engine samples (at one
+    /// proxy px per document px).
+    #[test]
+    fn strokes_are_painted_once_and_the_overlay_is_the_engines_sampling_area() {
+        let mut app = app_with_selection();
+        open(&mut app).unwrap();
+        control(&mut app, &json!({"sampling": "rectangular"})).unwrap();
+        let start = std::time::Instant::now();
+        for i in 0..400u32 {
+            // Lines across the document, most subtracting, every fifth adding (Alt).
+            let y = 2.0 + f64::from(i % 40) * 4.0;
+            let pts: Vec<[f64; 2]> = (0..50).map(|j| [f64::from(j) * 4.0 + f64::from(i % 3), y + f64::from(j % 2)]).collect();
+            control(&mut app, &json!({"stroke": {"points": pts, "size": 6 + (i % 4) * 3, "alt": i % 5 == 0}})).unwrap();
+        }
+        let painted = start.elapsed();
+        let start = std::time::Instant::now();
+        control(&mut app, &json!({"undo": true})).unwrap();
+        control(&mut app, &json!({"redo": true})).unwrap();
+        let rebuilt = start.elapsed();
+        assert!(painted.as_secs_f64() < 10.0 && rebuilt.as_secs_f64() < 10.0, "400 strokes {painted:?}, undo + redo {rebuilt:?}");
+        let w = ws(&app);
+        assert_eq!((w.k, w.strokes.len()), (1, 400));
+        let (rect, source, hole) = engine_source(&app);
+        assert_eq!(rect, w.canvas, "Rectangular's window is the whole 200 × 160 canvas");
+        let differ = (0..source.len()).filter(|&i| (w.mask[i] && !w.hole_px[i]) != (source[i] && !hole[i])).count();
+        assert_eq!(differ, 0, "proxy pixels that differ from the engine's sampling area");
+        assert!(w.describe()["sampledProxyPixels"].as_u64().unwrap() > 1000);
+    }
+
+    /// `edit.contentAwareFill {"ui": …}` addresses the workspace: with it closed that is an
+    /// error, not a fill with the default settings (an agent polling the state after an Esc
+    /// used to add a fill per poll).
+    #[test]
+    fn ui_params_with_the_workspace_closed_are_an_error_not_a_fill() {
+        let ctx = egui::Context::default();
+        let mut app = app_with_selection();
+        let steps = app.session.active().unwrap().history.past_len();
+        for ui in [json!({}), json!({"cancel": true}), json!({"sampling": "rectangular"})] {
+            let r = crate::menus::invoke(&mut app, &ctx, "edit.contentAwareFill", json!({"ui": ui}));
+            assert!(r.as_ref().is_err_and(|e| e.contains("not open")), "{r:?}");
+        }
+        assert_eq!(app.session.active().unwrap().history.past_len(), steps, "nothing was filled");
+        assert!(app.distort.caf.is_none());
+    }
+
+    /// The press is the first point of a stroke (and of a lasso), and the pointer's moves before
+    /// egui's drag threshold are its next ones: the drag, which starts a few pixels later, goes
+    /// on with the same stroke rather than beginning another over it.
+    #[test]
+    fn a_stroke_keeps_its_points_from_before_the_drag_threshold() {
+        use egui::{Modifiers, PointerButton};
+        for tool in ["brush", "lasso"] {
+            let mut app = app_with_selection();
+            open(&mut app).unwrap();
+            control(&mut app, &json!({"tool": tool, "sampling": "rectangular"})).unwrap();
+            let mut h = egui_kittest::Harness::builder().with_size(vec2(1600.0, 1000.0)).build_ui_state(
+                |ui, app: &mut PhotocraftApp| {
+                    let ctx = ui.ctx().clone();
+                    if !ctx.fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
+                        return;
+                    }
+                    show(app, &ctx);
+                },
+                app,
+            );
+            PhotocraftApp::setup_context(&h.ctx, crate::theme::ThemeKind::ALL[0]);
+            h.run_steps(4);
+            // The document view sits between the tool strip and the Preview panel, under the
+            // title and the options bar; its centre shows the document's centre.
+            let view = ERect::from_min_max(pos2(LEFT_W, 30.0 + BAR_H), pos2(1600.0 - PANEL_W - PREVIEW_W, 1000.0));
+            let c = view.center();
+            let at = |dx: f32, dy: f32| pos2(c.x + dx, c.y + dy);
+            let press = |h: &mut egui_kittest::Harness<'_, PhotocraftApp>, down: bool, p: Pos2| {
+                h.event(egui::Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: down, modifiers: Modifiers::NONE });
+                h.run_steps(1);
+            };
+            h.event(egui::Event::PointerMoved(at(0.0, 0.0)));
+            h.run_steps(1);
+            press(&mut h, true, at(0.0, 0.0));
+            // Within egui's click distance (6 px): no drag yet, but these are the stroke's points.
+            // Then past it: the drag starts. (Not collinear: the lasso's polygon needs an area.)
+            for (dx, dy) in [(2.0, 1.0), (4.0, 2.0), (30.0, 20.0), (60.0, -10.0), (90.0, 40.0)] {
+                h.event(egui::Event::PointerMoved(at(dx, dy)));
+                h.run_steps(1);
+            }
+            press(&mut h, false, at(90.0, 40.0));
+            h.run_steps(2);
+            let w = h.state().distort.caf.as_ref().unwrap();
+            let points: Vec<[f64; 2]> = match tool {
+                "brush" => {
+                    assert_eq!(w.strokes.len(), 1, "one stroke");
+                    w.strokes[0].points.clone()
+                }
+                _ => {
+                    assert_eq!(w.fill_edits.len(), 1, "one lasso edit");
+                    serde_json::from_value(w.fill_edits[0]["points"].clone()).unwrap()
+                }
+            };
+            let centre = [f64::from(w.canvas.x0 + w.canvas.x1) / 2.0, f64::from(w.canvas.y0 + w.canvas.y1) / 2.0];
+            assert_eq!(points.len(), 6, "{tool}: the press and every move are points: {points:?}");
+            let d = ((points[0][0] - centre[0]).powi(2) + (points[0][1] - centre[1]).powi(2)).sqrt();
+            assert!(d < 1.0, "{tool}: the first point is the press ({:?} vs {centre:?})", points[0]);
+            assert!(w.cur.is_none() && w.lasso.is_none() && !w.pressed, "{tool}: the release ended it");
+        }
+    }
+
+    /// The preview texture fits the device: a plan rectangle wider than the texture limit is
+    /// box-averaged to fit, and is still drawn over the plan's rectangle.
+    #[test]
+    fn the_preview_texture_respects_the_device_limit() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+        app.session.execute("file.new", json!({"width": 2200, "height": 40, "depth": 8})).unwrap();
+        app.session.execute("layer.new.layer", json!({})).unwrap();
+        app.session
+            .edit("paint", |doc, active| {
+                let s = doc.layer_mut(active.unwrap()).unwrap().surface_mut().unwrap();
+                s.fill_rect(Rect::new(0, 0, 2200, 40), &[0.2, 0.6, 0.4, 1.0]);
+                s.fill_rect(Rect::new(1090, 10, 1110, 30), &[1.0, 0.0, 0.0, 1.0]);
+                Ok(())
+            })
+            .unwrap();
+        app.session.execute("select.rect", json!({"x": 1090, "y": 10, "width": 20, "height": 20})).unwrap();
+        app.sync_views();
+        open(&mut app).unwrap();
+        // Custom sampling with a stroke across the whole width: the plan's rectangle is 2200 px wide.
+        control(&mut app, &json!({"sampling": "custom", "stroke": {"points": [[0.0, 5.0], [2200.0, 5.0]], "size": 8}})).unwrap();
+        for (limit, want) in [(2048usize, 1100usize), (4096, 2200)] {
+            let w = app.distort.caf.as_mut().unwrap();
+            w.texture_limit = limit;
+            w.stale();
+            control(&mut app, &json!({"waitPreview": true})).unwrap();
+            let (rect, img) = ws(&app).preview.pending_image.clone().unwrap();
+            assert_eq!((rect.width(), img.size[0]), (2200, want), "limit {limit}");
+            assert!(img.size.iter().all(|s| *s <= limit), "limit {limit}: {:?}", img.size);
+            let (sum, n) = img.pixels.iter().fold((0u32, 0u32), |(s, n), p| (s + u32::from(p.g()), n + 1));
+            assert!(sum / n > 100, "limit {limit}: the reduced preview keeps the image ({})", sum / n);
+        }
+    }
+
+    /// A preview that fails stands for that state: nothing is shown, the error is reported, and
+    /// the same preview is not started again on every frame.
+    #[test]
+    fn a_failing_preview_is_reported_once_not_restarted() {
+        let mut app = app_with_selection();
+        open(&mut app).unwrap();
+        control(&mut app, &json!({"waitPreview": true})).unwrap();
+        assert!(ws(&app).preview.pending_image.is_some());
+        // The selection goes away under the workspace: there is nothing to fill.
+        app.session.execute("select.deselect", json!({})).unwrap();
+        app.distort.caf.as_mut().unwrap().stale();
+        assert!(control(&mut app, &json!({"waitPreview": true})).is_err());
+        let pv = &ws(&app).preview;
+        assert_eq!(pv.shown, pv.want, "the failed state counts as shown: no retry");
+        assert!(pv.pending_image.is_none() && pv.tex.is_none());
+        let d = ws(&app).describe();
+        assert_eq!(d["previewReady"], json!(false));
+        assert!(d["previewError"].as_str().is_some_and(|e| e.contains("selection")), "{d}");
+    }
+
+    /// The view shows the document, not the layer alone: after Apply to a new layer the fill
+    /// (on that layer) covers the blemish.
+    #[test]
+    fn the_view_shows_the_document_after_an_apply_to_a_new_layer() {
+        let mut app = app_with_selection();
+        open(&mut app).unwrap();
+        let red = |img: &egui::ColorImage| {
+            let p = img.pixels[80 * img.size[0] + 100];
+            p.r() > 200 && p.g() < 60
+        };
+        let before = view_image(&app).unwrap();
+        assert_eq!(before.size, [200, 160]);
+        assert!(red(&before), "the blemish shows before the fill");
+        control(&mut app, &json!({"output": "new", "colorAdaptation": "none", "apply": true})).unwrap();
+        assert!(!red(&view_image(&app).unwrap()), "the fill on the new layer shows");
+    }
+
+    /// The engine's limits (MAX_CAF_EDITS strokes or lasso edits, MAX_CAF_POINTS points in all)
+    /// hold at the brush: a stroke past them is refused with a message, so Apply and the
+    /// preview never fail on what was painted.
+    #[test]
+    fn strokes_past_the_engines_limits_are_refused_at_the_brush() {
+        let mut app = app_with_selection();
+        open(&mut app).unwrap();
+        control(&mut app, &json!({"sampling": "rectangular"})).unwrap();
+        for i in 0..MAX_CAF_EDITS {
+            let x = (i % 190) as f64;
+            control(&mut app, &json!({"stroke": {"points": [[x, 5.0], [x + 3.0, 5.0]], "size": 2}})).unwrap();
+        }
+        let d = control(&mut app, &json!({"stroke": {"points": [[10.0, 50.0], [20.0, 50.0]], "size": 2}})).unwrap();
+        assert_eq!(d["strokes"], json!(MAX_CAF_EDITS));
+        assert!(d["error"].as_str().is_some_and(|e| e.contains("at most")), "{d}");
+        control(&mut app, &json!({"waitPreview": true})).unwrap();
+        // The points budget: a long stroke stops at it.
+        let mut app = app_with_selection();
+        open(&mut app).unwrap();
+        let pts: Vec<[f64; 2]> = (0..MAX_CAF_POINTS + 100).map(|i| [10.0 + i as f64 * 0.0005, 5.0]).collect();
+        let d = control(&mut app, &json!({"stroke": {"points": pts, "size": 2}})).unwrap();
+        assert_eq!(ws(&app).points_used(), MAX_CAF_POINTS);
+        assert!(d["error"].as_str().is_some_and(|e| e.contains("at most")), "{d}");
+        control(&mut app, &json!({"waitPreview": true})).unwrap();
+        // A lasso edit past the points budget is refused too.
+        let d = control(&mut app, &json!({"lasso": {"op": "add", "points": [[130.0, 70.0], [150.0, 70.0], [150.0, 90.0]]}})).unwrap();
+        assert_eq!(d["fillEdits"], json!(0));
+        assert!(d["error"].as_str().is_some_and(|e| e.contains("at most")), "{d}");
+    }
+}
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 391ad464fd..91644b5f73 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -15,6 +15,13 @@ use crate::state::{Tool, View};
 /// Largest texture side we upload; bigger documents display downsampled until the GPU path lands.
 pub const MAX_TEXTURE: u32 = 4096;
 
+/// The largest texture side to upload on this device: [`MAX_TEXTURE`], or less where the GPU
+/// allows less (2048 on some older or low-end GPUs and WebGL contexts). Past the device's limit
+/// egui asserts and the backend fails to create the texture.
+fn texture_side(ctx: &egui::Context) -> u32 {
+    u32::try_from(ctx.input(|i| i.max_texture_side)).unwrap_or(MAX_TEXTURE).clamp(1, MAX_TEXTURE)
+}
+
 pub(crate) struct ClonePreviewCache {
     key: String,
     texture: egui::TextureHandle,
@@ -1196,12 +1203,13 @@ pub(crate) fn display_doc(app: &mut PhotocraftApp, idx: usize) -> (std::sync::Ar
             return (doc.clone(), key);
         }
     }
+    let revision = st.revision;
     let snapshot = st.doc.clone();
     if let Some((layer, params)) = app.live_adjust.clone()
         && let Some(l) = snapshot.layer(layer)
         && let LayerContent::Adjustment(a) = &l.content
     {
-        let key = 1 + params.to_string().bytes().fold(0u64, |h, b| h.wrapping_mul(31).wrapping_add(b as u64));
+        let key = crate::adjust_preview::live_key(app, &snapshot, revision, layer, &params);
         let shown = memo_display(app, &snapshot, key, || {
             let kind = photocraft_engine::commands::adjustment_kind(a);
             let preview = photocraft_engine::adjust_params::from_params(kind, &params, Some(a), snapshot.mode).unwrap_or_else(|_| a.clone());
@@ -1421,7 +1429,7 @@ pub fn ensure_texture(app: &mut PhotocraftApp, ctx: &egui::Context, idx: usize,
     if cache.tex_revision != revision || cache.texture.is_none() || cache.tex_preview_key != preview_key {
         let t0 = crate::gpu_canvas::now_ms();
         let longest = doc.size.width.max(doc.size.height);
-        let factor = longest.div_ceil(MAX_TEXTURE).max(1);
+        let factor = longest.div_ceil(texture_side(ctx)).max(1);
         let (w, h) = ((doc.size.width / factor).max(1), (doc.size.height / factor).max(1));
         let current = cache.texture.as_mut().filter(|t| t.size() == [w as usize, h as usize]);
         if let (Some(d), Some(t)) = (damage, current) {
@@ -1482,6 +1490,14 @@ pub(crate) fn damage_since(app: &PhotocraftApp, idx: usize, seen: (u64, u64), no
     {
         return Some(r);
     }
+    // Between a Properties-panel adjustment-layer drag's previews (and the document): the
+    // layer's area. Without this every parameter value recomposited the whole document (#6839).
+    if seen.0 == now.0
+        && let Some(st) = app.session.documents().get(idx)
+        && let Some(r) = crate::adjust_preview::live_switch_region(app, st.doc.id, now.0, seen.1 ^ display_key, now.1)
+    {
+        return Some(r);
+    }
     // Between a Move drag's offsets: where the moving layers were and are (Auto-Select's pick
     // at the press changes no pixels).
     if (seen.0 == now.0 || (seen.0 + 1 == now.0 && last_damage.is_some_and(|r| r.is_empty())))
@@ -1585,6 +1601,12 @@ fn ensure_gpu(app: &mut PhotocraftApp, ctx: &egui::Context, idx: usize, visible:
     {
         damage = Some(crate::adjust_preview::switch_damage(app, raw_key, r, visible));
     }
+    // The same for a Properties-panel drag's previews.
+    if damage.is_some()
+        && let Some(r) = seen.filter(|s| s.0 == revision).and_then(|s| crate::adjust_preview::live_switch_region(app, id, revision, s.1 ^ display_key, raw_key))
+    {
+        damage = Some(crate::adjust_preview::live_switch_damage(app, raw_key, r, visible));
+    }
     let preview_key = raw_key ^ display_key;
     // The Navigator may draw this texture only while it holds the plain document (no live
     // preview, which can be composited only where the view is).
@@ -1608,24 +1630,47 @@ fn ensure_gpu(app: &mut PhotocraftApp, ctx: &egui::Context, idx: usize, visible:
         grid: None,
     });
     let present = cache.on_gpu && gpu.has(id.0, size);
-    if present && cache.revision == revision && cache.preview_key == preview_key {
+    let current = cache.revision == revision && cache.preview_key == preview_key;
+    // GPU Memory or Memory Usage changed with nothing to redraw: the new budget, and whether the
+    // layers fit it, show at once (the status bar's GPU Memory Full).
+    if present && app.perf.gpu_budget_allowance != budget_allowance(app) {
+        gpu_budget(app, &gpu, idx, false, visible);
+    }
+    // Switched to a document whose canvas is already current: size the budget for it and measure
+    // whether its layers fit, so GPU Memory Full shows (or clears) at once rather than at its
+    // next full refresh. Once per switch: the fit then names this document.
+    if present && app.perf.gpu_layer_fit.is_none_or(|f| f.doc != id.0) {
+        gpu_budget(app, &gpu, idx, false, visible);
+        let fit = gpu.measure_fit(&doc).unwrap_or(crate::gpu_canvas::LayerFit { doc: id.0, needed: 0, budget: 0 });
+        app.perf.gpu_layer_fit = Some(fit);
+    }
+    if present && current {
         // An adjustment preview composited where the view was: catch up where it moved to.
         if let Some(r) = crate::adjust_preview::uncovered(app, id, raw_key, visible) {
             let r = gpu.refresh(id.0, &doc, Some(r), display.as_deref());
             app.perf.record(r.kind, r.px, r.composite_ms, r.upload_ms);
         }
+        if let Some(r) = crate::adjust_preview::live_uncovered(app, id, raw_key, visible) {
+            let r = gpu.refresh(id.0, &doc, Some(r), display.as_deref());
+            app.perf.record(r.kind, r.px, r.composite_ms, r.upload_ms);
+        }
         return true;
     }
     // Display textures for a canvas this large would not fit the GPU: the reduced CPU canvas
     // draws it (checked before the memory budget, which walks the history, every frame).
     if !gpu.fits_canvas(&doc) {
         crate::background_redraw::cancel(app, id);
+        // Drawn on the CPU canvas: no layer budget applies to it.
+        if app.perf.gpu_layer_fit.is_some_and(|f| f.doc == id.0) {
+            app.perf.gpu_layer_fit = None;
+        }
         return false;
     }
     let partial = present && damage.is_some();
     gpu_budget(app, &gpu, idx, partial, visible);
     let defer = crate::background_redraw::enabled(app);
     let r = gpu.refresh_with(id.0, &doc, if partial { damage } else { None }, display.as_deref(), defer);
+    app.perf.gpu_layer_fit = gpu.layer_fit();
     if r.kind == "lost" || r.kind == crate::gpu_canvas::REFRESH_OVER_BUDGET {
         // The device is gone (`gpu_status` then drops the GPU canvas) or the canvas is over the
         // texture budget: draw this frame on the CPU path.
@@ -1666,21 +1711,53 @@ fn ensure_gpu(app: &mut PhotocraftApp, ctx: &egui::Context, idx: usize, visible:
     true
 }
 
-/// Point the wgpu compositor at what the view shows, and size its memory budget from Memory
-/// Usage, the document's pixels and History, and physical memory: on full refreshes (pixels
-/// counted once per structural change, not per brush dab) and whenever the preference changes.
+/// Point the wgpu compositor at what the view shows, and size its memory budget from GPU Memory,
+/// or Memory Usage, the document's pixels and History (charged where the GPU shares the system's
+/// memory), physical memory and the GPU's own: on full refreshes (pixels counted once per
+/// structural change, not per brush dab) and whenever either preference changes.
 fn gpu_budget(app: &mut PhotocraftApp, gpu: &crate::gpu_canvas::GpuCanvas, idx: usize, partial: bool, visible: DRect) {
     gpu.set_focus(Some(visible));
-    let allowance = u64::from(app.session.prefs().performance.memory_usage_mb).saturating_mul(1 << 20);
-    if partial && app.perf.gpu_budget_allowance == allowance && gpu.memory_budget().is_some() {
+    let allowance = budget_allowance(app);
+    let changed = app.perf.gpu_budget_allowance != allowance;
+    if partial && !changed && gpu.memory_budget().is_some() {
         return;
     }
     let Some(st) = app.session.documents().get(idx) else { return };
     let pixels = st.memory_bytes() as u64;
-    let budget = crate::gpu_canvas::memory_budget(allowance, pixels, crate::gpu_canvas::physical_memory());
+    let budget = crate::gpu_canvas::memory_budget(allowance.0, pixels, crate::gpu_canvas::physical_memory(), gpu.video_memory(), allowance.1);
     gpu.set_memory_budget(budget);
     app.perf.gpu_budget_mb = budget >> 20;
     app.perf.gpu_budget_allowance = allowance;
+    if changed && let Some(fit) = gpu.measure_fit(&st.doc) {
+        app.perf.gpu_layer_fit = Some(fit);
+    }
+}
+
+/// Memory Usage and GPU Memory (Preferences › Performance), in bytes.
+fn budget_allowance(app: &PhotocraftApp) -> (u64, u64) {
+    let performance = &app.session.prefs().performance;
+    (u64::from(performance.memory_usage_mb).saturating_mul(1 << 20), u64::from(performance.gpu_memory_mb).saturating_mul(1 << 20))
+}
+
+/// The proxy factor of a live preview of filter `cmd` with `params` on `doc`, the active document:
+/// reduced on a large document (Preferences › Performance › Low Resolution Previews), except for
+/// filters whose features don't scale with a proxy (#2063), and never coarser than the active view,
+/// so at 100 % the preview shows every pixel instead of k-pixel blocks (#6326, as adjustment
+/// previews have since #5764). Zoomed out, the proxy keeps previews of large documents fast.
+///
+/// The in-dialog preview window ([`crate::filter_preview_ui`]) sizes its own textures from this
+/// too, so the canvas and the window never disagree about the factor.
+///
+/// Full resolution costs a whole filter per parameter change, which only the background worker
+/// absorbs. The web build has no worker and computes the preview inline on the UI thread (#1676),
+/// where that would freeze the page: there the document's proxy stands. The test and
+/// `PHOTOCRAFT_INLINE_JOBS` inline paths keep the cap deliberately, because `background_jobs` is
+/// flipped mid-session (a shell save during `actions.play`): a factor that followed it would change
+/// [`crate::filter_dialog::FilterPreviewKey`] under a finished preview and recompute it inline,
+/// the very stall this avoids.
+pub(crate) fn filter_preview_factor(app: &PhotocraftApp, doc: &Document, cmd: &str, params: &serde_json::Value) -> u32 {
+    let k = crate::filter_dialog::preview_factor(cmd, params, crate::proxy::preview_factor(doc, crate::proxy::reduced_previews(app)));
+    if cfg!(target_arch = "wasm32") { k } else { crate::proxy::view_factor(k, app.current_zoom()) }
 }
 
 /// Live preview for an open filter dialog: run the filter on the proxy and upload it. With
@@ -1714,8 +1791,7 @@ pub(crate) fn ensure_filter_preview(app: &mut PhotocraftApp, idx: usize, ctx: &e
         params = crate::select_mask_view::request_params(&d.fields, params);
     }
     let st = app.session.documents().get(idx)?;
-    // Filters whose features don't scale with a proxy preview at full resolution (#2063).
-    let k = crate::filter_dialog::preview_factor(&cmd, &params, crate::proxy::preview_factor(&st.doc, crate::proxy::reduced_previews(app)));
+    let k = filter_preview_factor(app, &st.doc, &cmd, &params);
     let request = crate::filter_dialog::FilterPreviewKey {
         doc: st.doc.id,
         revision: st.revision,
@@ -1762,6 +1838,7 @@ pub(crate) fn ensure_filter_preview(app: &mut PhotocraftApp, idx: usize, ctx: &e
         if !fresh && !app.filter_preview_worker.busy() {
             let doc = app.session.documents().get(idx)?.doc.clone();
             let documents: Vec<_> = app.session.documents().iter().map(|d| d.doc.clone()).collect();
+            let color = app.session.color.settings.clone();
             let task = request.clone();
             if let Err(error) = app.filter_preview_worker.start(request.clone(), ctx.clone(), move |cancel| {
                 let t0 = crate::gpu_canvas::now_ms();
@@ -1774,6 +1851,7 @@ pub(crate) fn ensure_filter_preview(app: &mut PhotocraftApp, idx: usize, ctx: &e
                     Some(cancel),
                     task.target,
                     &documents,
+                    &color,
                 )
                 .map(|doc| {
                     let buffer = photocraft_compose::flatten(&doc);
@@ -1812,12 +1890,14 @@ pub(crate) fn ensure_filter_preview(app: &mut PhotocraftApp, idx: usize, ctx: &e
             None,
             request.target,
             &documents,
+            &app.session.color.settings,
         )
         .map(std::sync::Arc::new);
         if let Some(r) = &result {
             let buf = photocraft_compose::flatten(r);
             let t1 = crate::gpu_canvas::now_ms();
-            let (display, _) = canvas_display(app, &doc, None);
+            // The preview's own profile: Assign and Convert to Profile change it (see `publish_filter_preview`).
+            let (display, _) = canvas_display(app, r, None);
             if let Some(gpu) = app.gpu.as_ref() {
                 gpu.upload_buffer_full(key, &texture_buffer(display.as_deref(), &buf), doc.depth);
             }
@@ -1853,7 +1933,9 @@ fn publish_filter_preview(
     let result = computed.and_then(|(result, buffer)| {
         let t0 = crate::gpu_canvas::now_ms();
         let doc = app.session.documents().get(idx)?.doc.clone();
-        let (display, _) = canvas_display(app, &doc, None);
+        // Shown through the preview's own colour management, as the result will be: Assign and
+        // Convert to Profile change the profile (and Convert the mode), not just the pixels.
+        let (display, _) = canvas_display(app, &result, None);
         // A GPU texture is an optimisation: headless/CPU tests must still see the preview.
         if let Some(gpu) = app.gpu.as_ref() {
             gpu.upload_buffer_full(request.doc.0 ^ (1u64 << 61), &texture_buffer(display.as_deref(), &buffer), doc.depth);
@@ -1864,6 +1946,16 @@ fn publish_filter_preview(
     app.filter_preview = Some(crate::filter_dialog::FilterPreview { key: request, result, committing: false });
 }
 
+/// The document whose colour management the canvas texture under `key` is shown through: a filter
+/// preview's own result (it keeps the document's id, so Proof Colors still apply), else `doc`.
+/// Assign Profile changes only the profile, so through `doc`'s its preview looked unchanged.
+fn filter_preview_display_doc(app: &PhotocraftApp, doc: &std::sync::Arc<Document>, key: u64) -> std::sync::Arc<Document> {
+    if key != doc.id.0 ^ (1u64 << 61) {
+        return doc.clone();
+    }
+    app.filter_preview.as_ref().and_then(|p| p.result.clone()).filter(|r| r.id == doc.id).unwrap_or_else(|| doc.clone())
+}
+
 /// After a filter dialog's OK: `Some(shown)` while its preview stands in for the background job
 /// that commits it (the document unchanged and the job still running, for this document's views),
 /// `None` otherwise (other documents' views included). A job that lands, fails or is cancelled
@@ -2138,7 +2230,7 @@ fn tabs(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> TabStrip {
         .map_or_else(|| app.session.active_index().unwrap_or(0), |p| tab_count + p);
     let frame = egui::Frame::NONE.fill(t.canvas).inner_margin(egui::Margin { left: 8, right: 8, top: 6, bottom: 4 }).show(ui, |ui| {
         let (row, _) = ui.allocate_exact_size(egui::vec2(ui.available_width(), tab_h), Sense::hover());
-        let f = crate::tab_strip::fit(&natural, selected, row.width(), DOC_TAB_MIN_W, crate::tab_strip::CHEVRON_W);
+        let f = fit_doc_tabs(&natural, selected, row.width());
         let mut x = row.left();
         let mut placed: Vec<(usize, Rect)> = Vec::with_capacity(f.shown.len());
         for &(i, w) in &f.shown {
@@ -2236,7 +2328,10 @@ fn tabs(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> TabStrip {
             let labels: Vec<&str> =
                 app.session.documents().iter().map(|st| st.doc.name.as_str()).chain(opening.iter().map(|(_, name, _)| name.as_str())).collect();
             let mut picked = None;
-            crate::tab_strip::overflow_button(ui, ui.id().with("dtab-overflow"), r, tl!("More documents"), &labels, &f.overflow, &mut picked);
+            // Like Photoshop's, the menu lists every open document, not only the hidden ones, and checks
+            // the active one (#4487).
+            let every: Vec<usize> = (0..labels.len()).collect();
+            crate::tab_strip::overflow_button(ui, ui.id().with("dtab-overflow"), r, tl!("More documents"), &labels, &every, Some(selected), &mut picked);
             match picked {
                 Some(i) if i < tab_count => activate = Some(i),
                 Some(i) => focus_open = opening.get(i - tab_count).map(|(job, _, _)| *job).or(focus_open),
@@ -2410,23 +2505,39 @@ fn open_tab_clicks(
     }
 }
 
-/// Document tabs: the chrome around a title (the × and its gaps), and the width a tab shrinks to
-/// before it moves into the » overflow menu.
+/// Document tabs: the chrome around a title (the × and its gaps).
 const DOC_TAB_PAD: f32 = 42.0;
-const DOC_TAB_MIN_W: f32 = 72.0;
 /// The Studio strip's tabs carried 4 pt of spacing between them and 44 pt of chrome; `fit` sees
 /// one number per tab, so the gap rides in the natural width and comes back out when painted.
 const STUDIO_TAB_PAD: f32 = 48.0;
 const STUDIO_TAB_GAP: f32 = 4.0;
 
+/// Fit document tabs as Photoshop does (#4487): a tab never shrinks below its whole title, so the
+/// tabs that don't fit move into the » menu instead. Only the active tab, when it alone is wider
+/// than the strip, is cut.
+fn fit_doc_tabs(natural: &[f32], selected: usize, avail: f32) -> crate::tab_strip::TabFit {
+    let widest = natural.iter().copied().filter(|w| w.is_finite()).fold(0.0, f32::max);
+    crate::tab_strip::fit(natural, selected, avail, widest, crate::tab_strip::CHEVRON_W)
+}
+
 /// Photoshop's tab title: "name @ 50% (Layer 1, RGB/8)", "(Layer 1, Layer Mask/8)" when the mask
-/// is targeted; the Background layer's name is omitted.
+/// is targeted, "(Quick Mask/8)" in Quick Mask mode; the Background layer's name is omitted.
 fn pro_tab_title(app: &PhotocraftApp, i: usize) -> String {
+    use photocraft_engine::channel_cmds::ChannelTarget;
     let Some(st) = app.session.documents().get(i) else { return String::new() };
     let zoom = app.ui.views.get(i).map_or(100.0, |v| v.zoom * 100.0);
-    let active_layer = st.active_layer.and_then(|id| st.doc.layer(id)).filter(|l| !st.doc.is_background(l.id));
+    // Quick Mask mode targets the mask, not the layer (see `paint_target`): painting and Free
+    // Transform change the red overlay, so the tab says so, as Photoshop's does.
+    let quick_mask = st.doc.quick_mask.is_some() && st.channel_view.target == ChannelTarget::Composite;
+    let active_layer = st.active_layer.and_then(|id| st.doc.layer(id)).filter(|l| !quick_mask && !st.doc.is_background(l.id));
     let mask = app.session.active_index() == Some(i) && app.ui.mask_target && active_layer.is_some_and(|l| l.mask.is_some());
-    let model = if mask { tl!("Layer Mask").to_string() } else { mode_label(&st.doc).to_string() };
+    let model = if quick_mask {
+        tl!("Quick Mask").to_string()
+    } else if mask {
+        tl!("Layer Mask").to_string()
+    } else {
+        mode_label(&st.doc).to_string()
+    };
     let layer = active_layer.map(|l| format!("{}, ", l.name)).unwrap_or_default();
     // A save in progress: "name @ 100% (Layer 1, RGB/16) - Saving 45%", as Photoshop does (#3389).
     let saving = crate::jobs_ui::save_progress(app, st.doc.id).map(|s| format!(" - {s}")).unwrap_or_default();
@@ -2440,8 +2551,8 @@ fn studio_tab_name(app: &PhotocraftApp, st: &photocraft_engine::DocState) -> Str
 }
 
 /// Photoshop document tabs: "name @ 33.3% (RGB/8)" on a dark strip; active tab matches panels.
-/// Tabs that don't fit shrink and elide, and the ones that still don't fit move into a » menu at
-/// the end of the strip; the active document's tab always stays on the strip (#1276).
+/// Tabs keep their whole titles, and the ones that don't fit move into a » menu at the end of the
+/// strip; the active document's tab always stays on the strip (#1276, #4487).
 fn pro_tabs(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> TabStrip {
     let t = crate::theme::Tokens::get(ui.ctx());
     let active = app.session.active_index().filter(|_| app.jobs.focus.is_none());
@@ -2470,7 +2581,7 @@ fn pro_tabs(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> TabStrip {
         .focus
         .and_then(|job| opening.iter().position(|(open, _, _)| *open == job))
         .map_or_else(|| app.session.active_index().unwrap_or(0), |p| tab_count + p);
-    let f = crate::tab_strip::fit(&natural, selected, strip.width(), DOC_TAB_MIN_W, crate::tab_strip::CHEVRON_W);
+    let f = fit_doc_tabs(&natural, selected, strip.width());
     let mut x = strip.left();
     let mut placed: Vec<(usize, Rect)> = Vec::with_capacity(f.shown.len());
     for &(i, w) in &f.shown {
@@ -2549,7 +2660,10 @@ fn pro_tabs(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> TabStrip {
         let r = Rect::from_min_size(egui::pos2(left, strip.top()), egui::vec2(crate::tab_strip::CHEVRON_W, strip.height()));
         let labels: Vec<&str> = titles.iter().map(String::as_str).collect();
         let mut picked = None;
-        crate::tab_strip::overflow_button(ui, ui.id().with("ptab-overflow"), r, tl!("More documents"), &labels, &f.overflow, &mut picked);
+        // Like Photoshop's, the menu lists every open document, not only the hidden ones, and checks
+        // the active one (#4487).
+        let every: Vec<usize> = (0..labels.len()).collect();
+        crate::tab_strip::overflow_button(ui, ui.id().with("ptab-overflow"), r, tl!("More documents"), &labels, &every, Some(selected), &mut picked);
         match picked {
             Some(i) if i < tab_count => activate = Some(i),
             Some(i) => focus_open = opening.get(i - tab_count).map(|(job, _, _)| *job).or(focus_open),
@@ -2975,6 +3089,7 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
             on_gpu = true;
             app.navigator_gpu.remove(&doc.id);
             let original_size = [doc.size.width.div_ceil(k), doc.size.height.div_ceil(k)];
+            let shown = filter_preview_display_doc(app, &doc, key);
             let params = crate::gpu_canvas::ViewParams {
                 doc: key,
                 doc_size: preview_size,
@@ -2991,7 +3106,7 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
                 },
                 pixel_grid: false,
                 view_key: egui::Id::new(("pc-canvas-proxy", ctx.viewport_id(), idx)).value(),
-                display: sync_display_lut(app, &doc, key, output),
+                display: sync_display_lut(app, &shown, key, output),
                 output: output.unwrap_or(0),
                 hdr: hdr_preview(app, &doc),
                 offset: [0.0, 0.0],
@@ -4054,6 +4169,8 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
     if primary && hand_pan && response.dragged() {
         crate::transform_tool::draw_content(app, &painter, &xf);
         crate::transform_tool::draw_overlay(app, &painter, &xf);
+        // The Pen's path in progress survives a Space pan, and stays on screen through it (#6592).
+        crate::vector_ui::draw_overlay(app, &painter, &xf, &doc);
     }
     app.tool_override = None;
     if let Some(b) = layer_edges_rect(app, idx) {
@@ -4520,8 +4637,8 @@ fn draw_beyond_canvas(app: &mut PhotocraftApp, painter: &egui::Painter, xf: &Vie
         None => {
             let t0 = crate::gpu_canvas::now_ms();
             let extent = photocraft_engine::extra_cmds::reveal_all_bounds(&doc);
-            // One texel per `k` document pixels keeps every texture within MAX_TEXTURE.
-            let k = extent.width().max(extent.height()).div_ceil(MAX_TEXTURE).max(1);
+            // One texel per `k` document pixels keeps every texture within the device's side.
+            let k = extent.width().max(extent.height()).div_ceil(texture_side(&ctx)).max(1);
             let proxy = (k > 1).then(|| photocraft_compose::proxy::proxy_document(&doc, k));
             let src = proxy.as_ref().unwrap_or(&*doc);
             let k = k as i32;
@@ -5459,6 +5576,7 @@ pub fn tool_event(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers)
             {
                 e.dragging = false;
                 e.resize = None;
+                app.ui.caret_blink_time = app.last_frame_time;
             }
             if tool == Tool::Pen {
                 crate::vector_ui::pen_up(app);
@@ -5806,14 +5924,12 @@ pub(crate) fn finish_gesture(app: &mut PhotocraftApp, d: Drag) {
                 let _ = app.run("select.deselect", json!({}));
             }
         }
-        Tool::Gradient => {
-            if (end[0] - d.start[0]).abs() + (end[1] - d.start[1]).abs() >= 2.0 {
-                let o = app.ui.tool_options.clone();
-                let _ = app.run(
-                    "paint.gradient",
-                    json!({"from": [d.start[0], d.start[1]], "to": [end[0], end[1]], "style": o.gradient_style, "reverse": o.gradient_reverse, "dither": o.gradient_dither, "opacity": o.fill_opacity, "mode": o.gradient_blend_mode.label(), "target": paint_target(app)}),
-                );
-            }
+        Tool::Gradient if (end[0] - d.start[0]).abs() + (end[1] - d.start[1]).abs() >= 2.0 => {
+            let o = app.ui.tool_options.clone();
+            let _ = app.run(
+                "paint.gradient",
+                json!({"from": [d.start[0], d.start[1]], "to": [end[0], end[1]], "style": o.gradient_style, "reverse": o.gradient_reverse, "dither": o.gradient_dither, "opacity": o.fill_opacity, "mode": o.gradient_blend_mode.label(), "target": paint_target(app)}),
+            );
         }
         Tool::Move => {
             let (dx, dy) = ((end[0] - d.start[0]).round(), (end[1] - d.start[1]).round());
@@ -6070,6 +6186,59 @@ mod tests {
         assert_eq!(super::display_image(Some(&d), &buf).pixels, reference(d.to_rgba8(&buf)).pixels);
     }
 
+    /// #6326: a filter's live preview is never coarser than the screen. On a document big enough
+    /// for a reduced proxy, the view at 100 % previews at full resolution, and only a view zoomed
+    /// out far enough uses the proxy. Through `ensure_filter_preview`, so the factor the canvas
+    /// actually requests is the one under test.
+    #[test]
+    fn filter_preview_at_100_percent_is_full_resolution() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        app.background_jobs = false;
+        app.run("file.new", json!({"width": 2400, "height": 2200})).unwrap();
+        assert_eq!(crate::proxy::preview_factor(&app.session.active().unwrap().doc, true), 2, "big enough for a proxy");
+        crate::filter_dialog::open(&mut app, "filter.stylize.solarize").unwrap();
+        let ctx = egui::Context::default();
+        let preview_at = |app: &mut PhotocraftApp, zoom: f32| {
+            app.ui.views.get_mut(0).expect("the new document's view").zoom = zoom;
+            assert_eq!(app.current_zoom(), zoom);
+            let (k, _, size) = ensure_filter_preview(app, 0, &ctx).expect("a preview");
+            (k, size)
+        };
+        assert_eq!(preview_at(&mut app, 1.0), (1, [2400, 2200]), "100 %: every pixel");
+        assert_eq!(preview_at(&mut app, 0.25), (2, [1200, 1100]), "zoomed out: the document's proxy");
+        // Low Resolution Previews off: full resolution at any zoom, exactly as before #6326.
+        app.run("prefs.set", json!({"path": "performance.lowResolutionPreviews", "value": false})).unwrap();
+        assert_eq!(preview_at(&mut app, 0.25), (1, [2400, 2200]), "the preference still decides");
+    }
+
+    /// The factor itself over the zoom range, and that Preferences › Performance › Low
+    /// Resolution Previews still decides whether there is a proxy at all (#6326).
+    #[test]
+    fn filter_preview_factor_caps_at_the_view_without_overriding_the_preference() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        // 9 MP: reduced previews halve it (empty tiles, so nothing is allocated).
+        app.run("file.new", json!({"width": 3000, "height": 3000, "background": "transparent"})).unwrap();
+        let doc = app.session.active().unwrap().doc.clone();
+        let params = json!({"amount": 100, "radius": 4.0, "threshold": 0});
+        let k = |app: &mut PhotocraftApp, zoom: f32| {
+            app.ui.views.get_mut(0).expect("the new document's view").zoom = zoom;
+            super::filter_preview_factor(app, &doc, "filter.sharpen.unsharpMask", &params)
+        };
+        assert_eq!(k(&mut app, 0.25), 2, "zoomed out the preview stays reduced");
+        assert_eq!(k(&mut app, 0.5), 2);
+        assert_eq!(k(&mut app, 0.75), 1, "past the proxy's resolution it shows every pixel");
+        assert_eq!(k(&mut app, 1.0), 1);
+        assert_eq!(k(&mut app, 4.0), 1);
+        // A corrupt or unset zoom must not pick a coarser proxy than the document's own.
+        assert_eq!(k(&mut app, f32::NAN), 1);
+        assert_eq!(k(&mut app, 0.0), 1);
+        // Low Resolution Previews off: full resolution at any zoom, the cap a no-op.
+        app.run("prefs.set", json!({"path": "performance.lowResolutionPreviews", "value": false})).unwrap();
+        for zoom in [0.1, 0.25, 1.0, 4.0] {
+            assert_eq!(k(&mut app, zoom), 1, "zoom {zoom}");
+        }
+    }
+
     #[cfg(not(target_arch = "wasm32"))]
     #[test]
     fn every_filter_previews_off_the_ui_thread_and_a_newer_value_cancels_the_old() {
@@ -6168,13 +6337,21 @@ mod tests {
         app.filter_preview_worker
             .start(key.clone(), ctx.clone(), move |_| {
                 wait.recv_timeout(std::time::Duration::from_secs(60)).expect("the test releases the job");
-                let result =
-                    crate::filter_dialog::preview_document_for_target(&doc, key.active, &key.command, &key.params, key.k, None, key.target, &documents).map(
-                        |d| {
-                            let buffer = photocraft_compose::flatten(&d);
-                            (std::sync::Arc::new(d), buffer)
-                        },
-                    );
+                let result = crate::filter_dialog::preview_document_for_target(
+                    &doc,
+                    key.active,
+                    &key.command,
+                    &key.params,
+                    key.k,
+                    None,
+                    key.target,
+                    &documents,
+                    &Default::default(),
+                )
+                .map(|d| {
+                    let buffer = photocraft_compose::flatten(&d);
+                    (std::sync::Arc::new(d), buffer)
+                });
                 crate::filter_preview_worker::Computed { result, ms: 0.0 }
             })
             .expect("the worker starts");
@@ -6525,6 +6702,25 @@ mod tests {
         assert_eq!(uploads(&ctx), vec![(true, crisp)], "a partial update keeps the crisp sampling");
     }
 
+    /// A device that allows smaller textures than MAX_TEXTURE (2048 on some older GPUs and WebGL
+    /// contexts, and on the fallback adapter the GPU tests sometimes get under load): the canvas
+    /// texture is reduced to fit it. A 2600 px document was uploaded at full size, which egui
+    /// asserts on and the backend can't create.
+    #[test]
+    fn cpu_canvas_texture_fits_the_device_limit() {
+        for (side, (w, h), want) in [(2048, (2600, 1700), [1300, 850]), (2048, (5000, 2000), [1666, 666]), (8192, (5000, 2000), [2500, 1000])] {
+            let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+            app.run("file.new", json!({"width": w, "height": h})).unwrap();
+            let ctx = egui::Context::default();
+            ctx.input_mut(|i| i.max_texture_side = side);
+            let (tex, _) = ensure_texture(&mut app, &ctx, 0, None).unwrap();
+            let mut delta = ctx.tex_manager().write().take_delta();
+            let sizes: Vec<_> = delta.set.get(&tex).into_iter().flatten().map(|d| d.image.size()).collect();
+            delta.clear();
+            assert_eq!(sizes, vec![want], "{w}x{h} on a {side} px device");
+        }
+    }
+
     #[test]
     fn cpu_canvas_of_a_reduced_document_stays_bilinear() {
         // Over MAX_TEXTURE the texture holds one texel per `factor` pixels: a texel is not a
@@ -6542,6 +6738,7 @@ mod tests {
 
     #[test]
     fn gpu_display_luts_are_per_display() {
+        let _gpu = photocraft_testkit::gpu_lock();
         let Ok(rs) = std::panic::catch_unwind(|| egui_kittest::wgpu::create_render_state(crate::gpu_canvas::wgpu_setup(), Default::default())) else {
             eprintln!("skipping: no GPU adapter");
             return;
@@ -7460,6 +7657,7 @@ mod tests {
         // must update only the reduced pixels it touched.
         let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
         let ctx = egui::Context::default();
+        ctx.input_mut(|i| i.max_texture_side = 8192);
         app.run("file.new", json!({"width": 4097, "height": 90, "background": "transparent"})).unwrap();
         let tilt = json!({"size": 30, "hardness": 1.0, "spacing": 0.05, "shapeDynamics": {"enabled": true, "size": {"control": "penTilt"}}});
         app.run("tools.setBrush", json!({ "brush": tilt })).unwrap();
@@ -8529,6 +8727,64 @@ mod rotation_preview_isolation_tests {
         }
     }
 
+    /// Assign and Convert to Profile have Photoshop's Preview. Assign changes only the profile, so
+    /// its preview must be shown through the profile it assigns (through the document's own it
+    /// looked unchanged); Convert keeps the look of in-gamut colours. Their `working` is the
+    /// working space from Color Settings, not the built-in default.
+    #[test]
+    fn profile_dialogs_preview_through_the_profile_they_choose() {
+        let mut session = photocraft_engine::Session::new();
+        session.color.settings.monitor_profile = "srgb".into();
+        session.color.settings.working_rgb = "display-p3".into();
+        session.execute("file.new", json!({"width": 4, "height": 4})).unwrap();
+        session.execute("edit.assignProfile", json!({"profile": "srgb"})).unwrap();
+        session
+            .edit("Fixture", |doc, _| {
+                let layer = doc.layers.last_mut().unwrap();
+                for y in 0..4 {
+                    for x in 0..4 {
+                        layer.surface_mut().unwrap().write_pixel(x, y, &[0.6, 0.35, 0.25, 1.0]);
+                    }
+                }
+                Ok(())
+            })
+            .unwrap();
+        let mut app = PhotocraftApp::new(session, crate::Services::default());
+        let shown_pixels = |app: &PhotocraftApp, doc: &Document| {
+            let (display, _) = canvas_display(app, doc, None);
+            display_image(display.as_deref(), &photocraft_compose::flatten(doc)).pixels[0]
+        };
+        let original = app.session.active().unwrap().doc.clone();
+        let before = shown_pixels(&app, &original);
+        let preview = |app: &mut PhotocraftApp, command: &str, profile: &str| {
+            crate::filter_dialog::open(app, command).unwrap();
+            let fields = &mut app.ui.dialogs.last_mut().unwrap().fields;
+            assert_eq!(fields.get("__preview"), Some(&json!(true)), "{command} has a Preview checkbox, on");
+            fields.insert("profile".into(), json!(profile));
+            ensure_filter_preview(app, 0, &egui::Context::default()).expect("a preview");
+            let result = app.filter_preview.as_ref().unwrap().result.clone().unwrap();
+            let key = original.id.0 ^ (1u64 << 61);
+            assert_eq!(filter_preview_display_doc(app, &original, key).icc_profile, result.icc_profile, "the canvas shows it through its own profile");
+            assert_eq!(app.session.active().unwrap().doc.icc_profile, original.icc_profile, "previewing changes nothing");
+            app.ui.dialogs.clear();
+            app.filter_preview = None;
+            result
+        };
+        let description = |doc: &Document| photocraft_engine::color_cmds::profile_from_bytes(doc.icc_profile.as_ref().unwrap()).unwrap().description.clone();
+
+        let assigned = preview(&mut app, "edit.assignProfile", "prophoto-compat");
+        assert_eq!(description(&assigned), photocraft_cms::Builtin::ProPhotoCompat.description());
+        let shown = shown_pixels(&app, &assigned);
+        assert!(shown.r().abs_diff(before.r()) > 10 || shown.b().abs_diff(before.b()) > 10, "the assigned profile shows: {before:?} → {shown:?}");
+
+        let converted = preview(&mut app, "edit.convertToProfile", "working");
+        assert_eq!(description(&converted), photocraft_cms::Builtin::DisplayP3.description(), "`working` is Color Settings' working space");
+        let shown = shown_pixels(&app, &converted);
+        for (a, b) in [(shown.r(), before.r()), (shown.g(), before.g()), (shown.b(), before.b())] {
+            assert!(a.abs_diff(b) <= 2, "converting keeps the look: {before:?} → {shown:?}");
+        }
+    }
+
     /// A CPU-only app must be able to generate the actual rotation preview without a
     /// GPU adapter; checking the result also verifies Preview off and document integrity.
     #[test]
diff --git a/crates/ui-egui/src/canvas/tabs_tests.rs b/crates/ui-egui/src/canvas/tabs_tests.rs
index 4cc2bca0f0..42f5c58d8e 100644
--- a/crates/ui-egui/src/canvas/tabs_tests.rs
+++ b/crates/ui-egui/src/canvas/tabs_tests.rs
@@ -1,5 +1,6 @@
-//! #1276: a document tab strip with more tabs than fit keeps the active document's tab on the
-//! strip, shrinks and elides the others, and moves the rest into a » menu (whole app, real tree).
+//! #1276, #4487: a document tab strip with more tabs than fit keeps the active document's tab on
+//! the strip, keeps whole titles on the tabs it shows, and moves the rest into a » menu (whole
+//! app, real tree).
 
 use egui::vec2;
 use egui_kittest::Harness;
@@ -166,3 +167,60 @@ fn ctrl_tab_with_one_document_or_a_focused_field() {
     }
     assert!(!Focus::Widget.allows(&crate::shortcuts::parse("Tab").unwrap()), "a focused widget keeps plain Tab");
 }
+
+#[test]
+fn quick_mask_mode_names_the_quick_mask_in_the_tab() {
+    let mut h = harness(1, ThemeKind::Pro);
+    h.state_mut().run("layer.new.layer", json!({})).unwrap();
+    assert_eq!(pro_tab_title(h.state(), 0), "ch1-p01.png @ 100% (Layer 1, RGB/8)*");
+    h.state_mut().run("select.editInQuickMaskMode", json!({"on": true})).unwrap();
+    assert_eq!(pro_tab_title(h.state(), 0), "ch1-p01.png @ 100% (Quick Mask/8)*");
+    h.state_mut().run("select.editInQuickMaskMode", json!({"on": false})).unwrap();
+    assert_eq!(pro_tab_title(h.state(), 0), "ch1-p01.png @ 100% (Layer 1, RGB/8)*");
+}
+
+/// Whether any title painted on the strip was cut with '…'.
+fn elided_on_strip(h: &Harness<'_, PhotocraftApp>) -> bool {
+    fn elided(shape: &egui::Shape, strip: egui::Rect) -> bool {
+        match shape {
+            egui::Shape::Text(text) => text.galley.elided && strip.intersects(text.visual_bounding_rect()),
+            egui::Shape::Vec(shapes) => shapes.iter().any(|shape| elided(shape, strip)),
+            _ => false,
+        }
+    }
+    let strip = strip(h).rect;
+    h.output().shapes.iter().any(|shape| elided(&shape.shape, strip))
+}
+
+/// #4487: a crowded strip keeps whole names on the tabs it shows and moves the rest into the »
+/// menu instead of shrinking them all, and the menu lists every open document with the active one
+/// checked, as Photoshop's does.
+#[test]
+fn crowded_tabs_keep_their_whole_names_and_the_menu_lists_every_document() {
+    for theme in [ThemeKind::Pro, ThemeKind::Studio] {
+        let mut h = harness(14, theme);
+        let s = strip(&h);
+        assert!(s.tabs.len() > 1 && s.tabs.len() < 14, "{theme:?}: {} shown", s.tabs.len());
+        assert!(!elided_on_strip(&h), "{theme:?}: no tab title is cut");
+        // The last new document is active; then one that was behind the menu, then the first.
+        for active in [13, 5, 0] {
+            h.state_mut().session.set_active(active);
+            h.run_steps(2);
+            let pro = crate::theme::Tokens::get(&h.ctx).pro;
+            let labels: Vec<String> =
+                (0..14).map(|i| if pro { pro_tab_title(h.state(), i) } else { h.state().session.documents()[i].doc.name.clone() }).collect();
+            h.get_by_label("More documents").click();
+            h.run_steps(2);
+            for (i, label) in labels.iter().enumerate() {
+                // The menu bar's padding: an unchecked row keeps the check mark's room, so names line up.
+                let (on, off) = (format!("✔ {label}"), format!("   {label}"));
+                let (want, other) = if i == active { (&on, &off) } else { (&off, &on) };
+                assert_eq!(h.query_all_by_label(want).count(), 1, "{theme:?}, active {active}: document {i} is in the menu as {want:?}");
+                assert_eq!(h.query_all_by_label(other).count(), 0, "{theme:?}, active {active}: document {i} is not {other:?}");
+            }
+            h.key_press(egui::Key::Escape);
+            h.run_steps(2);
+            assert!(h.query_by_label(&format!("✔ {}", labels[active])).is_none(), "{theme:?}: the menu closed");
+        }
+    }
+}
diff --git a/crates/ui-egui/src/chrome_ui.rs b/crates/ui-egui/src/chrome_ui.rs
index bbdce8fa78..02fa202cc5 100644
--- a/crates/ui-egui/src/chrome_ui.rs
+++ b/crates/ui-egui/src/chrome_ui.rs
@@ -183,6 +183,24 @@ pub fn status_bar_pro(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     status_message(app, ui, &t);
 }
 
+/// The active document's layers don't fit the GPU memory budget (`perf.gpuLayerFit`): edits that
+/// redraw the whole document do it on the CPU, so say so in the status bar until they fit again.
+/// Clicking it opens Preferences › Performance, where GPU Memory raises the budget.
+pub fn gpu_memory_status(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
+    let Some(doc) = app.session.active().map(|st| st.doc.id.0) else { return };
+    let Some(fit) = app.perf.gpu_layer_fit.filter(|f| f.doc == doc && !f.fits()) else { return };
+    let t = Tokens::get(ui.ctx());
+    let resp = ui
+        .add(egui::Label::new(RichText::new(tl!("GPU Memory Full")).color(t.warning).size(12.0)).sense(Sense::click()))
+        .on_hover_text(crate::i18n::fmt(
+            tl!("The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory."),
+            &[("needed", &fmt_bytes(fit.needed)), ("budget", &fmt_bytes(fit.budget))],
+        ));
+    if resp.clicked() {
+        crate::shortcut_dispatch::dispatch(app, ui.ctx(), "edit.preferences.performance");
+    }
+}
+
 /// The latest status message after a separator, in the warning colour when it is an error.
 fn status_message(app: &PhotocraftApp, ui: &mut egui::Ui, t: &Tokens) {
     if app.ui.status.is_empty() {
@@ -293,6 +311,39 @@ mod tests {
         assert_eq!(status_info_text_with_units(&d, "dimensions", "", "", &units), "722.7 pt x 451.7 pt (240 ppi)");
     }
 
+    /// L3: layers over the GPU memory budget show "GPU Memory Full" in the status bar, for that
+    /// document only, and clicking it opens Preferences › Performance (GPU Memory).
+    #[test]
+    fn status_bar_says_when_layers_dont_fit_gpu_memory() {
+        use egui_kittest::{Harness, kittest::Queryable};
+        for theme in [crate::theme::ThemeKind::Pro, crate::theme::ThemeKind::Studio] {
+            let mut h = Harness::builder().with_size(vec2(1200.0, 700.0)).with_max_steps(64).build_eframe(move |cc| {
+                PhotocraftApp::setup_context(&cc.egui_ctx, theme);
+                let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+                app.ui.theme = theme;
+                app
+            });
+            h.state_mut().run("file.new", json!({"width": 800, "height": 600})).unwrap();
+            h.state_mut().sync_views();
+            h.run_steps(4);
+            let doc = h.state().session.active().unwrap().doc.id.0;
+            assert!(h.query_by_label("GPU Memory Full").is_none(), "{theme:?}: nothing measured yet");
+            let over = crate::gpu_canvas::LayerFit { doc, needed: 3 << 30, budget: 2 << 30 };
+            h.state_mut().perf.gpu_layer_fit = Some(crate::gpu_canvas::LayerFit { doc: doc + 1, ..over });
+            h.run_steps(2);
+            assert!(h.query_by_label("GPU Memory Full").is_none(), "{theme:?}: another document's layers");
+            h.state_mut().perf.gpu_layer_fit = Some(crate::gpu_canvas::LayerFit { budget: 4 << 30, ..over });
+            h.run_steps(2);
+            assert!(h.query_by_label("GPU Memory Full").is_none(), "{theme:?}: they fit");
+            h.state_mut().perf.gpu_layer_fit = Some(over);
+            h.run_steps(2);
+            h.get_by_label("GPU Memory Full").click();
+            h.run_steps(4);
+            let open = h.state().ui.dialogs.iter().any(|d| d.fields.get("section") == Some(&json!("performance")));
+            assert!(open, "{theme:?}: Preferences › Performance opens");
+        }
+    }
+
     #[test]
     fn status_bar_updates_dimensions_after_a_ruler_preference_change() {
         use egui_kittest::{Harness, kittest::Queryable};
diff --git a/crates/ui-egui/src/clipping_indicator_tests.rs b/crates/ui-egui/src/clipping_indicator_tests.rs
index 9bfb600b6f..7395a533de 100644
--- a/crates/ui-egui/src/clipping_indicator_tests.rs
+++ b/crates/ui-egui/src/clipping_indicator_tests.rs
@@ -83,6 +83,7 @@ fn alt_click_clipping_still_creates_releases_and_undoes_without_moving_rows() {
 #[test]
 #[ignore = "writes synthetic English Layers-panel screenshots for before/after inspection"]
 fn write_clipping_indicator_preview() {
+    let _gpu = photocraft_testkit::gpu_lock();
     let output = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../plan/evidence/clipping");
     std::fs::create_dir_all(&output).unwrap();
     for theme in crate::theme::ThemeKind::ALL {
diff --git a/crates/ui-egui/src/color_picker_ui.rs b/crates/ui-egui/src/color_picker_ui.rs
index 09a3ce8d4c..19272a62ed 100644
--- a/crates/ui-egui/src/color_picker_ui.rs
+++ b/crates/ui-egui/src/color_picker_ui.rs
@@ -171,7 +171,7 @@ pub fn open(app: &mut PhotocraftApp, target: &str) -> u64 {
     let c = if target == "background" { app.session.tools.background } else { app.session.tools.foreground };
     let rgb = [c[0], c[1], c[2]];
     let label = if target == "background" { "Color Picker (Background Color)" } else { "Color Picker (Foreground Color)" };
-    let mut fields = initial_fields(target, label, rgb);
+    let mut fields = fields_with_web(app, target, label, rgb);
     // A colour that was picked as CMYK shows the inks it was picked as, not what its sRGB stand-in converts to (#4196).
     if let Some(cmyk) = app.session.tools.picked_cmyk(rgb) {
         fields.insert("__cmyk".into(), json!(cmyk));
@@ -192,10 +192,23 @@ pub(crate) fn initial_fields(target: &str, label: &str, rgb: [f32; 3]) -> Map<St
     f
 }
 
+/// Seed [`initial_fields`] with the last Only Web Colors setting. With web-only on, the opening
+/// colour is snapped and `__orig` follows it: OK without an edit is "unchanged", so opening the
+/// picker never rewrites a fill behind the user's back (#4995).
+pub(crate) fn fields_with_web(app: &PhotocraftApp, target: &str, label: &str, rgb: [f32; 3]) -> Map<String, Value> {
+    let mut f = initial_fields(target, label, rgb);
+    f.insert("__webOnly".into(), json!(app.ui.color_panel.web_only));
+    if app.ui.color_panel.web_only {
+        set_rgb(&mut f, rgb, Keep::Nothing);
+        f.insert("__orig".into(), f["color"].clone());
+    }
+    f
+}
+
 /// Open the picker on `rgb` for something other than the tool colours: OK runs `command` with
 /// `params` plus `"color": "#rrggbb"` (e.g. a gradient stop's colour).
 pub fn open_for_command(app: &mut PhotocraftApp, label: &str, rgb: [f32; 3], command: &str, params: Value) -> u64 {
-    let mut f = initial_fields("command", label, rgb);
+    let mut f = fields_with_web(app, "command", label, rgb);
     f.insert("__command".into(), json!(command));
     f.insert("__params".into(), params);
     app.ui.open_dialog(DialogKind::Command, f)
@@ -204,33 +217,16 @@ pub fn open_for_command(app: &mut PhotocraftApp, label: &str, rgb: [f32; 3], com
 /// Open the picker on `rgb` for a colour field of another dialog (e.g. Edit › Fill's Color…): OK
 /// writes `"#rrggbb"` into `field` of dialog `dialog`, which stays open; Cancel leaves it alone.
 pub fn open_for_field(app: &mut PhotocraftApp, label: &str, rgb: [f32; 3], dialog: u64, field: &str) -> u64 {
-    let hsv = rgb_to_hsv(rgb);
-    let mut f = Map::new();
-    f.insert("__colorPicker".into(), json!("field"));
-    f.insert("__label".into(), json!(label));
+    let mut f = fields_with_web(app, "field", label, rgb);
     f.insert("__dialog".into(), json!(dialog));
     f.insert("__field".into(), json!(field));
-    f.insert("color".into(), json!(hex(rgb)));
-    f.insert("__orig".into(), json!(hex(rgb)));
-    f.insert("__hsv".into(), json!(hsv));
-    f.insert("__mode".into(), json!("h"));
-    f.insert("__webOnly".into(), json!(false));
     app.ui.open_dialog(DialogKind::Command, f)
 }
 
 /// Open the picker on `rgb` for a colour the shell keeps itself (e.g. the Crop shield's custom
 /// colour): OK hands `"#rrggbb"` to `target`'s setter in [`confirm`]; Cancel leaves it alone.
 pub fn open_for_target(app: &mut PhotocraftApp, target: &str, label: &str, rgb: [f32; 3]) -> u64 {
-    let hsv = rgb_to_hsv(rgb);
-    let mut f = Map::new();
-    f.insert("__colorPicker".into(), json!(target));
-    f.insert("__label".into(), json!(label));
-    f.insert("color".into(), json!(hex(rgb)));
-    f.insert("__orig".into(), json!(hex(rgb)));
-    f.insert("__hsv".into(), json!(hsv));
-    f.insert("__mode".into(), json!("h"));
-    f.insert("__webOnly".into(), json!(false));
-    app.ui.open_dialog(DialogKind::Command, f)
+    app.ui.open_dialog(DialogKind::Command, fields_with_web(app, target, label, rgb))
 }
 
 /// Set by a dialog body (to the picker's title) to open the Color Picker on its `color` field.
@@ -367,7 +363,7 @@ pub fn current(f: &Map<String, Value>) -> Components {
 
 fn set_rgb(f: &mut Map<String, Value>, rgb: [f32; 3], keep: Keep) {
     let web = f.get("__webOnly").and_then(Value::as_bool).unwrap_or(false);
-    let (rgb, keep) = if web { (rgb.map(|v| (v * 5.0).round() / 5.0), Keep::Nothing) } else { (rgb, keep) };
+    let (rgb, keep) = if web { (web_safe(rgb), Keep::Nothing) } else { (rgb, keep) };
     f.insert("color".into(), json!(hex(rgb)));
     for key in ["__hsv", "__lab", "__cmyk"] {
         f.remove(key);
@@ -688,9 +684,14 @@ fn fields(ui: &mut egui::Ui, f: &mut Map<String, Value>, mode: &str, now: &Compo
                 let focused = ui.memory(|m| m.has_focus(id));
                 let pasted = if focused { take_hex_paste(ui) } else { None };
                 let typing = if focused { ui.data(|d| d.get_temp::<String>(id)) } else { None };
+                // Drop stale typing when another path (web snap, field drag, Current) changed `color`.
+                let shown = hex(rgb);
                 let mut h = match pasted {
                     Some(c) => hex(c).trim_start_matches('#').to_ascii_uppercase(),
-                    None => typing.unwrap_or_else(|| hex(rgb).trim_start_matches('#').to_ascii_uppercase()),
+                    None => match typing {
+                        Some(t) if parse_hex(&t).is_none() || parse_hex(&t).map(hex).as_deref() == Some(shown.as_str()) => t,
+                        _ => shown.trim_start_matches('#').to_ascii_uppercase(),
+                    },
                 };
                 let r = crate::widgets::text_field_ex(ui, id, &mut h, "", 64.0, true, Some(6));
                 if let Some(c) = pasted {
@@ -783,6 +784,9 @@ pub fn confirm(app: &mut PhotocraftApp, f: &Map<String, Value>) -> Result<Value,
     if crate::layer_style::color_picker::owns(f) {
         return crate::layer_style::color_picker::confirm(app, f);
     }
+    if crate::solid_fill_ui::owns_new(f) {
+        return crate::solid_fill_ui::confirm_new(app, f);
+    }
     if crate::solid_fill_ui::owns(f) {
         return crate::solid_fill_ui::confirm(app, f);
     }
@@ -1041,6 +1045,7 @@ mod tests {
         h.get_by_label("Only Web Colors").click();
         h.run_steps(2);
         assert_eq!(color(&h), "#003366");
+        assert_eq!(h.get_by_role(Role::TextInput).value().as_deref(), Some("003366"), "hex field follows the snap while it has focus");
         h.get_by_label("Only Web Colors").click();
         h.run_steps(2);
         h.get_by_label("Click to restore the current colour").click();
@@ -1048,6 +1053,48 @@ mod tests {
         assert_eq!(color(&h), "#123456");
     }
 
+    #[test]
+    fn web_only_snaps_hex_field_and_component_edits() {
+        let mut f = Map::new();
+        f.insert("color".into(), json!("#123456"));
+        f.insert("__webOnly".into(), json!(true));
+        set_rgb(&mut f, parse_hex("#ff8800").unwrap(), Keep::Nothing);
+        assert_eq!(f["color"], json!("#ff9900"));
+        set_rgb(&mut f, hsv_to_rgb(40.0, 1.0, 1.0), Keep::Hsv([40.0, 1.0, 1.0]));
+        assert_eq!(f["color"], json!("#ff9900"));
+        assert!(f.get("__hsv").is_none(), "kept HSV does not outlive a web snap");
+        set_rgb(&mut f, photocraft_color::convert::lab_to_srgb([50.0, 40.0, 20.0]).map(|c| c.clamp(0.0, 1.0)), Keep::Lab([50.0, 40.0, 20.0]));
+        assert_eq!(not_web_safe(parse_hex(f["color"].as_str().unwrap()).unwrap()), None);
+        assert!(f.get("__lab").is_none());
+    }
+
+    #[test]
+    fn web_only_survives_reopen_and_other_picker_targets() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        app.ui.color_panel.web_only = true;
+        let id = open(&mut app, "foreground");
+        let f = &app.ui.dialog_mut(id).unwrap().fields;
+        assert_eq!(f["__webOnly"], json!(true));
+        assert_eq!(f["color"], json!(hex(web_safe([app.session.tools.foreground[0], app.session.tools.foreground[1], app.session.tools.foreground[2]]))));
+        assert_eq!(f["__orig"], f["color"], "the opening snap moves __orig too, so OK with no edit is unchanged");
+        app.ui.dialogs.clear();
+        let id = open_for_target(&mut app, "noteColor", "Color Picker", [1.0, 0.53, 0.0]);
+        let f = &app.ui.dialogs.iter().find(|d| d.id == id).unwrap().fields;
+        assert_eq!(f["__webOnly"], json!(true));
+        assert_eq!(f["color"], json!("#ff9900"));
+        assert_eq!(f["__orig"], json!("#ff9900"), "a non-web-safe start colour is not committed by opening the picker");
+    }
+
+    #[test]
+    fn sample_at_snaps_when_only_web_colors_is_on() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        let id = open(&mut app, "foreground");
+        let f = &mut app.ui.dialog_mut(id).unwrap().fields;
+        f.insert("__webOnly".into(), json!(true));
+        set_rgb(f, [0.07, 0.2, 0.34], Keep::Nothing);
+        assert_eq!(f["color"], json!("#003366"));
+    }
+
     #[test]
     fn side_buttons_and_keyboard_confirm_or_cancel_without_changing_the_other_color() {
         for target in ["foreground", "background"] {
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index ff786be197..8cddc60b23 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -131,8 +131,9 @@ pub enum Outcome {
 /// field's value is validated before the first one is applied, so a typo, an unknown field, a
 /// bad value or a bad nested key can't reply with success while nothing — or only half of it —
 /// changed (#412).
-pub const UI_SET_FIELDS: [&str; 37] = [
+pub const UI_SET_FIELDS: [&str; 38] = [
     "tool",
+    "strokeTrace",
     "panels",
     "dock",
     "dockTabs",
@@ -492,6 +493,19 @@ fn dispatch(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest)
                     None => None,
                 };
                 let gradient_classic = bool_field(p, "gradientClassic")?;
+                // The stroke latency trace (`stroke_trace`), at runtime: on (stderr) or off. A CSV
+                // file is only for the user's own launch (`--stroke-trace <path>`): a path over the
+                // control channel would write outside the automation write root.
+                let stroke_trace = match p.get("strokeTrace") {
+                    None | Some(Value::Null) => None,
+                    Some(Value::Bool(b)) => Some(if *b { "stderr" } else { "off" }),
+                    Some(Value::String(v)) => match v.trim() {
+                        "stderr" | "on" | "true" => Some("stderr"),
+                        "off" | "false" => Some("off"),
+                        _ => return Err("strokeTrace must be true, false, \"stderr\" or \"off\"; a CSV file is set at launch (--stroke-trace <path>)".into()),
+                    },
+                    Some(_) => return Err("strokeTrace must be true, false, \"stderr\" or \"off\"".into()),
+                };
                 // The Eyedropper's options bar (#1649): Sample Size, Sample, Show Sampling Ring.
                 let eyedropper_size = match p.get("eyedropperSampleSize") {
                     Some(v) => Some(
@@ -663,6 +677,9 @@ fn dispatch(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest)
                 if let Some(mode) = gradient_blend {
                     app.ui.tool_options.gradient_blend_mode = mode;
                 }
+                if let Some(v) = &stroke_trace {
+                    app.stroke_trace.set(v);
+                }
                 if let Some(classic) = gradient_classic {
                     app.ui.tool_options.gradient_classic = classic;
                 }
@@ -1385,6 +1402,26 @@ mod tests {
         }
     }
 
+    #[test]
+    fn ui_set_turns_the_stroke_trace_on_and_off_at_runtime() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        let ctx = egui::Context::default();
+        assert!(!app.stroke_trace.enabled());
+        assert_eq!(call(&mut app, &ctx, "ui.set", json!({"strokeTrace": true}))["ok"], true);
+        assert!(app.stroke_trace.enabled());
+        assert_eq!(call(&mut app, &ctx, "ui.set", json!({"strokeTrace": "off"}))["ok"], true);
+        assert!(!app.stroke_trace.enabled());
+        let bad = call(&mut app, &ctx, "ui.set", json!({"strokeTrace": 3, "tool": "Pencil"}));
+        assert_eq!(bad["ok"], false);
+        // A file path isn't accepted over the channel (it would write outside the automation
+        // write root); nothing is created.
+        let path = std::env::temp_dir().join(format!("photocraft-trace-{}.csv", std::process::id()));
+        let bad = call(&mut app, &ctx, "ui.set", json!({"strokeTrace": path.to_str().unwrap(), "tool": "Pencil"}));
+        assert_eq!(bad["ok"], false);
+        assert!(!path.exists());
+        assert!(!app.stroke_trace.enabled() && app.ui.tool != crate::state::Tool::Pencil, "a rejected call applies nothing");
+    }
+
     #[test]
     fn camera_raw_control_updates_and_commits_or_cancels_an_open_raw() {
         use photocraft_raw::testgen::{DngSpec, mosaic, scene};
diff --git a/crates/ui-egui/src/crop_presets.rs b/crates/ui-egui/src/crop_presets.rs
index e049fdfa8c..e30b0d1cfc 100644
--- a/crates/ui-egui/src/crop_presets.rs
+++ b/crates/ui-egui/src/crop_presets.rs
@@ -109,7 +109,7 @@ pub fn savable(o: &ToolOptions) -> Option<(Map<String, Value>, String)> {
     if !(a.is_finite() && b.is_finite() && a > 0.0 && b > 0.0) {
         return None;
     }
-    let name = format!("{} : {}", crate::widgets::fmt_num(a), crate::widgets::fmt_num(b));
+    let name = format!("{} : {}", crop_size::fmt_ratio(a), crop_size::fmt_ratio(b));
     let mut fields = Map::new();
     fields.insert("crop_ratio".into(), json!(o.crop_ratio));
     Some((fields, name))
diff --git a/crates/ui-egui/src/crop_size.rs b/crates/ui-egui/src/crop_size.rs
index 28a6a0e12f..b30cdd8c4a 100644
--- a/crates/ui-egui/src/crop_size.rs
+++ b/crates/ui-egui/src/crop_size.rs
@@ -146,6 +146,14 @@ pub fn ratio(o: &ToolOptions, doc_dpi: f64) -> Option<f64> {
     Some(w / h).filter(|k| k.is_finite() && *k > 0.0)
 }
 
+/// Decimals a custom ratio side keeps and shows: 1.414 : 1 (ISO A sizes) as in Photoshop (#6487).
+pub const RATIO_DECIMALS: u32 = 3;
+
+/// A ratio side as stored in a `crop_ratio` key ("1.414", "16").
+pub fn fmt_ratio(v: f64) -> String {
+    crate::widgets::fmt_num_prec(v, RATIO_DECIMALS)
+}
+
 /// Editable W and H shown for a custom aspect ratio. An existing valid ratio is authoritative;
 /// when either side is zero, use the in-progress values retained in ToolOptions.
 pub fn custom_ratio_fields(o: &ToolOptions, doc_size: (f64, f64)) -> (f32, f32) {
@@ -170,7 +178,7 @@ pub fn set_custom_ratio_fields(o: &mut ToolOptions, width: f32, height: f32) {
     o.crop_custom_ratio_width = width;
     o.crop_custom_ratio_height = height;
     if width.is_finite() && height.is_finite() && width > 0.0 && height > 0.0 {
-        o.crop_ratio = format!("{}:{}", crate::widgets::fmt_num(f64::from(width)), crate::widgets::fmt_num(f64::from(height)));
+        o.crop_ratio = format!("{}:{}", fmt_ratio(f64::from(width)), fmt_ratio(f64::from(height)));
     } else {
         o.crop_ratio.clear();
     }
@@ -347,6 +355,15 @@ mod tests {
         assert_eq!(width / height, 4.0 / 3.0);
     }
 
+    #[test]
+    fn custom_ratio_keeps_three_decimals() {
+        // #6487: 1.414 : 1 (ISO A sizes) stays 1.414, not 1.4, as in Photoshop.
+        let mut options = ToolOptions::default();
+        set_custom_ratio_fields(&mut options, 1.414, 1.0);
+        assert_eq!(options.crop_ratio, "1.414:1");
+        assert_eq!(custom_ratio_fields(&options, (0.0, 0.0)), (1.414, 1.0));
+    }
+
     #[test]
     fn selecting_free_ratio_clears_previous_custom_dimensions() {
         let mut options = ToolOptions { crop_ratio: "16:9".into(), ..ToolOptions::default() };
diff --git a/crates/ui-egui/src/crop_ui.rs b/crates/ui-egui/src/crop_ui.rs
index 78f8d44b50..f1df63ff14 100644
--- a/crates/ui-egui/src/crop_ui.rs
+++ b/crates/ui-egui/src/crop_ui.rs
@@ -645,7 +645,7 @@ pub fn swapped(r: [f64; 4]) -> [f64; 4] {
 /// no ratio is set; "original" becomes the document's size turned on its side.
 pub fn swapped_ratio(key: &str, doc_w: f64, doc_h: f64) -> Option<String> {
     let (w, h) = crate::chrome_ui::crop_ratio(key, doc_w, doc_h).filter(|(w, h)| w.is_finite() && h.is_finite() && *w > 0.0 && *h > 0.0)?;
-    Some(format!("{}:{}", crate::widgets::fmt_num(h), crate::widgets::fmt_num(w)))
+    Some(format!("{}:{}", crate::crop_size::fmt_ratio(h), crate::crop_size::fmt_ratio(w)))
 }
 
 /// X: swaps the pending frame between portrait and landscape about its centre, keeping its angle,
@@ -1949,6 +1949,7 @@ mod tests {
         app.ui.tool_options.crop_ratio = String::new();
         assert!(swap_orientation(&mut app));
         assert_eq!(app.ui.tool_options.crop_ratio, "", "no ratio stays none");
+        assert_eq!(swapped_ratio("1.414:1", 1.0, 1.0).as_deref(), Some("1:1.414"), "decimals survive the swap (#6487)");
         assert_eq!(swapped_ratio("0:5", 1.0, 1.0), None);
         assert_eq!(swapped_ratio("nonsense", 1.0, 1.0), None);
         // No frame, or another tool: X is Switch Foreground and Background Colors.
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index 013c79e825..43b4f3d3f9 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -321,6 +321,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 DialogKind::Command if crate::channel_options_ui::owns_new_spot(&fields) => crate::channel_options_ui::new_spot_body(ui, &mut fields),
                 DialogKind::Command if crate::shape_dialog::owns(&fields) => crate::shape_dialog::body(app, ui, &mut fields),
                 DialogKind::Command if crate::delete_layer_prompt::owns(&fields) => crate::delete_layer_prompt::body(ui, &mut fields),
+                DialogKind::Command if crate::disk_change_prompt::owns(&fields) => crate::disk_change_prompt::body(ui, &fields),
                 DialogKind::Command if crate::actions::owns_insert_stop(&fields) => crate::actions::insert_stop_body(ui, &mut fields),
                 DialogKind::Command if crate::new_layer_ui::owns(&fields) => crate::new_layer_ui::body(ui, &mut fields),
                 DialogKind::Command if crate::mask_trash_prompt::owns(&fields) => crate::mask_trash_prompt::body(ui, &fields),
@@ -334,6 +335,9 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 DialogKind::Command if crate::color_picker_ui::owns(&fields) => {
                     outcome = crate::color_picker_ui::body(ui, &mut fields);
                     crate::color_picker_ui::take_add_swatch(app, &mut fields);
+                    if let Some(web) = fields.get("__webOnly").and_then(Value::as_bool) {
+                        app.ui.color_panel.web_only = web;
+                    }
                 }
                 DialogKind::Command if crate::color_range_ui::owns(&fields) => crate::color_range_ui::body(app, ui, &mut fields),
                 DialogKind::Command if crate::prefs_ui::owns(&fields) => crate::prefs_ui::body(app, ui, &mut fields),
@@ -401,6 +405,8 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                             tl!("Create")
                         } else if crate::delete_layer_prompt::owns(&d.fields) {
                             tl!("Delete")
+                        } else if crate::disk_change_prompt::owns(&d.fields) {
+                            tl!("Replace")
                         } else if d.fields.contains_key("__export") {
                             tl!("Export")
                         } else {
@@ -614,6 +620,7 @@ pub fn confirm(app: &mut PhotocraftApp, id: u64) -> Result<Value, String> {
         DialogKind::Command if crate::channel_options_ui::owns_new_spot(&d.fields) => crate::channel_options_ui::confirm_new_spot(app, &d.fields),
         DialogKind::Command if crate::shape_dialog::owns(&d.fields) => crate::shape_dialog::confirm(app, &d.fields),
         DialogKind::Command if crate::delete_layer_prompt::owns(&d.fields) => crate::delete_layer_prompt::confirm(app, &d.fields),
+        DialogKind::Command if crate::disk_change_prompt::owns(&d.fields) => crate::disk_change_prompt::confirm(app, &d.fields),
         DialogKind::Command if crate::actions::owns_insert_stop(&d.fields) => crate::actions::insert_stop_confirm(app, &d.fields),
         DialogKind::Command if crate::new_layer_ui::owns(&d.fields) => crate::new_layer_ui::confirm(app, &d.fields),
         DialogKind::Command if crate::mask_trash_prompt::owns(&d.fields) => crate::mask_trash_prompt::confirm(app, &d.fields),
diff --git a/crates/ui-egui/src/discard_ui.rs b/crates/ui-egui/src/discard_ui.rs
index 30e5f47deb..3dbf33c905 100644
--- a/crates/ui-egui/src/discard_ui.rs
+++ b/crates/ui-egui/src/discard_ui.rs
@@ -21,6 +21,8 @@ pub struct Prompt {
     /// The document the command was aimed at (`document` param, else the active one), if it has one.
     target: Option<DocId>,
     docs: Vec<DocId>,
+    /// The document whose question has already put keyboard focus on its default answer.
+    focused: Option<DocId>,
 }
 
 fn index_of(app: &PhotocraftApp, id: DocId) -> Option<usize> {
@@ -69,7 +71,7 @@ pub fn intercept(app: &mut PhotocraftApp, id: &str, params: &Value) -> bool {
     if docs.is_empty() {
         return false;
     }
-    let prompt = Prompt { id: id.to_string(), params: params.clone(), target, docs };
+    let prompt = Prompt { id: id.to_string(), params: params.clone(), target, docs, focused: None };
     match &app.discard {
         None => ask(app, prompt),
         // Quitting overrides whatever is pending: it covers every document, so nothing is lost.
@@ -155,6 +157,25 @@ fn advance(app: &mut PhotocraftApp, ctx: &egui::Context) {
     if next.is_some() {
         return;
     }
+    // A save or close hook may have dirtied a document that was clean when the prompt opened (or
+    // made a new one): ask about those before the final close, which discards without checking.
+    if one_by_one && let Some(p) = app.discard.as_ref() {
+        let (id, target) = (p.id.clone(), p.target);
+        let rest: Vec<DocId> = app
+            .session
+            .documents()
+            .iter()
+            .filter(|d| d.is_dirty() && (matches!(reach(&id), Some(Reach::All)) || Some(d.doc.id) != target))
+            .map(|d| d.doc.id)
+            .collect();
+        if !rest.is_empty() {
+            show_tab(app, rest.first().copied());
+            if let Some(p) = app.discard.as_mut() {
+                p.docs = rest;
+            }
+            return;
+        }
+    }
     let Some(Prompt { id, mut params, target, .. }) = app.discard.take() else { return };
     if id == EXIT {
         app.allow_close = true;
@@ -226,6 +247,10 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     // Save can ask for a path and then TIFF or Targa Options, and then write in the background.
     // Wait for all three; cancellation or a failed save brings us back.
     if app.file_dialog_open() || app.save_options_open() || app.saving() {
+        // Hidden meanwhile: the question takes focus again when it comes back.
+        if let Some(p) = app.discard.as_mut() {
+            p.focused = None;
+        }
         return;
     }
     let Some(p) = &app.discard else { return };
@@ -246,6 +271,12 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
         };
         (tl!("Unsaved changes"), crate::i18n::fmt(template, &[("name", &name)]))
     };
+    // Each question comes up with its default answer focused, as in Photoshop: the arrow keys then
+    // move between the answers and Enter presses the focused one (#6441).
+    let focus = p.focused != Some(doc);
+    if let Some(p) = app.discard.as_mut() {
+        p.focused = Some(doc);
+    }
     let mac = ctx.os() == egui::os::OperatingSystem::Mac;
     // The answers in the platform's words; `dialog_buttons` puts them in its order. Windows (and
     // Linux) ask Yes / No / Cancel with Y, N and Esc, as Photoshop does there; macOS asks
@@ -266,7 +297,8 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     };
     let mut answer = ctx.input_mut(|i| buttons.iter().find(|b| b.2.is_some_and(|k| i.consume_key(egui::Modifiers::NONE, k))).map(|b| b.4));
     let labels = button_labels(mac, &buttons.iter().map(|b| (b.1, b.2)).collect::<Vec<_>>());
-    let row: Vec<DialogButton> = buttons.iter().zip(&labels).map(|(b, label)| DialogButton::new(b.0, label, b.3)).collect();
+    let row: Vec<DialogButton> =
+        buttons.iter().zip(&labels).map(|(b, label)| DialogButton::new(b.0, label, b.3).focus(focus && b.0 == ButtonRole::Default)).collect();
     let modal = egui::Modal::new(egui::Id::new("discard-prompt")).show(ctx, |ui| {
         ui.set_max_width(420.0);
         ui.label(egui::RichText::new(tl!(&title)).font(crate::theme::semibold(15.0)));
@@ -482,6 +514,38 @@ mod tests {
         assert!(app.session.documents().is_empty());
     }
 
+    /// A document that became dirty while the prompt was up is asked about before the final close (#4954).
+    #[test]
+    fn a_document_dirtied_during_the_prompt_is_asked_about_before_the_final_close() {
+        for command in ["file.closeAll", EXIT] {
+            let mut app = app_with_docs(2);
+            let ctx = egui::Context::default();
+            make_dirty(&mut app, 0);
+            let late = doc_id(&app, 1);
+            crate::menus::invoke(&mut app, &ctx, command, json!({})).unwrap();
+            make_dirty(&mut app, 1);
+            advance(&mut app, &ctx);
+            assert_eq!(app.discard.as_ref().map(|p| p.docs.clone()), Some(vec![late]), "{command}: asks about the newly dirty document");
+            assert!(!app.allow_close, "{command}");
+            assert_eq!(app.session.documents().len(), 1, "{command}: it is not discarded unasked");
+            advance(&mut app, &ctx);
+            assert!(app.discard.is_none(), "{command}");
+        }
+        // Close Others asks about the others too, but still not about the document it keeps.
+        let mut app = app_with_docs(3);
+        let ctx = egui::Context::default();
+        make_dirty(&mut app, 0);
+        let (late, kept) = (doc_id(&app, 1), doc_id(&app, 2));
+        crate::menus::invoke(&mut app, &ctx, "file.closeOthers", json!({"document": 2})).unwrap();
+        make_dirty(&mut app, 1);
+        make_dirty(&mut app, 2);
+        advance(&mut app, &ctx);
+        assert_eq!(app.discard.as_ref().map(|p| p.docs.clone()), Some(vec![late]), "file.closeOthers: asks about the newly dirty other document");
+        advance(&mut app, &ctx);
+        assert!(app.discard.is_none());
+        assert_eq!(app.session.documents().iter().map(|d| d.doc.id).collect::<Vec<_>>(), [kept]);
+    }
+
     #[test]
     fn close_others_closes_each_answered_document_and_keeps_its_target() {
         let mut app = app_with_docs(3);
@@ -582,31 +646,60 @@ mod tests {
         v.into_iter().map(|(_, l)| l).collect()
     }
 
-    /// Tab walks `labels` left to right and wraps; Shift+Tab steps back.
-    fn tab_walks(h: &mut Prompted, labels: [&str; 3]) {
-        use egui_kittest::kittest::Queryable;
-        let focused = |h: &Prompted| labels.into_iter().find(|l| h.get_by_label(l).is_focused());
-        for want in [labels[0], labels[1], labels[2], labels[0]] {
+    /// Tab walks `labels` left to right from the focused default answer, `labels[default]`, and
+    /// wraps; Shift+Tab steps back.
+    fn tab_walks(h: &mut Prompted, labels: [&str; 3], default: usize) {
+        assert_eq!(focused(h, &labels), Some(labels[default]));
+        for step in 1..=3 {
             h.key_press(Key::Tab);
             h.run_steps(2);
-            assert_eq!(focused(h), Some(want));
+            assert_eq!(focused(h, &labels), Some(labels[(default + step) % 3]));
         }
         h.key_press_modifiers(egui::Modifiers::SHIFT, Key::Tab);
         h.run_steps(2);
-        assert_eq!(focused(h), Some(labels[2]));
+        assert_eq!(focused(h, &labels), Some(labels[(default + 2) % 3]));
     }
 
     fn docs_left(h: &Prompted) -> Option<usize> {
         h.state().discard.as_ref().map(|p| p.docs.len())
     }
 
+    /// Which of `labels` has keyboard focus.
+    fn focused<'a>(h: &Prompted, labels: &[&'a str]) -> Option<&'a str> {
+        use egui_kittest::kittest::Queryable;
+        labels.iter().copied().find(|l| h.get_by_label(l).is_focused())
+    }
+
+    /// The default answer has keyboard focus as each question comes up, so the arrow keys move
+    /// between the answers and Enter presses the one they reached, as in Photoshop (#6441).
+    #[test]
+    fn each_question_comes_up_with_the_default_answer_focused() {
+        let mut h = prompt_on(egui::os::OperatingSystem::Windows);
+        let labels = ["(Y)es", "(N)o", "(C)ancel"];
+        assert_eq!(focused(&h, &labels), Some("(Y)es"));
+        h.key_press(Key::ArrowRight);
+        h.run_steps(2);
+        assert_eq!(focused(&h, &labels), Some("(N)o"));
+        h.key_press(Key::Enter);
+        h.run_steps(2);
+        assert_eq!(docs_left(&h), Some(1), "Enter pressed No");
+        assert_eq!(focused(&h, &labels), Some("(Y)es"), "the next question starts on the default again");
+
+        let mut h = prompt_on(egui::os::OperatingSystem::Mac);
+        let labels = ["Don't Save", "Cancel", "Save"];
+        assert_eq!(focused(&h, &labels), Some("Save"));
+        h.key_press(Key::ArrowLeft);
+        h.run_steps(2);
+        assert_eq!(focused(&h, &labels), Some("Cancel"));
+    }
+
     #[test]
     fn windows_and_linux_ask_yes_no_cancel_with_the_default_first() {
         for os in [egui::os::OperatingSystem::Windows, egui::os::OperatingSystem::Nix] {
             let mut h = prompt_on(os);
             let labels = ["(Y)es", "(N)o", "(C)ancel"];
             assert_eq!(drawn_order(&h, labels), labels, "{os:?}");
-            tab_walks(&mut h, labels);
+            tab_walks(&mut h, labels, 0);
             h.key_press(Key::N);
             h.run_steps(2);
             assert_eq!(docs_left(&h), Some(1), "N answered the first document");
@@ -699,7 +792,7 @@ mod tests {
         let mut h = prompt_on(egui::os::OperatingSystem::Mac);
         let labels = ["Don't Save", "Cancel", "Save"];
         assert_eq!(drawn_order(&h, labels), labels);
-        tab_walks(&mut h, labels);
+        tab_walks(&mut h, labels, 2);
         h.key_press(Key::D);
         h.run_steps(2);
         assert_eq!(docs_left(&h), Some(1), "D answered the first document");
@@ -736,11 +829,9 @@ mod tests {
         h.run_steps(2);
         assert_eq!(asked.borrow().len(), 1, "Enter answered Yes, which saves");
         assert_eq!(docs_left(&h), Some(2));
-        // Tab to No: Enter now presses it.
-        for _ in 0..2 {
-            h.key_press(Key::Tab);
-            h.run_steps(2);
-        }
+        // Tab from the focused Yes to No: Enter now presses it.
+        h.key_press(Key::Tab);
+        h.run_steps(2);
         h.key_press(Key::Enter);
         h.run_steps(2);
         assert_eq!(asked.borrow().len(), 1, "no second dialog");
@@ -776,7 +867,7 @@ mod tests {
         assert!(h.query_by_label("(Y)es").is_none(), "the prompt waits behind the dialog");
         answer(&mut h, None);
         assert_eq!(docs_left(&h), Some(1));
-        assert!(h.query_by_label("(Y)es").is_some());
+        assert_eq!(focused(&h, &["(Y)es", "(N)o", "(C)ancel"]), Some("(Y)es"), "the prompt comes back with Yes focused");
         // Saving closes the document.
         h.key_press(Key::Y);
         h.run_steps(3);
diff --git a/crates/ui-egui/src/discard_ui/tests/tiff_tests.rs b/crates/ui-egui/src/discard_ui/tests/tiff_tests.rs
index 73571fa751..f42de68ea0 100644
--- a/crates/ui-egui/src/discard_ui/tests/tiff_tests.rs
+++ b/crates/ui-egui/src/discard_ui/tests/tiff_tests.rs
@@ -7,6 +7,7 @@ use std::{cell::RefCell, rc::Rc};
 type Writes = Rc<RefCell<Vec<(String, Vec<u8>)>>>;
 
 fn tiff_prompt(command: &str) -> (Prompted, Writes, DocId, DocId) {
+    let _gpu = photocraft_testkit::gpu_lock();
     let mut app = app_with_docs(2);
     make_dirty(&mut app, 0);
     let (saved, other) = (doc_id(&app, 0), doc_id(&app, 1));
diff --git a/crates/ui-egui/src/disk_change_prompt.rs b/crates/ui-egui/src/disk_change_prompt.rs
new file mode 100644
index 0000000000..dd9b8215b9
--- /dev/null
+++ b/crates/ui-egui/src/disk_change_prompt.rs
@@ -0,0 +1,57 @@
+//! File › Save asks before replacing the document's own file when another app changed it after
+//! the document was opened from it or last saved to it (#6596). Replace writes the document over
+//! it anyway; Cancel leaves the file and the document as they are, and File › Save As keeps both.
+//!
+//! The prompt is an ordinary dialog in the UI state: `ui.dialog.confirm` replaces the file and
+//! `ui.dialog.cancel` keeps it. Recorded actions and automation saves don't ask.
+
+use photocraft_doc::DocId;
+use serde_json::{Map, Value, json};
+
+use crate::PhotocraftApp;
+use crate::state::DialogKind;
+
+const MARK: &str = "__diskChanged";
+
+pub fn owns(fields: &Map<String, Value>) -> bool {
+    fields.contains_key(MARK)
+}
+
+/// Opens the prompt instead of saving `doc` to its own file at `path` when another app changed
+/// that file; `None` saves as usual. `flat` is a flat file confirmed in the Save dialog, which
+/// is saved (and recorded) the way [`PhotocraftApp::save_dialog_flow`] does it.
+pub(crate) fn intercept(app: &mut PhotocraftApp, doc: DocId, path: &str, flat: bool) -> Option<Result<Value, String>> {
+    if !app.changed_on_disk(doc, path) {
+        return None;
+    }
+    if app.ui.dialogs.iter().any(|d| owns(&d.fields)) {
+        return Some(Ok(json!({"confirmationPending": true})));
+    }
+    let name = crate::file_open::display_name(path);
+    let message = crate::i18n::fmt(tl!("{name} was changed by another app after it was opened or saved here."), &[("name", name.as_str())]);
+    let fields = json!({MARK: true, "__label": "Save", "message": message, "document": doc.0, "path": path, "flat": flat});
+    let id = app.ui.open_dialog(DialogKind::Command, fields.as_object().cloned().unwrap_or_default());
+    Some(Ok(json!({"dialog": id, "confirmationPending": true})))
+}
+
+pub fn body(ui: &mut egui::Ui, fields: &Map<String, Value>) {
+    ui.label(fields.get("message").and_then(Value::as_str).unwrap_or_default());
+    ui.add_space(6.0);
+    ui.label(tl!("Replace it with this document, or cancel and use File › Save As to keep both."));
+}
+
+/// Replace: the save the prompt held back.
+pub fn confirm(app: &mut PhotocraftApp, fields: &Map<String, Value>) -> Result<Value, String> {
+    let doc = fields.get("document").and_then(Value::as_u64).map(DocId).ok_or(tl!("The document is closed"))?;
+    let path = fields.get("path").and_then(Value::as_str).unwrap_or_default().to_string();
+    let flat = fields.get("flat").and_then(Value::as_bool) == Some(true);
+    app.with_document(doc, |app| {
+        if flat {
+            let r = app.save_to(path.clone(), None)?;
+            app.journal_as_plain_save(&path);
+            Ok(r)
+        } else {
+            app.save_in_place(path)
+        }
+    })
+}
diff --git a/crates/ui-egui/src/distort_ui.rs b/crates/ui-egui/src/distort_ui.rs
index 1f12b129f1..4987d8cc4d 100644
--- a/crates/ui-egui/src/distort_ui.rs
+++ b/crates/ui-egui/src/distort_ui.rs
@@ -22,6 +22,8 @@ use crate::canvas::{ToolEvent, ViewXform};
 #[derive(Default)]
 pub struct Distort {
     pub liquify: Option<crate::liquify_ui::LiquifyDialog>,
+    /// Edit › Content-Aware Fill… (caf_ui).
+    pub caf: Option<crate::caf_ui::CafWorkspace>,
     pub puppet: Option<crate::puppet_ui::PuppetSession>,
     pub perspective: Option<crate::perspective_ui::PerspSession>,
     pub vanishing: Option<crate::vp_ui::VpSession>,
@@ -33,13 +35,14 @@ pub struct Distort {
 
 impl Distort {
     pub fn active(&self) -> bool {
-        self.liquify.is_some() || self.puppet.is_some() || self.perspective.is_some() || self.vanishing.is_some()
+        self.liquify.is_some() || self.caf.is_some() || self.puppet.is_some() || self.perspective.is_some() || self.vanishing.is_some()
     }
 
     /// Short description for `ui.inspect`.
     pub fn describe(&self) -> Value {
         json!({
             "liquify": self.liquify.as_ref().map(|d| d.describe()),
+            "contentAwareFill": self.caf.as_ref().map(|d| d.describe()),
             "puppet": self.puppet.as_ref().map(|p| p.describe()),
             "perspective": self.perspective.as_ref().map(|p| p.describe()),
             "vanishingPoint": self.vanishing.as_ref().map(|v| v.describe()),
@@ -111,6 +114,9 @@ pub fn menu(app: &mut PhotocraftApp, ctx: &egui::Context, id: &str, params: &Val
         "filter.filterGallery" if ui.is_some() && app.distort.gallery.is_some() => Some(crate::gallery_ui::control(app, ui.unwrap_or(&Value::Null))),
         "filter.liquify" if empty => Some(crate::liquify_ui::open(app, ctx).map(|_| json!({"liquify": app.distort.describe()["liquify"]}))),
         "filter.liquify" if ui.is_some() && app.distort.liquify.is_some() => Some(crate::liquify_ui::control(app, ui.unwrap_or(&Value::Null))),
+        "edit.contentAwareFill" if ui.is_some() && app.distort.caf.is_some() => Some(crate::caf_ui::control(app, ui.unwrap_or(&Value::Null))),
+        // `ui` addresses the workspace: closed, that is an error, not a fill with the defaults.
+        "edit.contentAwareFill" if ui.is_some() => Some(Err("Content-Aware Fill is not open".into())),
         "edit.puppetWarp" | "layer.smartObjects.puppetWarp" if empty => {
             Some(crate::puppet_ui::begin(app, ctx, id).map(|_| json!({"puppet": app.distort.describe()["puppet"]})))
         }
@@ -131,6 +137,10 @@ pub fn menu(app: &mut PhotocraftApp, ctx: &egui::Context, id: &str, params: &Val
 
 /// Pointer events (document coordinates) while a mode is active. True when consumed.
 pub fn pointer(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers) -> bool {
+    if app.distort.caf.is_some() {
+        crate::caf_ui::pointer(app, ev, mods);
+        return true;
+    }
     if app.distort.liquify.is_some() {
         crate::liquify_ui::pointer(app, ev, mods);
         return true;
@@ -164,6 +174,14 @@ pub fn keys(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
         }
         return true;
     }
+    if app.distort.caf.is_some() {
+        if enter(ctx) {
+            crate::caf_ui::commit(app);
+        } else if esc(ctx) {
+            crate::caf_ui::cancel(app);
+        }
+        return true;
+    }
     if app.distort.liquify.is_some() {
         if enter(ctx) {
             crate::liquify_ui::commit(app);
@@ -248,6 +266,8 @@ pub fn drop_foreign(app: &mut PhotocraftApp) {
         app.distort.owner = current;
     } else if app.distort.owner != current {
         app.distort.liquify = None;
+        // Stops its background preview too; what Apply wrote stays, as with Cancel.
+        crate::caf_ui::cancel(app);
         app.distort.puppet = None;
         app.distort.perspective = None;
         app.distort.vanishing = None;
@@ -256,9 +276,12 @@ pub fn drop_foreign(app: &mut PhotocraftApp) {
     }
 }
 
-/// Full-window dialogs (Liquify, Filter Gallery).
+/// Full-window dialogs (Liquify, Content-Aware Fill, Filter Gallery).
 pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     drop_foreign(app);
+    if app.distort.caf.is_some() {
+        crate::caf_ui::show(app, ctx);
+    }
     if app.distort.gallery.is_some() {
         crate::gallery_ui::show(app, ctx);
     }
diff --git a/crates/ui-egui/src/export_dialog.rs b/crates/ui-egui/src/export_dialog.rs
index 9367045aff..275221e050 100644
--- a/crates/ui-egui/src/export_dialog.rs
+++ b/crates/ui-egui/src/export_dialog.rs
@@ -907,7 +907,10 @@ pub fn quick_export_png(app: &mut PhotocraftApp) -> Result<Value, String> {
         let fmt = serde_json::to_value(prefs.quick_export_format).ok().and_then(|v| v.as_str().map(str::to_string)).unwrap_or_else(|| "png".into());
         let same = serde_json::to_value(prefs.quick_export_location).ok().is_some_and(|v| v == "sameFolder");
         let saved = app.session.active().is_some_and(|d| d.path.is_some());
-        if same && saved {
+        // Same Folder writes beside the document's file without asking, except when that would
+        // replace the file itself (a document opened from photo.png): then the save dialog asks,
+        // so replacing it is the user's choice (#6599).
+        if same && saved && !photocraft_engine::web_cmds::quick_export_target_is_own_file(&app.session) {
             return quick_export(app, json!({}));
         }
         let st = app.session.active().ok_or("no document")?;
diff --git a/crates/ui-egui/src/file_dialog/tests.rs b/crates/ui-egui/src/file_dialog/tests.rs
index 2a325ea2ce..bb827274ff 100644
--- a/crates/ui-egui/src/file_dialog/tests.rs
+++ b/crates/ui-egui/src/file_dialog/tests.rs
@@ -687,6 +687,53 @@ fn smart_source(app: &PhotocraftApp, id: u64) -> photocraft_doc::SmartSource {
     }
 }
 
+#[test]
+fn place_embedded_uses_the_single_file_picker_and_accepts_contents() {
+    let (mut app, open, _) = app();
+    let ctx = egui::Context::default();
+    assert!(menus::is_enabled(&app, "file.placeEmbedded"));
+    let source = photocraft_io::export(&app.session.active().unwrap().doc, "source.png", &Default::default()).unwrap().bytes;
+    let layers_before = app.session.active().unwrap().doc.layers.len();
+
+    // Cancel leaves the document alone and does not report an error.
+    menus::invoke(&mut app, &ctx, "file.placeEmbedded", json!({})).unwrap();
+    app.poll_file_dialog(&ctx, None);
+    assert!(matches!(open.borrow().as_slice(), [(FileDialogRequest::Open { multiple: false, .. }, _)]));
+    answer(&open, None);
+    app.poll_file_dialog(&ctx, None);
+    assert_eq!(app.session.active().unwrap().doc.layers.len(), layers_before);
+    assert!(!app.ui.status_error, "{}", app.ui.status);
+
+    // The Web picker returns the selected file's name and bytes instead of a filesystem path.
+    menus::invoke(&mut app, &ctx, "file.placeEmbedded", json!({})).unwrap();
+    app.poll_file_dialog(&ctx, None);
+    answer(&open, Some(FileDialogAnswer::Contents("source.png".into(), source)));
+    app.poll_file_dialog(&ctx, None);
+    assert!(!app.ui.status_error, "{}", app.ui.status);
+    let st = app.session.active().unwrap();
+    assert_eq!(st.doc.layers.len(), layers_before + 1);
+    let layer = st.doc.layer(st.active_layer.unwrap()).unwrap();
+    assert_eq!(layer.name, "source");
+    assert_eq!(app.ui.transform.as_ref().and_then(|t| t.made), Some(crate::state::MadeLayer::Place));
+    assert!(matches!(
+        &layer.content,
+        photocraft_doc::LayerContent::Smart(sm)
+            if matches!(&sm.source, photocraft_doc::SmartSource::Embedded { file_name, .. } if file_name == "source.png")
+    ));
+
+    // Finish the successful placement before starting the next picker.
+    crate::transform_tool::commit(&mut app);
+    assert!(app.ui.transform.is_none());
+
+    // Invalid contents are reported without adding a layer.
+    menus::invoke(&mut app, &ctx, "file.placeEmbedded", json!({})).unwrap();
+    app.poll_file_dialog(&ctx, None);
+    answer(&open, Some(FileDialogAnswer::Contents("broken.png".into(), b"not an image".to_vec())));
+    app.poll_file_dialog(&ctx, None);
+    assert!(app.ui.status_error);
+    assert_eq!(app.session.active().unwrap().doc.layers.len(), layers_before + 1);
+}
+
 #[test]
 fn replace_contents_picks_a_file_for_every_instance() {
     let (mut app, open, _, ids) = smart_app();
@@ -791,6 +838,37 @@ fn quick_export_selected_layers_writes_separate_pngs_with_one_prompt() {
     assert!(!app.ui.status_error, "{}", app.ui.status);
 }
 
+/// #6599: Quick Export as PNG with Location = Same Folder asks before replacing the document's
+/// own file (a document opened from photo.png), and keeps writing beside a PSD without a prompt.
+#[test]
+fn same_folder_quick_export_asks_before_replacing_the_documents_own_file() {
+    let dir = std::env::temp_dir().join(format!("photocraft-quick-own-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let own = dir.join("photo.png").to_string_lossy().into_owned();
+    std::fs::write(&own, b"original").unwrap();
+    let (mut app, open, _) = app();
+    app.run("prefs.set", json!({"path": "export.quickExportLocation", "value": "sameFolder"})).unwrap();
+    app.session.active_mut().unwrap().path = Some(own.clone());
+    let ctx = egui::Context::default();
+    menus::invoke(&mut app, &ctx, "file.export.quickExportAsPng", Value::Null).unwrap();
+    app.poll_file_dialog(&ctx, None);
+    assert_eq!(open.borrow().len(), 1, "the save dialog asks");
+    assert_eq!(std::fs::read(&own).unwrap(), b"original", "nothing written before the answer");
+    answer(&open, Some(FileDialogAnswer::SaveTo(own.clone())));
+    app.poll_file_dialog(&ctx, None);
+    assert!(std::fs::read(&own).unwrap().starts_with(b"\x89PNG\r\n\x1a\n"), "replaced once confirmed: {}", app.ui.status);
+
+    // Beside a PSD, Same Folder still writes without a prompt.
+    app.session.active_mut().unwrap().path = Some(dir.join("photo.psd").to_string_lossy().into_owned());
+    std::fs::write(&own, b"earlier export").unwrap();
+    menus::invoke(&mut app, &ctx, "file.export.quickExportAsPng", Value::Null).unwrap();
+    app.poll_file_dialog(&ctx, None);
+    assert!(open.borrow().is_empty(), "no dialog");
+    assert!(std::fs::read(&own).unwrap().starts_with(b"\x89PNG\r\n\x1a\n"));
+    std::fs::remove_dir_all(&dir).ok();
+}
+
 #[test]
 fn cancelling_multi_layer_quick_export_writes_nothing() {
     let (mut app, open, written) = app();
@@ -963,3 +1041,90 @@ fn render_video_menu_asks_for_directory_and_writes_frames_only_after_confirmatio
     assert!(!app.file_dialog_open());
     std::fs::remove_dir_all(&dir).unwrap();
 }
+
+/// How many times each path was written, standing in for its size and modification time.
+type Disk = Rc<RefCell<std::collections::HashMap<String, u64>>>;
+
+/// Gives `app` file stamps from a fake disk that its own writes update too.
+fn on_disk(app: &mut PhotocraftApp) -> Disk {
+    let disk = Disk::default();
+    let (read, wrote) = (disk.clone(), disk.clone());
+    app.services.file_stamp = Some(Box::new(move |path| read.borrow().get(path).map(|&n| crate::FileStamp { len: n, modified: None })));
+    let mut write = app.services.write.take().unwrap();
+    app.services.write = Some(Box::new(move |path, bytes| {
+        write(path, bytes)?;
+        *wrote.borrow_mut().entry(path.to_string()).or_default() += 1;
+        Ok(())
+    }));
+    disk
+}
+
+fn changed_by_another_app(disk: &Disk, path: &str) {
+    *disk.borrow_mut().entry(path.to_string()).or_default() += 1;
+}
+
+fn disk_prompt(app: &PhotocraftApp) -> Option<&crate::state::Dialog> {
+    app.ui.dialogs.iter().find(|d| crate::disk_change_prompt::owns(&d.fields))
+}
+
+#[test]
+fn save_asks_before_replacing_a_file_another_app_changed() {
+    let ctx = egui::Context::default();
+    let (mut app, _open, written) = app();
+    let disk = on_disk(&mut app);
+    changed_by_another_app(&disk, "/pics/a.psd");
+    app.opened_from("/pics/a.psd");
+    app.run("layer.new.layer", json!({})).unwrap();
+    // Unchanged on disk: Save writes at once.
+    menus::invoke(&mut app, &ctx, "file.save", json!({})).unwrap();
+    assert_eq!(*written.borrow(), ["/pics/a.psd"]);
+    assert!(disk_prompt(&app).is_none());
+
+    // Our own save isn't a change; another app's write after it is.
+    changed_by_another_app(&disk, "/pics/a.psd");
+    app.run("layer.new.layer", json!({})).unwrap();
+    let r = menus::invoke(&mut app, &ctx, "file.save", json!({})).unwrap();
+    assert_eq!(r["confirmationPending"], true);
+    assert_eq!(written.borrow().len(), 1, "nothing is written before the answer");
+    let prompt = disk_prompt(&app).expect("Save asks first");
+    assert!(prompt.fields["message"].as_str().unwrap().contains("a.psd"));
+
+    // Cancel leaves the file and the unsaved document alone.
+    let id = prompt.id;
+    app.ui.close_dialog(id);
+    assert_eq!(written.borrow().len(), 1);
+    assert!(app.session.active().unwrap().is_dirty());
+
+    // Replace writes it, and the next Save doesn't ask again.
+    let id = menus::invoke(&mut app, &ctx, "file.save", json!({})).unwrap()["dialog"].as_u64().unwrap();
+    crate::dialogs::confirm(&mut app, id).unwrap();
+    assert_eq!(written.borrow().len(), 2);
+    assert!(!app.session.active().unwrap().is_dirty());
+    app.run("layer.new.layer", json!({})).unwrap();
+    menus::invoke(&mut app, &ctx, "file.save", json!({})).unwrap();
+    assert_eq!(written.borrow().len(), 3);
+    assert!(disk_prompt(&app).is_none());
+}
+
+#[test]
+fn save_of_a_flat_file_asks_after_the_dialog_when_another_app_changed_it() {
+    let ctx = egui::Context::default();
+    // Lowercase: the Save dialog lowercases a typed extension by default.
+    let path = "/pics/My image.jpg";
+    let (mut app, open, written) = jpeg_app(None, false);
+    let disk = on_disk(&mut app);
+    changed_by_another_app(&disk, path);
+    app.opened_from(path);
+    app.run("image.adjustments.invert", json!({})).unwrap();
+    changed_by_another_app(&disk, path);
+    menus::invoke(&mut app, &ctx, "file.save", json!({})).unwrap();
+    app.poll_file_dialog(&ctx, None);
+    answer(&open, Some(FileDialogAnswer::SaveTo(path.into())));
+    app.poll_file_dialog(&ctx, None);
+    assert!(written.borrow().is_empty(), "the changed file is not replaced before the answer");
+    let id = disk_prompt(&app).expect("Save asks first").id;
+    crate::dialogs::confirm(&mut app, id).unwrap();
+    assert_eq!(*written.borrow(), [path]);
+    assert!(!app.session.active().unwrap().is_dirty());
+    assert_eq!(app.session.journal.last().map(|s| s.0.as_str()), Some("file.save"), "still recorded as a plain Save");
+}
diff --git a/crates/ui-egui/src/file_open.rs b/crates/ui-egui/src/file_open.rs
index d67e56dbf0..1cf61e98d3 100644
--- a/crates/ui-egui/src/file_open.rs
+++ b/crates/ui-egui/src/file_open.rs
@@ -33,6 +33,15 @@ pub enum DropTarget {
     Elsewhere,
 }
 
+/// A file dropped on the canvas, waiting its turn to be placed.
+pub(crate) enum DropPlace {
+    /// Dropped onto the window (desktop): read from its path, or through egui.
+    File(egui::DroppedFileHandle),
+    /// Read by the shell itself (the browser reads dropped files asynchronously): its name and
+    /// contents, delivered through [`Services::place_inbox`](crate::Services::place_inbox).
+    Bytes(String, Vec<u8>),
+}
+
 /// `warnings` from an import, plus one for each font family the active document's type uses that
 /// isn't installed (#4559): Photoshop warns about missing fonts as a file opens, and the CLI and
 /// automation already report them; the type would otherwise silently render in a fallback face.
@@ -89,6 +98,8 @@ impl PhotocraftApp {
             && !st.source_read_only
         {
             st.path = Some(path.to_string());
+            let doc = st.doc.id;
+            self.remember_stamp(doc, path);
         }
         self.push_recent(path);
     }
@@ -105,6 +116,9 @@ impl PhotocraftApp {
     /// Read and open the file at `path` (see [`open_file`](Self::open_file)).
     #[cfg(not(target_arch = "wasm32"))]
     pub fn open_path(&mut self, path: &str) -> Result<Vec<String>, String> {
+        if self.show_if_open(path) {
+            return Ok(Vec::new());
+        }
         // Documents opening in the background are read on the worker too (a 2 GB PSB read
         // would block the window). Preset files (brushes, gradients) go the usual way.
         let ext = std::path::Path::new(path).extension().map(|e| e.to_string_lossy().to_ascii_lowercase()).unwrap_or_default();
@@ -131,6 +145,10 @@ impl PhotocraftApp {
         let batch = crate::jobs_ui::begin_batch(self);
         let mut opened = 0;
         for (seq, abs) in paths.iter().enumerate() {
+            // Not a member of the set: its tab is already in place.
+            if self.show_if_open(abs) {
+                continue;
+            }
             let order = crate::jobs_ui::OpenOrder { batch, seq };
             let pending = self.jobs.opens.len();
             match self.open_path(abs) {
@@ -150,6 +168,26 @@ impl PhotocraftApp {
         opened
     }
 
+    /// Show the document already open from the file at `path`, or its tab while it is still
+    /// opening in the background, as Photoshop does, rather than open a second copy bound to the
+    /// same file (#6598). True when there was one.
+    pub(crate) fn show_if_open(&mut self, path: &str) -> bool {
+        let canon = canonical(path);
+        let same = |p: &str| same_file(p, path, canon.as_deref());
+        if let Some(i) = self.session.documents().iter().position(|d| d.path.as_deref().is_some_and(same)) {
+            self.session.set_active(i);
+            self.jobs.focus = None;
+        } else if let Some(o) = self.jobs.opens.iter().find(|o| o.path.as_deref().is_some_and(|p| !is_template(p) && same(p))) {
+            // A template still loading opens as another Untitled, as it does once loaded.
+            self.jobs.focus = Some(o.job);
+        } else {
+            return false;
+        }
+        // The document count didn't change, so the Home screen wouldn't give way by itself.
+        self.ui.chrome.home = None;
+        true
+    }
+
     /// Show "Couldn't open <name>: <error>" as an error (status bar + notice).
     pub fn open_failed(&mut self, name: &str, err: &str) {
         self.failed({
@@ -182,7 +220,7 @@ impl PhotocraftApp {
         for f in files {
             let name = dropped_name(&f);
             if target == DropTarget::Canvas && !crate::preset_files_ui::is_preset_file(&name) {
-                self.drop_places.push_back(f);
+                self.drop_places.push_back(DropPlace::File(f));
                 continue;
             }
             match self.open_dropped_file(&f, &name, slot) {
@@ -193,6 +231,24 @@ impl PhotocraftApp {
         }
     }
 
+    /// Which of the files called `names`, dropped onto the window just now, are placed on the
+    /// active document's canvas rather than opened, for a shell that reads dropped files itself
+    /// (the browser reads them asynchronously, so the web shell can't hand them to
+    /// [`open_dropped`](Self::open_dropped)). It delivers those through
+    /// [`Services::place_inbox`](crate::Services::place_inbox) and the rest through
+    /// [`Services::inbox`](crate::Services::inbox). The pointer comes from
+    /// [`Services::cursor_pos`](crate::Services::cursor_pos). As with a desktop canvas drop, a Free
+    /// Transform still open is applied first (#4833).
+    pub fn dropped_on_canvas(&mut self, ctx: &egui::Context, names: &[String]) -> Vec<bool> {
+        let at = self.services.cursor_pos.as_mut().and_then(|f| f(ctx));
+        let canvas = self.drop_target(ctx, at) == DropTarget::Canvas;
+        let places: Vec<bool> = names.iter().map(|n| canvas && !crate::preset_files_ui::is_preset_file(n)).collect();
+        if places.contains(&true) && self.ui.transform.is_some() {
+            crate::transform_tool::commit(self);
+        }
+        places
+    }
+
     /// Where a drop at `at` lands. Over a window or dialog it's neither the canvas nor the tabs.
     pub(crate) fn drop_target(&self, ctx: &egui::Context, at: Option<egui::Pos2>) -> DropTarget {
         let Some(p) = at.filter(|p| ctx.layer_id_at(*p).is_none_or(|l| l.order == egui::Order::Background)) else {
@@ -230,11 +286,20 @@ impl PhotocraftApp {
     /// transform is in progress (so several files are placed and transformed one after another).
     pub(crate) fn place_next_dropped(&mut self, ctx: &egui::Context) {
         while self.ui.transform.is_none() {
-            let Some(f) = self.drop_places.pop_front() else { return };
-            let placed = if f.path().is_absolute() {
-                self.run("file.placeEmbedded", serde_json::json!({"path": f.path().to_string_lossy()}))
-            } else {
-                crate::read_dropped(&*f).and_then(|bytes| self.place_bytes(&dropped_name(&f), bytes, None))
+            let Some(next) = self.drop_places.pop_front() else { return };
+            let (name, placed) = match next {
+                DropPlace::File(f) if f.path().is_absolute() => {
+                    (dropped_name(&f), self.run("file.placeEmbedded", serde_json::json!({"path": f.path().to_string_lossy()})))
+                }
+                DropPlace::File(f) => {
+                    let name = dropped_name(&f);
+                    let placed = crate::read_dropped(&*f).and_then(|bytes| self.place_bytes(&name, bytes, None));
+                    (name, placed)
+                }
+                DropPlace::Bytes(name, bytes) => {
+                    let placed = self.place_bytes(&name, bytes, None);
+                    (name, placed)
+                }
             };
             match placed {
                 Ok(_) => {
@@ -242,7 +307,7 @@ impl PhotocraftApp {
                         self.ui.status = e;
                     }
                 }
-                Err(e) => self.failed(crate::i18n::fmt(tl!("Couldn't place {name}: {error}"), &[("name", &dropped_name(&f)), ("error", &e)])),
+                Err(e) => self.failed(crate::i18n::fmt(tl!("Couldn't place {name}: {error}"), &[("name", &name), ("error", &e)])),
             }
         }
     }
@@ -262,8 +327,21 @@ impl PhotocraftApp {
             match e {
                 OsEvent::Open(paths) => {
                     self.open_paths(&paths);
-                    // Bring the window forward when another app (Finder, the Dock) asked us to open.
-                    ctx.send_viewport_cmd(egui::ViewportCommand::Focus);
+                    // Bring the window forward when another app (Finder, the Dock, Explorer via a
+                    // second launch) asked us to open; restore it first if it was minimized.
+                    if ctx.input(|i| i.viewport().minimized) == Some(true) {
+                        ctx.send_viewport_cmd(egui::ViewportCommand::Minimized(false));
+                    }
+                    // Native Wayland lets a window come forward only with the launcher's activation
+                    // token, which winit can't apply to an existing window (its focus is a no-op
+                    // there): mark the window as wanting attention instead, so the taskbar
+                    // highlights it rather than the file opening out of sight.
+                    let raise = if self.services.is_wayland {
+                        egui::ViewportCommand::RequestUserAttention(egui::UserAttentionType::Informational)
+                    } else {
+                        egui::ViewportCommand::Focus
+                    };
+                    ctx.send_viewport_cmd(raise);
                     ctx.request_repaint();
                 }
                 OsEvent::Quit => ctx.send_viewport_cmd(egui::ViewportCommand::Close),
@@ -323,5 +401,25 @@ fn absolute(p: &str) -> String {
     p.to_string()
 }
 
+/// `path` with symlinks, `.` and `..` and (on case-insensitive volumes) letter case resolved;
+/// `None` when it can't be (a missing file).
+#[cfg(not(target_arch = "wasm32"))]
+fn canonical(path: &str) -> Option<std::path::PathBuf> {
+    std::fs::canonicalize(path).ok()
+}
+
+#[cfg(target_arch = "wasm32")]
+fn canonical(_path: &str) -> Option<std::path::PathBuf> {
+    None
+}
+
+/// Whether an open document's path `p` names the file at `path` (`canon`: its [`canonical`]
+/// form). The cheap comparisons come first: `p` is resolved on disk only when they fail, so an
+/// open of a file that isn't open costs one resolution per document. A file moved or deleted
+/// since it was opened only matches its old path as written.
+fn same_file(p: &str, path: &str, canon: Option<&std::path::Path>) -> bool {
+    p == path || canon.is_some_and(|c| std::path::Path::new(p) == c || canonical(p).is_some_and(|q| q == c))
+}
+
 #[cfg(test)]
 mod tests;
diff --git a/crates/ui-egui/src/file_open/tests.rs b/crates/ui-egui/src/file_open/tests.rs
index b1eb1e7b72..00db3ef96e 100644
--- a/crates/ui-egui/src/file_open/tests.rs
+++ b/crates/ui-egui/src/file_open/tests.rs
@@ -173,6 +173,35 @@ fn the_web_opens_every_selected_file() {
     assert!(app.ui.notices.iter().any(|n| n.error && n.title.contains("broken.png")), "{:?}", app.ui.notices);
 }
 
+/// #5749: the web shell reads dropped files itself, so it asks where they landed: image files
+/// dropped on the canvas are placed from their bytes, presets and drops elsewhere are opened.
+#[test]
+fn web_drops_onto_the_canvas_are_placed_from_their_bytes() {
+    let ctx = egui::Context::default();
+    let mut app = app_with_canvas();
+    let names = vec!["photo.png".to_string(), "brushes.abr".to_string()];
+    // No pointer known: nothing is placed.
+    assert_eq!(app.dropped_on_canvas(&ctx, &names), [false, false]);
+    let at = Rc::new(std::cell::Cell::new(egui::pos2(400.0, 300.0)));
+    let reported = at.clone();
+    app.services.cursor_pos = Some(Box::new(move |_: &egui::Context| Some(reported.get())));
+    assert_eq!(app.dropped_on_canvas(&ctx, &names), [true, false]);
+    at.set(egui::pos2(20.0, 20.0));
+    assert_eq!(app.dropped_on_canvas(&ctx, &names), [false, false], "off the canvas: opened");
+    let layers = layer_count(&app);
+    app.drop_places.push_back(crate::file_open::DropPlace::Bytes("photo.png".into(), png_bytes(4, 3)));
+    app.drop_places.push_back(crate::file_open::DropPlace::Bytes("bad.png".into(), b"bad".to_vec()));
+    app.place_next_dropped(&ctx);
+    assert_eq!(layer_count(&app), layers + 1);
+    assert_eq!(app.ui.transform.as_ref().and_then(|t| t.made), Some(crate::state::MadeLayer::Place));
+    crate::transform_tool::commit(&mut app);
+    // The undecodable one is reported, not placed.
+    app.place_next_dropped(&ctx);
+    assert_eq!(layer_count(&app), layers + 1);
+    assert!(app.ui.notices.iter().any(|n| n.error && n.title.contains("bad.png")), "{:?}", app.ui.notices);
+    assert!(app.drop_places.is_empty());
+}
+
 #[test]
 fn pcraft_documents_save_in_place_but_flat_files_ask() {
     let (mut app, written) = app_with(vec![None]);
@@ -317,6 +346,28 @@ fn os_open_events_open_files_with_paths() {
     let _ = std::fs::remove_dir_all(&dir);
 }
 
+/// The viewport commands an `Open` event sends: focus, or an attention request on native Wayland
+/// where winit can't focus (#3708).
+fn raise_commands(is_wayland: bool) -> Vec<egui::ViewportCommand> {
+    let (mut app, _) = app_with(Vec::new());
+    app.services.is_wayland = is_wayland;
+    let mut queue = vec![OsEvent::Open(Vec::new())];
+    app.services.os_events = Some(Box::new(move || std::mem::take(&mut queue)));
+    let mut out = egui::Context::default().run_ui(egui::RawInput::default(), |ui| app.drain_os_events(ui.ctx()));
+    out.textures_delta.clear();
+    out.viewport_output.get(&egui::ViewportId::ROOT).map(|v| v.commands.clone()).unwrap_or_default()
+}
+
+#[test]
+fn an_os_open_brings_the_window_forward_or_asks_for_attention_on_wayland() {
+    use egui::{UserAttentionType, ViewportCommand};
+    let attention = ViewportCommand::RequestUserAttention(UserAttentionType::Informational);
+    let x11 = raise_commands(false);
+    assert!(x11.contains(&ViewportCommand::Focus) && !x11.contains(&attention), "{x11:?}");
+    let wayland = raise_commands(true);
+    assert!(wayland.contains(&attention) && !wayland.contains(&ViewportCommand::Focus), "{wayland:?}");
+}
+
 #[test]
 fn os_quit_and_empty_events_do_not_panic() {
     let (mut app, _) = app_with(Vec::new());
@@ -906,3 +957,61 @@ fn opening_type_in_a_missing_font_warns() {
     // The importer's own warning for the same font isn't doubled.
     assert_eq!(app.open_bytes("warned.psd", b"x").unwrap(), vec![warning]);
 }
+
+/// #6598: opening a file that is already open shows its document, as Photoshop does, rather than
+/// a second copy bound to the same file (saving one would overwrite the other). The path is
+/// compared as the file it names: another spelling of it, a symlink to it or, with background
+/// opens, a file still opening finds the same tab.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn opening_an_open_file_again_shows_its_tab() {
+    let (dir, paths) = files("already-open", &["a.psd", "b.psd"], b"x");
+    let (a, b) = (&paths[0], &paths[1]);
+    let (mut app, _) = app_with(Vec::new());
+    app.open_path(a).unwrap();
+    app.open_path(b).unwrap();
+    app.run("layer.new.layer", json!({})).unwrap();
+    app.ui.chrome.home = Some(2);
+    // Open Recent, File › Open, a drop: all go through `open_path`.
+    #[allow(unused_mut)]
+    let mut spellings = vec![a.clone(), dir.join(".").join("a.psd").to_string_lossy().into_owned()];
+    #[cfg(unix)]
+    {
+        let link = dir.join("link.psd");
+        std::os::unix::fs::symlink(a, &link).unwrap();
+        spellings.push(link.to_string_lossy().into_owned());
+    }
+    for again in spellings {
+        app.session.set_active(1);
+        app.ui.chrome.home = Some(2);
+        app.open_path(&again).unwrap();
+        assert_eq!(doc_names(&app), ["a.psd", "b.psd"], "{again}");
+        assert_eq!(app.session.active_index(), Some(0), "{again}");
+        assert_eq!(app.ui.chrome.home, None, "the Home screen gives way to the document");
+    }
+    assert!(app.session.documents()[1].is_dirty(), "b keeps its unsaved changes");
+    // A set holding an open file opens only the others.
+    let (dir2, more) = files("already-open-set", &["c.psd"], b"x");
+    assert_eq!(app.open_paths(&[b.clone(), more[0].clone()]), 1);
+    assert_eq!(doc_names(&app), ["a.psd", "b.psd", "c.psd"]);
+    // In the background: an open document, then a file still opening, show their tabs.
+    app.background_jobs = true;
+    app.open_path(a).unwrap();
+    assert!(app.jobs.opens.is_empty());
+    assert_eq!(app.session.active_index(), Some(0));
+    let (dir3, late) = files("already-open-bg", &["d.psd"], b"x");
+    app.open_path(&late[0]).unwrap();
+    let job = app.jobs.opens[0].job;
+    app.jobs.focus = None;
+    app.open_path(&late[0]).unwrap();
+    assert_eq!(app.jobs.opens.len(), 1, "one tab for the file still opening");
+    assert_eq!(app.jobs.focus, Some(job));
+    // A template still loading opens again as another Untitled, as it does once loaded.
+    let (dir4, template) = files("already-open-template", &["e.psdt"], b"x");
+    app.open_path(&template[0]).unwrap();
+    app.open_path(&template[0]).unwrap();
+    assert_eq!(app.jobs.opens.len(), 3, "two Untitleds from the template");
+    for d in [dir, dir2, dir3, dir4] {
+        let _ = std::fs::remove_dir_all(&d);
+    }
+}
diff --git a/crates/ui-egui/src/filter_dialog.rs b/crates/ui-egui/src/filter_dialog.rs
index fa7cb9524d..8cf7f3519a 100644
--- a/crates/ui-egui/src/filter_dialog.rs
+++ b/crates/ui-egui/src/filter_dialog.rs
@@ -7,6 +7,7 @@
 use std::sync::Arc;
 
 use photocraft_doc::Document;
+use photocraft_engine::color_cmds::ColorSettings;
 use serde_json::{Map, Value, json};
 
 use crate::PhotocraftApp;
@@ -279,6 +280,9 @@ pub const PREVIEWED: &[&str] = &[
     "layer.matting.colorDecontaminate",
     "layer.layerStyle.scaleEffects",
     "type.warpText",
+    // The preview shows the image through the chosen profile, as Photoshop's Preview does.
+    "edit.assignProfile",
+    "edit.convertToProfile",
 ];
 
 pub fn has_dialog(command: &str) -> bool {
@@ -293,8 +297,6 @@ pub fn has_dialog(command: &str) -> bool {
             command,
             "image.trim"
                 | "select.refineEdge"
-                | "edit.assignProfile"
-                | "edit.convertToProfile"
                 | "view.proofSetup"
                 | "layer.layerStyle.globalLight"
                 | "image.mode.colorTable"
@@ -556,6 +558,10 @@ pub(crate) fn source_label(key: &str) -> String {
     if key == "localized" {
         return "Localized Color Clusters".into();
     }
+    // Convert to Profile's, Proof Setup's…: spelled out, as in Photoshop (not "Bpc").
+    if key == "bpc" {
+        return "Black Point Compensation".into();
+    }
     // A name that already reads as text ("iPhone 14 Pro Max", "Web 1920") is not camelCase.
     if key.contains(' ') {
         return key.to_string();
@@ -875,12 +881,23 @@ pub fn preview_document_with(
     k: u32,
     cancel: Option<&photocraft_engine::jobs::JobCtx>,
 ) -> Option<Document> {
-    preview_document_for_target(doc, active, command, params, k, cancel, photocraft_engine::channel_cmds::ChannelTarget::Composite, &[])
+    preview_document_for_target(
+        doc,
+        active,
+        command,
+        params,
+        k,
+        cancel,
+        photocraft_engine::channel_cmds::ChannelTarget::Composite,
+        &[],
+        &ColorSettings::default(),
+    )
 }
 
 /// Run the preview with the same pixel target as the final command, including individual channels.
 /// `documents` are the open documents in session order: document params (Match Color's Source,
-/// Displace's map) index into them.
+/// Displace's map) index into them. `color` is the app's Edit › Color Settings: Assign and Convert
+/// to Profile's `working` is the working space chosen there, not the built-in default.
 #[allow(clippy::too_many_arguments)]
 pub(crate) fn preview_document_for_target(
     doc: &Document,
@@ -891,6 +908,7 @@ pub(crate) fn preview_document_for_target(
     cancel: Option<&photocraft_engine::jobs::JobCtx>,
     target: photocraft_engine::channel_cmds::ChannelTarget,
     documents: &[Arc<Document>],
+    color: &ColorSettings,
 ) -> Option<Document> {
     if command == crate::select_mask_view::COMMAND {
         return crate::select_mask_view::preview_document(doc, active, params, k, cancel);
@@ -900,6 +918,7 @@ pub(crate) fn preview_document_for_target(
     let (run_k, reduce_k) = if command == "type.warpText" { (1, k) } else { (k, 1) };
     let proxy = crate::proxy::proxy_document(doc, run_k);
     let mut s = photocraft_engine::Session::new();
+    s.color.settings = color.clone();
     s.set_inline_job_ctx(cancel.cloned());
     let doc_id = proxy.id;
     s.add_document(proxy, None);
@@ -1050,6 +1069,16 @@ mod tests {
         assert_eq!(source_label("centerX"), "Center X");
     }
 
+    /// Convert to Profile's and Proof Setup's `bpc` read "Bpc": spelled out, and translated.
+    #[test]
+    fn black_point_compensation_is_spelled_out() {
+        assert_eq!(source_label("bpc"), "Black Point Compensation");
+        // English is the source: it has no catalog.
+        for lang in crate::i18n::Lang::all().filter(|l| l.code() != "en") {
+            assert!(crate::i18n::has(lang, "Black Point Compensation"), "{lang:?}");
+        }
+    }
+
     fn key() -> FilterPreviewKey {
         FilterPreviewKey {
             doc: photocraft_doc::DocId(7),
@@ -1569,6 +1598,7 @@ mod tests {
                 None,
                 photocraft_engine::channel_cmds::ChannelTarget::Composite,
                 &documents,
+                &ColorSettings::default(),
             )
             .unwrap_or_else(|| panic!("{label}: no preview"));
             let got = preview.layers[0].surface().unwrap().pixel(24, 16);
@@ -1584,6 +1614,7 @@ mod tests {
             None,
             photocraft_engine::channel_cmds::ChannelTarget::Composite,
             &documents,
+            &ColorSettings::default(),
         )
         .unwrap();
         let px = preview.layers[0].surface().unwrap().pixel(12, 8);
diff --git a/crates/ui-egui/src/filter_preview_ui.rs b/crates/ui-egui/src/filter_preview_ui.rs
index 90eaf4f6fe..e4afdb7566 100644
--- a/crates/ui-egui/src/filter_preview_ui.rs
+++ b/crates/ui-egui/src/filter_preview_ui.rs
@@ -46,9 +46,14 @@ pub(crate) fn window(app: &PhotocraftApp, dialog: u64, ui: &mut egui::Ui, f: &mu
         (preview_on && p.key.dialog == dialog && p.key.doc == doc_id && p.key.command == cmd).then(|| p.result.clone().map(|r| (p.key.clone(), r))).flatten()
     });
     // The proxy factor the preview runs at (the filtered key's when it exists, else the request's).
+    // The fallback must be the factor the canvas will ask for, not the document's own: since #6326
+    // the canvas caps it with the view's zoom, and a window that sized its textures from the
+    // uncapped factor built a proxy the canvas never asked for, then rebuilt it (a full-size copy
+    // and upload on the UI thread at 100 %) the moment the first result arrived, shifting this
+    // window's 100 % mapping and pan clamp for a frame.
     let base_k = filtered.as_ref().map(|(k, _)| k.k).unwrap_or_else(|| {
         let params = app.with_mask_target(&cmd, crate::filter_dialog::params_of(f));
-        crate::filter_dialog::preview_factor(&cmd, &params, crate::proxy::preview_factor(&st.doc, crate::proxy::reduced_previews(app)))
+        crate::canvas::filter_preview_factor(app, &st.doc, &cmd, &params)
     });
 
     let t = Tokens::get(ui.ctx());
@@ -237,7 +242,7 @@ fn upload(ctx: &egui::Context, app: &PhotocraftApp, name: &str, doc: &Document)
 }
 
 /// The reduction that fits a `w`×`h` image inside a `max_side` texture (1: it already fits).
-fn texture_factor(w: u32, h: u32, max_side: usize) -> u32 {
+pub(crate) fn texture_factor(w: u32, h: u32, max_side: usize) -> u32 {
     let max_side = u32::try_from(max_side).unwrap_or(u32::MAX).max(1);
     w.max(h).div_ceil(max_side).max(1)
 }
@@ -324,6 +329,7 @@ mod tests {
                     None,
                     ChannelTarget::Alpha(0),
                     &[],
+                    &Default::default(),
                 )
                 .unwrap();
                 let ctx = egui::Context::default();
diff --git a/crates/ui-egui/src/gpu_canvas.rs b/crates/ui-egui/src/gpu_canvas.rs
index 2e583e8e5b..1770979db1 100644
--- a/crates/ui-egui/src/gpu_canvas.rs
+++ b/crates/ui-egui/src/gpu_canvas.rs
@@ -27,6 +27,7 @@
 
 use std::collections::HashMap;
 use std::num::NonZeroU64;
+use std::sync::atomic::Ordering;
 
 use eframe::egui_wgpu::{self, CallbackResources, CallbackTrait, RenderState, ScreenDescriptor};
 use eframe::wgpu;
@@ -110,6 +111,11 @@ pub struct GpuCanvas {
     tile: u32,
     high: HighPolicy,
     health: photocraft_gpu::DeviceHealth,
+    /// [`video_memory`] of the adapter, detected once.
+    vram: Option<u64>,
+    /// [`canvas_budget`], shared with the paint callback's resources: [`GpuCanvas::format_for`]
+    /// reads it while the renderer is locked.
+    canvas_budget: std::sync::Arc<std::sync::atomic::AtomicU64>,
 }
 
 /// Whether `regenerate_mips` builds each level in a scratch texture and copies it back: on
@@ -158,9 +164,16 @@ impl GpuCanvas {
         res.health = health.clone();
         let info = rs.adapter.get_info();
         res.separate_mip_targets = separate_mip_targets(info.backend, info.vendor, std::env::var("PHOTOCRAFT_SEPARATE_MIPS").ok().as_deref());
+        let vram = video_memory(&info);
+        res.canvas_budget.store(canvas_budget(physical_memory(), vram), Ordering::Relaxed);
+        let budget = res.canvas_budget.clone();
         rs.renderer.write().callback_resources.insert(res);
-        log::info!("gpu canvas: target {:?}, max texture {max}, tile {tile}, 16F canvas {high:?}", rs.target_format);
-        Self { rs: rs.clone(), tile, high, health }
+        log::info!(
+            "gpu canvas: target {:?}, max texture {max}, tile {tile}, 16F canvas {high:?}, video memory {}",
+            rs.target_format,
+            vram.map_or_else(|| "unknown".to_owned(), |b| format!("{} MB", b >> 20))
+        );
+        Self { rs: rs.clone(), tile, high, health, vram, canvas_budget: budget }
     }
 
     /// The device's health flag (shared with the wgpu compositor and the paint callback).
@@ -192,6 +205,12 @@ impl GpuCanvas {
         self.rs.adapter.get_info()
     }
 
+    /// The adapter's own memory where it has one and the platform reports it (see
+    /// [`video_memory`]); it caps [`memory_budget`] and [`canvas_budget`].
+    pub fn video_memory(&self) -> Option<u64> {
+        self.vram
+    }
+
     /// The canvas texture format for a document of `depth` and `size`: `Rgba16Float` for 16/32-bit
     /// documents when the adapter supports it and the document fits [`F16_BUDGET_PX`], else
     /// `Rgba8Unorm`.
@@ -204,7 +223,11 @@ impl GpuCanvas {
         let px = size[0] as u64 * size[1] as u64;
         let high = match self.high {
             HighPolicy::Off => false,
-            HighPolicy::Budget => px <= F16_BUDGET_PX,
+            // Within the canvas budget too: a 16-bit canvas a small card can't hold as floats
+            // stays on the GPU as `Rgba8Unorm` rather than falling back to the CPU canvas.
+            HighPolicy::Budget => {
+                px <= F16_BUDGET_PX && canvas_texture_bytes(size, self.tile, texel_bytes(FORMAT_HIGH)) <= self.canvas_budget.load(Ordering::Relaxed)
+            }
             HighPolicy::Always => true,
         };
         if high && depth != photocraft_doc::SampleType::U8 { FORMAT_HIGH } else { FORMAT }
@@ -240,10 +263,7 @@ impl GpuCanvas {
 
     /// Set the GPU bytes one document's display texture set may take (see [`canvas_budget`]).
     pub fn set_canvas_budget(&self, bytes: u64) {
-        let mut r = self.rs.renderer.write();
-        if let Some(res) = r.callback_resources.get_mut::<Resources>() {
-            res.canvas_budget = bytes;
-        }
+        self.canvas_budget.store(bytes, Ordering::Relaxed);
     }
 
     /// Whether `doc`'s display textures fit [`canvas_budget`]; when they don't, nothing is
@@ -252,7 +272,7 @@ impl GpuCanvas {
         let size = [doc.size.width, doc.size.height];
         let bytes = canvas_texture_bytes(size, self.tile, texel_bytes(self.format_for(doc.depth, size)));
         let r = self.rs.renderer.read();
-        r.callback_resources.get::<Resources>().is_some_and(|res| bytes <= res.canvas_budget)
+        r.callback_resources.get::<Resources>().is_some_and(|res| bytes <= res.canvas_budget.load(Ordering::Relaxed))
     }
 
     /// Cap lower-stack composite reuse; zero disables it for profiling the uncached path.
@@ -283,6 +303,28 @@ impl GpuCanvas {
         Some((c.resident_bytes(), c.fx_cache_bytes().saturating_add(usize::try_from(c.composite_cache_bytes()).unwrap_or(usize::MAX))))
     }
 
+    /// Whether `doc`'s layers fit the budget as it now stands, measured without a refresh (a GPU
+    /// Memory change shows in the status bar at once). `None` before the compositor exists.
+    pub fn measure_fit(&self, doc: &photocraft_doc::Document) -> Option<LayerFit> {
+        let mut r = self.rs.renderer.write();
+        let res = r.callback_resources.get_mut::<Resources>()?;
+        let budget = res.compositor_budget;
+        let comp = res.compositor.as_mut()?;
+        if let Some(b) = budget {
+            comp.set_memory_budget(b);
+        }
+        let fit = LayerFit { doc: doc.id.0, needed: comp.working_set(doc, doc.bounds()), budget: comp.resident_budget() };
+        res.layer_fit = Some(fit);
+        Some(fit)
+    }
+
+    /// Whether the layers of the last full (or large) refresh fit the GPU memory budget, and by
+    /// how much (`None` before the first one).
+    pub fn layer_fit(&self) -> Option<LayerFit> {
+        let r = self.rs.renderer.read();
+        r.callback_resources.get::<Resources>()?.layer_fit
+    }
+
     /// Set the checkerboard and gamut warning colours.
     pub fn set_style(&self, style: CanvasStyle) {
         let mut r = self.rs.renderer.write();
@@ -451,9 +493,13 @@ impl GpuCanvas {
         // compositor does it (in the background on desktop). So does a large damage rect, such
         // as hiding a big layer (#4024); small edits in the view stay on the GPU.
         let large = region.width() as u64 * region.height() as u64 >= DEFER_PX;
-        if (region == doc.bounds() || large) && !comp.fits_budget(doc, region) {
-            res.compositor = Some(comp);
-            return Err(photocraft_gpu::Unsupported(OVER_BUDGET.into()));
+        if region == doc.bounds() || large {
+            let fit = LayerFit { doc: doc.id.0, needed: comp.working_set(doc, region), budget: comp.resident_budget() };
+            res.layer_fit = Some(fit);
+            if !fit.fits() {
+                res.compositor = Some(comp);
+                return Err(photocraft_gpu::Unsupported(OVER_BUDGET.into()));
+            }
         }
         if fresh {
             let Some(tex) = DocTextures::new(device, res, size, self.tile, format) else {
@@ -834,9 +880,9 @@ pub struct Refresh {
     pub fallback: Option<String>,
 }
 
-/// How the app creates its wgpu device: egui's defaults, except that the texture and buffer size
-/// limits are the adapter's own rather than egui's 8192 px cap, so large documents stay on the
-/// GPU compositor.
+/// How the app creates its wgpu device: egui's defaults clamped to the adapter's supported limits,
+/// with the adapter's own texture and buffer sizes rather than egui's 8192 px cap, so large
+/// documents stay on the GPU compositor.
 pub fn wgpu_setup() -> egui_wgpu::WgpuSetup {
     let mut setup = egui_wgpu::WgpuSetup::without_display_handle();
     use_adapter_limits(&mut setup);
@@ -845,7 +891,8 @@ pub fn wgpu_setup() -> egui_wgpu::WgpuSetup {
 
 /// Make `setup` request the adapter's own texture and buffer size limits instead of egui's
 /// default 8192 px cap (which sent every document wider or taller than 8192 px to the CPU
-/// compositor). Everything else (features, the WebGL2 base limits on GL) stays egui's default.
+/// compositor). Other limits use egui's defaults (WebGL2's on GL), clamped to adapter support;
+/// features stay egui's default.
 pub fn use_adapter_limits(setup: &mut egui_wgpu::WgpuSetup) {
     use_adapter_limits_with(setup, |_| {});
 }
@@ -861,11 +908,15 @@ pub fn use_adapter_limits_with(setup: &mut egui_wgpu::WgpuSetup, on_adapter: imp
     }
 }
 
-/// egui's base limits (WebGL2's on GL) with the adapter's maximum texture and buffer sizes.
+/// egui's base limits (WebGL2's on GL), clamped to adapter support, with its maximum texture and buffer sizes.
 pub fn device_limits(adapter: &wgpu::Adapter) -> wgpu::Limits {
-    let base = if adapter.get_info().backend == wgpu::Backend::Gl { wgpu::Limits::downlevel_webgl2_defaults() } else { wgpu::Limits::default() };
-    let a = adapter.limits();
-    wgpu::Limits { max_texture_dimension_2d: a.max_texture_dimension_2d, max_buffer_size: a.max_buffer_size, ..base }
+    device_limits_for(adapter.get_info().backend, adapter.limits())
+}
+
+fn device_limits_for(backend: wgpu::Backend, supported: wgpu::Limits) -> wgpu::Limits {
+    let base = if backend == wgpu::Backend::Gl { wgpu::Limits::downlevel_webgl2_defaults() } else { wgpu::Limits::default() };
+    let base = base.or_worse_values_from(&supported);
+    wgpu::Limits { max_texture_dimension_2d: supported.max_texture_dimension_2d, max_buffer_size: supported.max_buffer_size, ..base }
 }
 
 /// Milliseconds since first call (monotonic). Always 0 on wasm, where `std::time` is unavailable.
@@ -906,9 +957,13 @@ pub struct Perf {
     /// GPU memory the compositor may hold for layer pages and effect maps (MB; see
     /// [`memory_budget`]).
     pub gpu_budget_mb: u64,
-    /// The Memory Usage allowance (bytes) `gpu_budget_mb` was computed from.
+    /// The Memory Usage allowance and the GPU Memory preference (bytes) `gpu_budget_mb` was
+    /// computed from.
     #[serde(skip)]
-    pub gpu_budget_allowance: u64,
+    pub gpu_budget_allowance: (u64, u64),
+    /// The layer pages the last full refresh needed against the part of the budget they may
+    /// hold; when they don't fit, edits that redraw the whole document do it on the CPU.
+    pub gpu_layer_fit: Option<LayerFit>,
     /// Last command run through the app and its duration (ms).
     pub last_command: String,
     pub command_ms: f64,
@@ -934,6 +989,9 @@ pub struct GpuInfo {
     pub device_type: String,
     /// Driver name and version as the driver reports them.
     pub driver: String,
+    /// The adapter's own memory in MB ([`video_memory`]): discrete GPUs where the platform
+    /// reports it. It caps the GPU memory budgets.
+    pub video_memory_mb: Option<u64>,
     /// `performance.gpuBackend` at launch.
     pub preference: String,
     /// The backend startup chose ("auto", "dx12", "cpu", …, or "env" for `WGPU_BACKEND`).
@@ -945,6 +1003,9 @@ pub struct GpuInfo {
     pub canvas: String,
     /// Why the GPU canvas was dropped during this session (device lost or a GPU error).
     pub lost: Option<String>,
+    /// Present mode and frame latency ("fifo, latency 2"; launch overrides marked, see the
+    /// app's `presentation`). Empty in hosts that don't set it.
+    pub present: String,
 }
 
 impl GpuInfo {
@@ -961,6 +1022,7 @@ impl GpuInfo {
         }
         .to_string();
         self.driver = [info.driver.as_str(), info.driver_info.as_str()].iter().filter(|s| !s.is_empty()).copied().collect::<Vec<_>>().join(" ");
+        self.video_memory_mb = video_memory(info).map(|b| b >> 20);
     }
 
     /// Human-readable lines for Help › System Info.
@@ -1185,21 +1247,53 @@ fn texel_to_f32(format: wgpu::TextureFormat, b: &[u8]) -> [f32; 4] {
 // ---------------------------------------------------------------------------------------------
 // GPU resources
 
+/// The GPU memory a refresh's layer pages need against what they may hold (bytes).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct LayerFit {
+    /// The document refreshed.
+    pub doc: u64,
+    pub needed: u64,
+    pub budget: u64,
+}
+
+impl LayerFit {
+    pub fn fits(&self) -> bool {
+        self.needed <= self.budget
+    }
+}
+
 /// Floor of the compositor's memory budget: enough for a viewport's pages of a dozen layers.
 pub const MIN_GPU_BUDGET: u64 = 512 << 20;
 
 /// Why a full refresh whose layer pages don't fit [`memory_budget`] goes to the CPU compositor.
 pub const OVER_BUDGET: &str = "layers exceed the GPU memory budget; full refresh on the CPU";
 
-/// GPU memory the wgpu compositor may hold for layer pages and effect maps: what Memory Usage
-/// (`allowance`, Preferences › Performance) leaves after the document's pixels and History
-/// (`pixels`), at most a quarter of physical memory (`ram`; 16 GB assumed when unknown), and at
-/// least [`MIN_GPU_BUDGET`]. On unified-memory machines these textures share RAM with the
-/// document, so a huge document keeps its layers on the GPU only as far as memory allows; the
-/// rest is uploaded per refresh as the view needs it.
-pub fn memory_budget(allowance: u64, pixels: u64, ram: Option<u64>) -> u64 {
+/// GPU memory the wgpu compositor may hold for layer pages and effect maps.
+///
+/// `fixed` (Preferences › Performance › GPU Memory, bytes) sets it when it isn't 0, within
+/// [`vram_share`] of a discrete GPU's own memory (`vram`, from [`video_memory`]). Otherwise it is
+/// Memory Usage (`allowance`) within a quarter of physical memory (`ram`; 16 GB assumed when
+/// unknown) and the VRAM share. The document's pixels and History (`pixels`) come off Memory Usage
+/// unless the card's own memory is known: a discrete card doesn't hold them, while integrated and
+/// software adapters (and a card whose memory can't be read) share the system's. Never below
+/// [`MIN_GPU_BUDGET`]. Layers beyond it redraw full refreshes on the CPU ([`OVER_BUDGET`]).
+pub fn memory_budget(allowance: u64, pixels: u64, ram: Option<u64>, vram: Option<u64>, fixed: u64) -> u64 {
+    let card = vram.map_or(u64::MAX, vram_share);
+    if fixed > 0 {
+        return fixed.min(card).max(MIN_GPU_BUDGET);
+    }
     let ram = ram.unwrap_or(16 << 30);
-    allowance.saturating_sub(pixels).min(ram / 4).max(MIN_GPU_BUDGET)
+    let charged = if vram.is_some() { 0 } else { pixels };
+    allowance.saturating_sub(charged).min(ram / 4).min(card).max(MIN_GPU_BUDGET)
+}
+
+/// The share of a discrete GPU's memory each of [`memory_budget`] and [`canvas_budget`] may
+/// plan for: three eighths, so the two together leave a quarter of the card to the window's
+/// swapchain, egui and other applications instead of over-committing it and letting the driver
+/// page (#4536).
+pub fn vram_share(vram: u64) -> u64 {
+    vram / 8 * 3
 }
 
 /// Why a document whose display textures don't fit [`canvas_budget`] is drawn on the CPU canvas.
@@ -1217,11 +1311,12 @@ pub const REFRESH_DEFERRED: &str = "deferred";
 pub const DEFER_PX: u64 = 1 << 22;
 
 /// GPU bytes one document's display texture set (every tile and mip level) may take: a quarter
-/// of physical memory (`ram`; 16 GB assumed when unknown), at least [`MIN_GPU_BUDGET`]. The set
-/// covers the whole canvas at full resolution, so its size follows the declared canvas, not the
-/// layer pixels; a larger canvas is drawn on the (reduced) CPU canvas instead (#2934).
-pub fn canvas_budget(ram: Option<u64>) -> u64 {
-    (ram.unwrap_or(16 << 30) / 4).max(MIN_GPU_BUDGET)
+/// of physical memory (`ram`; 16 GB assumed when unknown) and at most [`vram_share`] of a
+/// discrete GPU's own memory (`vram`), at least [`MIN_GPU_BUDGET`]. The set covers the whole
+/// canvas at full resolution, so its size follows the declared canvas, not the layer pixels; a
+/// larger canvas is drawn on the (reduced) CPU canvas instead (#2934).
+pub fn canvas_budget(ram: Option<u64>, vram: Option<u64>) -> u64 {
+    (ram.unwrap_or(16 << 30) / 4).min(vram.map_or(u64::MAX, vram_share)).max(MIN_GPU_BUDGET)
 }
 
 /// GPU bytes of a display texture set for a `size` canvas in `tile`-sided tiles of `bpp` bytes
@@ -1285,6 +1380,70 @@ fn detect_physical_memory() -> Option<u64> {
     None
 }
 
+/// The memory of `adapter` itself, in bytes, when it is a discrete GPU and the platform reports
+/// it: DXGI's dedicated video memory on Windows, amdgpu's VRAM size on Linux. `None` for
+/// integrated and software adapters, whose textures live in system memory (the RAM-based
+/// budgets already cover them), and where nothing reports it. `PHOTOCRAFT_VRAM_MB` overrides it
+/// for any adapter, simulating a discrete card of that size: on an integrated GPU the budget then
+/// stops charging the document's pixels too, as for a real card (a development switch).
+pub fn video_memory(adapter: &wgpu::AdapterInfo) -> Option<u64> {
+    if let Some(mb) = std::env::var("PHOTOCRAFT_VRAM_MB").ok().and_then(|v| v.trim().parse::<u64>().ok()) {
+        return mb.checked_mul(1 << 20).filter(|b| *b > 0);
+    }
+    if adapter.device_type != wgpu::DeviceType::DiscreteGpu {
+        return None;
+    }
+    // Detected once per adapter, as `physical_memory` is: on Windows each detection builds a
+    // DXGI factory, and startup asks three times. Keyed by the adapter, since a GPU retry can
+    // pick another one.
+    /// (vendor, device) ids and the memory found for them.
+    type Seen = Vec<((u32, u32), Option<u64>)>;
+    static SEEN: std::sync::Mutex<Seen> = std::sync::Mutex::new(Vec::new());
+    let key = (adapter.vendor, adapter.device);
+    let mut seen = SEEN.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    if let Some((_, bytes)) = seen.iter().find(|(k, _)| *k == key) {
+        return *bytes;
+    }
+    let bytes = detect_video_memory(key.0, key.1).filter(|b| *b > 0);
+    seen.push((key, bytes));
+    bytes
+}
+
+#[cfg(windows)]
+fn detect_video_memory(vendor: u32, device: u32) -> Option<u64> {
+    use winsafe::prelude::*;
+    let factory = winsafe::CreateDXGIFactory1().ok()?;
+    factory
+        .EnumAdapters1()
+        .filter_map(|a| a.ok()?.GetDesc1().ok())
+        .find(|d| d.VendorId == vendor && d.DeviceId == device)
+        .and_then(|d| u64::try_from(d.DedicatedVideoMemory).ok())
+}
+
+#[cfg(target_os = "linux")]
+fn detect_video_memory(vendor: u32, device: u32) -> Option<u64> {
+    drm_video_memory(std::path::Path::new("/sys/class/drm"), vendor, device)
+}
+
+/// amdgpu's VRAM size (`<card>/device/mem_info_vram_total`, bytes) of the card under `drm` (the
+/// sysfs `/sys/class/drm` folder) whose PCI `vendor` and `device` ids (hex files beside it) match.
+#[cfg(any(target_os = "linux", test))]
+fn drm_video_memory(drm: &std::path::Path, vendor: u32, device: u32) -> Option<u64> {
+    let hex = |p: std::path::PathBuf| u32::from_str_radix(std::fs::read_to_string(p).ok()?.trim().trim_start_matches("0x"), 16).ok();
+    std::fs::read_dir(drm).ok()?.flatten().find_map(|card| {
+        let dev = card.path().join("device");
+        if hex(dev.join("vendor"))? != vendor || hex(dev.join("device"))? != device {
+            return None;
+        }
+        std::fs::read_to_string(dev.join("mem_info_vram_total")).ok()?.trim().parse().ok()
+    })
+}
+
+#[cfg(not(any(target_os = "linux", windows)))]
+fn detect_video_memory(_vendor: u32, _device: u32) -> Option<u64> {
+    None
+}
+
 struct Resources {
     view_bgl: wgpu::BindGroupLayout,
     tile_bgl: wgpu::BindGroupLayout,
@@ -1312,10 +1471,13 @@ struct Resources {
     /// GPU memory the compositor may hold (`None`: its default), and the document area the
     /// view shows; applied before every composite.
     compositor_budget: Option<u64>,
+    /// The layer pages the last full (or large) refresh needed and the budget they had to fit
+    /// (bytes): when they don't fit, full refreshes go to the CPU ([`OVER_BUDGET`]).
+    layer_fit: Option<LayerFit>,
     compositor_cache_budget: Option<u64>,
     compositor_focus: Option<photocraft_geom::Rect>,
     /// GPU bytes one document's display texture set may take (see [`canvas_budget`]).
-    canvas_budget: u64,
+    canvas_budget: std::sync::Arc<std::sync::atomic::AtomicU64>,
     encode_bgl: wgpu::BindGroupLayout,
     encode_pipeline: wgpu::RenderPipeline,
     lut_bgl: wgpu::BindGroupLayout,
@@ -1579,9 +1741,10 @@ impl Resources {
             compositor_failed: None,
             health: photocraft_gpu::DeviceHealth::new(),
             compositor_budget: None,
+            layer_fit: None,
             compositor_cache_budget: None,
             compositor_focus: None,
-            canvas_budget: canvas_budget(physical_memory()),
+            canvas_budget: std::sync::Arc::new(std::sync::atomic::AtomicU64::new(canvas_budget(physical_memory(), None))),
             encode_bgl,
             encode_pipeline,
         }
@@ -1620,7 +1783,7 @@ impl DocTextures {
     /// The texture set for a `size` canvas, or `None` (nothing created) when it doesn't fit
     /// the canvas budget.
     fn new(device: &wgpu::Device, res: &Resources, size: [u32; 2], tile: u32, format: wgpu::TextureFormat) -> Option<Self> {
-        if canvas_texture_bytes(size, tile, texel_bytes(format)) > res.canvas_budget {
+        if canvas_texture_bytes(size, tile, texel_bytes(format)) > res.canvas_budget.load(Ordering::Relaxed) {
             return None;
         }
         let mut tiles = Vec::new();
@@ -2217,6 +2380,64 @@ mod mip_tests;
 mod tests {
     use super::*;
 
+    #[test]
+    fn device_limits_support_v3d_shader_variable_limit() {
+        let supported = wgpu::Limits { max_texture_dimension_2d: 7680, max_inter_stage_shader_variables: 15, ..wgpu::Limits::default() };
+        let requested = device_limits_for(wgpu::Backend::Vulkan, supported.clone());
+        assert_eq!(requested.max_inter_stage_shader_variables, 15);
+        assert!(requested.check_limits(&supported));
+        assert_eq!(requested.max_texture_dimension_2d, 7680);
+        assert_eq!(requested.max_buffer_size, supported.max_buffer_size);
+    }
+
+    #[test]
+    fn device_limits_support_weaker_gl_adapters() {
+        let supported = wgpu::Limits {
+            max_texture_dimension_2d: 1024,
+            max_texture_dimension_3d: 128,
+            max_bind_groups: 2,
+            max_buffer_size: 128 << 20,
+            ..wgpu::Limits::downlevel_webgl2_defaults()
+        };
+        let requested = device_limits_for(wgpu::Backend::Gl, supported.clone());
+        assert!(requested.check_limits(&supported));
+        assert_eq!(requested, supported);
+    }
+
+    #[test]
+    fn device_limits_preserve_backend_defaults_on_capable_adapters() {
+        let supported = wgpu::Limits {
+            max_texture_dimension_2d: 16_384,
+            max_buffer_size: 1 << 30,
+            max_bind_groups: 8,
+            max_inter_stage_shader_variables: 32,
+            min_uniform_buffer_offset_alignment: 64,
+            min_storage_buffer_offset_alignment: 64,
+            ..wgpu::Limits::default()
+        };
+        for (backend, base) in [
+            (wgpu::Backend::Vulkan, wgpu::Limits::default()),
+            (wgpu::Backend::Dx12, wgpu::Limits::default()),
+            (wgpu::Backend::Metal, wgpu::Limits::default()),
+            (wgpu::Backend::Gl, wgpu::Limits::downlevel_webgl2_defaults()),
+        ] {
+            let requested = device_limits_for(backend, supported.clone());
+            assert!(requested.check_limits(&supported));
+            assert_eq!(requested, wgpu::Limits { max_texture_dimension_2d: 16_384, max_buffer_size: 1 << 30, ..base }, "{backend:?}");
+        }
+    }
+
+    #[test]
+    fn device_limits_support_larger_minimum_alignments() {
+        let supported = wgpu::Limits { min_uniform_buffer_offset_alignment: 512, min_storage_buffer_offset_alignment: 1024, ..wgpu::Limits::default() };
+        for backend in [wgpu::Backend::Vulkan, wgpu::Backend::Gl] {
+            let requested = device_limits_for(backend, supported.clone());
+            assert!(requested.check_limits(&supported));
+            assert_eq!(requested.min_uniform_buffer_offset_alignment, 512);
+            assert_eq!(requested.min_storage_buffer_offset_alignment, 1024);
+        }
+    }
+
     /// The scratch-texture workaround is for Intel's DX12 drivers (#892); other DX12 adapters
     /// render straight into the level like every other backend (#4515).
     #[test]
@@ -2237,16 +2458,84 @@ mod tests {
     #[test]
     fn gpu_budget_follows_memory_usage_and_ram() {
         const G: u64 = 1 << 30;
-        // What Memory Usage leaves after the document, within a quarter of RAM.
-        assert_eq!(memory_budget(8 * G, 3 * G, Some(48 * G)), 5 * G);
-        assert_eq!(memory_budget(8 * G, 3 * G, Some(16 * G)), 4 * G);
-        assert_eq!(memory_budget(64 * G, 3 * G, Some(16 * G)), 4 * G);
+        // Card memory unknown (integrated, software, or unreadable): what Memory Usage leaves
+        // after the document, within a quarter of RAM.
+        assert_eq!(memory_budget(8 * G, 3 * G, Some(48 * G), None, 0), 5 * G);
+        assert_eq!(memory_budget(8 * G, 3 * G, Some(16 * G), None, 0), 4 * G);
+        assert_eq!(memory_budget(64 * G, 3 * G, Some(16 * G), None, 0), 4 * G);
         // Never below the floor, even with nothing left; 16 GB assumed when RAM is unknown.
-        assert_eq!(memory_budget(8 * G, 10 * G, Some(48 * G)), MIN_GPU_BUDGET);
-        assert_eq!(memory_budget(64 * G, 0, None), 4 * G);
+        assert_eq!(memory_budget(8 * G, 10 * G, Some(48 * G), None, 0), MIN_GPU_BUDGET);
+        assert_eq!(memory_budget(64 * G, 0, None, None, 0), 4 * G);
+        // A card's own memory, known, doesn't hold the document's pixels: 10 GB of layers no
+        // longer squeeze the budget, which stays within 3/8 of the card (#4536).
+        assert_eq!(memory_budget(8 * G, 10 * G, Some(32 * G), Some(32 * G), 0), 8 * G);
+        assert_eq!(memory_budget(8 * G, 10 * G, Some(32 * G), Some(16 * G), 0), 6 * G);
+        assert_eq!(memory_budget(8 * G, 10 * G, Some(16 * G), Some(32 * G), 0), 4 * G);
+        // GPU Memory set: that much, within the card's share, above the floor.
+        assert_eq!(memory_budget(8 * G, 10 * G, Some(16 * G), None, 12 * G), 12 * G);
+        assert_eq!(memory_budget(8 * G, 10 * G, Some(16 * G), Some(16 * G), 12 * G), 6 * G);
+        assert_eq!(memory_budget(8 * G, 0, None, Some(32 * G), 1 << 20), MIN_GPU_BUDGET);
         assert!(physical_memory().is_none_or(|b| b >= 256 << 20));
     }
 
+    /// An 8 GB card in a 64 GB machine: both budgets used to plan for 16 GB, twice the card (#4536).
+    #[test]
+    fn gpu_budgets_fit_a_discrete_gpus_own_memory() {
+        const G: u64 = 1 << 30;
+        let (ram, vram) = (Some(64 * G), Some(8 * G));
+        assert_eq!(memory_budget(64 * G, 3 * G, ram, vram, 0), 3 * G);
+        assert_eq!(canvas_budget(ram, vram), 3 * G);
+        assert!(memory_budget(64 * G, 0, ram, vram, 0) + canvas_budget(ram, vram) <= 6 * G, "a quarter of the card stays free");
+        // A card larger than a quarter of RAM caps nothing (its own memory isn't charged for the
+        // document's 3 GB); a tiny one keeps the floor.
+        assert_eq!(memory_budget(8 * G, 3 * G, Some(48 * G), Some(24 * G), 0), 8 * G);
+        assert_eq!(canvas_budget(Some(16 * G), Some(24 * G)), 4 * G);
+        assert_eq!(memory_budget(64 * G, 0, ram, Some(G), 0), MIN_GPU_BUDGET);
+        assert_eq!(canvas_budget(ram, Some(G)), MIN_GPU_BUDGET);
+    }
+
+    /// DXGI reports each adapter's dedicated memory, found by the vendor and device ids wgpu gives.
+    #[cfg(windows)]
+    #[test]
+    fn windows_reports_the_adapters_own_memory() {
+        use winsafe::prelude::*;
+        let descs: Vec<_> = winsafe::CreateDXGIFactory1().unwrap().EnumAdapters1().map(|a| a.unwrap().GetDesc1().unwrap()).collect();
+        assert!(!descs.is_empty(), "DXGI lists at least its software adapter");
+        for d in descs.iter().filter(|d| d.DedicatedVideoMemory > 0) {
+            // The first adapter with these ids is the one matched.
+            let first = descs.iter().find(|e| e.VendorId == d.VendorId && e.DeviceId == d.DeviceId).unwrap();
+            assert_eq!(detect_video_memory(d.VendorId, d.DeviceId), Some(first.DedicatedVideoMemory as u64));
+        }
+        assert_eq!(detect_video_memory(0xdead, 0xbeef), None, "no such adapter");
+    }
+
+    /// The Linux reader finds the card by its PCI ids in a `/sys/class/drm`-shaped folder and reads
+    /// amdgpu's VRAM size; a card without one, unreadable ids or a malformed size give nothing.
+    #[test]
+    fn drm_video_memory_reads_the_matching_cards_vram() {
+        let drm = std::env::temp_dir().join(format!("pc-drm-{}", std::process::id()));
+        let card = |name: &str, vendor: &str, device: &str, vram: Option<&str>| {
+            let dev = drm.join(name).join("device");
+            std::fs::create_dir_all(&dev).unwrap();
+            std::fs::write(dev.join("vendor"), vendor).unwrap();
+            std::fs::write(dev.join("device"), device).unwrap();
+            if let Some(v) = vram {
+                std::fs::write(dev.join("mem_info_vram_total"), v).unwrap();
+            }
+        };
+        // An Intel iGPU (no VRAM file), an AMD card, and an entry with garbage ids.
+        card("card0", "0x8086\n", "0x9a49\n", None);
+        card("card1", "0x1002\n", "0x73bf\n", Some("17163091968\n"));
+        card("card2", "not hex\n", "0x73bf\n", Some("1\n"));
+        card("card3", "0x10de\n", "0x2684\n", Some("lots\n"));
+        assert_eq!(drm_video_memory(&drm, 0x1002, 0x73bf), Some(17_163_091_968));
+        assert_eq!(drm_video_memory(&drm, 0x8086, 0x9a49), None, "no amdgpu VRAM file");
+        assert_eq!(drm_video_memory(&drm, 0x10de, 0x2684), None, "a malformed size");
+        assert_eq!(drm_video_memory(&drm, 0xdead, 0xbeef), None, "no such card");
+        assert_eq!(drm_video_memory(&drm.join("missing"), 0x1002, 0x73bf), None, "no drm folder");
+        std::fs::remove_dir_all(&drm).unwrap();
+    }
+
     /// Windows used to report no RAM at all, so the budget assumed 16 GB on every machine.
     #[cfg(windows)]
     #[test]
@@ -2277,12 +2566,12 @@ mod tests {
         assert_eq!(canvas_texture_bytes([0, 500], 64, 4), 0);
         // A canvas declared in a few bytes of a file is priced without building (or looping over) it.
         let huge = canvas_texture_bytes([300_000, 300_000], 8192, 4);
-        assert!(huge > 300_000u64 * 300_000 * 4 && huge > canvas_budget(Some(1 << 40)));
+        assert!(huge > 300_000u64 * 300_000 * 4 && huge > canvas_budget(Some(1 << 40), None));
         assert_eq!(canvas_texture_bytes([u32::MAX, u32::MAX], 64, 8), u64::MAX, "saturates");
         // A quarter of RAM (16 GB assumed), never below the compositor's floor.
-        assert_eq!(canvas_budget(None), 4 << 30);
-        assert_eq!(canvas_budget(Some(1 << 30)), MIN_GPU_BUDGET);
-        assert!(canvas_texture_bytes([12_000, 8_000], DEFAULT_TILE, 8) < canvas_budget(None), "a 96 MP 16-bit canvas stays on the GPU");
+        assert_eq!(canvas_budget(None, None), 4 << 30);
+        assert_eq!(canvas_budget(Some(1 << 30), None), MIN_GPU_BUDGET);
+        assert!(canvas_texture_bytes([12_000, 8_000], DEFAULT_TILE, 8) < canvas_budget(None, None), "a 96 MP 16-bit canvas stays on the GPU");
     }
 
     #[test]
diff --git a/crates/ui-egui/src/gpu_canvas_mip_tests.rs b/crates/ui-egui/src/gpu_canvas_mip_tests.rs
index a1c3e8ee14..82e911bae9 100644
--- a/crates/ui-egui/src/gpu_canvas_mip_tests.rs
+++ b/crates/ui-egui/src/gpu_canvas_mip_tests.rs
@@ -51,6 +51,7 @@ fn read_mips(gpu: &GpuCanvas, key: u64) -> Vec<Vec<[f32; 4]>> {
 
 #[test]
 fn canvas_mips_preserve_opaque_pixels_and_partial_updates() {
+    let _gpu = photocraft_testkit::gpu_lock();
     let rs = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| egui_kittest::wgpu::create_render_state(wgpu_setup(), Default::default())));
     let Ok(rs) = rs else {
         eprintln!("skipping mip readback: no GPU adapter");
diff --git a/crates/ui-egui/src/gpu_status.rs b/crates/ui-egui/src/gpu_status.rs
index bbbc997fc1..337283bdf8 100644
--- a/crates/ui-egui/src/gpu_status.rs
+++ b/crates/ui-egui/src/gpu_status.rs
@@ -50,6 +50,8 @@ pub fn fall_back(app: &mut PhotocraftApp, fault: &photocraft_gpu::Fault) {
     app.prefs_rt.gpu_style = None;
     app.perf.gpu = false;
     app.perf.gpu_fallback = Some(fault.to_string());
+    // The CPU canvas has no GPU memory budget: GPU Memory Full no longer applies.
+    app.perf.gpu_layer_fit = None;
     app.perf.gpu_info.canvas = "cpu".into();
     app.perf.gpu_info.lost = Some(fault.to_string());
     let title = if fault.is_lost() { LOST_MESSAGE } else { ERROR_MESSAGE };
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 6c8f21418a..6175183cb5 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -2442,7 +2442,6 @@ cameraRaw	Color	Barvy
 	Redrawing	Překreslování
 	This redraw took {seconds} s on the CPU.	Toto překreslení na CPU trvalo {seconds} s.
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	Úpravy, které mění celý dokument, například režim prolnutí, krytí nebo viditelnost vrstvy, jej překreslí celý.
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	Vrstvy se nevejdou do rozpočtu paměti GPU. Zvýšením hodnoty Využití paměti v Předvolbách › Výkon se rozpočet zvětší, nejvýše na čtvrtinu paměti tohoto počítače.
 	The GPU compositor wasn't used: {reason}	Kompozitor GPU nebyl použit: {reason}
 fontWeight	Thin	Jemná
 fontWeight	ExtraLight	Extrajemná
@@ -2642,6 +2641,26 @@ cameraData	Lens	Objektiv
 	Snap to Origin	Přichytit k počátku
 	Search settings…	Hledat nastavení…
 	No matching settings	Žádná odpovídající nastavení
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	Nástroj Štětec vzorkování
+	Sampling Area Overlay	Překrytí oblasti vzorkování
+	Show Sampling Area	Zobrazit oblast vzorkování
+	Indicates	Označuje
+	Sampling Area	Oblast vzorkování
+	Excluded Area	Vyloučená oblast
+	Sampling Area Options	Volby oblasti vzorkování
+	Rectangular	Obdélníková
+	Fill Settings	Nastavení výplně
+	Rotation Adaptation	Přizpůsobení otočení
+	Very High	Velmi vysoká
+	High	Vysoká
+	Low	Nízká
+	Full	Úplná
+	Mirror	Zrcadlit
+	Output Settings	Nastavení výstupu
+	Output To	Výstup do
+	Duplicate Layer	Duplikovat vrstvu
+	Contract	Zúžit
 
 # Dynamic labels the tl! literal scanner cannot see: filter and Filter Gallery parameter names and
 # choices (humanized from their keys), Camera Raw controls, render filters (Flame, Picture Frame, Tree),
@@ -2782,7 +2801,6 @@ cameraData	Lens	Objektiv
 	Content-Aware Fill	Výplň s ohledem na obsah
 	Content-Aware Move	Přesun s ohledem na obsah
 	Continue	Pokračovat
-	Contract	Zúžit
 	Contrasty	Kontrastní
 	Conté Crayon	Křída Conté
 	Convert to Linked	Převést na propojený
@@ -2858,7 +2876,6 @@ cameraData	Lens	Objektiv
 	Draft	Koncept
 	Dry Brush	Suchý štětec
 	Duplicate	Duplikovat
-	Duplicate Layer	Duplikovat vrstvu
 	Duplicate Layer Comp	Duplikovat kompozici vrstev
 	Duplicate Layers	Duplikovat vrstvy
 	Duplicate Path	Duplikovat cestu
@@ -2985,7 +3002,6 @@ cameraData	Lens	Objektiv
 	Hide	Skrýt
 	Hide Others	Skrýt ostatní
 	Hide {app}	Skrýt {app}
-	High	Vysoká
 	High Pass	Horní propust
 	Highlight	Světla
 	Highlight Amount	Míra světel
@@ -3072,7 +3088,6 @@ cameraData	Lens	Objektiv
 	Long Lines	Dlouhé čáry
 	Long Strokes	Dlouhé tahy
 	Loop	Smyčka
-	Low	Nízká
 	Lower	Dolní
 	Lum	Jas
 	Lut	LUT
@@ -3797,3 +3812,29 @@ navigator	Zoom	Zvětšení
 	There are too many sets: delete one first.	Sad je příliš mnoho: nejprve jednu smažte.
 	set name	název sady
 	{set} (modified)	{set} (změněno)
+	Accept and Go to Conflict	Přijmout a přejít ke konfliktu
+	Changes undone.	Změny vráceny.
+	Choose a new shortcut for this command, or leave it without one.	Zvolte pro tento příkaz novou zkratku, nebo ho nechte bez ní.
+	Put this command's shortcuts back as they were	Vrátit zkratky tohoto příkazu do původního stavu
+	Take the shortcut from the other command and select it	Odebrat zkratku druhému příkazu a vybrat ho
+	Undo Changes	Vrátit změny
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut} je vyhrazena systémem a nelze ji přiřadit.
+	Low-Latency Drawing (vsync off, applies at next launch)	Kreslení s nízkou latencí (bez vertikální synchronizace, platí po dalším spuštění)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	Volná transformace se stále použije; zkuste to znovu, až skončí.
+	The transform couldn't be applied.	Transformaci nelze použít.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	Vrstvy potřebují {needed} paměti GPU; rozpočet jim ponechává {budget}.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	V Předvolbách › Výkon nastavte Paměť GPU na tolik, kolik vaše grafická karta pojme, nejvýše 3/8 její paměti. Automaticky se řídí Využitím paměti, v rámci čtvrtiny paměti tohoto počítače a 3/8 paměti karty, a u karty se známou pamětí do ní dokument nezapočítává. Dokud se nevejdou, stavový řádek ukazuje Paměť GPU je plná.
+	GPU Memory Full	Paměť GPU je plná
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	Vrstvy potřebují {needed} paměti GPU a mohou zabrat {budget}, takže úpravy, které překreslují celý dokument, to dělají na CPU. Kliknutím nastavíte Paměť GPU.
+	GPU memory budget: {budget}	Rozpočet paměti GPU: {budget}
+	This document's layers: {needed} of {budget} for layers	Vrstvy tohoto dokumentu: {needed} z {budget} pro vrstvy
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	Vrstvy tohoto dokumentu potřebují {needed}, ale mohou zabrat {budget}: překreslení celého dokumentu probíhá na CPU
+	GPU Memory (MB, 0 = Automatic)	Paměť GPU (MB, 0 = Automaticky)
+	{name} was changed by another app after it was opened or saved here.	Soubor {name} změnila jiná aplikace poté, co byl zde otevřen nebo uložen.
+	Replace it with this document, or cancel and use File › Save As to keep both.	Nahraďte ho tímto dokumentem, nebo zrušte a použijte Soubor › Uložit jako, abyste zachovali obojí.
+	Decrease Brush Size	Zmenšit velikost štětce
+	Increase Brush Size	Zvětšit velikost štětce
+	Decrease Brush Hardness	Snížit tvrdost štětce
+	Increase Brush Hardness	Zvýšit tvrdost štětce
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 2bb1c57f19..5fbbceb440 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -2481,7 +2481,6 @@ layerLabel	No Color	Keine Farbe
 	Redrawing	Neuzeichnen
 	This redraw took {seconds} s on the CPU.	Dieses Neuzeichnen auf der CPU dauerte {seconds} s.
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	Änderungen, die das ganze Dokument betreffen, etwa Füllmethode, Deckkraft oder Sichtbarkeit einer Ebene, zeichnen es vollständig neu.
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	Die Ebenen passen nicht in das GPU-Speicherbudget. Eine höhere Speichernutzung unter Voreinstellungen › Leistung erhöht das Budget, bis zu einem Viertel des Arbeitsspeichers dieses Computers.
 	The GPU compositor wasn't used: {reason}	Der GPU-Compositor wurde nicht verwendet: {reason}
 cameraRaw	Light	Licht
 fontWeight	Thin	Haarfein
@@ -2676,6 +2675,24 @@ cameraData	Lens	Objektiv
 	Snap to Origin	An Ursprung ausrichten
 	Search settings…	Einstellungen durchsuchen…
 	No matching settings	Keine passenden Einstellungen
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	Aufnahmepinsel-Werkzeug
+	Sampling Area Overlay	Überlagerung des Aufnahmebereichs
+	Show Sampling Area	Aufnahmebereich einblenden
+	Indicates	Kennzeichnet
+	Sampling Area	Aufnahmebereich
+	Excluded Area	Ausgeschlossener Bereich
+	Sampling Area Options	Optionen für Aufnahmebereich
+	Rectangular	Rechteckig
+	Fill Settings	Füllungseinstellungen
+	Rotation Adaptation	Drehungsanpassung
+	Very High	Sehr hoch
+	Full	Voll
+	Mirror	Spiegeln
+	Output Settings	Ausgabeeinstellungen
+	Output To	Ausgabe in
+	Duplicate Layer	Ebene duplizieren
+	Contract	Verkleinern
 	Loading fonts…	Schriften werden geladen…
 	Response curve	Reaktionskurve
 	Tool	Werkzeug
@@ -3191,3 +3208,25 @@ curves	Smooth	Glätten
 	There are too many sets: delete one first.	Zu viele Sätze: Löschen Sie zuerst einen.
 	set name	Name des Satzes
 	{set} (modified)	{set} (geändert)
+	Accept and Go to Conflict	Übernehmen und zum Konflikt
+	Changes undone.	Änderungen rückgängig gemacht.
+	Choose a new shortcut for this command, or leave it without one.	Wählen Sie einen neuen Kurzbefehl für diesen Befehl oder lassen Sie ihn ohne.
+	Put this command's shortcuts back as they were	Die Kurzbefehle dieses Befehls wiederherstellen
+	Take the shortcut from the other command and select it	Den Kurzbefehl dem anderen Befehl entziehen und diesen auswählen
+	Undo Changes	Änderungen rückgängig machen
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut} ist vom System reserviert und kann nicht zugewiesen werden.
+	Low-Latency Drawing (vsync off, applies at next launch)	Zeichnen mit geringer Latenz (ohne VSync, gilt ab dem nächsten Start)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	Frei transformieren wird noch angewendet; versuchen Sie es erneut, wenn es fertig ist.
+	The transform couldn't be applied.	Die Transformation konnte nicht angewendet werden.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	Die Ebenen brauchen {needed} GPU-Speicher; das Budget lässt ihnen {budget}.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	Stellen Sie unter Voreinstellungen › Leistung den GPU-Speicher auf das ein, was Ihre Grafikkarte fassen kann, höchstens 3/8 ihres Speichers. Automatisch folgt der Speichernutzung, innerhalb eines Viertels des Arbeitsspeichers dieses Computers und 3/8 des Kartenspeichers, und rechnet das Dokument bei einer Karte mit bekanntem Speicher nicht an. Solange sie nicht hineinpassen, zeigt die Statusleiste GPU-Speicher voll.
+	GPU Memory Full	GPU-Speicher voll
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	Die Ebenen brauchen {needed} GPU-Speicher und dürfen {budget} belegen, daher zeichnen Änderungen, die das ganze Dokument neu zeichnen, auf der CPU. Klicken, um den GPU-Speicher einzustellen.
+	GPU memory budget: {budget}	GPU-Speicherbudget: {budget}
+	This document's layers: {needed} of {budget} for layers	Ebenen dieses Dokuments: {needed} von {budget} für Ebenen
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	Die Ebenen dieses Dokuments brauchen {needed}, dürfen aber {budget} belegen: Das ganze Dokument wird auf der CPU neu gezeichnet
+	GPU Memory (MB, 0 = Automatic)	GPU-Speicher (MB, 0 = Automatisch)
+	{name} was changed by another app after it was opened or saved here.	{name} wurde von einer anderen App geändert, nachdem es hier geöffnet oder gespeichert wurde.
+	Replace it with this document, or cancel and use File › Save As to keep both.	Ersetze die Datei durch dieses Dokument oder brich ab und nutze Datei › Speichern unter, um beide zu behalten.
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index 48d23d13b9..d21c3ba6e4 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -3439,7 +3439,6 @@ cameraRaw	Yellow	Κίτρινο
 	HSB/HSL	HSB/HSL
 	Import Swatches…	Εισαγωγή δειγμάτων χρωμάτων…
 	Impressionist	Ιμπρεσιονιστικό
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	Τα επίπεδά του δεν χωρούν στο όριο μνήμης της GPU. Αυξάνοντας τη Χρήση μνήμης στις Προτιμήσεις › Επιδόσεις αυξάνεται το όριο, έως το ένα τέταρτο της μνήμης αυτού του υπολογιστή.
 	Knockout	Διάτρηση
 	Large document: redrawing on the CPU	Μεγάλο έγγραφο: επανασχεδίαση στη CPU
 	Redrawing	Επανασχεδίαση
@@ -3732,6 +3731,22 @@ cameraData	Lens	Φακός
 	Snap to Origin	Προσκόλληση στην αρχή
 	Search settings…	Αναζήτηση ρυθμίσεων…
 	No matching settings	Δεν βρέθηκαν ρυθμίσεις
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	Εργαλείο πινέλου δειγματοληψίας
+	Sampling Area Overlay	Επικάλυψη περιοχής δειγματοληψίας
+	Show Sampling Area	Εμφάνιση περιοχής δειγματοληψίας
+	Indicates	Υποδεικνύει
+	Sampling Area	Περιοχή δειγματοληψίας
+	Excluded Area	Εξαιρούμενη περιοχή
+	Sampling Area Options	Επιλογές περιοχής δειγματοληψίας
+	Rectangular	Ορθογώνια
+	Fill Settings	Ρυθμίσεις γεμίσματος
+	Rotation Adaptation	Προσαρμογή περιστροφής
+	Very High	Πολύ υψηλή
+	Full	Πλήρης
+	Mirror	Κατοπτρισμός
+	Output Settings	Ρυθμίσεις εξόδου
+	Output To	Έξοδος σε
 	Loading fonts…	Φόρτωση γραμματοσειρών…
 	Response curve	Καμπύλη απόκρισης
 	Simulate Pressure	Προσομοίωση πίεσης
@@ -3889,3 +3904,29 @@ curves	Smooth	Εξομάλυνση
 	There are too many sets: delete one first.	Υπάρχουν πάρα πολλά σύνολα: διαγράψτε πρώτα ένα.
 	set name	όνομα συνόλου
 	{set} (modified)	{set} (τροποποιημένο)
+	Accept and Go to Conflict	Αποδοχή και μετάβαση στη σύγκρουση
+	Changes undone.	Οι αλλαγές αναιρέθηκαν.
+	Choose a new shortcut for this command, or leave it without one.	Επιλέξτε νέα συντόμευση για αυτήν την εντολή ή αφήστε την χωρίς.
+	Put this command's shortcuts back as they were	Επαναφορά των συντομεύσεων αυτής της εντολής όπως ήταν
+	Take the shortcut from the other command and select it	Αφαίρεση της συντόμευσης από την άλλη εντολή και επιλογή της
+	Undo Changes	Αναίρεση αλλαγών
+	{shortcut} is reserved by the system and can't be assigned.	Η συντόμευση {shortcut} δεσμεύεται από το σύστημα και δεν μπορεί να εκχωρηθεί.
+	Low-Latency Drawing (vsync off, applies at next launch)	Σχεδίαση χαμηλής καθυστέρησης (χωρίς vsync, ισχύει στην επόμενη εκκίνηση)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	Ο Ελεύθερος μετασχηματισμός εφαρμόζεται ακόμη· δοκιμάστε ξανά όταν ολοκληρωθεί.
+	The transform couldn't be applied.	Δεν ήταν δυνατή η εφαρμογή του μετασχηματισμού.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	Τα επίπεδά του χρειάζονται {needed} μνήμης GPU· το όριο τους αφήνει {budget}.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	Ορίστε τη Μνήμη GPU στις Προτιμήσεις › Επιδόσεις σε όσο χωράει η κάρτα γραφικών σας, το πολύ στα 3/8 της μνήμης της. Το Αυτόματο ακολουθεί τη Χρήση μνήμης, εντός του ενός τετάρτου της μνήμης αυτού του υπολογιστή και των 3/8 της κάρτας, και δεν χρεώνει το έγγραφο σε κάρτα με γνωστή μνήμη. Όσο δεν χωρούν, η γραμμή κατάστασης δείχνει Η μνήμη GPU είναι πλήρης.
+	GPU Memory Full	Η μνήμη GPU είναι πλήρης
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	Τα επίπεδα χρειάζονται {needed} μνήμης GPU και μπορούν να καταλάβουν {budget}, οπότε οι αλλαγές που ξανασχεδιάζουν όλο το έγγραφο το κάνουν στη CPU. Κάντε κλικ για να ορίσετε τη Μνήμη GPU.
+	GPU memory budget: {budget}	Όριο μνήμης GPU: {budget}
+	This document's layers: {needed} of {budget} for layers	Επίπεδα αυτού του εγγράφου: {needed} από {budget} για επίπεδα
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	Τα επίπεδα αυτού του εγγράφου χρειάζονται {needed} αλλά μπορούν να καταλάβουν {budget}: η επανασχεδίαση όλου του εγγράφου γίνεται στη CPU
+	GPU Memory (MB, 0 = Automatic)	Μνήμη GPU (MB, 0 = Αυτόματο)
+	{name} was changed by another app after it was opened or saved here.	Το {name} άλλαξε από άλλη εφαρμογή αφού ανοίχτηκε ή αποθηκεύτηκε εδώ.
+	Replace it with this document, or cancel and use File › Save As to keep both.	Αντικαταστήστε το με αυτό το έγγραφο ή ακυρώστε και χρησιμοποιήστε Αρχείο › Αποθήκευση ως για να κρατήσετε και τα δύο.
+	Decrease Brush Size	Μείωση μεγέθους πινέλου
+	Increase Brush Size	Αύξηση μεγέθους πινέλου
+	Decrease Brush Hardness	Μείωση σκληρότητας πινέλου
+	Increase Brush Hardness	Αύξηση σκληρότητας πινέλου
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index a7338795aa..4956fcd97b 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -2512,7 +2512,6 @@ cameraRaw	Amount	Cantidad
 	Redrawing	Redibujando
 	This redraw took {seconds} s on the CPU.	Este redibujado en la CPU tardó {seconds} s.
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	Las ediciones que cambian todo el documento, como el modo de fusión, la opacidad o la visibilidad de una capa, lo redibujan por completo.
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	Las capas no caben en el presupuesto de memoria de la GPU. Aumentar Uso de memoria en Preferencias › Rendimiento amplía el presupuesto, hasta una cuarta parte de la memoria de este equipo.
 	The GPU compositor wasn't used: {reason}	No se usó el compositor de GPU: {reason}
 fontWeight	Thin	Ultrafina
 fontWeight	ExtraLight	Extrafina
@@ -2718,6 +2717,22 @@ cameraData	Lens	Objetivo
 	Snap to Origin	Ajustar a origen
 	Search settings…	Buscar ajustes…
 	No matching settings	No hay ajustes que coincidan
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	Herramienta Pincel de muestreo
+	Sampling Area Overlay	Superposición del área de muestreo
+	Show Sampling Area	Mostrar área de muestreo
+	Indicates	Indica
+	Sampling Area	Área de muestreo
+	Excluded Area	Área excluida
+	Sampling Area Options	Opciones del área de muestreo
+	Rectangular	Rectangular
+	Fill Settings	Ajustes de relleno
+	Rotation Adaptation	Adaptación de rotación
+	Very High	Muy alta
+	Full	Completa
+	Mirror	Reflejar
+	Output Settings	Ajustes de salida
+	Output To	Salida a
 	Loading fonts…	Cargando fuentes…
 	Response curve	Curva de respuesta
 	Tool	Herramienta
@@ -4151,3 +4166,29 @@ navigator	Zoom	Zoom
 	There are too many sets: delete one first.	Hay demasiados conjuntos: elimine uno primero.
 	set name	nombre del conjunto
 	{set} (modified)	{set} (modificado)
+	Accept and Go to Conflict	Aceptar e ir al conflicto
+	Changes undone.	Cambios deshechos.
+	Choose a new shortcut for this command, or leave it without one.	Elija un nuevo método abreviado para este comando o déjelo sin ninguno.
+	Put this command's shortcuts back as they were	Restaurar los métodos abreviados de este comando como estaban
+	Take the shortcut from the other command and select it	Quitar el método abreviado al otro comando y seleccionarlo
+	Undo Changes	Deshacer cambios
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut} está reservado por el sistema y no se puede asignar.
+	Low-Latency Drawing (vsync off, applies at next launch)	Dibujo de baja latencia (sin sincronización vertical, se aplica al volver a iniciar)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	Transformación libre aún se está aplicando; inténtelo de nuevo cuando termine.
+	The transform couldn't be applied.	No se pudo aplicar la transformación.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	Sus capas necesitan {needed} de memoria de GPU; el presupuesto les deja {budget}.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	Ajuste Memoria de GPU en Preferencias › Rendimiento a lo que pueda alojar su tarjeta gráfica, como máximo 3/8 de su memoria. Automático sigue Uso de memoria, dentro de una cuarta parte de la memoria de este equipo y 3/8 de la de la tarjeta, y no descuenta el documento en una tarjeta cuya memoria se conoce. Mientras no quepan, la barra de estado muestra Memoria de GPU llena.
+	GPU Memory Full	Memoria de GPU llena
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	Las capas necesitan {needed} de memoria de GPU y pueden ocupar {budget}, así que las ediciones que redibujan todo el documento lo hacen en la CPU. Haga clic para ajustar Memoria de GPU.
+	GPU memory budget: {budget}	Presupuesto de memoria de GPU: {budget}
+	This document's layers: {needed} of {budget} for layers	Capas de este documento: {needed} de {budget} para capas
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	Las capas de este documento necesitan {needed} pero pueden ocupar {budget}: los redibujados de todo el documento usan la CPU
+	GPU Memory (MB, 0 = Automatic)	Memoria de GPU (MB, 0 = Automático)
+	{name} was changed by another app after it was opened or saved here.	Otra aplicación cambió {name} después de abrirlo o guardarlo aquí.
+	Replace it with this document, or cancel and use File › Save As to keep both.	Reemplázalo con este documento, o cancela y usa Archivo › Guardar como para conservar ambos.
+	Decrease Brush Size	Reducir tamaño del pincel
+	Increase Brush Size	Aumentar tamaño del pincel
+	Decrease Brush Hardness	Reducir dureza del pincel
+	Increase Brush Hardness	Aumentar dureza del pincel
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index ba1de7b706..62b2e8ea26 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -2862,7 +2862,6 @@ cameraRaw	Blending	Fusion
 	Redrawing	Redessin
 	This redraw took {seconds} s on the CPU.	Ce redessin sur le CPU a pris {seconds} s.
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	Les modifications qui touchent tout le document, comme le mode de fusion, l'opacité ou la visibilité d'un calque, le redessinent entièrement.
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	Les calques dépassent le budget de mémoire GPU. Augmenter Utilisation de la mémoire dans Préférences › Performances relève ce budget, jusqu'au quart de la mémoire de cet ordinateur.
 	The GPU compositor wasn't used: {reason}	Le compositeur GPU n'a pas été utilisé : {reason}
 fontWeight	Thin	Ultrafin
 fontWeight	ExtraLight	Extrafin
@@ -3052,6 +3051,24 @@ cameraData	Lens	Objectif
 	Snap to Origin	Aligner sur l'origine
 	Search settings…	Rechercher des réglages…
 	No matching settings	Aucun réglage correspondant
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	Outil Pinceau d’échantillonnage
+	Sampling Area Overlay	Incrustation de la zone d’échantillonnage
+	Show Sampling Area	Afficher la zone d’échantillonnage
+	Indicates	Indique
+	Sampling Area	Zone d’échantillonnage
+	Excluded Area	Zone exclue
+	Sampling Area Options	Options de la zone d’échantillonnage
+	Rectangular	Rectangulaire
+	Fill Settings	Paramètres de remplissage
+	Rotation Adaptation	Adaptation de la rotation
+	Very High	Très élevée
+	Full	Totale
+	Mirror	Miroir
+	Output Settings	Paramètres de sortie
+	Output To	Sortie vers
+	Duplicate Layer	Dupliquer le calque
+	Contract	Contracter
 	Loading fonts…	Chargement des polices…
 	Response curve	Courbe de réponse
 	Tool	Outil
@@ -3194,3 +3211,30 @@ curves	Smooth	Lisser
 	set name	nom du jeu
 	{set} (modified)	{set} (modifié)
 	Random	Aléatoire
+	Accept and Go to Conflict	Accepter et aller au conflit
+	Changes undone.	Modifications annulées.
+	Choose a new shortcut for this command, or leave it without one.	Choisissez un nouveau raccourci pour cette commande ou laissez-la sans raccourci.
+	Put this command's shortcuts back as they were	Rétablir les raccourcis de cette commande
+	Take the shortcut from the other command and select it	Retirer le raccourci de l’autre commande et la sélectionner
+	Undo Changes	Annuler les modifications
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut} est réservé par le système et ne peut pas être attribué.
+	Low-Latency Drawing (vsync off, applies at next launch)	Dessin à faible latence (sans synchronisation verticale, au prochain lancement)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	La transformation manuelle est encore en cours d'application ; réessayez quand elle sera terminée.
+	The transform couldn't be applied.	Impossible d'appliquer la transformation.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	Ses calques ont besoin de {needed} de mémoire GPU ; le budget leur laisse {budget}.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	Réglez Mémoire GPU dans Préférences › Performances sur ce que votre carte graphique peut contenir, au plus 3/8 de sa mémoire. Automatique suit Utilisation de la mémoire, dans la limite du quart de la mémoire de cet ordinateur et des 3/8 de celle de la carte, et ne compte pas le document sur une carte dont la mémoire est connue. Tant qu'ils ne tiennent pas, la barre d'état affiche Mémoire GPU pleine.
+	GPU Memory Full	Mémoire GPU pleine
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	Les calques ont besoin de {needed} de mémoire GPU et peuvent en occuper {budget} : les modifications qui redessinent tout le document le font sur le CPU. Cliquez pour régler Mémoire GPU.
+	GPU memory budget: {budget}	Budget de mémoire GPU : {budget}
+	This document's layers: {needed} of {budget} for layers	Calques de ce document : {needed} sur {budget} pour les calques
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	Les calques de ce document ont besoin de {needed} mais peuvent occuper {budget} : le document entier se redessine sur le CPU
+	GPU Memory (MB, 0 = Automatic)	Mémoire GPU (Mo, 0 = Automatique)
+	Replace	Remplacer
+	{name} was changed by another app after it was opened or saved here.	{name} a été modifié par une autre application après avoir été ouvert ou enregistré ici.
+	Replace it with this document, or cancel and use File › Save As to keep both.	Remplacez-le par ce document, ou annulez et utilisez Fichier › Enregistrer sous pour garder les deux.
+	Decrease Brush Size	Réduire la taille du pinceau
+	Increase Brush Size	Augmenter la taille du pinceau
+	Decrease Brush Hardness	Réduire la dureté du pinceau
+	Increase Brush Hardness	Augmenter la dureté du pinceau
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index e26f3ec3b8..a52cb5fdba 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -3312,7 +3312,6 @@ cameraRaw	Yellow	Sárga
 	Interpret Footage	Videoanyag értelmezése
 	Interval	Intervallum
 	Invalid {mode} profile	Érvénytelen profil ({mode})
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	A dokumentum rétegei nem férnek el a GPU memóriakeretében. Ha a Beállítások › Teljesítmény alatt növeled a memóriahasználatot, a keret is nő, legfeljebb a számítógép memóriájának negyedéig.
 	Join us on Discord	Csatlakozz hozzánk a Discordon
 	Keep Using CPU	Marad a CPU
 	Kernel	Szűrőmag
@@ -4018,6 +4017,22 @@ cameraRaw	Yellow	Sárga
 	The layer or its mask changed. Drag the mask onto the Trash again.	A réteg vagy a maszkja megváltozott. Húzd újra a maszkot a Kukába.
 	Transform On Drop	Átalakítás elengedéskor
 	Vanishing Point is not active	Az Enyészpont nem aktív
+# Edit › Content-Aware Fill workspace
+	Excluded Area	Kizárt terület
+	Fill Settings	Kitöltési beállítások
+	Full	Teljes
+	Indicates	Jelzi
+	Mirror	Tükrözés
+	Output Settings	Kimeneti beállítások
+	Output To	Kimenet célja
+	Rectangular	Téglalap
+	Rotation Adaptation	Elforgatás-adaptáció
+	Sampling Area	Mintavételi terület
+	Sampling Area Options	Mintavételi terület beállításai
+	Sampling Area Overlay	Mintavételi terület átfedése
+	Sampling Brush Tool	Mintavételi ecset
+	Show Sampling Area	Mintavételi terület megjelenítése
+	Very High	Nagyon magas
 	Vanishing Point: click four corners to create a plane	Enyészpont: sík létrehozásához kattints a négy sarokra
 	Response curve	Válaszgörbe
 	Show home recent files	Legutóbbi fájlok megjelenítése a kezdőképernyőn
@@ -4108,3 +4123,29 @@ cameraRaw	Yellow	Sárga
 	There are too many sets: delete one first.	Túl sok készlet van: előbb töröljön egyet.
 	set name	készlet neve
 	{set} (modified)	{set} (módosítva)
+	Accept and Go to Conflict	Elfogadás és ugrás az ütközéshez
+	Changes undone.	Változások visszavonva.
+	Choose a new shortcut for this command, or leave it without one.	Válasszon új billentyűparancsot ehhez a parancshoz, vagy hagyja nélküle.
+	Put this command's shortcuts back as they were	A parancs billentyűparancsainak visszaállítása
+	Take the shortcut from the other command and select it	A billentyűparancs elvétele a másik parancstól, és annak kijelölése
+	Undo Changes	Változások visszavonása
+	{shortcut} is reserved by the system and can't be assigned.	A(z) {shortcut} a rendszer számára fenntartott, nem rendelhető hozzá.
+	Low-Latency Drawing (vsync off, applies at next launch)	Kis késleltetésű rajzolás (vsync nélkül, a következő indításkor lép életbe)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	A szabad alakítás alkalmazása még folyamatban van; próbáld újra, ha befejeződött.
+	The transform couldn't be applied.	Az átalakítás nem alkalmazható.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	A rétegeknek {needed} GPU-memória kell; a keret {budget} hagy nekik.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	A Beállítások › Teljesítmény alatt állítsd a GPU-memóriát arra, amennyit a videokártyád elbír, legfeljebb a memóriája 3/8-ára. Az Automatikus a memóriahasználatot követi, a számítógép memóriájának negyedén és a kártya 3/8-án belül, és ismert memóriájú kártyánál nem számítja bele a dokumentumot. Amíg nem férnek el, az állapotsor a GPU-memória megtelt üzenetet mutatja.
+	GPU Memory Full	GPU-memória megtelt
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	A rétegeknek {needed} GPU-memória kell, és {budget} foglalhatnak, ezért a teljes dokumentumot újrarajzoló szerkesztések a CPU-n futnak. Kattints a GPU-memória beállításához.
+	GPU memory budget: {budget}	GPU-memóriakeret: {budget}
+	This document's layers: {needed} of {budget} for layers	A dokumentum rétegei: {needed} / {budget} a rétegeknek
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	A dokumentum rétegeinek {needed} kell, de {budget} foglalhatnak: a teljes dokumentum újrarajzolása a CPU-n fut
+	GPU Memory (MB, 0 = Automatic)	GPU-memória (MB, 0 = Automatikus)
+	{name} was changed by another app after it was opened or saved here.	A(z) {name} fájlt egy másik alkalmazás módosította, miután itt megnyitották vagy mentették.
+	Replace it with this document, or cancel and use File › Save As to keep both.	Cserélje le erre a dokumentumra, vagy válassza a Mégse gombot, és a Fájl › Mentés másként paranccsal tartsa meg mindkettőt.
+	Decrease Brush Size	Ecsetméret csökkentése
+	Increase Brush Size	Ecsetméret növelése
+	Decrease Brush Hardness	Ecsetkeménység csökkentése
+	Increase Brush Hardness	Ecsetkeménység növelése
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index d13db9f0cf..14e65b2b72 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -2849,7 +2849,6 @@ cameraRaw	Blending	Pembauran
 	Redrawing	Menggambar ulang
 	This redraw took {seconds} s on the CPU.	Penggambaran ulang di CPU ini memakan waktu {seconds} dtk.
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	Suntingan yang mengubah seluruh dokumen, seperti mode campuran, opasitas, atau visibilitas layer, menggambar ulang semuanya.
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	Layer tidak muat dalam anggaran memori GPU. Menaikkan Pemakaian memori di Preferensi › Performa menaikkan anggaran, hingga seperempat memori komputer ini.
 	The GPU compositor wasn't used: {reason}	Kompositor GPU tidak digunakan: {reason}
 fontWeight	Thin	Sangat Tipis
 fontWeight	ExtraLight	Ekstra Tipis
@@ -3039,6 +3038,24 @@ cameraData	Lens	Lensa
 	Snap to Origin	Jepret ke Titik Asal
 	Search settings…	Cari pengaturan…
 	No matching settings	Tidak ada pengaturan yang cocok
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	Alat Kuas Pengambilan Sampel
+	Sampling Area Overlay	Hamparan Area Pengambilan Sampel
+	Show Sampling Area	Tampilkan Area Pengambilan Sampel
+	Indicates	Menandai
+	Sampling Area	Area Pengambilan Sampel
+	Excluded Area	Area yang Dikecualikan
+	Sampling Area Options	Opsi Area Pengambilan Sampel
+	Rectangular	Persegi Panjang
+	Fill Settings	Pengaturan Isian
+	Rotation Adaptation	Adaptasi Rotasi
+	Very High	Sangat Tinggi
+	Full	Penuh
+	Mirror	Cermin
+	Output Settings	Pengaturan Keluaran
+	Output To	Keluaran Ke
+	Duplicate Layer	Duplikat Layer
+	Contract	Ciutkan
 	Loading fonts…	Memuat font…
 	Response curve	Kurva respons
 	Tool	Alat
@@ -3181,3 +3198,30 @@ curves	Smooth	Haluskan
 	set name	nama set
 	{set} (modified)	{set} (diubah)
 	Random	Acak
+	Accept and Go to Conflict	Terima dan Buka Konflik
+	Changes undone.	Perubahan dibatalkan.
+	Choose a new shortcut for this command, or leave it without one.	Pilih pintasan baru untuk perintah ini, atau biarkan tanpa pintasan.
+	Put this command's shortcuts back as they were	Kembalikan pintasan perintah ini seperti semula
+	Take the shortcut from the other command and select it	Ambil pintasan dari perintah lain dan pilih perintah itu
+	Undo Changes	Batalkan Perubahan
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut} dicadangkan oleh sistem dan tidak dapat ditetapkan.
+	Low-Latency Drawing (vsync off, applies at next launch)	Menggambar latensi rendah (tanpa vsync, berlaku saat peluncuran berikutnya)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	Transformasi Bebas masih diterapkan; coba lagi setelah selesai.
+	The transform couldn't be applied.	Transformasi tidak dapat diterapkan.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	Layer-nya membutuhkan {needed} memori GPU; anggaran menyisakan {budget}.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	Atur Memori GPU di Preferensi › Performa sesuai kapasitas kartu grafis Anda, paling banyak 3/8 memorinya. Otomatis mengikuti Pemakaian memori, dalam seperempat memori komputer ini dan 3/8 memori kartu, dan tidak membebankan dokumen pada kartu yang memorinya diketahui. Selama belum muat, bilah status menampilkan Memori GPU Penuh.
+	GPU Memory Full	Memori GPU Penuh
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	Layer membutuhkan {needed} memori GPU dan boleh memakai {budget}, sehingga suntingan yang menggambar ulang seluruh dokumen melakukannya di CPU. Klik untuk mengatur Memori GPU.
+	GPU memory budget: {budget}	Anggaran memori GPU: {budget}
+	This document's layers: {needed} of {budget} for layers	Layer dokumen ini: {needed} dari {budget} untuk layer
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	Layer dokumen ini membutuhkan {needed} tetapi boleh memakai {budget}: penggambaran ulang seluruh dokumen memakai CPU
+	GPU Memory (MB, 0 = Automatic)	Memori GPU (MB, 0 = Otomatis)
+	Replace	Ganti
+	{name} was changed by another app after it was opened or saved here.	{name} diubah oleh aplikasi lain setelah dibuka atau disimpan di sini.
+	Replace it with this document, or cancel and use File › Save As to keep both.	Ganti dengan dokumen ini, atau batalkan dan gunakan Berkas › Simpan Sebagai untuk menyimpan keduanya.
+	Decrease Brush Size	Perkecil ukuran kuas
+	Increase Brush Size	Perbesar ukuran kuas
+	Decrease Brush Hardness	Kurangi kekerasan kuas
+	Increase Brush Hardness	Tambah kekerasan kuas
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index 1779c1259e..857cc66d96 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -2512,7 +2512,6 @@ cameraRaw	Amount	Quantità
 	Redrawing	Ridisegno
 	This redraw took {seconds} s on the CPU.	Questo ridisegno sulla CPU ha richiesto {seconds} s.
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	Le modifiche che cambiano tutto il documento, come metodo di fusione, opacità o visibilità di un livello, lo ridisegnano per intero.
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	I livelli non rientrano nel budget di memoria della GPU. Aumentare Uso memoria in Preferenze › Prestazioni alza il budget, fino a un quarto della memoria di questo computer.
 	The GPU compositor wasn't used: {reason}	Il compositore GPU non è stato usato: {reason}
 fontWeight	Thin	Sottile
 fontWeight	ExtraLight	Extraleggero
@@ -2706,6 +2705,22 @@ cameraData	Lens	Obiettivo
 	Snap to Origin	Aggancia all'origine
 	Search settings…	Cerca impostazioni…
 	No matching settings	Nessuna impostazione corrispondente
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	Strumento Pennello di campionamento
+	Sampling Area Overlay	Sovrapposizione area di campionamento
+	Show Sampling Area	Mostra area di campionamento
+	Indicates	Indica
+	Sampling Area	Area di campionamento
+	Excluded Area	Area esclusa
+	Sampling Area Options	Opzioni area di campionamento
+	Rectangular	Rettangolare
+	Fill Settings	Impostazioni di riempimento
+	Rotation Adaptation	Adattamento rotazione
+	Very High	Molto alta
+	Full	Completa
+	Mirror	Rifletti
+	Output Settings	Impostazioni di output
+	Output To	Output in
 	Loading fonts…	Caricamento font…
 	Response curve	Curva di risposta
 	Tool	Strumento
@@ -4310,3 +4325,25 @@ shape	Appearance	Aspetto
 	There are too many sets: delete one first.	Ci sono troppi set: eliminane prima uno.
 	set name	nome del set
 	{set} (modified)	{set} (modificato)
+	Accept and Go to Conflict	Accetta e vai al conflitto
+	Changes undone.	Modifiche annullate.
+	Choose a new shortcut for this command, or leave it without one.	Scegli una nuova scorciatoia per questo comando o lascialo senza.
+	Put this command's shortcuts back as they were	Ripristina le scorciatoie di questo comando com'erano
+	Take the shortcut from the other command and select it	Togli la scorciatoia all'altro comando e selezionalo
+	Undo Changes	Annulla modifiche
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut} è riservata dal sistema e non può essere assegnata.
+	Low-Latency Drawing (vsync off, applies at next launch)	Disegno a bassa latenza (senza vsync, si applica al prossimo avvio)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	Trasformazione libera è ancora in corso di applicazione; riprova quando è terminata.
+	The transform couldn't be applied.	Impossibile applicare la trasformazione.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	I livelli richiedono {needed} di memoria GPU; il budget ne lascia {budget}.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	Imposta Memoria GPU in Preferenze › Prestazioni su quanto può contenere la tua scheda grafica, al massimo 3/8 della sua memoria. Automatico segue Uso memoria, entro un quarto della memoria di questo computer e 3/8 di quella della scheda, e non conta il documento su una scheda la cui memoria è nota. Finché non ci stanno, la barra di stato mostra Memoria GPU piena.
+	GPU Memory Full	Memoria GPU piena
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	I livelli richiedono {needed} di memoria GPU e possono occuparne {budget}, quindi le modifiche che ridisegnano tutto il documento lo fanno sulla CPU. Fai clic per impostare Memoria GPU.
+	GPU memory budget: {budget}	Budget di memoria GPU: {budget}
+	This document's layers: {needed} of {budget} for layers	Livelli di questo documento: {needed} su {budget} per i livelli
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	I livelli di questo documento richiedono {needed} ma possono occupare {budget}: i ridisegni dell'intero documento usano la CPU
+	GPU Memory (MB, 0 = Automatic)	Memoria GPU (MB, 0 = Automatico)
+	{name} was changed by another app after it was opened or saved here.	{name} è stato modificato da un'altra app dopo essere stato aperto o salvato qui.
+	Replace it with this document, or cancel and use File › Save As to keep both.	Sostituiscilo con questo documento, oppure annulla e usa File › Salva con nome per tenerli entrambi.
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index dd0cca727f..b14f5c1192 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -2413,7 +2413,6 @@ cameraRaw	Color	カラー
 	Redrawing	再描画中
 	This redraw took {seconds} s on the CPU.	この再描画は CPU で {seconds} 秒かかりました。
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	レイヤーの描画モード、不透明度、表示/非表示など、ドキュメント全体に関わる編集では全体が再描画されます。
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	レイヤーが GPU メモリの予算に収まりません。環境設定 › パフォーマンスのメモリ使用量を増やすと、このコンピューターのメモリの4分の1まで予算が増えます。
 	The GPU compositor wasn't used: {reason}	GPU コンポジターは使用されませんでした: {reason}
 fontWeight	Thin	極細
 fontWeight	ExtraLight	特細
@@ -3647,6 +3646,22 @@ cameraData	Lens	レンズ
 	Snap to Origin	原点にスナップ
 	Search settings…	設定を検索…
 	No matching settings	一致する設定はありません
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	サンプリングブラシツール
+	Sampling Area Overlay	サンプリング領域のオーバーレイ
+	Show Sampling Area	サンプリング領域を表示
+	Indicates	表示対象
+	Sampling Area	サンプリング領域
+	Excluded Area	除外された領域
+	Sampling Area Options	サンプリング領域オプション
+	Rectangular	長方形
+	Fill Settings	塗りつぶし設定
+	Rotation Adaptation	回転への適応
+	Very High	非常に高い
+	Full	フル
+	Mirror	ミラー
+	Output Settings	出力設定
+	Output To	出力先
 	Loading fonts…	フォントを読み込み中…
 	Response curve	応答カーブ
 	Simulate Pressure	筆圧をシミュレート
@@ -3865,3 +3880,30 @@ curves	Smooth	スムーズ
 	There are too many sets: delete one first.	セットが多すぎます。先に 1 つ削除してください。
 	set name	セット名
 	{set} (modified)	{set}（変更あり）
+	Accept and Go to Conflict	適用して競合へ移動
+	Changes undone.	変更を取り消しました。
+	Choose a new shortcut for this command, or leave it without one.	このコマンドに新しいショートカットを選択するか、なしのままにしてください。
+	Put this command's shortcuts back as they were	このコマンドのショートカットを元に戻す
+	Take the shortcut from the other command and select it	もう一方のコマンドからショートカットを外して選択
+	Undo Changes	変更を取り消し
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut} はシステムで予約されているため割り当てられません。
+	Low-Latency Drawing (vsync off, applies at next launch)	低遅延描画（垂直同期オフ、次回起動時に適用）
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	自由変形を適用中です。完了してからもう一度お試しください。
+	The transform couldn't be applied.	変形を適用できませんでした。
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	レイヤーには {needed} の GPU メモリが必要ですが、予算で使えるのは {budget} です。
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	環境設定 › パフォーマンスの GPU メモリを、グラフィックカードが保持できる量（最大でメモリの 3/8）に設定してください。自動はメモリ使用量に従い、このコンピューターのメモリの4分の1とカードの 3/8 の範囲内で、メモリ量がわかるカードではドキュメント分を差し引きません。収まらない間、ステータスバーに「GPU メモリ不足」と表示されます。
+	GPU Memory Full	GPU メモリ不足
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	レイヤーには {needed} の GPU メモリが必要ですが、使えるのは {budget} のため、ドキュメント全体を再描画する編集は CPU で行われます。クリックして GPU メモリを設定します。
+	GPU memory budget: {budget}	GPU メモリ予算: {budget}
+	This document's layers: {needed} of {budget} for layers	このドキュメントのレイヤー: レイヤー用 {budget} のうち {needed}
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	このドキュメントのレイヤーには {needed} が必要ですが、使えるのは {budget} です: ドキュメント全体の再描画は CPU で行われます
+	GPU Memory (MB, 0 = Automatic)	GPU メモリ（MB、0 = 自動）
+	Replace	置き換え
+	{name} was changed by another app after it was opened or saved here.	{name} は、ここで開くか保存した後に別のアプリで変更されました。
+	Replace it with this document, or cancel and use File › Save As to keep both.	この書類で置き換えるか、キャンセルしてファイル › 名前を付けて保存で両方を残してください。
+	Decrease Brush Size	ブラシサイズを小さく
+	Increase Brush Size	ブラシサイズを大きく
+	Decrease Brush Hardness	ブラシの硬さを下げる
+	Increase Brush Hardness	ブラシの硬さを上げる
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index f5c243d1e5..ce06b65cdc 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -507,7 +507,7 @@
 	Save Default Type Styles	기본 문자 스타일 저장
 	Deselect	선택 해제
 	Reselect	다시 선택
-	Inverse	반대로
+	Inverse	반전
 	Inverse Selection	선택 영역 반전
 	Similar	유사한 항목
 	Color Range…	색상 범위…
@@ -1399,10 +1399,10 @@
 	Imported {n} shortcuts from {file}. Click OK to keep them.	{file}에서 단축키 {n}개를 가져왔습니다. 유지하려면 확인을 클릭하세요.
 	{n} commands are not in PhotoCraft.	명령 {n}개는 PhotoCraft에 없습니다.
 	Keyboard shortcuts imported	키보드 단축키를 가져왔습니다
-	Your keyboard shortcut set {set} is in use here: {n} shortcuts differ from the defaults. Edit › Keyboard Shortcuts shows them; Reset All to Defaults undoes this.	키보드 단축키 세트 {set}을(를) 여기서 사용합니다. 단축키 {n}개가 기본값과 다릅니다. 편집 › 키보드 단축키에서 확인할 수 있고, 모두 기본값으로 재설정으로 되돌릴 수 있습니다.
-	Import keyboard shortcuts?	키보드 단축키를 가져올까요?
-	PhotoCraft found your keyboard shortcut set {set} from another image editor on this computer: {n} of its shortcuts differ from PhotoCraft's. Import it?	PhotoCraft가 이 컴퓨터에서 다른 이미지 편집기의 키보드 단축키 세트 {set}을(를) 찾았습니다. 단축키 {n}개가 PhotoCraft와 다릅니다. 가져올까요?
-	Edit › Keyboard Shortcuts › Reset All to Defaults undoes an import.	편집 › 키보드 단축키 › 모두 기본값으로 재설정으로 가져오기를 되돌릴 수 있습니다.
+	Your keyboard shortcut set {set} is in use here: {n} shortcuts differ from the defaults. Edit › Keyboard Shortcuts shows them; Reset All to Defaults undoes this.	키보드 단축키 세트 {set}을(를) 여기서 사용합니다. 단축키 {n}개가 기본값과 다릅니다. 편집 › 키보드 단축키에서 확인할 수 있고, 모두 기본값으로 초기화로 되돌릴 수 있습니다.
+	Import keyboard shortcuts?	키보드 단축키를 가져오시겠습니까?
+	PhotoCraft found your keyboard shortcut set {set} from another image editor on this computer: {n} of its shortcuts differ from PhotoCraft's. Import it?	PhotoCraft가 이 컴퓨터에서 다른 이미지 편집기의 키보드 단축키 세트 {set}을(를) 찾았습니다. 단축키 {n}개가 PhotoCraft와 다릅니다. 가져오시겠습니까?
+	Edit › Keyboard Shortcuts › Reset All to Defaults undoes an import.	편집 › 키보드 단축키 › 모두 기본값으로 초기화를 누르면 가져오기를 되돌릴 수 있습니다.
 	Don't Import	가져오지 않음
 	The keyboard shortcut set was not imported: {error}	키보드 단축키 세트를 가져오지 못했습니다: {error}
 	Reset Section	섹션 초기화
@@ -1817,8 +1817,8 @@
 	Zoom Tool	돋보기 도구
 	{name} Properties	{name} 속성
 	Revert “{name}” to the last saved version? Your changes will be lost.	“{name}”을(를) 마지막으로 저장한 버전으로 되돌릴까요? 변경 사항이 사라집니다.
-	Do you want to save the changes you made to “{name}” before quitting?	종료하기 전에 “{name}”의 변경 사항을 저장할까요?
-	Do you want to save the changes you made to “{name}” before closing?	닫기 전에 “{name}”의 변경 사항을 저장할까요?
+	Do you want to save the changes you made to “{name}” before quitting?	종료하기 전에 “{name}”의 변경 사항을 저장하시겠습니까?
+	Do you want to save the changes you made to “{name}” before closing?	닫기 전에 “{name}”의 변경 사항을 저장하시겠습니까?
 	Doc: {flat}/{layered}	문서: {flat}/{layered}
 	Scratch: {size}	스크래치: {size}
 	Untagged {mode}	프로파일 없는 {mode}
@@ -2127,12 +2127,12 @@
 	The current gradient (pick one in Window › Gradients)	현재 그레이디언트(창 › 그레이디언트에서 선택)
 	Select a type layer to edit its character and paragraph settings.	문자 및 단락 설정을 편집하려면 문자 레이어를 선택하세요.
 # Gradient Editor window, opened from the options bar's gradient swatch.
-	Gradient Editor	그라디언트 편집기
-	Gradient picker	그라디언트 선택기
-	Save As Preset	프리셋으로 저장
-	The gradient the Gradient tool paints with	그라디언트 도구가 칠하는 그라디언트입니다
-	Adds the current gradient to the Gradients panel	현재 그라디언트를 그라디언트 패널에 추가합니다
-	Gradient stops	그라디언트 스톱
+	Gradient Editor	그레이디언트 편집기
+	Gradient picker	그레이디언트 선택기
+	Save As Preset	사전 설정으로 저장
+	The gradient the Gradient tool paints with	그레이디언트 도구가 칠하는 그레이디언트입니다
+	Adds the current gradient to the Gradients panel	현재 그레이디언트를 그레이디언트 패널에 추가합니다
+	Gradient stops	그레이디언트 스톱
 	Text color	텍스트 색상
 	Type Options	문자 옵션
 	Anti-aliasing method	앤티 앨리어스 방식
@@ -3022,7 +3022,6 @@ cameraRaw	Color	색상
 	Redrawing	다시 그리는 중
 	This redraw took {seconds} s on the CPU.	이번 다시 그리기는 CPU에서 {seconds}초 걸렸습니다.
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	레이어의 혼합 모드, 불투명도, 표시 여부처럼 문서 전체를 바꾸는 편집은 문서 전체를 다시 그립니다.
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	레이어가 GPU 메모리 예산에 맞지 않습니다. 환경 설정 › 성능에서 메모리 사용량을 늘리면 이 컴퓨터 메모리의 4분의 1까지 예산이 늘어납니다.
 	The GPU compositor wasn't used: {reason}	GPU 합성기를 사용하지 않았습니다: {reason}
 fontWeight	Thin	아주 가늘게
 fontWeight	ExtraLight	더 가늘게
@@ -3042,7 +3041,7 @@ fontWeight	Italic	기울임
 	Rotate View	보기 회전
 	Rotate View Tool	보기 회전 도구
 	Reset View	보기 재설정
-	Drag around the centre to rotate the view  ·  Shift constrains to 15°	중심 주위를 드래그해 보기를 회전합니다  ·  Shift는 15°로 제한
+	Drag around the centre to rotate the view  ·  Shift constrains to 15°	중심 주위를 드래그해 보기 회전  ·  Shift로 15° 단위 제한
 
 # Painting symmetry presets.
 	Dual Axis	이중 축
@@ -3071,7 +3070,7 @@ fontWeight	Italic	기울임
 	PhotoCraft — Screen Color Picker	PhotoCraft — 화면 색상 선택기
 
 	Rasterize svg groups deeper than	이 깊이보다 깊은 SVG 그룹 래스터화
-	0 turns this threshold off; SVG groups nested deeper than 100 levels are always rasterized.	0이면 이 임계값을 끕니다. 100단계보다 깊이 중첩된 SVG 그룹은 항상 래스터화됩니다.
+	0 turns this threshold off; SVG groups nested deeper than 100 levels are always rasterized.	0이면 이 한계값을 끕니다. 100단계보다 깊이 중첩된 SVG 그룹은 항상 래스터화됩니다.
 	Rule of Thirds	삼등분 법칙
 	Golden Ratio	황금 비율
 	Golden Spiral	황금 나선
@@ -3141,15 +3140,15 @@ fontWeight	Italic	기울임
 	Dashed line	파선
 	Dash	선
 	Gap	간격
-	Dash / gap lengths × stroke width	선 / 간격 길이 × 획 너비
+	Dash / gap lengths × stroke width	선 / 간격 길이 × 획 폭
 	Add pair	쌍 추가
 	Remove pair	쌍 제거
 	Dash offset	파선 오프셋
 	Open paths use centered strokes	열린 패스는 가운데 획을 사용합니다
 	Use finite lengths and a positive pattern total	유한한 길이와 양수 패턴 합계를 사용하세요
-	No subject found — try Object Selection or the Lasso	피사체를 찾을 수 없습니다 — 개체 선택 또는 올가미를 사용해 보세요
+	No subject found — try Object Selection or the Lasso	피사체를 찾을 수 없습니다 — 오브젝트 선택 또는 올가미를 사용해 보세요
 	Quick Selection found nothing there	빠른 선택으로 해당 위치에서 아무것도 찾지 못했습니다
-	Object Selection found nothing there — try a tighter rectangle	개체 선택으로 해당 위치에서 아무것도 찾지 못했습니다 — 더 좁은 사각형을 사용해 보세요
+	Object Selection found nothing there — try a tighter rectangle	오브젝트 선택으로 해당 위치에서 아무것도 찾지 못했습니다 — 더 좁은 사각형을 사용해 보세요
 	No subject found — try a rectangle around the object	피사체를 찾을 수 없습니다 — 개체 주위에 사각형을 그려 보세요
 	Auto Erase	자동 지우기
 	Click the first point or press {key} to close · {del} removes a point · Esc cancels	첫 점을 클릭하거나 {key}를 눌러 닫기 · {del}로 점 제거 · Esc로 취소
@@ -3220,6 +3219,22 @@ cameraData	Lens	렌즈
 	Snap to Origin	원점에 스냅
 	Search settings…	설정 검색…
 	No matching settings	일치하는 설정 없음
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	샘플링 브러시 도구
+	Sampling Area Overlay	샘플링 영역 오버레이
+	Show Sampling Area	샘플링 영역 표시
+	Indicates	표시 대상
+	Sampling Area	샘플링 영역
+	Excluded Area	제외 영역
+	Sampling Area Options	샘플링 영역 옵션
+	Rectangular	사각형
+	Fill Settings	채우기 설정
+	Rotation Adaptation	회전 적응
+	Very High	매우 높음
+	Full	전체
+	Mirror	미러
+	Output Settings	출력 설정
+	Output To	출력 위치
 	Loading fonts…	글꼴 불러오는 중…
 	Response curve	응답 곡선
 	Simulate Pressure	압력 시뮬레이션
@@ -3367,3 +3382,30 @@ curves	Smooth	매끄럽게
 	There are too many sets: delete one first.	세트가 너무 많습니다. 먼저 하나를 삭제하세요.
 	set name	세트 이름
 	{set} (modified)	{set}(수정됨)
+	Accept and Go to Conflict	적용 후 충돌 항목으로 이동
+	Changes undone.	변경 사항을 취소했습니다.
+	Choose a new shortcut for this command, or leave it without one.	이 명령의 새 단축키를 선택하거나 단축키 없이 두세요.
+	Put this command's shortcuts back as they were	이 명령의 단축키를 원래대로 되돌리기
+	Take the shortcut from the other command and select it	다른 명령에서 단축키를 빼고 그 명령 선택
+	Undo Changes	변경 사항 취소
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut}은(는) 시스템에서 예약되어 할당할 수 없습니다.
+	Low-Latency Drawing (vsync off, applies at next launch)	저지연 그리기(수직 동기화 끔, 다음 실행 시 적용)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	자유 변형을 아직 적용하는 중입니다. 완료된 후 다시 시도하세요.
+	The transform couldn't be applied.	변형을 적용할 수 없습니다.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	레이어에 GPU 메모리 {needed}가 필요하지만 예산은 {budget}만 남겨 둡니다.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	환경 설정 › 성능에서 GPU 메모리를 그래픽 카드가 감당할 수 있는 양으로 설정하세요(최대 카드 메모리의 3/8). 자동은 메모리 사용량을 따르며, 이 컴퓨터 메모리의 4분의 1과 카드 메모리의 3/8 이내이고, 메모리를 알 수 있는 카드에서는 문서를 차감하지 않습니다. 맞지 않는 동안 상태 표시줄에 GPU 메모리 부족이 표시됩니다.
+	GPU Memory Full	GPU 메모리 부족
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	레이어에 GPU 메모리 {needed}가 필요하지만 {budget}만 사용할 수 있어 문서 전체를 다시 그리는 편집은 CPU에서 처리됩니다. 클릭하여 GPU 메모리를 설정합니다.
+	GPU memory budget: {budget}	GPU 메모리 예산: {budget}
+	This document's layers: {needed} of {budget} for layers	이 문서의 레이어: 레이어용 {budget} 중 {needed}
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	이 문서의 레이어에 {needed}가 필요하지만 {budget}만 사용할 수 있습니다: 문서 전체 다시 그리기는 CPU를 사용합니다
+	GPU Memory (MB, 0 = Automatic)	GPU 메모리(MB, 0 = 자동)
+	Replace	대치
+	{name} was changed by another app after it was opened or saved here.	{name}이(가) 여기서 열거나 저장한 뒤 다른 앱에서 변경되었습니다.
+	Replace it with this document, or cancel and use File › Save As to keep both.	이 문서로 대치하거나, 취소하고 파일 › 다른 이름으로 저장을 사용해 둘 다 보관하세요.
+	Decrease Brush Size	브러시 크기 줄이기
+	Increase Brush Size	브러시 크기 늘리기
+	Decrease Brush Hardness	브러시 경도 줄이기
+	Increase Brush Hardness	브러시 경도 늘리기
diff --git a/crates/ui-egui/src/i18n/live_tests.rs b/crates/ui-egui/src/i18n/live_tests.rs
index 89c47ef1ac..7d8d6457ef 100644
--- a/crates/ui-egui/src/i18n/live_tests.rs
+++ b/crates/ui-egui/src/i18n/live_tests.rs
@@ -42,6 +42,46 @@ fn ukrainian_native_app_menu_keeps_product_and_language_names() {
     });
 }
 
+#[test]
+fn ukrainian_color_picker_titles_draw_in_the_selected_language() {
+    with_language(Lang::EN, || {
+        for (target, expected) in [("foreground", "Вибір кольору (основний колір)"), ("background", "Вибір кольору (колір тла)")]
+        {
+            let mut h = harness();
+            h.state_mut().run("prefs.set", json!({"path": "interface.language", "value": "uk"})).unwrap();
+            crate::color_picker_ui::open(h.state_mut(), target);
+            h.run_steps(4);
+            let text = drawn_text(&h);
+            assert!(text.iter().any(|text| text == expected), "missing title {expected}");
+            assert!(!text.iter().any(|text| text.starts_with("Color Picker")), "no English picker title");
+        }
+        assert_eq!(tr(lang("uk"), "Color Picker (Custom Canvas Color)"), "Вибір кольору (власний колір полотна)");
+    });
+}
+
+#[test]
+fn ukrainian_rasterize_prompts_explain_the_loss_of_editable_content() {
+    use crate::rasterize_prompt::Kind;
+
+    for kind in Kind::ALL {
+        let translated = tr(lang("uk"), kind.message());
+        assert_ne!(translated, kind.message(), "{kind:?}: the warning must be translated");
+        assert!(translated.contains("більше не можна буде редагувати"), "{kind:?}: explain the loss of editability");
+    }
+    with_language(Lang::EN, || {
+        let mut h = harness();
+        h.state_mut().run("prefs.set", json!({"path": "interface.language", "value": "uk"})).unwrap();
+        h.state_mut().run("type.create", json!({"text": "Editable text"})).unwrap();
+        let layer = h.state().session.active().unwrap().active_layer.unwrap();
+        crate::rasterize_prompt::open(h.state_mut(), Kind::Type, layer, crate::state::Tool::Brush, [10.0, 10.0, 1.0]);
+        h.run_steps(4);
+        let expected = tr(lang("uk"), Kind::Type.message());
+        let text = drawn_text(&h);
+        assert!(text.iter().any(|text| text == expected), "the actual dialog draws the Ukrainian warning");
+        assert!(!text.iter().any(|text| text == Kind::Type.message()));
+    });
+}
+
 #[test]
 fn french_and_korean_plural_messages_keep_placeholders() {
     for (n, expected) in [(0, "0 élément"), (1, "1 élément"), (2, "2 éléments"), (21, "21 éléments")] {
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index b976e395fc..c7a0d574b2 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -514,6 +514,21 @@ mod tests {
         assert_eq!(Lang::from_pref("xx-unknown"), Lang::EN);
     }
 
+    /// The brush size/hardness shortcut rows (`tools.*` commands without a menu item) must be translated in
+    /// every catalog, or they show English in the Keyboard Shortcuts dialog and cannot be found by searching.
+    #[test]
+    fn brush_size_and_hardness_shortcuts_are_translated_in_every_language() {
+        let keys = ["Decrease Brush Size", "Increase Brush Size", "Decrease Brush Hardness", "Increase Brush Hardness"];
+        for lang in Lang::all().filter(|lang| *lang != Lang::EN) {
+            for key in keys {
+                assert!(has(lang, key), "{} has no translation for {key:?}", lang.code());
+            }
+        }
+        let zh = Lang::from_code("zh-hans").expect("zh-hans registered");
+        assert_eq!(tr(zh, "Decrease Brush Size"), "减小画笔大小");
+        assert_eq!(tr(zh, "Increase Brush Size"), "增大画笔大小");
+    }
+
     #[test]
     fn simplified_chinese_covers_dynamic_shortcuts_and_layer_counts() {
         let zh = Lang::from_code("zh-hans").expect("zh-hans registered");
diff --git a/crates/ui-egui/src/i18n/nl.tsv b/crates/ui-egui/src/i18n/nl.tsv
index aea44757ca..394aaecbbb 100644
--- a/crates/ui-egui/src/i18n/nl.tsv
+++ b/crates/ui-egui/src/i18n/nl.tsv
@@ -2441,7 +2441,6 @@ layerLabel	No Color	Geen kleur
 	Redrawing	Opnieuw tekenen
 	This redraw took {seconds} s on the CPU.	Opnieuw tekenen duurde {seconds} s op de CPU.
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	Bewerkingen die het hele document veranderen, zoals de overvloeimodus, dekking of zichtbaarheid van een laag, tekenen alles opnieuw.
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	De lagen passen niet binnen het GPU-geheugenbudget. Door Geheugengebruik te verhogen in Voorkeuren › Prestaties wordt het budget groter, tot een kwart van het geheugen van deze computer.
 	The GPU compositor wasn't used: {reason}	De GPU-compositor is niet gebruikt: {reason}
 cameraRaw	Light	Licht
 fontWeight	Thin	Dun
@@ -3791,6 +3790,22 @@ cameraData	Lens	Lens
 	Search settings…	Instellingen zoeken…
 	No matching settings	Geen overeenkomende instellingen
 	PhotoCraft — Screen Color Picker	PhotoCraft — Schermkleurkiezer
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	Gereedschap Monsterpenseel
+	Sampling Area Overlay	Overlay van monstergebied
+	Show Sampling Area	Monstergebied tonen
+	Indicates	Geeft aan
+	Sampling Area	Monstergebied
+	Excluded Area	Uitgesloten gebied
+	Sampling Area Options	Opties voor monstergebied
+	Rectangular	Rechthoekig
+	Fill Settings	Vulinstellingen
+	Rotation Adaptation	Rotatieaanpassing
+	Very High	Zeer hoog
+	Full	Volledig
+	Mirror	Spiegelen
+	Output Settings	Uitvoerinstellingen
+	Output To	Uitvoer naar
 	Loading fonts…	Lettertypen laden…
 	Response curve	Responscurve
 	Simulate Pressure	Druk simuleren
@@ -3949,3 +3964,29 @@ curves	Smooth	Vloeiend maken
 	There are too many sets: delete one first.	Er zijn te veel sets: verwijder er eerst een.
 	set name	naam van de set
 	{set} (modified)	{set} (gewijzigd)
+	Accept and Go to Conflict	Accepteren en naar conflict
+	Changes undone.	Wijzigingen ongedaan gemaakt.
+	Choose a new shortcut for this command, or leave it without one.	Kies een nieuwe sneltoets voor deze opdracht of laat hem zonder.
+	Put this command's shortcuts back as they were	De sneltoetsen van deze opdracht herstellen
+	Take the shortcut from the other command and select it	De sneltoets van de andere opdracht afnemen en die selecteren
+	Undo Changes	Wijzigingen ongedaan maken
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut} is door het systeem gereserveerd en kan niet worden toegewezen.
+	Low-Latency Drawing (vsync off, applies at next launch)	Tekenen met lage latentie (zonder vsync, na de volgende start)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	Vrije transformatie wordt nog toegepast; probeer het opnieuw als die klaar is.
+	The transform couldn't be applied.	De transformatie kon niet worden toegepast.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	De lagen hebben {needed} GPU-geheugen nodig; het budget laat ze {budget}.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	Stel GPU-geheugen in bij Voorkeuren › Prestaties op wat uw videokaart aankan, hooguit 3/8 van haar geheugen. Automatisch volgt Geheugengebruik, binnen een kwart van het geheugen van deze computer en 3/8 van dat van de kaart, en rekent het document niet af van een kaart waarvan het geheugen bekend is. Zolang ze niet passen, toont de statusbalk GPU-geheugen vol.
+	GPU Memory Full	GPU-geheugen vol
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	De lagen hebben {needed} GPU-geheugen nodig en mogen {budget} gebruiken, dus bewerkingen die het hele document opnieuw tekenen doen dat op de CPU. Klik om GPU-geheugen in te stellen.
+	GPU memory budget: {budget}	GPU-geheugenbudget: {budget}
+	This document's layers: {needed} of {budget} for layers	Lagen van dit document: {needed} van {budget} voor lagen
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	De lagen van dit document hebben {needed} nodig maar mogen {budget} gebruiken: het hele document wordt op de CPU opnieuw getekend
+	GPU Memory (MB, 0 = Automatic)	GPU-geheugen (MB, 0 = Automatisch)
+	{name} was changed by another app after it was opened or saved here.	{name} is door een andere app gewijzigd nadat het hier is geopend of bewaard.
+	Replace it with this document, or cancel and use File › Save As to keep both.	Vervang het door dit document, of annuleer en gebruik Bestand › Opslaan als om beide te houden.
+	Decrease Brush Size	Penseelgrootte verkleinen
+	Increase Brush Size	Penseelgrootte vergroten
+	Decrease Brush Hardness	Penseelhardheid verlagen
+	Increase Brush Hardness	Penseelhardheid verhogen
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 17feb459aa..660e93bbb7 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -3471,7 +3471,6 @@ cameraRaw	Roughness	Chropowatość
 	Redrawing	Odświeżanie
 	This redraw took {seconds} s on the CPU.	To odświeżenie na CPU trwało {seconds} s.
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	Zmiany obejmujące cały dokument, takie jak tryb mieszania, krycie lub widoczność warstwy, odświeżają go w całości.
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	Warstwy nie mieszczą się w budżecie pamięci GPU. Zwiększenie wartości Użycie pamięci w Preferencje › Wydajność zwiększa budżet, maksymalnie do jednej czwartej pamięci tego komputera.
 	The GPU compositor wasn't used: {reason}	Kompozytor GPU nie został użyty: {reason}
 # Pattern Stamp tool
 	Pattern Stamp Tool	Narzędzie Pieczątka wzoru
@@ -3649,6 +3648,22 @@ cameraData	Lens	Obiektyw
 	Snap to Origin	Przyciągnij do początku
 	Search settings…	Szukaj ustawień…
 	No matching settings	Brak pasujących ustawień
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	Narzędzie Pędzel próbkowania
+	Sampling Area Overlay	Nakładka obszaru próbkowania
+	Show Sampling Area	Pokaż obszar próbkowania
+	Indicates	Wskazuje
+	Sampling Area	Obszar próbkowania
+	Excluded Area	Obszar wykluczony
+	Sampling Area Options	Opcje obszaru próbkowania
+	Rectangular	Prostokątny
+	Fill Settings	Ustawienia wypełnienia
+	Rotation Adaptation	Dopasowanie obrotu
+	Very High	Bardzo wysoka
+	Full	Pełna
+	Mirror	Odbicie lustrzane
+	Output Settings	Ustawienia wyjścia
+	Output To	Wyjście do
 	Loading fonts…	Wczytywanie czcionek…
 	Response curve	Krzywa odpowiedzi
 	Simulate Pressure	Symuluj nacisk
@@ -3787,3 +3802,30 @@ curves	Smooth	Wygładź
 	There are too many sets: delete one first.	Zestawów jest za dużo: najpierw usuń jeden.
 	set name	nazwa zestawu
 	{set} (modified)	{set} (zmieniony)
+	Accept and Go to Conflict	Akceptuj i przejdź do konfliktu
+	Changes undone.	Zmiany cofnięte.
+	Choose a new shortcut for this command, or leave it without one.	Wybierz nowy skrót dla tego polecenia lub zostaw je bez skrótu.
+	Put this command's shortcuts back as they were	Przywróć skróty tego polecenia
+	Take the shortcut from the other command and select it	Odbierz skrót drugiemu poleceniu i zaznacz je
+	Undo Changes	Cofnij zmiany
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut} jest zarezerwowany przez system i nie można go przypisać.
+	Low-Latency Drawing (vsync off, applies at next launch)	Rysowanie z małym opóźnieniem (bez synchronizacji pionowej, od następnego uruchomienia)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	Przekształcanie swobodne jest nadal stosowane; spróbuj ponownie, gdy się zakończy.
+	The transform couldn't be applied.	Nie można zastosować przekształcenia.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	Warstwy potrzebują {needed} pamięci GPU; budżet zostawia im {budget}.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	Ustaw Pamięć GPU w Preferencje › Wydajność na tyle, ile zmieści Twoja karta graficzna, najwyżej 3/8 jej pamięci. Automatycznie podąża za Użyciem pamięci, w granicach jednej czwartej pamięci tego komputera i 3/8 pamięci karty, i nie wlicza dokumentu przy karcie o znanej pamięci. Dopóki się nie mieszczą, pasek stanu pokazuje Pamięć GPU pełna.
+	GPU Memory Full	Pamięć GPU pełna
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	Warstwy potrzebują {needed} pamięci GPU i mogą zająć {budget}, więc edycje, które odświeżają cały dokument, robią to na CPU. Kliknij, aby ustawić Pamięć GPU.
+	GPU memory budget: {budget}	Budżet pamięci GPU: {budget}
+	This document's layers: {needed} of {budget} for layers	Warstwy tego dokumentu: {needed} z {budget} na warstwy
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	Warstwy tego dokumentu potrzebują {needed}, ale mogą zająć {budget}: odświeżanie całego dokumentu używa CPU
+	GPU Memory (MB, 0 = Automatic)	Pamięć GPU (MB, 0 = Automatycznie)
+	Replace	Zastąp
+	{name} was changed by another app after it was opened or saved here.	Plik {name} został zmieniony przez inną aplikację po otwarciu lub zapisaniu go tutaj.
+	Replace it with this document, or cancel and use File › Save As to keep both.	Zastąp go tym dokumentem albo anuluj i użyj Plik › Zapisz jako, aby zachować oba.
+	Decrease Brush Size	Zmniejsz rozmiar pędzla
+	Increase Brush Size	Zwiększ rozmiar pędzla
+	Decrease Brush Hardness	Zmniejsz twardość pędzla
+	Increase Brush Hardness	Zwiększ twardość pędzla
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 0e9559c80e..338c4fadb7 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -2865,7 +2865,6 @@ cameraRaw	Whites	Brancos
 	Redrawing	Redesenhando
 	This redraw took {seconds} s on the CPU.	Este redesenho na CPU levou {seconds} s.
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	Edições que mudam o documento inteiro, como modo de mesclagem, opacidade ou visibilidade de uma camada, redesenham tudo.
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	As camadas não cabem no orçamento de memória da GPU. Aumentar Uso de memória em Preferências › Desempenho eleva o orçamento, até um quarto da memória deste computador.
 	The GPU compositor wasn't used: {reason}	O compositor de GPU não foi usado: {reason}
 fontWeight	Thin	Fina
 fontWeight	ExtraLight	Extrafina
@@ -3055,6 +3054,25 @@ cameraData	Lens	Lente
 	Snap to Origin	Ajustar à origem
 	Search settings…	Pesquisar configurações…
 	No matching settings	Nenhuma configuração encontrada
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	Ferramenta Pincel de amostragem
+	Sampling Area Overlay	Sobreposição da área de amostragem
+	Show Sampling Area	Mostrar área de amostragem
+	Indicates	Indica
+	Sampling Area	Área de amostragem
+	Excluded Area	Área excluída
+	Sampling Area Options	Opções da área de amostragem
+	Rectangular	Retangular
+	Fill Settings	Configurações de preenchimento
+	Rotation Adaptation	Adaptação de rotação
+	Very High	Muito alta
+	Full	Completa
+	Mirror	Espelhar
+	Output Settings	Configurações de saída
+	Output To	Saída para
+	New Layer	Nova camada
+	Duplicate Layer	Duplicar camada
+	Contract	Contrair
 	Loading fonts…	Carregando fontes…
 	Response curve	Curva de resposta
 	Tool	Ferramenta
@@ -3074,7 +3092,6 @@ curves	Smooth	Suavizar
 	Smooth the curve values	Suavizar os valores da curva
 	Drag to draw the curve · {key}-click draws a straight line	Arraste para desenhar a curva · {key}-clique traça uma linha reta
 	Grid Size:	Tamanho da grade:
-	New Layer	Nova camada
 	Vanishing Point: click four corners to create a plane	Ponto de fuga: clique em quatro cantos para criar um plano
 	Vanishing Point is not active	Ponto de fuga não está ativo
 	Apply Vanishing Point ({key})	Aplicar ponto de fuga ({key})
@@ -3119,7 +3136,6 @@ layerLabel	No Color	Sem cor
 	Clear Selection	Limpar seleção
 	Invert Selection	Inverter seleção
 	Select Inverse	Inverter seleção
-	Contract	Contrair
 	Sample Size	Tamanho da amostra
 	Strength	Intensidade
 	Gamma	Gama
@@ -3146,7 +3162,6 @@ layerLabel	No Color	Sem cor
 	Workspaces	Áreas de trabalho
 	Show All	Mostrar tudo
 	Hidden	Oculto
-	Duplicate Layer	Duplicar camada
 	Ungroup	Desagrupar
 	Lock Transparent Pixels	Bloquear pixels transparentes
 	Lock Image Pixels	Bloquear pixels da imagem
@@ -3979,3 +3994,29 @@ layerLabel	No Color	Sem cor
 	There are too many sets: delete one first.	Há conjuntos demais: exclua um primeiro.
 	set name	nome do conjunto
 	{set} (modified)	{set} (modificado)
+	Accept and Go to Conflict	Aceitar e ir para o conflito
+	Changes undone.	Alterações desfeitas.
+	Choose a new shortcut for this command, or leave it without one.	Escolha um novo atalho para este comando ou deixe-o sem atalho.
+	Put this command's shortcuts back as they were	Restaurar os atalhos deste comando como estavam
+	Take the shortcut from the other command and select it	Tirar o atalho do outro comando e selecioná-lo
+	Undo Changes	Desfazer alterações
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut} é reservado pelo sistema e não pode ser atribuído.
+	Low-Latency Drawing (vsync off, applies at next launch)	Desenho de baixa latência (sem sincronização vertical, aplicado na próxima inicialização)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	A Transformação livre ainda está sendo aplicada; tente novamente quando terminar.
+	The transform couldn't be applied.	Não foi possível aplicar a transformação.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	As camadas precisam de {needed} de memória da GPU; o orçamento lhes deixa {budget}.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	Ajuste Memória da GPU em Preferências › Desempenho para o que sua placa de vídeo comporta, no máximo 3/8 da memória dela. Automático segue Uso de memória, dentro de um quarto da memória deste computador e 3/8 da memória da placa, e não desconta o documento de uma placa cuja memória é conhecida. Enquanto não couberem, a barra de status mostra Memória da GPU cheia.
+	GPU Memory Full	Memória da GPU cheia
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	As camadas precisam de {needed} de memória da GPU e podem ocupar {budget}, então as edições que redesenham o documento inteiro fazem isso na CPU. Clique para ajustar Memória da GPU.
+	GPU memory budget: {budget}	Orçamento de memória da GPU: {budget}
+	This document's layers: {needed} of {budget} for layers	Camadas deste documento: {needed} de {budget} para camadas
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	As camadas deste documento precisam de {needed} mas podem ocupar {budget}: o documento inteiro é redesenhado na CPU
+	GPU Memory (MB, 0 = Automatic)	Memória da GPU (MB, 0 = Automático)
+	{name} was changed by another app after it was opened or saved here.	{name} foi alterado por outro app depois de ser aberto ou salvo aqui.
+	Replace it with this document, or cancel and use File › Save As to keep both.	Substitua-o por este documento, ou cancele e use Arquivo › Salvar como para manter os dois.
+	Decrease Brush Size	Diminuir tamanho do pincel
+	Increase Brush Size	Aumentar tamanho do pincel
+	Decrease Brush Hardness	Diminuir dureza do pincel
+	Increase Brush Hardness	Aumentar dureza do pincel
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 78e10a10c4..11fd43811a 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -2712,7 +2712,6 @@ cameraRaw	Roughness	Неровность
 	Redrawing	Перерисовка
 	This redraw took {seconds} s on the CPU.	Эта перерисовка на CPU заняла {seconds} с.
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	Правки, затрагивающие весь документ, например режим наложения, непрозрачность или видимость слоя, перерисовывают его целиком.
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	Слои не помещаются в бюджет памяти GPU. Увеличение параметра «Память» в разделе Настройки › Производительность повышает бюджет, но не больше четверти памяти этого компьютера.
 	The GPU compositor wasn't used: {reason}	Компоновщик GPU не использовался: {reason}
 fontWeight	Thin	Тонкий
 fontWeight	ExtraLight	Сверхтонкий
@@ -2976,6 +2975,24 @@ cameraData	Lens	Объектив
 	Rasterize Layer Style	Растрировать стиль слоя
 	Search settings…	Поиск настроек…
 	No matching settings	Нет подходящих настроек
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	Кисть области выборки
+	Sampling Area Overlay	Наложение области выборки
+	Show Sampling Area	Показать область выборки
+	Indicates	Обозначает
+	Sampling Area	Область выборки
+	Excluded Area	Исключённая область
+	Sampling Area Options	Параметры области выборки
+	Rectangular	Прямоугольная
+	Fill Settings	Параметры заливки
+	Rotation Adaptation	Адаптация поворота
+	Very High	Очень высокая
+	Full	Полная
+	Mirror	Отражение
+	Output Settings	Параметры вывода
+	Output To	Вывод в
+	Duplicate Layer	Дубликат слоя
+	Contract	Сжать
 	Loading fonts…	Загрузка шрифтов…
 	Response curve	Кривая отклика
 	Tool	Инструмент
@@ -3159,3 +3176,30 @@ curves	Smooth	Сгладить
 	set name	имя набора
 	{set} (modified)	{set} (изменён)
 	Random	Случайно
+	Accept and Go to Conflict	Принять и перейти к конфликту
+	Changes undone.	Изменения отменены.
+	Choose a new shortcut for this command, or leave it without one.	Выберите новую комбинацию для этой команды или оставьте её без комбинации.
+	Put this command's shortcuts back as they were	Вернуть комбинации этой команды
+	Take the shortcut from the other command and select it	Снять комбинацию с другой команды и выбрать её
+	Undo Changes	Отменить изменения
+	{shortcut} is reserved by the system and can't be assigned.	Комбинация {shortcut} зарезервирована системой и не может быть назначена.
+	Low-Latency Drawing (vsync off, applies at next launch)	Рисование с малой задержкой (без вертикальной синхронизации, после перезапуска)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	Свободное трансформирование ещё применяется; повторите попытку, когда оно завершится.
+	The transform couldn't be applied.	Не удалось применить трансформирование.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	Слоям нужно {needed} памяти GPU; бюджет оставляет им {budget}.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	Задайте «Память GPU» в разделе Настройки › Производительность по объёму, который вмещает ваша видеокарта, не больше 3/8 её памяти. «Автоматически» следует параметру «Память», в пределах четверти памяти этого компьютера и 3/8 памяти видеокарты, и не учитывает документ на видеокарте с известным объёмом памяти. Пока слои не помещаются, в строке состояния показано «Память GPU заполнена».
+	GPU Memory Full	Память GPU заполнена
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	Слоям нужно {needed} памяти GPU, а занимать они могут {budget}, поэтому правки, перерисовывающие весь документ, выполняются на CPU. Нажмите, чтобы задать «Память GPU».
+	GPU memory budget: {budget}	Бюджет памяти GPU: {budget}
+	This document's layers: {needed} of {budget} for layers	Слои этого документа: {needed} из {budget} для слоёв
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	Слоям этого документа нужно {needed}, но занимать они могут {budget}: весь документ перерисовывается на CPU
+	GPU Memory (MB, 0 = Automatic)	Память GPU (МБ, 0 = автоматически)
+	Replace	Заменить
+	{name} was changed by another app after it was opened or saved here.	Файл {name} был изменён другим приложением после того, как его открыли или сохранили здесь.
+	Replace it with this document, or cancel and use File › Save As to keep both.	Замените его этим документом или отмените и используйте Файл › Сохранить как, чтобы сохранить оба.
+	Decrease Brush Size	Уменьшить размер кисти
+	Increase Brush Size	Увеличить размер кисти
+	Decrease Brush Hardness	Уменьшить жёсткость кисти
+	Increase Brush Hardness	Увеличить жёсткость кисти
diff --git a/crates/ui-egui/src/i18n/sr.tsv b/crates/ui-egui/src/i18n/sr.tsv
index f4a8552fb0..25175aeff2 100644
--- a/crates/ui-egui/src/i18n/sr.tsv
+++ b/crates/ui-egui/src/i18n/sr.tsv
@@ -2836,7 +2836,6 @@ cameraRaw	Blending	Stapanje
 	Large document: redrawing on the CPU	Veliki dokument: ponovno iscrtavanje procesorom
 	This redraw took {seconds} s on the CPU.	Ovo iscrtavanje je trajalo {seconds} s na procesoru.
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	Izmene koje menjaju ceo dokument, kao što su režim stapanja, neprozirnost ili vidljivost sloja, ponovo iscrtavaju ceo dokument.
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	Njegovi slojevi ne staju u budžet GPU memorije. Povećanje vrednosti Korišćenje memorije u Podešavanja › Performanse povećava budžet, do četvrtine memorije ovog računara.
 	The GPU compositor wasn't used: {reason}	GPU kompozitor nije korišćen: {reason}
 fontWeight	Thin	Tanko
 fontWeight	ExtraLight	Ekstra lagano
@@ -4226,6 +4225,22 @@ shape	Appearance	Izgled
 	Ink Characteristics	Karakteristike mastila
 	Solidity:	Punoća:
 	Redrawing	Ponovno iscrtavanje
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	Alatka četkica za uzorkovanje
+	Sampling Area Overlay	Preklop oblasti uzorkovanja
+	Show Sampling Area	Prikaži oblast uzorkovanja
+	Indicates	Označava
+	Sampling Area	Oblast uzorkovanja
+	Excluded Area	Izuzeta oblast
+	Sampling Area Options	Opcije oblasti uzorkovanja
+	Rectangular	Pravougaona
+	Fill Settings	Podešavanja popune
+	Rotation Adaptation	Prilagođavanje rotacije
+	Very High	Veoma visoka
+	Full	Potpuna
+	Mirror	Preslikavanje
+	Output Settings	Podešavanja izlaza
+	Output To	Izlaz u
 	Response curve	Kriva odziva
 # Embedded Profile Mismatch: profile names beside the choices, Remember this choice
 	Use the embedded profile ({profile})	Koristi ugrađeni profil ({profile})
@@ -4262,3 +4277,29 @@ shape	Appearance	Izgled
 	There are too many sets: delete one first.	Previše skupova: prvo obrišite jedan.
 	set name	ime skupa
 	{set} (modified)	{set} (izmenjen)
+	Accept and Go to Conflict	Prihvati i idi na sukob
+	Changes undone.	Izmene su poništene.
+	Choose a new shortcut for this command, or leave it without one.	Izaberite novu prečicu za ovu komandu ili je ostavite bez prečice.
+	Put this command's shortcuts back as they were	Vrati prečice ove komande kakve su bile
+	Take the shortcut from the other command and select it	Uzmi prečicu drugoj komandi i izaberi je
+	Undo Changes	Poništi izmene
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut} je rezervisana od strane sistema i ne može se dodeliti.
+	Low-Latency Drawing (vsync off, applies at next launch)	Crtanje sa malim kašnjenjem (bez vsync-a, primenjuje se pri sledećem pokretanju)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	Slobodna transformacija se još primenjuje; pokušajte ponovo kad se završi.
+	The transform couldn't be applied.	Transformacija nije mogla da se primeni.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	Njegovim slojevima treba {needed} GPU memorije; budžet im ostavlja {budget}.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	Podesite GPU memoriju u Podešavanja › Performanse na onoliko koliko vaša grafička kartica može da primi, najviše 3/8 njene memorije. Automatski prati Korišćenje memorije, u okviru četvrtine memorije ovog računara i 3/8 memorije kartice, i ne računa dokument kod kartice čija je memorija poznata. Dok ne staju, statusna traka prikazuje GPU memorija je puna.
+	GPU Memory Full	GPU memorija je puna
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	Slojevima treba {needed} GPU memorije, a smeju da zauzmu {budget}, pa izmene koje ponovo iscrtavaju ceo dokument to rade na CPU-u. Kliknite da podesite GPU memoriju.
+	GPU memory budget: {budget}	Budžet GPU memorije: {budget}
+	This document's layers: {needed} of {budget} for layers	Slojevi ovog dokumenta: {needed} od {budget} za slojeve
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	Slojevima ovog dokumenta treba {needed}, a smeju da zauzmu {budget}: ceo dokument se ponovo iscrtava na CPU-u
+	GPU Memory (MB, 0 = Automatic)	GPU memorija (MB, 0 = Automatski)
+	{name} was changed by another app after it was opened or saved here.	Datoteku {name} je izmenila druga aplikacija nakon što je ovde otvorena ili sačuvana.
+	Replace it with this document, or cancel and use File › Save As to keep both.	Zameni je ovim dokumentom ili otkaži i koristi Datoteka › Sačuvaj kao da zadržiš obe.
+	Decrease Brush Size	Smanji veličinu četkice
+	Increase Brush Size	Povećaj veličinu četkice
+	Decrease Brush Hardness	Smanji tvrdoću četkice
+	Increase Brush Hardness	Povećaj tvrdoću četkice
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index b11f51a807..6af5510125 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -2410,7 +2410,6 @@ layerLabel	No Color	Renk Yok
 	Large document: redrawing on the CPU	Büyük belge: CPU'da yeniden çizim
 	This redraw took {seconds} s on the CPU.	Bu yeniden çizim CPU'da {seconds} saniye sürdü.
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	Bir katmanın karışım modu, opaklığı veya görünürlüğü gibi belgenin tamamını değiştiren düzenlemeler, belgenin tamamını yeniden çizer.
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	Katmanları GPU bellek bütçesine uymuyor. Tercihler'de Bellek kullanımını artırma › Performans, bütçeyi bu bilgisayarın belleğinin dörtte birine kadar artırır.
 	The GPU compositor wasn't used: {reason}	GPU dizgicisi kullanılmadı: {reason}
 cameraRaw	Light	Açık Tonlar
 fontWeight	Thin	İnce
@@ -3830,6 +3829,22 @@ cameraData	Lens	Lens
 @plural	{n} step|{n} steps	{n} adım
 @plural	{warning} (+{n} more brush preset warning)|{warning} (+{n} more brush preset warnings)	{warning} (+{n} fırça ön ayarı uyarısı daha)
 @plural	{what} with {n} warning|{what} with {n} warnings	{what}, {n} uyarı ile
+# Edit › Content-Aware Fill workspace
+	Excluded Area	Hariç Tutulan Alan
+	Fill Settings	Dolgu Ayarları
+	Full	Tam
+	Indicates	Gösterir
+	Mirror	Yansıt
+	Output Settings	Çıkış Ayarları
+	Output To	Çıkış Hedefi
+	Rectangular	Dikdörtgen
+	Rotation Adaptation	Döndürme Uyarlaması
+	Sampling Area	Örnekleme Alanı
+	Sampling Area Options	Örnekleme Alanı Seçenekleri
+	Sampling Area Overlay	Örnekleme Alanı Kaplaması
+	Sampling Brush Tool	Örnekleme Fırçası Aracı
+	Show Sampling Area	Örnekleme Alanını Göster
+	Very High	Çok Yüksek
 	Response curve	Yanıt eğrisi
 	Show home recent files	Ana ekranda son dosyaları göster
 	Clear Brush Controls	Fırça Denetimlerini Temizle
@@ -3919,3 +3934,29 @@ cameraData	Lens	Lens
 	There are too many sets: delete one first.	Çok fazla küme var: önce birini silin.
 	set name	küme adı
 	{set} (modified)	{set} (değiştirildi)
+	Accept and Go to Conflict	Kabul Et ve Çakışmaya Git
+	Changes undone.	Değişiklikler geri alındı.
+	Choose a new shortcut for this command, or leave it without one.	Bu komut için yeni bir kısayol seçin veya kısayolsuz bırakın.
+	Put this command's shortcuts back as they were	Bu komutun kısayollarını eski haline getir
+	Take the shortcut from the other command and select it	Kısayolu diğer komuttan al ve o komutu seç
+	Undo Changes	Değişiklikleri Geri Al
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut} sistem tarafından ayrılmıştır ve atanamaz.
+	Low-Latency Drawing (vsync off, applies at next launch)	Düşük gecikmeli çizim (dikey eşitleme kapalı, sonraki açılışta geçerli)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	Serbest Dönüştürme hâlâ uygulanıyor; bittiğinde yeniden deneyin.
+	The transform couldn't be applied.	Dönüştürme uygulanamadı.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	Katmanlarının {needed} GPU belleğine ihtiyacı var; bütçe onlara {budget} bırakıyor.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	Tercihler › Performans içindeki GPU Belleği'ni ekran kartınızın kaldırabileceği miktara, en fazla belleğinin 3/8'ine ayarlayın. Otomatik, Bellek kullanımını izler; bu bilgisayarın belleğinin dörtte biri ve kartın belleğinin 3/8'i içinde kalır, belleği bilinen bir kartta belgeyi hesaba katmaz. Sığmadıkları sürece durum çubuğu GPU Belleği Dolu gösterir.
+	GPU Memory Full	GPU Belleği Dolu
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	Katmanların {needed} GPU belleğine ihtiyacı var ve en fazla {budget} kullanabilirler; bu yüzden tüm belgeyi yeniden çizen düzenlemeler bunu CPU'da yapar. GPU Belleği'ni ayarlamak için tıklayın.
+	GPU memory budget: {budget}	GPU bellek bütçesi: {budget}
+	This document's layers: {needed} of {budget} for layers	Bu belgenin katmanları: katmanlar için {budget} içinden {needed}
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	Bu belgenin katmanlarının {needed} belleğe ihtiyacı var ama en fazla {budget} kullanabilirler: tüm belgenin yeniden çizimi CPU'yu kullanır
+	GPU Memory (MB, 0 = Automatic)	GPU Belleği (MB, 0 = Otomatik)
+	{name} was changed by another app after it was opened or saved here.	{name}, burada açıldıktan veya kaydedildikten sonra başka bir uygulama tarafından değiştirildi.
+	Replace it with this document, or cancel and use File › Save As to keep both.	Bu belgeyle değiştirin ya da iptal edip ikisini de korumak için Dosya › Farklı Kaydet'i kullanın.
+	Decrease Brush Size	Fırça boyutunu küçült
+	Increase Brush Size	Fırça boyutunu büyüt
+	Decrease Brush Hardness	Fırça sertliğini azalt
+	Increase Brush Hardness	Fırça sertliğini artır
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index e563354fdf..37851e90f3 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -2679,7 +2679,6 @@ cameraRaw	Roughness	Шорсткість
 	Redrawing	Перемальовування
 	This redraw took {seconds} s on the CPU.	Це перемальовування на CPU тривало {seconds} с.
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	Зміни, що впливають на весь документ, як-от режим накладання, непрозорість чи видимість шару, перемальовують його повністю.
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	Його шари не вміщуються в бюджет пам'яті GPU. Збільшення використання пам'яті в Налаштування › Продуктивність підвищує бюджет до чверті пам'яті цього комп'ютера.
 	The GPU compositor wasn't used: {reason}	Компонувальник GPU не використовувався: {reason}
 fontWeight	Thin	Тонкий
 fontWeight	ExtraLight	Екстралегкий
@@ -3723,6 +3722,22 @@ cameraData	Lens	Об'єктив
 	Search settings…	Пошук налаштувань…
 	No matching settings	Немає відповідних налаштувань
 	PhotoCraft — Screen Color Picker	PhotoCraft — Піпетка кольору екрана
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	Пензель області вибірки
+	Sampling Area Overlay	Накладання області вибірки
+	Show Sampling Area	Показати область вибірки
+	Indicates	Позначає
+	Sampling Area	Область вибірки
+	Excluded Area	Виключена область
+	Sampling Area Options	Параметри області вибірки
+	Rectangular	Прямокутна
+	Fill Settings	Параметри заливки
+	Rotation Adaptation	Адаптація повороту
+	Very High	Дуже висока
+	Full	Повна
+	Mirror	Віддзеркалення
+	Output Settings	Параметри виводу
+	Output To	Вивести в
 	Loading fonts…	Завантаження шрифтів…
 	Response curve	Крива відгуку
 	Simulate Pressure	Імітувати натиск
@@ -3888,3 +3903,38 @@ curves	Smooth	Згладити
 	There are too many sets: delete one first.	Забагато наборів: спершу видаліть один.
 	set name	назва набору
 	{set} (modified)	{set} (змінено)
+	Accept and Go to Conflict	Прийняти й перейти до конфлікту
+	Changes undone.	Зміни скасовано.
+	Choose a new shortcut for this command, or leave it without one.	Виберіть нове клавіатурне скорочення для цієї команди або залиште її без нього.
+	Put this command's shortcuts back as they were	Повернути клавіатурні скорочення цієї команди
+	Take the shortcut from the other command and select it	Забрати скорочення в іншої команди й вибрати її
+	Undo Changes	Скасувати зміни
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut} зарезервовано системою, його не можна призначити.
+	Low-Latency Drawing (vsync off, applies at next launch)	Малювання з малою затримкою (без вертикальної синхронізації, після перезапуску)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	Вільне трансформування ще застосовується; спробуйте знову, коли воно завершиться.
+	The transform couldn't be applied.	Не вдалося застосувати трансформування.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	Його шарам потрібно {needed} пам'яті GPU; бюджет залишає їм {budget}.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	Задайте «Пам'ять GPU» в Налаштування › Продуктивність відповідно до того, скільки вміщує ваша відеокарта, не більше 3/8 її пам'яті. «Автоматично» стежить за використанням пам'яті, у межах чверті пам'яті цього комп'ютера й 3/8 пам'яті відеокарти, і не враховує документ на відеокарті з відомим обсягом пам'яті. Поки шари не вміщуються, рядок стану показує «Пам'ять GPU заповнена».
+	GPU Memory Full	Пам'ять GPU заповнена
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	Шарам потрібно {needed} пам'яті GPU, а займати вони можуть {budget}, тому зміни, що перемальовують увесь документ, виконуються на CPU. Натисніть, щоб задати «Пам'ять GPU».
+	GPU memory budget: {budget}	Бюджет пам'яті GPU: {budget}
+	This document's layers: {needed} of {budget} for layers	Шари цього документа: {needed} з {budget} для шарів
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	Шарам цього документа потрібно {needed}, але займати вони можуть {budget}: увесь документ перемальовується на CPU
+	GPU Memory (MB, 0 = Automatic)	Пам'ять GPU (МБ, 0 = автоматично)
+	Replace	Замінити
+	{name} was changed by another app after it was opened or saved here.	Файл {name} змінила інша програма після того, як його тут відкрили або зберегли.
+	Replace it with this document, or cancel and use File › Save As to keep both.	Замініть його цим документом або скасуйте й скористайтеся Файл › Зберегти як, щоб зберегти обидва.
+	Decrease Brush Size	Зменшити розмір пензля
+	Increase Brush Size	Збільшити розмір пензля
+	Decrease Brush Hardness	Зменшити жорсткість пензля
+	Increase Brush Hardness	Збільшити жорсткість пензля
+# Dynamic color-picker titles and warnings about losing editable layer content.
+	Color Picker (Background Color)	Вибір кольору (колір тла)
+	Color Picker (Foreground Color)	Вибір кольору (основний колір)
+	Color Picker (Custom Canvas Color)	Вибір кольору (власний колір полотна)
+	This type layer must be rasterized before proceeding. Its text will no longer be editable. Rasterize the type?	Щоб продовжити, потрібно растеризувати цей текстовий шар. Після цього його текст більше не можна буде редагувати. Растеризувати текст?
+	This shape layer must be rasterized before proceeding. It will no longer be editable as a shape. Rasterize the shape?	Щоб продовжити, потрібно растеризувати цей шар фігури. Після цього його більше не можна буде редагувати як фігуру. Растеризувати фігуру?
+	This Smart Object must be rasterized before proceeding. Its contents will no longer be editable. Rasterize the Smart Object?	Щоб продовжити, потрібно растеризувати цей смартоб’єкт. Після цього його вміст більше не можна буде редагувати. Растеризувати смартоб’єкт?
+	This fill layer must be rasterized before proceeding. Its fill content will no longer be editable. Rasterize the layer?	Щоб продовжити, потрібно растеризувати цей шар заливки. Після цього його заливку більше не можна буде редагувати. Растеризувати шар?
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index 6907be96aa..fd7950b930 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -2156,7 +2156,6 @@ layers	Fill:	Độ tô:
 	Imported {n} shortcuts from {file}. Click OK to keep them.	Đã nhập {n} phím tắt từ {file}. Nhấp OK để giữ.
 	Indexed Color…	Màu lập chỉ mục…
 	Install Plug-in…	Cài plug-in…
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	Các lớp không vừa ngân sách bộ nhớ GPU. Tăng mức sử dụng bộ nhớ trong Tùy chọn › Hiệu năng sẽ nâng ngân sách, tối đa một phần tư bộ nhớ máy này.
 	Labels	Nhãn
 	Large document: redrawing on the CPU	Tài liệu lớn: đang vẽ lại trên CPU
 	Redrawing	Đang vẽ lại
@@ -3598,6 +3597,22 @@ curves	Smooth	Làm mượt
 	Remove after each stroke	Xóa sau mỗi nét vẽ
 	Apply the removal ({key})	Áp dụng việc xóa ({key})
 	Strokes to remove: {n} (Enter applies, Esc cancels)	Nét vẽ cần xóa: {n} (Enter áp dụng, Esc hủy)
+# Edit › Content-Aware Fill workspace
+	Excluded Area	Vùng loại trừ
+	Fill Settings	Cài đặt tô
+	Full	Toàn phần
+	Indicates	Biểu thị
+	Mirror	Phản chiếu
+	Output Settings	Cài đặt đầu ra
+	Output To	Đầu ra tới
+	Rectangular	Chữ nhật
+	Rotation Adaptation	Thích ứng xoay
+	Sampling Area	Vùng lấy mẫu
+	Sampling Area Options	Tùy chọn vùng lấy mẫu
+	Sampling Area Overlay	Lớp phủ vùng lấy mẫu
+	Sampling Brush Tool	Công cụ Cọ lấy mẫu
+	Show Sampling Area	Hiện vùng lấy mẫu
+	Very High	Rất cao
 	Show home recent files	Hiện tệp gần đây trên màn hình chính
 	Clear Brush Controls	Xóa điều khiển cọ
 	Reset All Locked Settings	Đặt lại tất cả cài đặt đã khóa
@@ -3675,3 +3690,30 @@ curves	Smooth	Làm mượt
 	There are too many sets: delete one first.	Có quá nhiều bộ: hãy xóa một bộ trước.
 	set name	tên bộ
 	{set} (modified)	{set} (đã sửa đổi)
+	Accept and Go to Conflict	Chấp nhận và đến xung đột
+	Changes undone.	Đã hoàn tác thay đổi.
+	Choose a new shortcut for this command, or leave it without one.	Chọn phím tắt mới cho lệnh này, hoặc để lệnh không có phím tắt.
+	Put this command's shortcuts back as they were	Khôi phục phím tắt của lệnh này như cũ
+	Take the shortcut from the other command and select it	Lấy phím tắt khỏi lệnh kia và chọn lệnh đó
+	Undo Changes	Hoàn tác thay đổi
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut} được hệ thống dành riêng và không thể gán.
+	Low-Latency Drawing (vsync off, applies at next launch)	Vẽ độ trễ thấp (tắt vsync, áp dụng ở lần khởi động sau)
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	Biến đổi tự do vẫn đang được áp dụng; hãy thử lại khi hoàn tất.
+	The transform couldn't be applied.	Không thể áp dụng phép biến đổi.
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	Các lớp cần {needed} bộ nhớ GPU; ngân sách chỉ dành cho chúng {budget}.
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	Đặt Bộ nhớ GPU trong Tùy chọn › Hiệu năng bằng mức card đồ họa của bạn chứa được, tối đa 3/8 bộ nhớ của card. Tự động theo mức sử dụng bộ nhớ, trong giới hạn một phần tư bộ nhớ máy này và 3/8 bộ nhớ card, và không tính tài liệu vào card đã biết dung lượng bộ nhớ. Khi chúng chưa vừa, thanh trạng thái hiện Bộ nhớ GPU đầy.
+	GPU Memory Full	Bộ nhớ GPU đầy
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	Các lớp cần {needed} bộ nhớ GPU và chỉ được dùng {budget}, nên những chỉnh sửa vẽ lại toàn bộ tài liệu sẽ làm trên CPU. Nhấp để đặt Bộ nhớ GPU.
+	GPU memory budget: {budget}	Ngân sách bộ nhớ GPU: {budget}
+	This document's layers: {needed} of {budget} for layers	Các lớp của tài liệu này: {needed} trên {budget} dành cho lớp
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	Các lớp của tài liệu này cần {needed} nhưng chỉ được dùng {budget}: vẽ lại toàn bộ tài liệu dùng CPU
+	GPU Memory (MB, 0 = Automatic)	Bộ nhớ GPU (MB, 0 = Tự động)
+	Replace	Thay thế
+	{name} was changed by another app after it was opened or saved here.	{name} đã bị một ứng dụng khác thay đổi sau khi được mở hoặc lưu ở đây.
+	Replace it with this document, or cancel and use File › Save As to keep both.	Thay thế bằng tài liệu này, hoặc hủy và dùng Tệp › Lưu thành để giữ cả hai.
+	Decrease Brush Size	Giảm kích thước cọ
+	Increase Brush Size	Tăng kích thước cọ
+	Decrease Brush Hardness	Giảm độ cứng của cọ
+	Increase Brush Hardness	Tăng độ cứng của cọ
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 3962f46d65..01e0d57051 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -2454,7 +2454,6 @@ cameraRaw	Blending	混合
 	Redrawing	正在重绘
 	This redraw took {seconds} s on the CPU.	此次 CPU 重绘耗时 {seconds} 秒。
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	更改整个文档的编辑（如图层的混合模式、不透明度或可见性）会重绘整个文档。
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	图层超出 GPU 内存预算。在 首选项 › 性能 中提高内存使用量可增加预算，最多为本机内存的四分之一。
 	The GPU compositor wasn't used: {reason}	未使用 GPU 合成器：{reason}
 fontWeight	Thin	极细
 fontWeight	ExtraLight	特细
@@ -2648,6 +2647,26 @@ cameraData	Lens	镜头
 	Snap to Origin	贴紧原点
 	Search settings…	搜索设置…
 	No matching settings	没有匹配的设置
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	取样画笔工具
+	Sampling Area Overlay	取样区域叠加
+	Show Sampling Area	显示取样区域
+	Indicates	指示
+	Sampling Area	取样区域
+	Excluded Area	排除区域
+	Sampling Area Options	取样区域选项
+	Rectangular	矩形
+	Fill Settings	填充设置
+	Rotation Adaptation	旋转适应
+	Very High	非常高
+	High	高
+	Low	低
+	Full	完全
+	Mirror	镜像
+	Output Settings	输出设置
+	Output To	输出到
+	Duplicate Layer	复制图层
+	Contract	收缩
 	Loading fonts…	正在加载字体…
 	Response curve	响应曲线
 	Tool	工具
@@ -2805,3 +2824,30 @@ curves	Smooth	平滑
 	set name	组名称
 	{set} (modified)	{set}（已修改）
 	Random	随机
+	Accept and Go to Conflict	接受并转到冲突
+	Changes undone.	已撤消更改。
+	Choose a new shortcut for this command, or leave it without one.	为此命令选择新的快捷键，或保留为无快捷键。
+	Put this command's shortcuts back as they were	将此命令的快捷键恢复原样
+	Take the shortcut from the other command and select it	从另一个命令移除该快捷键并选中它
+	Undo Changes	撤消更改
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut} 由系统保留，无法指定。
+	Low-Latency Drawing (vsync off, applies at next launch)	低延迟绘画（关闭垂直同步，下次启动时生效）
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	自由变换仍在应用中；请在完成后重试。
+	The transform couldn't be applied.	无法应用变换。
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	其图层需要 {needed} GPU 内存；预算只留给它们 {budget}。
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	在 首选项 › 性能 中将 GPU 内存设置为显卡能容纳的大小，最多为其显存的 3/8。自动跟随内存使用量，不超过本机内存的四分之一和显卡显存的 3/8，且在显存已知的显卡上不把文档计入。在图层放不下期间，状态栏显示“GPU 内存已满”。
+	GPU Memory Full	GPU 内存已满
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	图层需要 {needed} GPU 内存，但只能占用 {budget}，因此重绘整个文档的编辑会在 CPU 上进行。点击以设置 GPU 内存。
+	GPU memory budget: {budget}	GPU 内存预算：{budget}
+	This document's layers: {needed} of {budget} for layers	此文档的图层：图层可用 {budget} 中的 {needed}
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	此文档的图层需要 {needed}，但只能占用 {budget}：整个文档的重绘使用 CPU
+	GPU Memory (MB, 0 = Automatic)	GPU 内存（MB，0 = 自动）
+	Replace	替换
+	{name} was changed by another app after it was opened or saved here.	{name} 在此处打开或存储后已被其他应用更改。
+	Replace it with this document, or cancel and use File › Save As to keep both.	用此文档替换它，或取消并使用“文件 › 另存为”以保留两者。
+	Decrease Brush Size	减小画笔大小
+	Increase Brush Size	增大画笔大小
+	Decrease Brush Hardness	减小画笔硬度
+	Increase Brush Hardness	增大画笔硬度
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 005c992e23..2d9ad2905a 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -2424,7 +2424,6 @@ cameraRaw	Blending	混合
 	Redrawing	正在重繪
 	This redraw took {seconds} s on the CPU.	此次 CPU 重繪耗時 {seconds} 秒。
 	Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.	變更整份文件的編輯（例如圖層的混合模式、不透明度或可見度）會重繪整份文件。
-	Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.	圖層超出 GPU 記憶體預算。在 偏好設定 › 效能 中提高記憶體使用量可增加預算，最多為本機記憶體的四分之一。
 	The GPU compositor wasn't used: {reason}	未使用 GPU 合成器：{reason}
 fontWeight	Thin	極細
 fontWeight	ExtraLight	特細
@@ -2618,6 +2617,26 @@ cameraData	Lens	鏡頭
 	Snap to Origin	靠齊原點
 	Search settings…	搜尋設定…
 	No matching settings	沒有符合的設定
+# Edit › Content-Aware Fill workspace
+	Sampling Brush Tool	取樣筆刷工具
+	Sampling Area Overlay	取樣區域覆蓋
+	Show Sampling Area	顯示取樣區域
+	Indicates	指示
+	Sampling Area	取樣區域
+	Excluded Area	排除區域
+	Sampling Area Options	取樣區域選項
+	Rectangular	矩形
+	Fill Settings	填色設定
+	Rotation Adaptation	旋轉調整
+	Very High	非常高
+	High	高
+	Low	低
+	Full	完全
+	Mirror	鏡像
+	Output Settings	輸出設定
+	Output To	輸出至
+	Duplicate Layer	複製圖層
+	Contract	縮減
 	Loading fonts…	正在載入字體…
 	Response curve	回應曲線
 	Tool	工具
@@ -2790,3 +2809,30 @@ curves	Smooth	平滑
 	set name	組合名稱
 	{set} (modified)	{set}（已修改）
 	Random	隨機
+	Accept and Go to Conflict	接受並前往衝突
+	Changes undone.	已還原變更。
+	Choose a new shortcut for this command, or leave it without one.	為此指令選擇新的快速鍵，或保持沒有快速鍵。
+	Put this command's shortcuts back as they were	將此指令的快速鍵恢復原狀
+	Take the shortcut from the other command and select it	從另一個指令移除該快速鍵並選取它
+	Undo Changes	還原變更
+	{shortcut} is reserved by the system and can't be assigned.	{shortcut} 由系統保留，無法指定。
+	Low-Latency Drawing (vsync off, applies at next launch)	低延遲繪圖（關閉垂直同步，下次啟動時生效）
+# Free Transform: a new layer while the box is open (#5859)
+	Free Transform is still being applied; try again when it has finished.	任意變形仍在套用中；請在完成後再試一次。
+	The transform couldn't be applied.	無法套用變形。
+# Preferences › Performance › GPU Memory; the status bar and slow-redraw notice
+	Its layers need {needed} of GPU memory; the budget leaves them {budget}.	其圖層需要 {needed} GPU 記憶體；預算只留給它們 {budget}。
+	Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.	在 偏好設定 › 效能 中將 GPU 記憶體設為顯示卡能容納的大小，最多為其記憶體的 3/8。自動會跟隨記憶體使用量，不超過本機記憶體的四分之一和顯示卡記憶體的 3/8，且在記憶體已知的顯示卡上不把文件計入。在圖層放不下期間，狀態列會顯示「GPU 記憶體已滿」。
+	GPU Memory Full	GPU 記憶體已滿
+	The layers need {needed} of GPU memory and may hold {budget}, so edits that redraw the whole document do it on the CPU. Click to set GPU Memory.	圖層需要 {needed} GPU 記憶體，但只能佔用 {budget}，因此重繪整份文件的編輯會在 CPU 上進行。按一下以設定 GPU 記憶體。
+	GPU memory budget: {budget}	GPU 記憶體預算：{budget}
+	This document's layers: {needed} of {budget} for layers	此文件的圖層：圖層可用 {budget} 中的 {needed}
+	This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU	此文件的圖層需要 {needed}，但只能佔用 {budget}：整份文件的重繪使用 CPU
+	GPU Memory (MB, 0 = Automatic)	GPU 記憶體（MB，0 = 自動）
+	Replace	取代
+	{name} was changed by another app after it was opened or saved here.	{name} 在此處開啟或儲存後已被其他 App 更改。
+	Replace it with this document, or cancel and use File › Save As to keep both.	以此文件取代它，或取消並使用「檔案 › 另存新檔」以保留兩者。
+	Decrease Brush Size	縮小筆刷大小
+	Increase Brush Size	放大筆刷大小
+	Decrease Brush Hardness	降低筆刷硬度
+	Increase Brush Hardness	提高筆刷硬度
diff --git a/crates/ui-egui/src/icon_data.rs b/crates/ui-egui/src/icon_data.rs
index 9301f709ce..7fdaf4f7d0 100644
--- a/crates/ui-egui/src/icon_data.rs
+++ b/crates/ui-egui/src/icon_data.rs
@@ -39,6 +39,8 @@ pub static ICONS: &[(&str, &[u8])] = &[
     ("diamond", include_bytes!("../../../assets/icons/diamond.svg")),
     ("direct-select", include_bytes!("../../../assets/icons/direct-select.svg")),
     ("droplet", include_bytes!("../../../assets/icons/droplet.svg")),
+    // Original: a dashed horizontal ellipse (Elliptical Marquee), on Lucide's grid and stroke.
+    ("ellipse-dashed", include_bytes!("../../../assets/icons/ellipse-dashed.svg")),
     ("ellipsis", include_bytes!("../../../assets/icons/ellipsis.svg")),
     ("eraser", include_bytes!("../../../assets/icons/eraser.svg")),
     // Derived from Lucide's eraser (ISC): with a sparkle (Magic Eraser) / a transparency grid (Background Eraser).
diff --git a/crates/ui-egui/src/icons.rs b/crates/ui-egui/src/icons.rs
index 131886ae6b..37d0b4aeab 100644
--- a/crates/ui-egui/src/icons.rs
+++ b/crates/ui-egui/src/icons.rs
@@ -87,7 +87,7 @@ pub fn tool_icon(t: Tool) -> &'static str {
         Tool::Move => "move",
         Tool::Artboard => "artboard",
         Tool::RectMarquee => "square-dashed",
-        Tool::EllipseMarquee => "circle-dashed",
+        Tool::EllipseMarquee => "ellipse-dashed",
         Tool::SingleRowMarquee => "marquee-row",
         Tool::SingleColumnMarquee => "marquee-column",
         Tool::Brush => "brush",
@@ -272,12 +272,41 @@ mod tests {
             assert!(union > 0, "icons must have ink at {size}px");
             let overlap = shared as f32 / union as f32;
             assert!(overlap < 0.5, "the two glyphs must read as distinct: {overlap:.2} of their ink overlaps at {size}px");
-            // The dashed selection arc must actually rasterize: more ink than the bare brush.
-            let brush = ink(tool_icon(Tool::Brush), size);
-            assert!(quick.iter().filter(|a| **a).count() > brush.iter().filter(|a| **a).count(), "the dashed arc is missing at {size}px");
+            // The dashed selection "C" must actually rasterize down the left edge, where the brush has no ink.
+            let s = size as usize;
+            assert!(quick.iter().enumerate().any(|(i, a)| *a && i % s < s / 5), "the dashed selection edge is missing at {size}px");
         }
     }
 
+    /// Ink bounding box `(width, height)` of a rasterized mask.
+    fn ink_extent(mask: &[bool], size: u32) -> (usize, usize) {
+        let s = size as usize;
+        let (xs, ys): (Vec<usize>, Vec<usize>) = mask.iter().enumerate().filter(|(_, a)| **a).map(|(i, _)| (i % s, i / s)).unzip();
+        let span = |v: &[usize]| v.iter().max().zip(v.iter().min()).map_or(0, |(hi, lo)| hi - lo + 1);
+        (span(&xs), span(&ys))
+    }
+
+    #[test]
+    fn ellipse_marquee_icon_is_a_wide_ellipse() {
+        // #6875: Photoshop's Elliptical Marquee glyph is a horizontal ellipse, not a circle.
+        assert_ne!(tool_icon(Tool::EllipseMarquee), "circle-dashed");
+        for size in [14_u32, 28] {
+            let (w, h) = ink_extent(&ink(tool_icon(Tool::EllipseMarquee), size), size);
+            assert!(w as f32 >= h as f32 * 1.15, "ellipse marquee ink is {w}x{h} at {size}px: not wider than tall");
+        }
+    }
+
+    #[test]
+    fn quick_selection_icon_is_a_tall_selection_with_a_brush() {
+        // #6875: Photoshop's Quick Selection glyph is a dashed, upright rounded "C" with a brush.
+        let size = 28_u32;
+        let s = size as usize;
+        let quick = ink(tool_icon(Tool::QuickSelection), size);
+        // The left edge of the selection runs most of the icon's height.
+        let left_rows = (0..s).filter(|y| (0..s / 5).any(|x| quick.get(y * s + x).copied().unwrap_or(false))).count();
+        assert!(left_rows * 5 > s * 2, "left selection edge covers only {left_rows} of {s} rows");
+    }
+
     #[test]
     fn shared_catalog_preserves_existing_icons() {
         // Characterize the pre-extraction loader across every real asset. The UI's tint,
diff --git a/crates/ui-egui/src/kys_import.rs b/crates/ui-egui/src/kys_import.rs
index 0b9165abd5..75f46a775b 100644
--- a/crates/ui-egui/src/kys_import.rs
+++ b/crates/ui-egui/src/kys_import.rs
@@ -35,8 +35,7 @@ pub fn plan(app: &PhotocraftApp, set: &KysSet) -> Plan {
 /// The set's tool keys matched to our tools by name (Photoshop's names are ours): tool
 /// shortcut id (`tools.select.move`) → letter, and the tools PhotoCraft doesn't have.
 pub fn plan_tools(set: &KysSet) -> (BTreeMap<String, String>, Vec<String>) {
-    let tools: Vec<(String, &str)> = crate::state::Tool::ALL.into_iter().map(|t| (crate::tool_shortcuts::id(t), t.label())).collect();
-    photocraft_engine::kys::plan_tools(tools.iter().map(|(id, name)| (id.as_str(), *name)), set)
+    photocraft_engine::kys::plan_tools(photocraft_engine::shell_commands::TOOLS.iter().map(|t| (t.0, t.1)), set)
 }
 
 /// Put the plan into the open Keyboard Shortcuts dialog (opening one when none is), as
diff --git a/crates/ui-egui/src/layer_props_ui_tests.rs b/crates/ui-egui/src/layer_props_ui_tests.rs
new file mode 100644
index 0000000000..93055ee342
--- /dev/null
+++ b/crates/ui-egui/src/layer_props_ui_tests.rs
@@ -0,0 +1,78 @@
+//! The Layers panel's blend mode, Opacity, Fill and lock controls change every selected layer,
+//! as in Photoshop, not only the active one.
+
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use serde_json::json;
+
+use crate::PhotocraftApp;
+
+fn app() -> Harness<'static, PhotocraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_max_steps(64).build_eframe(|cc| {
+        PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        app.run("file.new", json!({"width": 64, "height": 64, "background": "white"})).unwrap();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app
+    });
+    h.run_steps(6);
+    h
+}
+
+/// The Layers panel's lock buttons change every selected layer (as do blend mode, Opacity and
+/// Fill), not only the active one.
+#[test]
+fn the_layers_panel_locks_every_selected_layer() {
+    let mut h = app();
+    let ids: Vec<u64> = h.state().session.active().unwrap().doc.layers.iter().map(|l| l.id.0).collect();
+    let extra = h.state_mut().run("layer.new.layer", json!({})).unwrap()["layer"].as_u64().unwrap();
+    h.state_mut().run("layer.select", json!({"layer": ids[1], "mode": "add"})).unwrap();
+    h.run_steps(3);
+    assert_eq!(h.state().session.active().unwrap().selected_layers().len(), 2);
+    h.query_by_label_contains("Lock all").expect("the Lock all button").click();
+    h.run_steps(3);
+    let st = h.state().session.active().unwrap();
+    let locked = |id: u64| st.doc.layer(photocraft_doc::LayerId(id)).unwrap().locks.all;
+    assert!(locked(extra) && locked(ids[1]), "both selected layers lock");
+    assert!(!locked(ids[0]), "the unselected Background doesn't");
+}
+
+/// The Basic layout's single lock toggle also locks every selected layer.
+#[test]
+fn the_basic_lock_toggle_locks_every_selected_layer() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_max_steps(64).build_eframe(|cc| {
+        PhotocraftApp::setup_context(&cc.egui_ctx, crate::theme::ThemeKind::Studio);
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        app.run("prefs.set", json!({"path": "interface.theme", "value": crate::theme::ThemeKind::Studio.id()})).unwrap();
+        app.ui.theme = crate::theme::ThemeKind::Studio;
+        app.run("file.new", json!({"width": 64, "height": 64, "background": "white"})).unwrap();
+        app
+    });
+    let a = h.state_mut().run("layer.new.layer", json!({})).unwrap()["layer"].as_u64().unwrap();
+    let b = h.state_mut().run("layer.new.layer", json!({})).unwrap()["layer"].as_u64().unwrap();
+    h.state_mut().run("layer.select", json!({"layer": a, "mode": "add"})).unwrap();
+    h.run_steps(4);
+    h.get_by_label("Lock layer").click();
+    h.run_steps(3);
+    let st = h.state().session.active().unwrap();
+    let locked = |id: u64| st.doc.layer(photocraft_doc::LayerId(id)).unwrap().locks.all;
+    assert!(locked(a) && locked(b), "both selected layers lock");
+}
+
+/// The Background, selected with other layers, is left out of their change (Opacity here)
+/// until Photoshop's behaviour is confirmed (#5856): it stays the Background.
+#[test]
+fn a_selected_background_is_left_out_of_a_several_layer_change() {
+    let mut h = app();
+    let st = h.state().session.active().unwrap();
+    let (bg, top) = (st.doc.layers[0].id.0, st.active_layer.unwrap().0);
+    h.state_mut().run("layer.select", json!({"layer": bg})).unwrap();
+    h.state_mut().run("layer.select", json!({"layer": top, "mode": "add"})).unwrap();
+    h.run_steps(3);
+    h.get_by_label("Lock all").click();
+    h.run_steps(3);
+    let st = h.state().session.active().unwrap();
+    let l = |id: u64| st.doc.layer(photocraft_doc::LayerId(id)).unwrap().clone();
+    assert!(l(top).locks.all, "the layer locks");
+    assert!(st.doc.is_background(photocraft_doc::LayerId(bg)) && !l(bg).locks.all, "the Background is left as it was");
+}
diff --git a/crates/ui-egui/src/layer_row_ui.rs b/crates/ui-egui/src/layer_row_ui.rs
index 5a6e60f792..4bed6a7cc4 100644
--- a/crates/ui-egui/src/layer_row_ui.rs
+++ b/crates/ui-egui/src/layer_row_ui.rs
@@ -94,10 +94,23 @@ pub fn truncated(painter: &Painter, text: &str, font: FontId, color: egui::Color
     if max_width < 8.0 {
         return None;
     }
-    let mut job = egui::text::LayoutJob::default();
-    job.append(text, 0.0, egui::TextFormat { font_id: font, color, italics, ..Default::default() });
-    job.wrap = egui::text::TextWrapping { max_width, max_rows: 1, break_anywhere: true, overflow_character: Some('…') };
-    Some(painter.layout_job(job))
+    let format = egui::text::TextFormat { font_id: font, color, italics, ..Default::default() };
+    let layout = |s: &str, wrap: bool| {
+        let mut job = egui::text::LayoutJob::default();
+        job.append(s, 0.0, format.clone());
+        if wrap {
+            job.wrap = egui::text::TextWrapping { max_width, max_rows: 1, break_anywhere: true, overflow_character: Some('…') };
+        }
+        painter.layout_job(job)
+    };
+    // A right-to-left name (Arabic, Hebrew) too long for the row is cut at its logical end and
+    // then put in display order, so its start stays and "…" is at the left (`bidi_text::elide`).
+    if let Some(shown) = crate::bidi_text::elide(text, |s| layout(s, false).size().x <= max_width) {
+        return Some(layout(&shown, false));
+    }
+    // Right-to-left names in display order: egui lays words out left to right. Left-to-right
+    // names are cut at their right end by egui.
+    Some(layout(&crate::bidi_text::visual(text), true))
 }
 
 /// Paint `l`'s right-hand indicators in `row` and handle the effects triangle. Returns the
diff --git a/crates/ui-egui/src/layer_style/color_picker.rs b/crates/ui-egui/src/layer_style/color_picker.rs
index b0edb16379..341e659c9e 100644
--- a/crates/ui-egui/src/layer_style/color_picker.rs
+++ b/crates/ui-egui/src/layer_style/color_picker.rs
@@ -92,7 +92,7 @@ pub(crate) fn open(app: &mut PhotocraftApp, parent: u64, effect: &str, field: &s
     let t = Target { parent, document: st.doc.id, layer, effect: effect.into(), field: field.into(), color: color.clone(), source };
     validate(app, &t)?;
     let rgb = color_picker_ui::parse_hex(&color).ok_or("invalid effect color")?;
-    let mut fields = color_picker_ui::initial_fields("dialog", "Color Picker (Layer Style Color)", rgb);
+    let mut fields = color_picker_ui::fields_with_web(app, "dialog", "Color Picker (Layer Style Color)", rgb);
     fields.insert(TARGET.into(), serde_json::to_value(t).map_err(|e| e.to_string())?);
     Ok(app.ui.open_dialog(DialogKind::Command, fields))
 }
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 5d95f2d662..e6685b9b77 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -1,4 +1,4 @@
-//! Photocraft's first UI shell, built on egui/eframe.
+//! PhotoCraft's first UI shell, built on egui/eframe.
 //!
 //! This crate is deliberately thin. Every action goes through
 //! [`photocraft_engine::Session::execute`], and all UI state lives in [`state::UiState`] (plain
@@ -25,6 +25,7 @@ pub mod anchor_tools;
 pub mod artboard_tool;
 pub mod artboard_ui;
 pub(crate) mod background_redraw;
+pub mod bidi_text;
 mod blend_keys;
 pub(crate) mod blend_preview;
 pub mod blur_pins;
@@ -37,6 +38,7 @@ pub mod brush_preview;
 pub mod brush_resize;
 pub mod brush_sections;
 pub mod brushes_tab;
+pub mod caf_ui;
 pub(crate) mod cam_preview;
 mod cam_transform;
 mod camera_raw_detail_ui;
@@ -74,6 +76,7 @@ pub mod dialogs;
 pub mod direct_select;
 pub mod direction;
 pub mod discard_ui;
+pub mod disk_change_prompt;
 pub mod distort_ui;
 pub mod doc_props_ui;
 pub mod dock;
@@ -281,6 +284,9 @@ pub struct ExportSettings {
     /// Embed EXIF, resolution and other non-XMP metadata when the format supports it. Export As
     /// turns this off for Metadata: None; Save As leaves it on.
     pub embed_metadata: bool,
+    /// The path of the document's own file, which linked smart objects that PSD/PSB embed are
+    /// resolved against ([`photocraft_io::ExportOptions::document_path`]).
+    pub document_path: Option<std::path::PathBuf>,
 }
 
 impl Default for ExportSettings {
@@ -296,6 +302,7 @@ impl Default for ExportSettings {
             psd_maximize_compatibility: true,
             embed_icc: true,
             embed_metadata: true,
+            document_path: None,
         }
     }
 }
@@ -319,6 +326,7 @@ impl ExportSettings {
         opts.tga_bits = self.tga_bits;
         opts.image_previews = self.image_previews;
         opts.psd_maximize_compatibility = self.psd_maximize_compatibility;
+        opts.document_path = self.document_path.clone();
         opts
     }
 }
@@ -349,6 +357,15 @@ pub(crate) fn plain_raster(doc: &Document) -> Option<&photocraft_doc::Layer> {
 /// Encode a document: (file bytes, warnings about anything approximated or dropped).
 pub type ExportFn = Box<dyn Fn(&Document, &str, &ExportSettings) -> Result<(Vec<u8>, Vec<String>), String>>;
 pub type WriteFn = Box<dyn FnMut(&str, &[u8]) -> Result<(), String>>;
+/// What a file on disk looked like when a document last read or wrote it: File › Save asks
+/// before replacing a file another app changed since (#6596).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct FileStamp {
+    pub len: u64,
+    pub modified: Option<std::time::SystemTime>,
+}
+/// The [`FileStamp`] of the file at a path, `None` when it can't be read.
+pub type FileStampFn = Box<dyn Fn(&str) -> Option<FileStamp>>;
 /// Encode a document and write it to a path, reporting the stage to the job; returns the export
 /// warnings. Runs on a worker thread (see [`Services::save_file`]). It must call
 /// [`jobs_ui::SaveCtl::commit`] right before replacing the file, and write nothing if that fails.
@@ -446,6 +463,9 @@ pub struct Services {
     pub file_dialog: Option<FileDialogFn>,
     /// Write bytes to a path (native) or trigger a download (web).
     pub write: Option<WriteFn>,
+    /// Size and modification time of a file (native); `None` on the web, where Save never
+    /// writes back to a file.
+    pub file_stamp: Option<FileStampFn>,
     /// Encode and write in one step on a worker thread, so a large save doesn't freeze the
     /// window (#2017). With background jobs on, saves use it instead of `export` and `write`.
     pub save_file: Option<SaveFileFn>,
@@ -466,8 +486,13 @@ pub struct Services {
     /// Preferences ▸ General ▸ Beep When Done: the platform's default beep, played when a
     /// background job finishes successfully. `None` in the web build (and in tests).
     pub beep: Option<fn()>,
-    /// Files delivered asynchronously (web drag-and-drop): drained every frame.
+    /// Files delivered asynchronously (web drag-and-drop): drained every frame and opened as
+    /// documents.
     pub inbox: Option<Inbox>,
+    /// Files delivered asynchronously for a drop onto the active document's canvas (web
+    /// drag-and-drop, routed by [`PhotocraftApp::dropped_on_canvas`]): placed as layers like a
+    /// desktop canvas drop (Place Embedded, each in Free Transform).
+    pub place_inbox: Option<Inbox>,
     /// OS clipboard images: copies go out, screenshots and images from other apps come in.
     pub clipboard_set_image: Option<ClipboardSetFn>,
     pub clipboard_get_image: Option<ClipboardGetFn>,
@@ -494,8 +519,9 @@ pub struct Services {
     pub append_text: Option<AppendTextFn>,
     /// OS requests (macOS open-documents / quit Apple events), polled every frame.
     pub os_events: Option<OsEventsFn>,
-    /// The pointer position read from the OS (desktop): winit 0.30's file drops carry none, and
-    /// the window gets no pointer events during an OS drag (see `file_open::DropTarget`).
+    /// The pointer position read from the OS (desktop) or from the page's drag events (web):
+    /// file drops carry none, and the window gets no pointer events during an OS drag (see
+    /// `file_open::DropTarget`).
     pub cursor_pos: Option<CursorPosFn>,
     /// Caps Lock toggled on (desktop; `None` on Wayland and the web). Read once per frame, so
     /// the canvas can show the precise crosshair for painting tools, whatever the preference.
@@ -653,11 +679,11 @@ pub struct PhotocraftApp {
     /// The document tab strip last frame: a drop there opens the file at the slot under it.
     pub(crate) tab_strip: Option<canvas::TabStrip>,
     /// Files dropped on the canvas still to place, one Free Transform at a time.
-    pub(crate) drop_places: std::collections::VecDeque<egui::DroppedFileHandle>,
+    pub(crate) drop_places: std::collections::VecDeque<file_open::DropPlace>,
     /// The document each of `ui.views` belongs to, as of the last [`Self::sync_views`].
     view_docs: Vec<DocId>,
     pub fps: f32,
-    last_frame_time: f64,
+    pub(crate) last_frame_time: f64,
     thumbs: HashMap<(photocraft_doc::LayerId, u8), (u64, egui::TextureHandle)>,
     /// The document area each layer thumbnail in `thumbs` frames (the canvas, or the layer's
     /// bounds with Clip Thumbnails to Layer Bounds; #4281).
@@ -684,6 +710,9 @@ pub struct PhotocraftApp {
     pub(crate) color_range: Option<color_range_ui::Preview>,
     /// Image › Adjustments dialog preview through a temporary clipped adjustment layer.
     pub(crate) adjust_preview: Option<adjust_preview::AdjustPreview>,
+    /// The Properties panel's live adjustment-layer drag: its damage region and coverage
+    /// (`adjust_preview::live_key`).
+    pub(crate) live_adjust_preview: Option<adjust_preview::LiveAdjust>,
     /// Synthetic input events queued by automation (`ui.click`, `ui.key`, …), injected next frame.
     pub(crate) synthetic: Vec<egui::Event>,
     /// True only while a frame is processing synthetic automation input. It
@@ -787,6 +816,9 @@ pub struct PhotocraftApp {
     /// Where each document was last saved or exported to through a dialog (#1826): its next Save
     /// As or export dialog starts there rather than beside the document. Session-only.
     pub(crate) save_dirs: HashMap<photocraft_doc::DocId, std::path::PathBuf>,
+    /// Each document's own file as it was when the document was opened from it or saved to it
+    /// (see [`FileStamp`]).
+    pub(crate) disk_stamps: HashMap<photocraft_doc::DocId, (String, FileStamp)>,
     /// A save to an RGB Targa parked behind the Targa Options prompt (see `targa_options_ui`).
     pub(crate) targa_options: Option<targa_options_ui::Prompt>,
     /// Files read but not opened yet: the first waits on its profile prompt, the rest behind it
@@ -800,6 +832,12 @@ pub struct PhotocraftApp {
     /// `jobs_ui`). The desktop app turns it on; off (the default), everything runs inline as
     /// before, which tests and scripts rely on.
     pub background_jobs: bool,
+    /// Shortest time between frames (ms), or `None` for no cap. A present mode that doesn't wait
+    /// for the display (Low-Latency Drawing) would otherwise redraw as fast as it can while
+    /// anything keeps requesting repaints (a drag hovering, autoscroll, Liquify held still).
+    /// After #4472 (astigmata).
+    pub min_frame_ms: Option<f64>,
+    last_frame_start_ms: f64,
     /// Background job bookkeeping: opening tabs, control replies waiting on a job.
     pub jobs: jobs_ui::JobsUi,
     #[cfg(all(debug_assertions, not(target_arch = "wasm32")))]
@@ -882,6 +920,7 @@ impl PhotocraftApp {
             redraws: Default::default(),
             color_range: None,
             adjust_preview: None,
+            live_adjust_preview: None,
             synthetic: Vec::new(),
             automation_input: false,
             channel_thumbs: None,
@@ -930,11 +969,14 @@ impl PhotocraftApp {
             file_dialog: None,
             tiff_options: None,
             save_dirs: HashMap::new(),
+            disk_stamps: HashMap::new(),
             targa_options: None,
             held_opens: Default::default(),
             allow_close: false,
             stylus: Default::default(),
             background_jobs: false,
+            min_frame_ms: None,
+            last_frame_start_ms: 0.0,
             jobs: Default::default(),
             #[cfg(all(debug_assertions, not(target_arch = "wasm32")))]
             live_tokens: theme::live::LiveTokens::from_env(),
@@ -1044,6 +1086,21 @@ impl PhotocraftApp {
         {
             authorize(id, &params)?;
         }
+        // A new layer while Free Transform is open applies the transform first, as Photoshop does
+        // (#5667): History reads the transform (or Place Embedded), then New Layer. Only for a
+        // command that can run; a transform refused or still being applied keeps the box open and
+        // the command doesn't run.
+        if photocraft_engine::PRECHECKED.contains(&id) && self.ui.transform.is_some() {
+            // Bad params or a command that can't run leave the box as it is.
+            self.session.precheck(id, &params).map_err(|e| e.to_string())?;
+            transform_tool::commit(self);
+            if transform_tool::committing(self).is_some() {
+                return Err(tl!("Free Transform is still being applied; try again when it has finished.").into());
+            }
+            if self.ui.transform.is_some() {
+                return Err(if self.ui.status.is_empty() { tl!("The transform couldn't be applied.").into() } else { self.ui.status.clone() });
+            }
+        }
         if let Some(result) = panel_docking::command(self, id, &params) {
             return result;
         }
@@ -1415,6 +1472,13 @@ impl PhotocraftApp {
         self.pick_save(&suggested, move |app, path| {
             app.with_document(doc, |app| {
                 let own = app.session.active().and_then(|st| st.path.clone());
+                // Confirming the document's own file: ask first if another app changed it (#6596).
+                if plain_save
+                    && own.as_deref() == Some(path.as_str())
+                    && let Some(r) = crate::disk_change_prompt::intercept(app, doc, &path, true)
+                {
+                    return r;
+                }
                 let r = app.save_to(path.clone(), tga_bits)?;
                 if plain_save && own.as_deref() == Some(path.as_str()) {
                     app.journal_as_plain_save(&path);
@@ -1425,7 +1489,7 @@ impl PhotocraftApp {
     }
 
     /// [`Self::save_as_with`] once the path is known.
-    fn save_to(&mut self, path: String, tga_bits: Option<photocraft_io::TgaBits>) -> Result<Value, String> {
+    pub(crate) fn save_to(&mut self, path: String, tga_bits: Option<photocraft_io::TgaBits>) -> Result<Value, String> {
         // An RGB Targa asks for its bits per pixel, unless the caller chose them; the save
         // continues from the prompt (still a copy when it would be one without the prompt),
         // which records the step once answered.
@@ -1469,7 +1533,7 @@ impl PhotocraftApp {
     }
 
     /// Re-label the Save As just journaled for `path` as File › Save (see [`Self::save_dialog_flow`]).
-    fn journal_as_plain_save(&mut self, path: &str) {
+    pub(crate) fn journal_as_plain_save(&mut self, path: &str) {
         if let Some(last) = self.session.journal.last_mut()
             && last.0 == "file.saveAs"
             && last.1.get("path").and_then(Value::as_str) == Some(path)
@@ -1526,6 +1590,7 @@ impl PhotocraftApp {
             settings.jpeg_quality = e.jpeg_quality.map(|q| q.clamp(1, 100));
             settings.webp_lossless = e.webp_lossless.unwrap_or(settings.webp_lossless);
             settings.webp_quality = e.webp_quality.map(|q| q.min(100));
+            settings.document_path = st.path.as_deref().map(std::path::PathBuf::from);
         }
         settings
     }
@@ -1610,6 +1675,7 @@ impl PhotocraftApp {
                     st.saved_to(path.to_string());
                     // The job locked the document, but record the revision that was written.
                     st.saved_revision = revision;
+                    app.remember_stamp(doc, path);
                 }
                 // "Save Document" script events and File › Generate › Image Assets.
                 if hooks
@@ -1629,6 +1695,9 @@ impl PhotocraftApp {
             if hooks {
                 self.push_recent(path);
             }
+        } else if self.disk_stamps.get(&doc).is_some_and(|(own, _)| own == path) {
+            // A copy written over the document's own file is this app's change too.
+            self.remember_stamp(doc, path);
         }
         self.ui.status_error = false;
         let what = crate::i18n::fmt(tl!("Saved {name}"), &[("name", file_open::display_name(path).as_str())]);
@@ -1636,6 +1705,21 @@ impl PhotocraftApp {
         self.sync_views();
     }
 
+    /// Note how `doc`'s own file at `path` looks now that the document read or wrote it.
+    pub(crate) fn remember_stamp(&mut self, doc: photocraft_doc::DocId, path: &str) {
+        match self.services.file_stamp.as_ref().and_then(|stamp| stamp(path)) {
+            Some(now) => self.disk_stamps.insert(doc, (path.to_string(), now)),
+            None => self.disk_stamps.remove(&doc),
+        };
+    }
+
+    /// Another app changed `doc`'s own file at `path` since the document was opened from it or
+    /// last saved to it. A file that is gone, or one never stamped, counts as unchanged.
+    pub(crate) fn changed_on_disk(&self, doc: photocraft_doc::DocId, path: &str) -> bool {
+        let Some((own, then)) = self.disk_stamps.get(&doc) else { return false };
+        own == path && self.services.file_stamp.as_ref().and_then(|stamp| stamp(path)).is_some_and(|now| now != *then)
+    }
+
     /// TIFF Options or Targa Options is waiting on an answer before a save is written.
     pub(crate) fn save_options_open(&self) -> bool {
         self.tiff_options.is_some() || self.targa_options.is_some()
@@ -1759,6 +1843,20 @@ impl PhotocraftApp {
     }
 }
 
+impl PhotocraftApp {
+    /// Wait out the rest of [`Self::min_frame_ms`] since the last frame started.
+    fn cap_frame_rate(&mut self) {
+        #[cfg(not(target_arch = "wasm32"))]
+        if let Some(min) = self.min_frame_ms.filter(|m| m.is_finite() && *m > 0.0) {
+            let wait = min.min(100.0) - (gpu_canvas::now_ms() - self.last_frame_start_ms);
+            if wait > 0.0 {
+                std::thread::sleep(std::time::Duration::from_secs_f64(wait / 1000.0));
+            }
+        }
+        self.last_frame_start_ms = gpu_canvas::now_ms();
+    }
+}
+
 impl eframe::App for PhotocraftApp {
     fn on_exit(&mut self) {
         if let Err(err) = tool_memory::save_on_exit(self) {
@@ -1767,6 +1865,7 @@ impl eframe::App for PhotocraftApp {
     }
 
     fn logic(&mut self, ctx: &egui::Context, frame: &mut eframe::Frame) {
+        self.cap_frame_rate();
         i18n::set_current(i18n::Lang::from_pref(&self.session.prefs().interface.language));
         // Caps Lock state read from the OS once per frame (see `Services::caps_lock`): the canvas
         // cursor block needs it before the frame renders. `None` (Wayland/web) keeps `false`.
@@ -1829,6 +1928,10 @@ impl eframe::App for PhotocraftApp {
                 self.open_failed(&name, &e);
             }
         }
+        // Web drops onto the canvas, read since the last frame: placed below, one at a time.
+        let to_place: Vec<(String, Vec<u8>)> =
+            self.services.place_inbox.as_ref().map(|q| std::mem::take(&mut *q.lock().unwrap_or_else(|e| e.into_inner()))).unwrap_or_default();
+        self.drop_places.extend(to_place.into_iter().map(|(name, bytes)| file_open::DropPlace::Bytes(name, bytes)));
         // Finder double-click / Open With / Dock drops (macOS open-documents events).
         self.drain_os_events(ctx);
         // While files are dragged over the window it gets no pointer events: keep frames coming so
@@ -2004,7 +2107,10 @@ impl eframe::App for PhotocraftApp {
         if self.stroke_trace.enabled() {
             self.stroke_trace.canvas(self.perf.frame_refresh_ms);
             let info = &self.perf.gpu_info;
-            self.stroke_trace.end_frame(ui_ms, self.live_stroke.is_some(), || format!("{} {}", info.backend, info.adapter).trim().to_string());
+            self.stroke_trace.end_frame(ui_ms, self.live_stroke.is_some(), || {
+                let gpu = format!("{} {}", info.backend, info.adapter).trim().to_string();
+                if info.present.is_empty() { gpu } else { format!("{gpu}, {}", info.present) }
+            });
         }
         // Synthetic input is injected one press/release step per frame: keep frames coming until
         // the queue is empty, then release control replies waiting on it.
@@ -2638,6 +2744,10 @@ mod pixel_aspect_tests;
 #[cfg(test)]
 mod transform_fx_tests;
 
+#[cfg(test)]
+mod layer_props_ui_tests;
+#[cfg(test)]
+mod transform_switch_tests;
 #[cfg(test)]
 mod transform_undo_tests;
 
diff --git a/crates/ui-egui/src/marquee_tests.rs b/crates/ui-egui/src/marquee_tests.rs
index 169d4588b9..321a31e73a 100644
--- a/crates/ui-egui/src/marquee_tests.rs
+++ b/crates/ui-egui/src/marquee_tests.rs
@@ -546,6 +546,29 @@ fn mouse_drag_inside_the_selection_moves_it() {
     assert_eq!(selection(&h), Rect::new(120, 90, 220, 170), "moved by (20, 10)");
 }
 
+/// #6290: with a fresh app's View › Snap To, a selection moved through the real canvas snaps its
+/// edges to a guide and the document bounds. Layers' targets were clipped to the selection, so
+/// it snapped back to its own starting edges and centre (shown as layer alignments) instead.
+#[test]
+fn a_moved_selection_snaps_to_guides_and_the_document_not_its_start() {
+    for (to, want) in [
+        // Right edge 3 px left of the guide at x = 200; 3 px down stays put (not back to y = 52).
+        ([145.0, 103.0], Rect::new(100, 55, 200, 105)),
+        // 5 and 7 px from the document's top-left corner (its centre was 3 px off its start).
+        ([53.0, 55.0], Rect::new(0, 0, 100, 50)),
+    ] {
+        let mut h = harness(Tool::RectMarquee);
+        h.state_mut().run("view.newGuide", json!({"orientation": "vertical", "position": 200})).unwrap();
+        h.state_mut().run("select.rect", json!({"x": 52, "y": 52, "width": 100, "height": 50})).unwrap();
+        h.run_steps(2);
+        drag_to(&mut h, [100.0, 100.0], to);
+        let up = screen(&h, to[0], to[1]);
+        button(&mut h, up, false, Modifiers::NONE);
+        h.run_steps(2);
+        assert_eq!(selection(&h), want, "dragged to {to:?}");
+    }
+}
+
 /// #5646: the Move tool keeps Photoshop's arrow pointer instead of the 4-way move cursor (the
 /// hover outline still marks the layer under the pointer).
 #[test]
diff --git a/crates/ui-egui/src/menu_keys.rs b/crates/ui-egui/src/menu_keys.rs
index 5762b2a945..dee906ccb1 100644
--- a/crates/ui-egui/src/menu_keys.rs
+++ b/crates/ui-egui/src/menu_keys.rs
@@ -118,6 +118,51 @@ pub fn mnemonic_text(ui: &Ui, prefix: &str, label: &str, mnemonic: Option<char>,
     job.into()
 }
 
+/// The checkmark menu rows draw in their gutter.
+pub const CHECK_MARK: &str = "✔ ";
+
+/// Width of the checkmark column every menu row reserves (#5705): the width of [`CHECK_MARK`] in
+/// the button font, so checked, unchecked and plain rows (and submenu headers) all start their
+/// label at the same x, whatever the script of the label.
+pub fn check_gutter(ui: &Ui) -> f32 {
+    let font = egui::TextStyle::Button.resolve(ui.style());
+    ui.painter().layout_no_wrap(CHECK_MARK.to_owned(), font, Color32::PLACEHOLDER).size().x
+}
+
+/// A menu row's text (#5705): the label behind a fixed-width checkmark column ([`check_gutter`]),
+/// with ✔ in the column when `checked`, and the mnemonic underlined when given (as
+/// [`mnemonic_text`]).
+pub fn menu_row_text(ui: &Ui, checked: bool, label: &str, mnemonic: Option<char>) -> egui::WidgetText {
+    let font = egui::TextStyle::Button.resolve(ui.style());
+    let plain = egui::TextFormat { font_id: font, color: Color32::PLACEHOLDER, ..Default::default() };
+    let mut job = egui::text::LayoutJob::default();
+    job.wrap.max_width = f32::INFINITY;
+    // The label starts after the column: a checked row draws the mark in it, the others leave it
+    // empty (a leading space of the same width, not padding characters whose width varies).
+    let mut lead = check_gutter(ui);
+    if checked {
+        job.append(CHECK_MARK, 0.0, plain.clone());
+        lead = 0.0;
+    }
+    let at = mnemonic.and_then(|m| label.char_indices().find(|(_, c)| c.to_ascii_uppercase() == m).map(|(i, c)| (i, c.len_utf8())));
+    let parts = match at {
+        Some((i, len)) => [label.get(..i), label.get(i..i + len), label.get(i + len..)],
+        None => [Some(label), None, None],
+    };
+    for (k, part) in parts.into_iter().enumerate() {
+        let Some(part) = part.filter(|p| !p.is_empty()) else { continue };
+        let format =
+            if k == 1 && at.is_some() { egui::TextFormat { underline: Stroke::new(1.0, Color32::PLACEHOLDER), ..plain.clone() } } else { plain.clone() };
+        job.append(part, lead, format);
+        lead = 0.0;
+    }
+    if job.sections.is_empty() {
+        // An empty label still keeps the row as wide as its column.
+        job.append("", lead, plain);
+    }
+    job.into()
+}
+
 impl Keys {
     /// Last frame's state.
     pub fn load(ctx: &egui::Context) -> Keys {
diff --git a/crates/ui-egui/src/menu_keys_tests.rs b/crates/ui-egui/src/menu_keys_tests.rs
index 1f226054e0..4954053578 100644
--- a/crates/ui-egui/src/menu_keys_tests.rs
+++ b/crates/ui-egui/src/menu_keys_tests.rs
@@ -210,3 +210,41 @@ fn the_shortcuts_wait_while_the_keyboard_is_on_the_bar() {
     h.run_steps(3);
     assert_ne!(h.state().ui.tool, tool, "off the bar, E picks the Eraser again");
 }
+
+/// Checked, unchecked and plain rows (and submenu headers) start their label at the same x, in
+/// any script: the checkmark column has a fixed width instead of padding characters (#5705).
+#[test]
+fn every_menu_row_starts_its_label_after_one_checkmark_column() {
+    let ctx = egui::Context::default();
+    let mut out = ctx.run_ui(Default::default(), |ui| {
+        let start = |checked: bool, label: &str, mnemonic: Option<char>| {
+            let galley = crate::menu_keys::menu_row_text(ui, checked, label, mnemonic).into_galley(
+                ui,
+                Some(egui::TextWrapMode::Extend),
+                f32::INFINITY,
+                egui::TextStyle::Button,
+            );
+            let first = label.chars().next().unwrap_or(' ');
+            let row = galley.rows.first().expect("one row");
+            let glyph = row.glyphs.iter().find(|g| g.chr == first).expect("the label's first glyph");
+            assert!(galley.text().ends_with(label), "the label is shown whole: {:?}", galley.text());
+            glyph.pos.x
+        };
+        let gutter = crate::menu_keys::check_gutter(ui);
+        assert!(gutter > 0.0, "the column has room for the mark");
+        for label in ["Lock Guides", "锁定参考线", "清除参考线"] {
+            let checked = start(true, label, None);
+            let unchecked = start(false, label, None);
+            assert!((checked - unchecked).abs() < 0.01, "{label}: checked {checked} vs unchecked {unchecked}");
+            assert!((unchecked - gutter).abs() < 1.0, "{label}: the label starts right after the column ({unchecked} vs {gutter})");
+        }
+        let underlined = start(false, "Clear Guides", Some('C'));
+        let plain = start(false, "Clear Guides", None);
+        assert!((underlined - plain).abs() < 0.01, "an underlined mnemonic doesn't move the label");
+        let underlined_mid = start(true, "Lock Guides", Some('G'));
+        assert!((underlined_mid - plain).abs() < 0.01, "nor a mnemonic after the first letter");
+        let t = crate::menu_keys::menu_row_text(ui, true, "Rulers", None);
+        assert_eq!(t.text(), "✔ Rulers", "a checked row keeps its mark (and its accessible label)");
+    });
+    out.textures_delta.clear();
+}
diff --git a/crates/ui-egui/src/menu_nav_tests.rs b/crates/ui-egui/src/menu_nav_tests.rs
index 1643e2765b..d46c50bbbf 100644
--- a/crates/ui-egui/src/menu_nav_tests.rs
+++ b/crates/ui-egui/src/menu_nav_tests.rs
@@ -844,3 +844,62 @@ fn heading_is_the_triangle_to_the_submenus_near_edge() {
     assert!(!heading(egui::pos2(150.0, 110.0), egui::pos2(170.0, 160.0), left));
     assert!(!heading(from, from, egui::Rect::NOTHING));
 }
+
+/// #5896, #6225: a menu scrolled down (to reach Edit › Preferences or Window › Theme) reopens
+/// scrolled, with the rows above its view lying over the menu bar. egui opens a submenu when the
+/// pointer is over its row even where the row is scrolled out of sight, so a hidden submenu row
+/// under the title opened on the press and the click on the title then closed the whole menu.
+/// Rows out of view must not open their submenus: the menu stays open.
+#[test]
+fn a_scrolled_menu_reopens_and_stays_open_with_a_hidden_submenu_row_under_its_title() {
+    use egui::{Modifiers, PointerButton};
+    for top in ["Edit", "Window"] {
+        let mut h = harness((1280.0, 420.0, 1.0));
+        open(&mut h, top);
+        let title = h.get_by_label(top).rect().center();
+        let view = Nav::current(&h.ctx).views[0];
+        assert!(Nav::current(&h.ctx).contents[0] > view.height() + 1.0, "{top} must overflow for this test to mean anything");
+        // Scroll to the end, then back up until a submenu row is out of view right under the title.
+        h.hover_at(egui::pos2(view.center().x, view.bottom() - 2.0));
+        let wheel = |h: &mut Harness<'static, PhotocraftApp>, dy: f32| {
+            h.event(egui::Event::MouseWheel {
+                unit: egui::MouseWheelUnit::Point,
+                delta: egui::vec2(0.0, dy),
+                modifiers: Modifiers::NONE,
+                phase: egui::TouchPhase::Move,
+            });
+            h.run_steps(1);
+        };
+        for _ in 0..60 {
+            wheel(&mut h, -60.0);
+        }
+        let under = |h: &Harness<'static, PhotocraftApp>| {
+            rows(h, 0).iter().any(|r| r.command.is_none() && r.enabled && r.rect.x_range().contains(title.x) && r.rect.y_range().contains(title.y))
+        };
+        for _ in 0..400 {
+            if under(&h) {
+                break;
+            }
+            wheel(&mut h, 8.0);
+        }
+        assert!(under(&h), "{top}: a submenu row scrolled under the title");
+        key(&mut h, egui::Key::Escape);
+        assert!(!is_open(&h.ctx), "{top}: Esc closed it");
+        // Click the title again: press, release, as a mouse does.
+        h.hover_at(title);
+        h.run_steps(1);
+        h.event(egui::Event::PointerButton { pos: title, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+        h.run_steps(1);
+        h.event(egui::Event::PointerButton { pos: title, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+        // Per frame after the click: is the menu open, and how many levels are drawn?
+        let frames: Vec<(bool, usize)> = (0..6)
+            .map(|_| {
+                h.run_steps(1);
+                let nav = Nav::current(&h.ctx);
+                (nav.rows.first().is_some_and(|r| !r.is_empty()), nav.rows.len())
+            })
+            .collect();
+        assert!(frames.iter().all(|f| f.0), "{top}: the menu closed again right after the click: {frames:?}");
+        assert!(frames.iter().all(|f| f.1 == 1), "{top}: a submenu scrolled out of view opened under the title: {frames:?}");
+    }
+}
diff --git a/crates/ui-egui/src/menus.rs b/crates/ui-egui/src/menus.rs
index 7f47e6ea64..bbaf6fa6a4 100644
--- a/crates/ui-egui/src/menus.rs
+++ b/crates/ui-egui/src/menus.rs
@@ -20,91 +20,9 @@ pub(crate) fn modal_allows(app: &PhotocraftApp, id: &str) -> bool {
 pub const TOP_MENUS: [&str; 10] = ["File", "Edit", "Image", "Layer", "Type", "Select", "Filter", "View", "Window", "Help"];
 
 /// UI-level commands (handled by the shell rather than the engine): id, label, menu, shortcut.
-pub const UI_COMMANDS: &[(&str, &str, &[&str], Option<&str>)] = &[
-    ("ui.symmetryTransform", "Transform Symmetry", &[], None),
-    // Right-click the options bar's tool icon (#2825); `tool.resetAll` asks first.
-    ("tool.reset", "Reset Tool", &[], None),
-    ("tool.resetAll", "Reset All Tools", &[], None),
-    ("window.panel.group", "Change Panel Group", &[], None),
-    ("window.panel.layout", "Change Panel Layout", &[], None),
-    ("window.panel.move", "Move Panel", &[], None),
-    ("window.panel.float", "Float Panel", &[], None),
-    ("window.panel.dock", "Dock Panel", &[], None),
-    ("window.panel.activate", "Activate Panel", &[], None),
-    ("window.panel.close", "Close Panel", &[], None),
-    ("file.open", "Open…", &["File"], Some("Cmd+O")),
-    ("file.save", "Save", &["File"], Some("Cmd+S")),
-    ("file.saveAs", "Save As…", &["File"], Some("Cmd+Shift+S")),
-    ("file.exit", "Exit", &["File"], Some("Cmd+Q")),
-    ("edit.freeTransform", "Free Transform", &["Edit"], Some("Cmd+T")),
-    ("file.export.exportAs", "Export As…", &["File", "Export"], Some("Cmd+Alt+Shift+W")),
-    ("file.export.quickExportAsPng", "Quick Export as PNG", &["File", "Export"], None),
-    ("edit.transform.scale", "Scale", &["Edit", "Transform"], None),
-    ("edit.transform.rotate", "Rotate", &["Edit", "Transform"], None),
-    ("edit.transform.skew", "Skew", &["Edit", "Transform"], None),
-    ("edit.transform.distort", "Distort", &["Edit", "Transform"], None),
-    ("edit.transform.perspective", "Perspective", &["Edit", "Transform"], None),
-    ("select.selectAndMask", "Select and Mask…", &["Select"], Some("Cmd+Alt+R")),
-    ("view.rulers", "Rulers", &["View"], Some("Cmd+R")),
-    ("view.show.grid", "Grid", &["View", "Show"], Some("Cmd+'")),
-    ("view.show.guides", "Guides", &["View", "Show"], Some("Cmd+;")),
-    ("view.snap", "Snap", &["View"], Some("Cmd+Shift+;")),
-    ("view.lockGuides", "Lock Guides", &["View"], Some("Cmd+Alt+;")),
-    ("view.extras", "Extras", &["View"], Some("Cmd+H")),
-    ("view.show.targetPath", "Target Path", &["View", "Show"], Some("Cmd+Shift+H")),
-    ("view.screenMode.cycle", "Cycle Screen Mode", &[], Some("F")),
-    // Photoshop's interface brightness shortcuts: step through the four Pro themes.
-    ("view.darkenInterface", "Darken Interface", &[], Some("Cmd+Shift+F1")),
-    ("view.lightenInterface", "Lighten Interface", &[], Some("Cmd+Shift+F2")),
-    ("edit.freeTransformCopy", "Free Transform a Copy", &[], Some("Cmd+Alt+T")),
-    ("type.editText", "Edit Type", &[], None),
-    ("view.zoomIn", "Zoom In", &["View"], Some("Cmd+=")),
-    ("view.zoomOut", "Zoom Out", &["View"], Some("Cmd+-")),
-    ("view.fitOnScreen", "Fit on Screen", &["View"], Some("Cmd+0")),
-    ("view.actualPixels", "100%", &["View"], Some("Cmd+1")),
-    ("view.rotateView", "Rotate View", &[], None),
-    ("view.resetView", "Reset View", &["View"], None),
-    ("window.newWindowForDocument", "New Window for Document", &["Window", "Arrange"], None),
-    ("window.toggle.layers", "Layers", &["Window"], Some("F7")),
-    ("window.toggle.history", "History", &["Window"], None),
-    ("window.toggle.properties", "Properties", &["Window"], None),
-    ("window.toggle.color", "Color", &["Window"], Some("F6")),
-    ("window.toggle.brushSettings", "Brush Settings", &["Window"], Some("F5")),
-    ("window.toggle.brushes", "Brushes", &["Window"], None),
-    ("window.toggle.navigator", "Navigator", &["Window"], None),
-    ("window.toggle.toolbar", "Tools", &["Window"], None),
-    // Photoshop's Tab and ⇧Tab: all panels (Tools, options bar and the dock), or only the dock.
-    ("window.togglePanels", "Show/Hide All Panels", &[], Some("Tab")),
-    ("window.toggle.dock", "Show/Hide Panels", &[], Some("Shift+Tab")),
-    ("window.toggle.options", "Options", &["Window"], None),
-    // Photoshop's Ctrl+Tab and Ctrl+Shift+Tab, on macOS too (⌘Tab belongs to the system, #2340).
-    ("window.nextDocument", "Next Document", &[], Some("Ctrl+Tab")),
-    ("window.previousDocument", "Previous Document", &[], Some("Ctrl+Shift+Tab")),
-    ("window.theme.toggle", "Next Appearance Mode", &["Window"], None),
-    ("window.theme.pro", "Pro Theme", &["Window", "Theme"], None),
-    ("window.theme.proMedium", "Pro Medium Gray Theme", &["Window", "Theme"], None),
-    ("window.theme.proLightGray", "Pro Light Gray Theme", &["Window", "Theme"], None),
-    ("window.theme.proLight", "Pro Light Theme", &["Window", "Theme"], None),
-    ("window.theme.studio", "Studio Theme", &["Window", "Theme"], None),
-    ("window.theme.studioLight", "Studio Light Theme", &["Window", "Theme"], None),
-    ("window.theme.classic", "Classic Theme", &["Window", "Theme"], None),
-    ("window.theme.solarizedDark", "Solarized Dark Theme", &["Window", "Theme"], None),
-    ("window.theme.adwaita", "Adwaita Light Theme", &["Window", "Theme"], None),
-    ("window.theme.adwaitaDark", "Adwaita Dark Theme", &["Window", "Theme"], None),
-    ("window.theme.breezeLight", "Breeze Light Theme", &["Window", "Theme"], None),
-    ("window.theme.breezeDark", "Breeze Dark Theme", &["Window", "Theme"], None),
-    ("window.theme.softLight", "Soft Light Theme", &["Window", "Theme"], None),
-    ("window.theme.softDark", "Soft Dark Theme", &["Window", "Theme"], None),
-    ("window.theme.system", "Sync with system", &["Window", "Theme"], None),
-    ("edit.search", "Search…", &["Edit"], Some("Cmd+F")),
-    ("help.discord", "Join the ArtCraft Discord…", &["Help"], None),
-    ("help.website", "PhotoCraft Website", &["Help"], None),
-    ("help.artcraftWebsite", "ArtCraft Website", &["Help"], None),
-    ("help.github", "PhotoCraft on GitHub", &["Help"], None),
-    ("help.reportIssue", "Report an Issue…", &["Help"], None),
-    ("help.systemInfo", "System Info…", &["Help"], None),
-    ("help.about", "About PhotoCraft", &["Help"], None),
-];
+/// The table is the engine's ([`photocraft_engine::shell_commands::SHELL_COMMANDS`]), so the
+/// commands and their keys exist without this UI (headless shortcut sets, lists, conflicts).
+pub const UI_COMMANDS: &[(&str, &str, &[&str], Option<&str>)] = photocraft_engine::shell_commands::SHELL_COMMANDS;
 
 /// Window › <document>: the open documents, listed at the end of the Window menu as in Photoshop.
 /// The id ends in the document's index, which is its tab's position.
@@ -313,7 +231,11 @@ pub(crate) fn invoke_unguarded(app: &mut PhotocraftApp, ctx: &egui::Context, id:
                 None => {
                     let own = app.session.active().and_then(|d| d.path.clone().map(|p| (photocraft_engine::file_cmds::holds_at(&d.doc, &p), p, d)));
                     match own {
-                        Some((true, path, _)) => app.save_in_place(path),
+                        Some((true, path, d)) => {
+                            // Another app changed the file since it was opened or saved: ask first (#6596).
+                            let doc = d.doc.id;
+                            crate::disk_change_prompt::intercept(app, doc, &path, false).unwrap_or_else(|| app.save_in_place(path))
+                        }
                         Some((false, path, d)) if photocraft_engine::file_cmds::saves_in_place(&path) => {
                             // Its own file is layered but can't hold what the document has now.
                             let losses = photocraft_engine::file_cmds::losses_at(&d.doc, &path);
@@ -487,6 +409,13 @@ pub(crate) fn invoke_unguarded(app: &mut PhotocraftApp, ctx: &egui::Context, id:
             }
             Ok(Value::Null)
         }
+        // Only interactive creation opens the Color Picker; it creates the layer on OK,
+        // so Cancel leaves neither an orphan layer nor an undo/redo history entry.
+        // Explicit parameters continue straight to the engine.
+        "layer.newFillLayer.solidColor" if params.as_object().is_none_or(|o| o.is_empty()) => {
+            let dialog = crate::solid_fill_ui::open_new(app).ok_or("no document is open")?;
+            Ok(json!({"dialog": dialog}))
+        }
         // Solid Color fills and solid-colour shapes use the Color Picker, Pattern fills the Pattern
         // Fill dialog; other adjustment / fill / shape controls use Properties.
         "layer.layerContentOptions" => {
@@ -1527,15 +1456,10 @@ fn render_level_rows(ui: &mut egui::Ui, items: &[&MenuItem], depth: usize, click
                 continue;
             }
             let label = translated_menu_label(lang, it);
-            let prefix = match it.checked {
-                Some(true) => "✔ ",
-                Some(false) => "   ",
-                None => "",
-            };
             let mnemonic = mnemonics.get(next_row).copied().flatten();
             next_row += 1;
-            let text: egui::WidgetText =
-                if nav.underline { crate::menu_keys::mnemonic_text(ui, prefix, &label, mnemonic, None) } else { format!("{prefix}{label}").into() };
+            // Checked, unchecked and plain rows share one checkmark column (#5705).
+            let text = crate::menu_keys::menu_row_text(ui, it.checked == Some(true), &label, mnemonic.filter(|_| nav.underline));
             let mut b = egui::Button::new(text);
             if let Some(tint) = it.color.as_deref().and_then(menu_tint) {
                 b = b.fill(tint.gamma_multiply(0.55));
@@ -1568,19 +1492,15 @@ fn render_level_rows(ui: &mut egui::Ui, items: &[&MenuItem], depth: usize, click
             let enabled = submenu_enabled(&child);
             let mnemonic = mnemonics.get(next_row).copied().flatten();
             next_row += 1;
-            let title: egui::WidgetText = if nav.underline {
-                crate::menu_keys::mnemonic_text(ui, "", crate::i18n::tr(lang, name), mnemonic, None)
-            } else {
-                crate::i18n::tr(lang, name).into()
-            };
+            let title = crate::menu_keys::menu_row_text(ui, false, crate::i18n::tr(lang, name), mnemonic.filter(|_| nav.underline));
             ui.add_enabled_ui(enabled, |ui| {
                 nav.row(ui, depth - 1, enabled, None, mnemonic, |ui, nav| {
-                    let r = ui.menu_button(title, |ui| render_level(ui, &child, depth + 1, clicked, nav));
-                    if r.inner.is_some() {
+                    let (response, inner) = submenu_row(ui, title, |ui| render_level(ui, &child, depth + 1, clicked, nav));
+                    if inner.is_some() {
                         // Where the submenu hangs from, to keep it below the menu bar (#319).
-                        nav.set_anchor(depth, r.response.rect);
+                        nav.set_anchor(depth, response.rect);
                     }
-                    (r.response, ())
+                    (response, ())
                 });
             });
             last_was_sep = false;
@@ -1588,6 +1508,32 @@ fn render_level_rows(ui: &mut egui::Ui, items: &[&MenuItem], depth: usize, click
     }
 }
 
+/// A submenu row, drawn as `ui.menu_button` draws it, except that a row scrolled out of view
+/// doesn't open its submenu. egui opens a submenu whenever the pointer is over its row, clipped
+/// or not: a menu reopened scrolled down (after Edit › Preferences or Window › Theme) has rows
+/// hidden above its view, over the menu bar, and the hidden one under the title opened on the
+/// press; the release on the title then counted as a click outside that submenu and closed the
+/// whole menu (#5896, #6225). An open submenu (e.g. opened from the keyboard) is drawn as usual.
+fn submenu_row<R>(ui: &mut egui::Ui, title: egui::WidgetText, content: impl FnOnce(&mut egui::Ui) -> R) -> (egui::Response, Option<R>) {
+    use egui::containers::menu::{MenuState, SubMenu, SubMenuButton};
+    let sub = SubMenu::id_from_widget_id(ui.next_auto_id());
+    let open = MenuState::from_ui(ui, |state, _| state.open_item == Some(sub));
+    let inactive = ui.style().visuals.widgets.inactive;
+    if open {
+        ui.style_mut().visuals.widgets.inactive = ui.style().visuals.widgets.open;
+    }
+    let response = ui.add(egui::Button::new(title).right_text(SubMenuButton::RIGHT_ARROW));
+    ui.style_mut().visuals.widgets.inactive = inactive;
+    // The rect egui tests the pointer against (`SubMenu::show`), against the part that can be seen.
+    let reach = response.rect.expand2(ui.spacing().item_spacing / 2.0);
+    let hidden = ui.ctx().pointer_hover_pos().is_some_and(|p| reach.contains(p) && !ui.clip_rect().contains(p));
+    if hidden && !open {
+        return (response, None);
+    }
+    let inner = SubMenu::new().show(ui, &response, content);
+    (response, inner.map(|r| r.inner))
+}
+
 /// A submenu header is enabled only while some item under it (at any depth) can run, so a
 /// submenu of greyed items is greyed too instead of opening onto them (#1976).
 fn submenu_enabled(children: &[&MenuItem]) -> bool {
@@ -2161,9 +2107,11 @@ mod open_recent_tests {
         let ctx = egui::Context::default();
         invoke(&mut app, &ctx, "file.open", json!({ "path": p })).unwrap();
         assert_eq!(app.ui.recent_files.first().map(String::as_str), Some(p.as_str()));
-        // Re-open via the recent entry.
+        // Re-open via the recent entry once closed (an open file shows its tab instead, #6598).
+        app.session.close(0);
         invoke(&mut app, &ctx, "file.openRecent.0", json!({})).unwrap();
-        assert_eq!(app.session.documents().len(), 2);
+        assert_eq!(app.session.documents().len(), 1);
+        assert_eq!(app.session.active().and_then(|d| d.path.as_deref()), Some(p.as_str()));
         let _ = std::fs::remove_file(&path);
     }
 }
diff --git a/crates/ui-egui/src/navigator_gpu_tests.rs b/crates/ui-egui/src/navigator_gpu_tests.rs
index 51326597f4..454181ff72 100644
--- a/crates/ui-egui/src/navigator_gpu_tests.rs
+++ b/crates/ui-egui/src/navigator_gpu_tests.rs
@@ -9,20 +9,25 @@ type Harness = egui_kittest::Harness<'static, PhotocraftApp>;
 
 fn harness() -> Option<Harness> {
     let built = std::panic::catch_unwind(|| {
-        egui_kittest::Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_pixels_per_point(1.0).with_max_steps(64).wgpu().build_eframe(|cc| {
-            PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
-            let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
-            if let Some(rs) = cc.wgpu_render_state.as_ref() {
-                app.set_wgpu(rs.clone());
-            }
-            app.ui.panels.navigator = true;
-            app.run("file.new", json!({"width": 400, "height": 300, "background": "white"})).unwrap();
-            app.run("select.rect", json!({"x": 0, "y": 0, "width": 200, "height": 300})).unwrap();
-            app.run("edit.fill", json!({"color": "#ff0000"})).unwrap();
-            app.run("select.deselect", json!({})).unwrap();
-            app.sync_views();
-            app
-        })
+        egui_kittest::Harness::builder()
+            .with_size(egui::vec2(1400.0, 900.0))
+            .with_pixels_per_point(1.0)
+            .with_max_steps(64)
+            .wgpu_setup(crate::gpu_canvas::wgpu_setup())
+            .build_eframe(|cc| {
+                PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
+                let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+                if let Some(rs) = cc.wgpu_render_state.as_ref() {
+                    app.set_wgpu(rs.clone());
+                }
+                app.ui.panels.navigator = true;
+                app.run("file.new", json!({"width": 400, "height": 300, "background": "white"})).unwrap();
+                app.run("select.rect", json!({"x": 0, "y": 0, "width": 200, "height": 300})).unwrap();
+                app.run("edit.fill", json!({"color": "#ff0000"})).unwrap();
+                app.run("select.deselect", json!({})).unwrap();
+                app.sync_views();
+                app
+            })
     });
     match built {
         Ok(h) => Some(h),
@@ -47,6 +52,7 @@ fn near(a: [u8; 4], b: [u8; 3]) -> bool {
 
 #[test]
 fn navigator_draws_the_gpu_canvas_texture_and_follows_edits() {
+    let _gpu = photocraft_testkit::gpu_lock();
     let Some(mut h) = harness() else { return };
     h.run_steps(8);
     if !h.state().perf.gpu {
diff --git a/crates/ui-egui/src/notices.rs b/crates/ui-egui/src/notices.rs
index 146b8b8180..cd974fbbe7 100644
--- a/crates/ui-egui/src/notices.rs
+++ b/crates/ui-egui/src/notices.rs
@@ -105,8 +105,14 @@ pub fn slow_cpu_refresh(app: &mut PhotocraftApp, doc: u64, ms: f64, reason: Opti
         tl!("Edits that change the whole document, such as a layer's blend mode, opacity or visibility, redraw all of it.").into(),
     ];
     if reason == Some(crate::gpu_canvas::OVER_BUDGET) {
+        if let Some(fit) = app.perf.gpu_layer_fit.filter(|f| f.doc == doc && !f.fits()) {
+            lines.push(crate::i18n::fmt(
+                tl!("Its layers need {needed} of GPU memory; the budget leaves them {budget}."),
+                &[("needed", &crate::chrome_ui::fmt_bytes(fit.needed)), ("budget", &crate::chrome_ui::fmt_bytes(fit.budget))],
+            ));
+        }
         lines.push(
-            tl!("Its layers don't fit the GPU memory budget. Raising Memory usage in Preferences › Performance raises the budget, up to a quarter of this computer's memory.")
+            tl!("Set GPU Memory in Preferences › Performance to what your graphics card can hold, at most 3/8 of its memory. Automatic follows Memory Usage, within a quarter of this computer's memory and 3/8 of the card's, and doesn't count the document against a card whose memory is known. The status bar shows GPU Memory Full while they don't fit.")
                 .into(),
         );
     } else if let Some(r) = reason {
@@ -354,12 +360,15 @@ mod tests {
         slow_cpu_refresh(&mut app, 1, f64::NAN, Some(crate::gpu_canvas::OVER_BUDGET));
         assert!(app.ui.notices.is_empty(), "a quick refresh needs no explanation");
 
+        // The layers of document 1 need 3.6 GB and may hold 3.4 GB: the notice says so.
+        app.perf.gpu_layer_fit = Some(crate::gpu_canvas::LayerFit { doc: 1, needed: 3600 << 20, budget: 3400 << 20 });
         slow_cpu_refresh(&mut app, 1, 55_000.0, Some(crate::gpu_canvas::OVER_BUDGET));
         assert_eq!(app.ui.notices.len(), 1);
         let text = app.ui.notices[0].lines.join(" ");
         assert!(text.contains("55.0 s"), "{text}");
         assert!(text.contains("blend mode, opacity or visibility"), "{text}");
-        assert!(text.contains("Memory usage in Preferences › Performance"), "{text}");
+        assert!(text.contains("need 3.5G of GPU memory; the budget leaves them 3.3G"), "{text}");
+        assert!(text.contains("GPU Memory in Preferences › Performance"), "{text}");
         assert!(!app.ui.notices[0].error);
 
         slow_cpu_refresh(&mut app, 1, 55_000.0, Some(crate::gpu_canvas::OVER_BUDGET));
diff --git a/crates/ui-egui/src/panel_docking_tests.rs b/crates/ui-egui/src/panel_docking_tests.rs
index c6feeff633..a4ae378eda 100644
--- a/crates/ui-egui/src/panel_docking_tests.rs
+++ b/crates/ui-egui/src/panel_docking_tests.rs
@@ -175,6 +175,7 @@ fn shared_layout_keeps_panel_identity_across_themes_and_respects_workspace_lock(
 /// Explicit offscreen evidence; this creates no native windows.
 #[test]
 fn capture_custom_panel_docking_visual_fixtures() {
+    let _gpu = photocraft_testkit::gpu_lock();
     let Some(directory) = std::env::var_os("CRAFT_UI_DOCKING_FIXTURES").map(std::path::PathBuf::from) else { return };
     std::fs::create_dir_all(&directory).unwrap();
     for theme in crate::theme::ThemeKind::ALL {
@@ -211,6 +212,7 @@ fn capture_custom_panel_docking_visual_fixtures() {
 
 #[test]
 fn floating_group_titles_are_opaque_in_studio_themes() {
+    let _gpu = photocraft_testkit::gpu_lock();
     // Studio's tab strip is transparent over the dock's card; a floating group must not show the canvas (#4509).
     let mut app = app();
     app.run("window.panel.float", json!({"panel":"swatches","x":40,"y":60,"width":300,"height":300})).unwrap();
@@ -346,6 +348,7 @@ fn splitting_a_short_column_keeps_the_layers_footer_visible_and_usable() {
 
 #[test]
 fn populated_canvas_keeps_a_real_opacity_edit_after_floating_and_redocking() {
+    let _gpu = photocraft_testkit::gpu_lock();
     let mut app = app();
     app.ui.theme = crate::theme::ThemeKind::Studio;
     app.run("file.new", json!({"width":480,"height":360})).unwrap();
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index 522c74dc15..10476013ee 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -694,6 +694,9 @@ pub fn title_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             if system {
                 return;
             }
+            // A right-to-left document name in display order (the OS title keeps the logical text),
+            // in a left-to-right line: "— PhotoCraft" stays after the name, at the right.
+            let title = crate::bidi_text::visual_ltr(&title).into_owned();
             let font = theme::medium(13.0);
             let galley = ui.painter().layout_no_wrap(title.clone(), font.clone(), t.text_dim);
             if let Some(x) = title_x(full.center().x, free.0, free.1, galley.size().x) {
@@ -1279,9 +1282,10 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                             // Keep partial edits in ToolOptions so the first side survives a frame;
                             // Original Ratio shows the document's numbers, as Photoshop does.
                             let (mut rw, mut rh) = crate::crop_size::custom_ratio_fields(o, doc_size);
-                            let cw = widgets::value_field(ui, &mut rw, 0.0..=99_999.0, "", 54.0).changed();
+                            let decimals = crate::crop_size::RATIO_DECIMALS;
+                            let cw = widgets::value_field_prec(ui, &mut rw, 0.0..=99_999.0, "", 54.0, decimals).changed();
                             let swap = icons::button(ui, "arrow-left-right", 22.0, false, tl!("Swaps height and width")).clicked();
-                            let ch = widgets::value_field(ui, &mut rh, 0.0..=99_999.0, "", 54.0).changed();
+                            let ch = widgets::value_field_prec(ui, &mut rh, 0.0..=99_999.0, "", 54.0, decimals).changed();
                             if swap {
                                 std::mem::swap(&mut rw, &mut rh);
                             }
@@ -1518,8 +1522,9 @@ const LAYER_PCT_W: f32 = 66.0 + widgets::POPUP_ARROW_W;
 
 /// The `layer.setProps` edit of a Layers panel Opacity or Fill (`key`) field at `pct` percent. A
 /// drag of the pop-up slider (`drag`) coalesces into one history step, as in Photoshop.
-fn pct_action(l: &Layer, key: &str, pct: f32, drag: Option<u64>) -> (String, Value) {
-    let mut p = json!({"layer": l.id.0, key: pct / 100.0});
+fn pct_action(target: &Value, key: &str, pct: f32, drag: Option<u64>) -> (String, Value) {
+    let mut p = target.clone();
+    p[key] = json!(pct / 100.0);
     if let Some(n) = drag {
         p["coalesce"] = json!(format!("layer-{key}-slider:{n}"));
     }
@@ -1612,6 +1617,7 @@ pub fn status_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                     ui.with_layout(crate::direction::trailing(), |ui| {
                         crate::jobs_ui::status_progress(app, ui);
                         crate::background_redraw::status(app, ui);
+                        crate::chrome_ui::gpu_memory_status(app, ui);
                     });
                     return;
                 }
@@ -1652,6 +1658,7 @@ pub fn status_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                         crate::jobs_ui::status_progress(app, ui);
                     }
                     crate::background_redraw::status(app, ui);
+                    crate::chrome_ui::gpu_memory_status(app, ui);
                 });
             });
         });
@@ -1932,13 +1939,42 @@ fn navigator(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         ui.painter().image(tex, rect, Rect::from_min_max(egui::Pos2::ZERO, pos2(1.0, 1.0)), Color32::WHITE);
     }
     let s = rect.width() / size.width.max(1) as f32;
-    if (resp.clicked() || resp.dragged())
+    // ⌘/Ctrl-drag over the preview draws a rectangle the view then zooms to, as in Photoshop
+    // (#6872); a plain click or drag moves the view.
+    let command = crate::workspace_ui::sticky_mods(app, ctx.input(|i| i.modifiers)).command;
+    if resp.drag_started() && command {
+        let start = ctx.input(|i| i.pointer.press_origin()).or(resp.interact_pointer_pos());
+        ui.data_mut(|d| match start {
+            Some(p) => {
+                d.insert_temp(navigator_zoom_drag_id(), p);
+            }
+            None => d.remove::<Pos2>(navigator_zoom_drag_id()),
+        });
+    }
+    let zoom_from = ui.data(|d| d.get_temp::<Pos2>(navigator_zoom_drag_id()));
+    if let Some(from) = zoom_from {
+        if let Some(to) = resp.interact_pointer_pos() {
+            let r = Rect::from_two_pos(from, to).intersect(rect);
+            crate::tool_feedback::draw_ants(ui.painter(), &[r.left_top(), r.right_top(), r.right_bottom(), r.left_bottom()], true);
+            if resp.drag_stopped() {
+                let doc_rect = Rect::from_min_max(((r.min - rect.min) / s).to_pos2(), ((r.max - rect.min) / s).to_pos2());
+                let (canvas, ppp, aspect) = (app.last_canvas_rect, app.canvas_ppp(), app.ui.view.display_aspect());
+                navigator_zoom_to(&mut app.ui.views[idx], doc_rect, [size.width, size.height], canvas.size(), ppp, aspect);
+            }
+        }
+        if resp.drag_stopped() || !resp.dragged() {
+            ui.data_mut(|d| d.remove::<Pos2>(navigator_zoom_drag_id()));
+        }
+    } else if (resp.clicked() || resp.dragged())
         && let Some(pp) = resp.interact_pointer_pos()
     {
         let d = (pp - rect.min) / s;
         app.ui.views[idx].center = [d.x.clamp(0.0, size.width as f32), d.y.clamp(0.0, size.height as f32)];
         app.ui.views[idx].fit_pending = false;
     }
+    if command && resp.hovered() {
+        ctx.set_cursor_icon(egui::CursorIcon::ZoomIn);
+    }
     // The Navigator has its own zoom target: an unmodified wheel over the preview
     // should zoom even when the document canvas is configured to scroll on wheel.
     // Use the canvas wheel classifier to honour one ×1.1 step per notch without
@@ -2017,6 +2053,42 @@ fn navigator_fit(frame: Rect, w: u32, h: u32) -> Rect {
     Rect::from_center_size(frame.center(), vec2(w * s, h * s))
 }
 
+/// Where a ⌘/Ctrl-drag over the Navigator's preview started, while it lasts.
+fn navigator_zoom_drag_id() -> egui::Id {
+    egui::Id::new("navigator-zoom-drag")
+}
+
+/// Zoom `view` so the document rectangle `doc_rect` (pixels) fills a canvas of `canvas` points,
+/// centred on it, as a Navigator ⌘/Ctrl-drag does (#6872). `doc` is the document's size in
+/// pixels (the view's own copy is only set once the canvas has been drawn), `ppp` the canvas's
+/// device pixels per point and `aspect` the pixel aspect ratio shown; the zoom stays within the
+/// zoom range. A rectangle under 2 document pixels across zooms one step in on its centre.
+fn navigator_zoom_to(view: &mut crate::state::View, doc_rect: Rect, doc: [u32; 2], canvas: egui::Vec2, ppp: f32, aspect: f32) {
+    // Checked before clipping: `min`/`max` would turn a NaN edge into a document edge.
+    if ![doc_rect.min.x, doc_rect.min.y, doc_rect.max.x, doc_rect.max.y].iter().all(|v| v.is_finite()) {
+        return;
+    }
+    let (w, h) = (doc[0] as f32, doc[1] as f32);
+    let r = doc_rect.intersect(Rect::from_min_size(Pos2::ZERO, vec2(w, h)));
+    if r.width() < 0.0 || r.height() < 0.0 {
+        return;
+    }
+    let aspect = if aspect.is_finite() && aspect > 0.0 { aspect } else { 1.0 };
+    let zoom = if r.width() < 2.0 || r.height() < 2.0 || canvas.x <= 0.0 || canvas.y <= 0.0 {
+        crate::zoom_levels::step(view.zoom, 1, view.doc_size)
+    } else {
+        // Document columns shown across the canvas are `canvas.x / (point_zoom * aspect)`.
+        let point_zoom = (canvas.x / (r.width() * aspect)).min(canvas.y / r.height());
+        point_zoom * ppp
+    };
+    if !zoom.is_finite() {
+        return;
+    }
+    view.zoom = crate::zoom_levels::clamp(zoom, view.doc_size);
+    view.center = [r.center().x, r.center().y];
+    view.fit_pending = false;
+}
+
 fn navigator_preview_id() -> egui::Id {
     egui::Id::new("navigator-preview-rect")
 }
@@ -2079,6 +2151,101 @@ mod navigator_wheel_tests {
         assert!((app.ui.views[0].zoom - 1.0).abs() < 1e-4, "wheel outside preview leaves zoom unchanged");
     }
 
+    /// #6872: the zoom a Navigator ⌘/Ctrl-drag sets: the rectangle fills the canvas, centred.
+    #[test]
+    fn navigator_zoom_to_fits_the_rectangle_in_the_canvas() {
+        let fresh = || crate::state::View { doc_size: [200, 100], zoom: 1.0, center: [100.0, 50.0], ..Default::default() };
+        let canvas = vec2(800.0, 600.0);
+        let r = Rect::from_min_max(pos2(50.0, 25.0), pos2(100.0, 50.0));
+        // 50 × 25 px on 800 × 600 pt: the width limits it, 16 points per pixel.
+        let mut v = fresh();
+        navigator_zoom_to(&mut v, r, [200, 100], canvas, 1.0, 1.0);
+        assert_eq!((v.zoom, v.center, v.fit_pending), (crate::zoom_levels::clamp(16.0, [200, 100]), [75.0, 37.5], false));
+        // Device pixels per point and a 2:1 pixel aspect scale it as the canvas shows pixels.
+        let mut v = fresh();
+        navigator_zoom_to(&mut v, r, [200, 100], canvas, 2.0, 2.0);
+        assert_eq!(v.zoom, crate::zoom_levels::clamp(16.0, [200, 100]), "8 points per pixel across, at 2 device pixels per point");
+        // Off the document: only the part on it counts.
+        let mut v = fresh();
+        navigator_zoom_to(&mut v, Rect::from_min_max(pos2(150.0, 50.0), pos2(400.0, 300.0)), [200, 100], canvas, 1.0, 1.0);
+        assert_eq!(v.center, [175.0, 75.0]);
+        // Under 2 px across: one step in on its centre.
+        let mut v = fresh();
+        navigator_zoom_to(&mut v, Rect::from_min_max(pos2(10.0, 10.0), pos2(11.0, 40.0)), [200, 100], canvas, 1.0, 1.0);
+        assert_eq!((v.zoom, v.center), (crate::zoom_levels::step(1.0, 1, [200, 100]), [10.5, 25.0]));
+        // Not a number, or wholly off the document: nothing changes.
+        for bad in [Rect::from_min_max(pos2(f32::NAN, 0.0), pos2(10.0, 10.0)), Rect::from_min_max(pos2(300.0, 300.0), pos2(400.0, 400.0))] {
+            let mut v = fresh();
+            navigator_zoom_to(&mut v, bad, [200, 100], canvas, 1.0, 1.0);
+            assert_eq!((v.zoom, v.center), (1.0, [100.0, 50.0]), "{bad:?}");
+        }
+    }
+
+    /// One frame of the Navigator with pointer `events` and `modifiers` held.
+    fn frame_with(app: &mut PhotocraftApp, ctx: &egui::Context, modifiers: Modifiers, mut events: Vec<Event>) {
+        events.insert(0, Event::ModifiersChanged(modifiers));
+        let input = RawInput { screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(430.0, 460.0))), events, ..Default::default() };
+        ctx.run_ui(input, |ui| navigator(app, ui)).textures_delta.clear();
+    }
+
+    /// A drag over the Navigator's preview between document points `from` and `to`.
+    fn drag(app: &mut PhotocraftApp, ctx: &egui::Context, modifiers: Modifiers, from: [f32; 2], to: [f32; 2]) {
+        let preview = last_navigator_preview(ctx).expect("the preview");
+        let s = preview.width() / 200.0;
+        let at = |p: [f32; 2]| preview.min + vec2(p[0], p[1]) * s;
+        let (a, b) = (at(from), at(to));
+        let button = |pos, pressed| Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers };
+        frame_with(app, ctx, modifiers, vec![Event::PointerMoved(a), button(a, true)]);
+        frame_with(app, ctx, modifiers, vec![Event::PointerMoved(a.lerp(b, 0.5))]);
+        frame_with(app, ctx, modifiers, vec![Event::PointerMoved(b)]);
+        frame_with(app, ctx, modifiers, vec![button(b, false)]);
+        frame_with(app, ctx, Modifiers::NONE, vec![]);
+    }
+
+    /// #6872: ⌘/Ctrl-dragging a rectangle over the preview zooms the view to it, as in
+    /// Photoshop; a plain drag still only moves the view.
+    #[test]
+    fn navigator_command_drag_zooms_to_the_rectangle() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        app.run("file.new", json!({"width": 200, "height": 100})).unwrap();
+        app.sync_views();
+        app.ui.views[0].zoom = 1.0;
+        app.ui.views[0].fit_pending = false;
+        let ctx = egui::Context::default();
+        PhotocraftApp::setup_context(&ctx, crate::theme::ThemeKind::ALL[0]);
+        // The preview settles once the zoom row under it has been measured.
+        for _ in 0..3 {
+            frame(&mut app, &ctx, pos2(5.0, 5.0), 0.0);
+        }
+        // A plain drag pans and keeps the zoom.
+        drag(&mut app, &ctx, Modifiers::NONE, [50.0, 25.0], [100.0, 50.0]);
+        assert_eq!(app.ui.views[0].zoom, 1.0);
+        let c = app.ui.views[0].center;
+        assert!((c[0] - 100.0).abs() < 1.0 && (c[1] - 50.0).abs() < 1.0, "the view follows the pointer: {c:?}");
+        // ⌘/Ctrl-drag: the rectangle fills the canvas (`last_canvas_rect`, 800 × 600 pt).
+        drag(&mut app, &ctx, Modifiers::COMMAND, [50.0, 25.0], [100.0, 50.0]);
+        let mut expected = app.ui.views[0].clone();
+        navigator_zoom_to(
+            &mut expected,
+            Rect::from_min_max(pos2(50.0, 25.0), pos2(100.0, 50.0)),
+            [200, 100],
+            vec2(800.0, 600.0),
+            app.canvas_ppp(),
+            app.ui.view.display_aspect(),
+        );
+        let v = &app.ui.views[0];
+        assert!((v.zoom - expected.zoom).abs() / expected.zoom < 0.05, "{} vs {}", v.zoom, expected.zoom);
+        assert!(
+            (v.center[0] - 75.0).abs() < 1.0 && (v.center[1] - 37.5).abs() < 1.0,
+            "centred on the rectangle: {:?} (zoom {}, expected {:?})",
+            v.center,
+            v.zoom,
+            (expected.zoom, expected.center)
+        );
+        assert!(v.zoom > 1.0 && !v.fit_pending);
+        assert!(ctx.data(|d| d.get_temp::<Pos2>(navigator_zoom_drag_id())).is_none(), "the drag is over");
+    }
+
     /// #4840: under the preview, one row as in Photoshop: the zoom in percent, Zoom Out, the
     /// slider and Zoom In. The buttons step the zoom like View › Zoom In / Out.
     #[test]
@@ -2159,13 +2326,17 @@ fn hsb_sliders(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
 /// any is set, and locks all otherwise. Toggling only "lock all" would leave the Background's
 /// transparency lock (still showing as locked), and a second click would lock its pixels,
 /// shutting out the Eraser and every other paint tool (#76).
-fn simple_lock_toggle(background: bool, l: &Layer) -> (String, Value) {
+/// The Basic layout's lock toggle: the active layer's state decides, and every target follows it
+/// (`targets`: `{"layer": id}` or `{"layers": [ids]}`).
+fn simple_lock_toggle(background: bool, l: &Layer, targets: &Value) -> (String, Value) {
     if background {
         return ("layer.new.layerFromBackground".into(), json!({}));
     }
     let locks =
         if l.locks.any() { json!({"transparency": false, "pixels": false, "position": false, "artboard": false, "all": false}) } else { json!({"all": true}) };
-    ("layer.setProps".into(), json!({"layer": l.id.0, "locks": locks}))
+    let mut p = targets.clone();
+    p["locks"] = locks;
+    ("layer.setProps".into(), p)
 }
 
 /// The Layers panel's blend modes: Photoshop's, plus the layer's own Paint.NET mode when it has one
@@ -2231,8 +2402,21 @@ fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         ui.add_space(4.0);
     }
     if let Some(l) = active_layer {
-        // Photoshop greys blend mode, Opacity and Fill for the Background layer.
+        // With several layers selected, blend mode, Opacity, Fill and the locks change every one
+        // of them, as in Photoshop; the controls show the active layer's values.
+        // The Background stays out of a several-layer change until Photoshop's behaviour is
+        // confirmed (#5856): Opacity, Fill or a blend mode would turn it into Layer 0.
+        let ids: Vec<LayerId> = if selection.len() > 1 && selection.contains(&l.id) {
+            selection.iter().copied().filter(|id| *id == l.id || !doc.layer(*id).is_some_and(|x| crate::doc_props_ui::is_background(&doc, x))).collect()
+        } else {
+            vec![l.id]
+        };
+        let targets = if ids.len() > 1 { json!({"layers": ids.iter().map(|id| id.0).collect::<Vec<_>>()}) } else { json!({"layer": l.id.0}) };
+        // Photoshop greys blend mode, Opacity and Fill for the Background layer. (With the
+        // Background among several selected, what Photoshop does awaits a check: #5856.)
         let bg = crate::doc_props_ui::is_background(&doc, l);
+        // Pass Through is a group's mode: offered only when every target is a group.
+        let all_groups = ids.iter().all(|id| doc.layer(*id).is_some_and(|x| x.is_group()));
         ui.horizontal(|ui| {
             ui.add_enabled_ui(!bg, |ui| {
                 let mut m = l.blend;
@@ -2242,13 +2426,15 @@ fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                 let opacity_label = if t.pro { tl!("Opacity:") } else { tl!("Opacity") };
                 let (blend_width, show_opacity_label) =
                     opacity_row_layout(ui.available_width(), body_text_width(ui, opacity_label), ui.spacing().item_spacing.x);
-                let (chosen, hovered) = widgets::dropdown_wheel_hovered(ui, "blend", &mut m, &blend_options(l.is_group(), l.blend), blend_width);
+                let (chosen, hovered) = widgets::dropdown_wheel_hovered(ui, "blend", &mut m, &blend_options(all_groups, l.blend), blend_width);
                 // One step per choice: a click, an arrow key or each wheel notch (#1747).
                 for m in &chosen {
-                    actions.push(("layer.setProps".into(), json!({"layer": l.id.0, "blend": m.label()})));
+                    let mut p = targets.clone();
+                    p["blend"] = json!(m.label());
+                    actions.push(("layer.setProps".into(), p));
                 }
                 // Hovering a mode previews it on the canvas (#970).
-                crate::blend_preview::hover(app, l.id, hovered.filter(|_| chosen.is_empty()));
+                crate::blend_preview::hover(app, &ids, hovered.filter(|_| chosen.is_empty()));
                 ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                     let mut o = l.opacity * 100.0;
                     let field = widgets::popup_value_field(ui, opacity_label, &mut o, 0.0..=100.0, "%", LAYER_PCT_W);
@@ -2259,7 +2445,7 @@ fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                         widgets::PopupFieldResponse::default()
                     };
                     if field.changed || scrub.changed {
-                        actions.push(pct_action(l, "opacity", o, scrub.drag.or(field.drag)));
+                        actions.push(pct_action(&targets, "opacity", o, scrub.drag.or(field.drag)));
                     }
                 });
             });
@@ -2295,7 +2481,9 @@ fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                         // Lock Image Pixels includes Lock Transparent Pixels, which waits for it (#4892).
                         let enabled = key != "transparency" || !lk.pixels;
                         if ui.add_enabled_ui(enabled, |ui| icons::button(ui, icon, 20.0, on, tip)).inner.clicked() {
-                            actions.push(("layer.setProps".into(), json!({"layer": l.id.0, "locks": { key: !on }})));
+                            let mut p = targets.clone();
+                            p["locks"] = json!({ key: !on });
+                            actions.push(("layer.setProps".into(), p));
                         }
                     }
                 });
@@ -2303,7 +2491,7 @@ fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             if !t.pro {
                 let locked = l.locks.any();
                 if icons::button(ui, if locked { "lock" } else { "lock-open" }, 22.0, locked, tl!("Lock layer")).clicked() {
-                    actions.push(simple_lock_toggle(bg, l));
+                    actions.push(simple_lock_toggle(crate::doc_props_ui::is_background(&doc, l), l, &targets));
                 }
             }
             ui.add_enabled_ui(!bg, |ui| {
@@ -2312,7 +2500,7 @@ fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                     let field = widgets::popup_value_field(ui, fill_label, &mut f, 0.0..=100.0, "%", LAYER_PCT_W);
                     let scrub = scrub_pct_label(ui, fill_label, &mut f, ui.available_width());
                     if field.changed || scrub.changed {
-                        actions.push(pct_action(l, "fill", f, scrub.drag.or(field.drag)));
+                        actions.push(pct_action(&targets, "fill", f, scrub.drag.or(field.drag)));
                     }
                 })
             });
@@ -2582,10 +2770,12 @@ fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             app.ui.dock.collapsed.retain(|g| *g != crate::dock::Group::Properties);
             continue;
         }
-        if p.is_null() {
-            // Context-menu items behave like their menu-bar twins (dialogs included).
+        if p.is_null() || id == "layer.newFillLayer.solidColor" {
+            // Context-menu items and the Layers footer's Solid Color… action behave like
+            // their menu-bar twins. In particular, a new Solid Color fill opens its picker.
             let ctx = ui.ctx().clone();
-            if let Err(e) = crate::menus::invoke(app, &ctx, &id, json!({})) {
+            let params = if p.is_null() { json!({}) } else { p };
+            if let Err(e) = crate::menus::invoke(app, &ctx, &id, params) {
                 app.ui.status = e;
                 app.ui.status_error = true;
             }
@@ -2877,7 +3067,7 @@ fn layer_row(
     if let Some(&(_, lock)) = indicators.iter().find(|(k, _)| *k == crate::layer_row_ui::Indicator::Lock)
         && ui.interact(lock, ui.id().with(("row-lock", l.id.0)), Sense::click()).clicked()
     {
-        actions.push(simple_lock_toggle(doc.is_background(l.id), l));
+        actions.push(simple_lock_toggle(doc.is_background(l.id), l, &json!({"layer": l.id.0})));
     }
     let name_color = if l.visible { t.text } else { t.text_faint };
     let font = if selected && !t.pro { theme::medium(13.0) } else { egui::FontId::proportional(if t.pro { 12.0 } else { 13.0 }) };
@@ -3139,6 +3329,8 @@ fn history(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             }
             let icon = match e.as_str() {
                 s if s.contains("Brush") || s.contains("Eraser") => "brush",
+                // The Layers panel's controls (layer.setProps).
+                "Opacity Change" | "Fill Opacity Change" | "Blending Change" => "layers",
                 s if s.contains("Layer") => "layers",
                 s if s.contains("Select") || s.contains("Marquee") || s.contains("Deselect") || s.contains("Lasso") => "square-dashed",
                 s if s.contains("Fill") => "paint-bucket",
@@ -4992,7 +5184,7 @@ mod lock_tests {
     fn click_lock(app: &mut PhotocraftApp) {
         let st = app.session.active().unwrap();
         let l = st.active_layer.and_then(|id| st.doc.layer(id)).unwrap();
-        let (cmd, p) = simple_lock_toggle(crate::doc_props_ui::is_background(&st.doc, l), l);
+        let (cmd, p) = simple_lock_toggle(crate::doc_props_ui::is_background(&st.doc, l), l, &json!({"layer": l.id.0}));
         app.run(&cmd, p).unwrap();
     }
 
@@ -5979,6 +6171,7 @@ mod compact_visual_regressions {
 
     #[test]
     fn capture_compact_visual_fixtures() {
+        let _gpu = photocraft_testkit::gpu_lock();
         let Some(directory) = std::env::var_os("CRAFT_UI_VISUAL_FIXTURES").map(std::path::PathBuf::from) else { return };
         std::fs::create_dir_all(&directory).unwrap();
         for kind in crate::theme::ThemeKind::ALL {
@@ -6190,6 +6383,40 @@ mod compact_visual_regressions {
         }
     }
 
+    #[test]
+    fn the_crop_ratio_fields_show_three_decimals() {
+        // #6487: a 1.414 : 1 ratio reads 1.414 in the bar, not 1.4.
+        let ctx = egui::Context::default();
+        crate::theme::install_fonts(&ctx);
+        let Some(kind) = crate::theme::ThemeKind::ALL.into_iter().find(|k| {
+            crate::theme::apply(&ctx, *k);
+            Tokens::get(&ctx).pro
+        }) else {
+            return;
+        };
+        crate::theme::apply(&ctx, kind);
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+        app.ui.tool = Tool::Crop;
+        app.ui.tool_options.crop_ratio = "1.414:1".into();
+        let screen = Rect::from_min_size(egui::Pos2::ZERO, vec2(1600.0, 120.0));
+        let mut out = ctx.run_ui(input_at_scale(screen, 1.0), |ui| options_bar(&mut app, ui));
+        for _ in 0..3 {
+            out.textures_delta.clear();
+            out = ctx.run_ui(input_at_scale(screen, 1.0), |ui| options_bar(&mut app, ui));
+        }
+        out.textures_delta.clear();
+        let texts: Vec<&str> = out
+            .shapes
+            .iter()
+            .filter_map(|s| match &s.shape {
+                egui::Shape::Text(t) => Some(t.galley.job.text.as_str()),
+                _ => None,
+            })
+            .collect();
+        assert!(texts.contains(&"1.414"), "{texts:?}");
+        assert_eq!(app.ui.tool_options.crop_ratio, "1.414:1", "showing the ratio leaves it alone");
+    }
+
     #[test]
     fn the_narrow_options_bar_preference_shortens_the_bar() {
         assert_eq!(options_bar_height(true, false), 36.0);
diff --git a/crates/ui-egui/src/pen_draw_tests.rs b/crates/ui-egui/src/pen_draw_tests.rs
index 155450eac6..57be940bd6 100644
--- a/crates/ui-egui/src/pen_draw_tests.rs
+++ b/crates/ui-egui/src/pen_draw_tests.rs
@@ -219,3 +219,59 @@ fn delete_with_the_pen_deletes_the_finished_work_path_not_the_pixels() {
     h.run_steps(2);
     assert!(work(&h), "another tool's Delete is Edit › Clear, not Delete Path");
 }
+
+fn space(h: &mut Harness<'static, PhotocraftApp>, down: bool) {
+    h.event(egui::Event::Key { key: Key::Space, physical_key: None, pressed: down, repeat: false, modifiers: Modifiers::NONE });
+    h.run_steps(1);
+}
+
+/// Did the last frame paint the Pen's path in progress: an accent polyline starting at `at`, its
+/// first anchor on screen (`vector_ui::draw_overlay`)?
+fn pen_path_painted(h: &Harness<'static, PhotocraftApp>, at: Pos2) -> bool {
+    let accent = crate::theme::Tokens::get(&h.ctx).accent;
+    h.output().shapes.iter().any(|c| match &c.shape {
+        egui::Shape::Path(p) => {
+            p.stroke.width == 1.5
+                && matches!(p.stroke.color, egui::epaint::ColorMode::Solid(col) if col == accent)
+                && p.points.len() >= 2
+                && p.points[0].distance(at) < 1.0
+        }
+        _ => false,
+    })
+}
+
+/// #6592: holding Space to pan with the Hand keeps the Pen's path in progress, and shows it, as in
+/// Photoshop.
+#[test]
+fn space_pan_keeps_the_pen_path_in_progress_visible() {
+    let mut h = harness();
+    click(&mut h, [20.0, 20.0]);
+    click(&mut h, [100.0, 20.0]);
+    assert_eq!(h.state().ui.pen.as_ref().map(|p| p.knots.len()), Some(2));
+    let p = screen(&h, [150.0, 100.0]);
+    h.event(egui::Event::PointerMoved(p));
+    h.run_steps(1);
+    assert!(pen_path_painted(&h, screen(&h, [20.0, 20.0])), "drawn before Space");
+    space(&mut h, true);
+    assert!(pen_path_painted(&h, screen(&h, [20.0, 20.0])), "drawn with Space held, before the drag");
+    let c0 = h.state().ui.views[0].center;
+    button(&mut h, p, true, Modifiers::NONE);
+    for i in 1..=5 {
+        // A pan frame paints the image and its overlays with the view it started with.
+        let first = screen(&h, [20.0, 20.0]);
+        h.event(egui::Event::PointerMoved(p + vec2(10.0 * i as f32, 0.0)));
+        h.run_steps(1);
+        let pen = h.state().ui.pen.as_ref().map(|p| p.knots.len());
+        let painted = pen_path_painted(&h, first);
+        assert_eq!(pen, Some(2), "the path in progress is kept while panning (step {i})");
+        assert!(painted, "the path in progress is drawn while panning (step {i})");
+    }
+    button(&mut h, p + vec2(50.0, 0.0), false, Modifiers::NONE);
+    space(&mut h, false);
+    h.run_steps(1);
+    let c1 = h.state().ui.views[0].center;
+    assert!((c1[0] - (c0[0] - 50.0)).abs() < 0.5, "Space-drag panned: {c0:?} -> {c1:?}");
+    assert_eq!(h.state().ui.tool, Tool::Pen);
+    assert_eq!(h.state().ui.pen.as_ref().map(|p| p.knots.len()), Some(2), "the path in progress survives the pan");
+    assert!(pen_path_painted(&h, screen(&h, [20.0, 20.0])), "drawn after the pan");
+}
diff --git a/crates/ui-egui/src/prefs_ui.rs b/crates/ui-egui/src/prefs_ui.rs
index d194803020..6c910865bd 100644
--- a/crates/ui-egui/src/prefs_ui.rs
+++ b/crates/ui-egui/src/prefs_ui.rs
@@ -804,6 +804,21 @@ pub fn shortcut_items(app: &PhotocraftApp) -> Vec<(String, String, Vec<String>,
     out
 }
 
+/// A fingerprint of the bindings a shortcut conflict describes.
+fn conflict_state(overrides: &BTreeMap<String, String>, alternates: &BTreeMap<String, Vec<String>>, selected: &str, set: Option<&Value>) -> u64 {
+    use std::hash::{Hash, Hasher};
+    let mut h = std::collections::hash_map::DefaultHasher::new();
+    (overrides, alternates, selected, set.map(Value::to_string)).hash(&mut h);
+    h.finish()
+}
+
+/// Keys the system takes before the app sees them (switching apps, closing the window, force
+/// quit): Edit › Keyboard Shortcuts won't assign them, as Photoshop won't. `sc` is in our
+/// notation, where `Cmd` is Ctrl off the Mac.
+pub fn reserved_shortcut(sc: &str) -> bool {
+    prefs::reserved_shortcut(sc)
+}
+
 /// Text of a key press for the shortcut editor (`Cmd+Shift+K`), `None` for bare modifiers.
 pub fn shortcut_text(key: egui::Key, m: egui::Modifiers) -> Option<String> {
     if is_modifier_key(key) {
@@ -892,19 +907,9 @@ pub fn invoke(app: &mut PhotocraftApp, ctx: &egui::Context, id: &str, params: &V
             }
             dialog(d)
         }
-        "edit.contentAwareFill" => {
-            if !app.session.is_enabled(id) {
-                return Some(Err("Content-Aware Fill needs a selection on a pixel layer".into()));
-            }
-            let d = crate::filter_dialog::open(app, id);
-            if let Some(dm) = d.and_then(|d| app.ui.dialog_mut(d)) {
-                dm.fields.insert("__preview".into(), json!(true));
-                for k in ["margin", "seed", "channel"] {
-                    dm.fields.remove(k);
-                }
-            }
-            dialog(d)
-        }
+        // Photoshop's Content-Aware Fill workspace (caf_ui); the engine command with params
+        // still runs directly.
+        "edit.contentAwareFill" => Some(crate::caf_ui::open(app).map(|_| json!({"contentAwareFill": app.distort.describe()["contentAwareFill"]}))),
         // Photoshop has no dialog: the menu opens the scale box (with params: the engine).
         crate::cas_transform::COMMAND => Some(crate::cas_transform::begin(app, ctx)),
         "edit.presets.presetManager" => {
@@ -1038,7 +1043,9 @@ pub fn open_mismatch(app: &mut PhotocraftApp, message: &str, action: &str, missi
 pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Value>) {
     match f.get("__prefsui").and_then(Value::as_str).unwrap_or("") {
         "prefs" => {
-            f.insert("__gpuInfo".into(), json!(app.perf.gpu_info.lines()));
+            let mut info = app.perf.gpu_info.lines();
+            info.extend(gpu_memory_lines(app));
+            f.insert("__gpuInfo".into(), json!(info));
             let system = system_theme(app, ui.ctx());
             prefs_body(ui, f, system);
         }
@@ -1050,6 +1057,27 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
     }
 }
 
+/// Performance › Graphics: the compositor's GPU memory budget and whether the active document's
+/// layers fit it (the GPU Memory preference sets it).
+fn gpu_memory_lines(app: &PhotocraftApp) -> Vec<String> {
+    let mut v = Vec::new();
+    if app.perf.gpu_budget_mb > 0 {
+        let budget = crate::chrome_ui::fmt_bytes(app.perf.gpu_budget_mb.saturating_mul(1 << 20));
+        v.push(crate::i18n::fmt(tl!("GPU memory budget: {budget}"), &[("budget", &budget)]));
+    }
+    let doc = app.session.active().map(|st| st.doc.id.0);
+    if let Some(fit) = app.perf.gpu_layer_fit.filter(|f| Some(f.doc) == doc) {
+        let args = [("needed", crate::chrome_ui::fmt_bytes(fit.needed)), ("budget", crate::chrome_ui::fmt_bytes(fit.budget))];
+        let args: Vec<(&str, &str)> = args.iter().map(|(k, v)| (*k, v.as_str())).collect();
+        v.push(if fit.fits() {
+            crate::i18n::fmt(tl!("This document's layers: {needed} of {budget} for layers"), &args)
+        } else {
+            crate::i18n::fmt(tl!("This document's layers need {needed} but may hold {budget}: whole-document redraws use the CPU"), &args)
+        });
+    }
+    v
+}
+
 fn humanize(key: &str) -> String {
     match key {
         "appearanceMode" => return "Appearance Mode".into(),
@@ -1079,6 +1107,15 @@ fn humanize(key: &str) -> String {
     if key == "nudgeBundlePauseMs" {
         return "Nudge Bundle Pause (ms)".into();
     }
+    // Performance: presentation without vsync (#1343); like the other graphics settings, it
+    // takes effect when the window next opens.
+    if key == "lowLatencyDrawing" {
+        return "Low-Latency Drawing (vsync off, applies at next launch)".into();
+    }
+    // Performance: the canvas compositor's GPU memory, 0 for the automatic budget (L3).
+    if key == "gpuMemoryMb" {
+        return "GPU Memory (MB, 0 = Automatic)".into();
+    }
     let mut s = String::new();
     for (i, ch) in key.chars().enumerate() {
         if i == 0 {
@@ -1515,6 +1552,8 @@ fn field_visible(section: &str, obj: &Map<String, Value>, k: &str, query: &str)
         // View › Rulers (⌘R) sets it, as in Photoshop.
         || path == "unitsAndRulers.showRulers"
         || (section == "performance" && matches!(k, "useGpu" | "gpuBackend" | "renderingMode"))
+        // The browser presents frames itself: Low-Latency Drawing does nothing there.
+        || (cfg!(target_arch = "wasm32") && path == "performance.lowLatencyDrawing")
         || (section == "export" && !export_field_visible(obj, k))
         || (section == "tools" && !tools_field_visible(obj, k));
     (query.is_empty() || preference_matches(section, k, query))
@@ -1687,6 +1726,9 @@ fn shortcuts_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String
     let alternates_ok = parsed_alts.as_ref().is_none_or(Result::is_ok);
     let mut alt_overrides = parsed_alts.and_then(Result::ok).unwrap_or_default();
     let mut capture_alt = f.get("captureAlt").and_then(Value::as_bool).unwrap_or(false);
+    // A key just assigned that another command holds: Photoshop's Accept and Go to Conflict /
+    // Undo Changes (an object: the key, the other command, and this one's keys before).
+    let mut conflict: Option<Value> = f.get("conflict").filter(|c| c.is_object()).cloned();
     let mut hidden: Vec<String> = f.get("hidden").and_then(|v| serde_json::from_value(v.clone()).ok()).unwrap_or_default();
     let mut colors: BTreeMap<String, String> = f.get("colors").and_then(|v| serde_json::from_value(v.clone()).ok()).unwrap_or_default();
     let mut selected = f.get("selected").and_then(Value::as_str).unwrap_or("").to_string();
@@ -1739,6 +1781,7 @@ fn shortcuts_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String
             });
             if key == egui::Key::Escape {
                 capture = false;
+                conflict = None;
             } else if matches!(key, egui::Key::Backspace | egui::Key::Delete) && m.is_none() {
                 if capture_alt {
                     alt_overrides.insert(selected.clone(), Vec::new());
@@ -1748,8 +1791,12 @@ fn shortcuts_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String
                 capture = false;
                 message = tl!("Shortcut removed.").into();
                 message_warning = false;
+            } else if let Some(sc) = shortcut_text(key, m).filter(|sc| reserved_shortcut(sc)) {
+                message = crate::i18n::fmt(tl!("{shortcut} is reserved by the system and can't be assigned."), &[("shortcut", &crate::shortcuts::pretty(&sc))]);
+                message_warning = true;
+                capture = false;
             } else if let Some(sc) = shortcut_text(key, m) {
-                let clash: Vec<String> = items
+                let clash_ids: Vec<&str> = items
                     .iter()
                     .filter(|(id, _, _, def)| {
                         let cur = eff(&overrides, id, def);
@@ -1757,11 +1804,30 @@ fn shortcuts_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String
                             && (cur.as_deref().and_then(prefs::normalize_shortcut) == Some(sc.clone())
                                 || eff_alts(&alt_overrides, id, cur.as_deref()).contains(&sc))
                     })
+                    .map(|(id, ..)| id.as_str())
+                    .collect();
+                let clash: Vec<String> = items
+                    .iter()
+                    .filter(|(id, ..)| clash_ids.contains(&id.as_str()))
                     .map(|(id, label, path, _)| {
                         let (path, label) = shown(id, label, path);
                         format!("{} › {}", path.join(" › "), label.trim_end_matches('…'))
                     })
                     .collect();
+                // What Undo Changes puts back: the command's main key and further keys as they were.
+                if let Some(first) = clash_ids.first() {
+                    conflict = Some(json!({
+                        "shortcut": sc,
+                        "with": first,
+                        // Every command holding the key: Accept takes it from all of them.
+                        "holders": clash_ids,
+                        "command": selected,
+                        "main": overrides.get(&selected),
+                        "alternates": alt_overrides.get(&selected),
+                    }));
+                } else {
+                    conflict = None;
+                }
                 if capture_alt {
                     let def = items.iter().find(|i| i.0 == selected).and_then(|i| i.3.clone());
                     let cur = eff(&overrides, &selected, &def);
@@ -1925,6 +1991,53 @@ fn shortcuts_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String
     if !message.is_empty() {
         ui.label(RichText::new(&message).color(if message_warning { t.warning } else { t.text_dim }));
     }
+    // The conflict describes the bindings as the capture left them: any later change (Use
+    // Default, Delete, ×, Reset All, another command or set) makes it stale, and it goes.
+    let state = conflict_state(&overrides, &alt_overrides, &selected, f.get("activeSet"));
+    if conflict.as_ref().and_then(|c| c.get("state")).is_some_and(|s| s.as_u64() != Some(state)) {
+        conflict = None;
+    }
+    if tab == 0
+        && let Some(c) = conflict.clone()
+    {
+        let (key, with, command) =
+            (c["shortcut"].as_str().unwrap_or_default(), c["with"].as_str().unwrap_or_default(), c["command"].as_str().unwrap_or_default());
+        ui.horizontal(|ui| {
+            if ui.button(tl!("Accept and Go to Conflict")).on_hover_text(tl!("Take the shortcut from the other command and select it")).clicked() {
+                let holders: Vec<String> = serde_json::from_value(c["holders"].clone()).unwrap_or_else(|_| vec![with.to_string()]);
+                for holder in &holders {
+                    let def = items.iter().find(|i| i.0 == *holder).and_then(|i| i.3.clone());
+                    let cur = eff(&overrides, holder, &def);
+                    if cur.as_deref().and_then(prefs::normalize_shortcut).as_deref() == Some(key) {
+                        overrides.insert(holder.clone(), String::new());
+                    }
+                    let keys = eff_alts(&alt_overrides, holder, eff(&overrides, holder, &def).as_deref());
+                    if keys.iter().any(|k| k == key) {
+                        alt_overrides.insert(holder.clone(), keys.into_iter().filter(|k| k != key).collect());
+                    }
+                }
+                selected = with.to_string();
+                filter.clear();
+                message = tl!("Choose a new shortcut for this command, or leave it without one.").into();
+                message_warning = false;
+                conflict = None;
+            }
+            if ui.button(tl!("Undo Changes")).on_hover_text(tl!("Put this command's shortcuts back as they were")).clicked() {
+                match c["main"].as_str() {
+                    Some(m) => overrides.insert(command.to_string(), m.to_string()),
+                    None => overrides.remove(command),
+                };
+                match serde_json::from_value::<Vec<String>>(c["alternates"].clone()) {
+                    Ok(list) => alt_overrides.insert(command.to_string(), list),
+                    Err(_) => alt_overrides.remove(command),
+                };
+                selected = command.to_string();
+                message = tl!("Changes undone.").into();
+                message_warning = false;
+                conflict = None;
+            }
+        });
+    }
     if overrides_ok {
         f.insert("overrides".into(), json!(overrides));
     }
@@ -1932,6 +2045,11 @@ fn shortcuts_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String
         f.insert("alternates".into(), json!(alt_overrides));
     }
     f.insert("captureAlt".into(), json!(capture && capture_alt));
+    // A conflict just found is stamped with the bindings it describes.
+    if let Some(c) = conflict.as_mut().filter(|c| c.get("state").is_none()) {
+        c["state"] = json!(conflict_state(&overrides, &alt_overrides, &selected, f.get("activeSet")));
+    }
+    f.insert("conflict".into(), conflict.unwrap_or(Value::Null));
     f.insert("hidden".into(), json!(hidden));
     f.insert("colors".into(), json!(colors));
     f.insert("selected".into(), json!(selected));
@@ -3857,9 +3975,11 @@ mod tests {
         assert!(note.starts_with("Monitor profile in use: sRGB") && note.contains("fallback"), "{note}");
         assert!(crate::menus::invoke(&mut app, &ctx, "edit.fade", json!({})).is_err());
         app.run("select.rect", json!({"x": 4, "y": 4, "width": 8, "height": 8})).unwrap();
-        let d = crate::menus::invoke(&mut app, &ctx, "edit.contentAwareFill", json!({})).unwrap()["dialog"].as_u64().unwrap();
-        assert_eq!(app.ui.dialogs.iter().find(|x| x.id == d).unwrap().fields["__preview"], true);
-        crate::dialogs::confirm(&mut app, d).unwrap();
+        // Content-Aware Fill opens its workspace (caf_ui); OK fills.
+        let r = crate::menus::invoke(&mut app, &ctx, "edit.contentAwareFill", json!({})).unwrap();
+        assert!(r["contentAwareFill"]["window"].is_array(), "{r}");
+        crate::caf_ui::commit(&mut app);
+        assert!(app.distort.caf.is_none());
         let r = crate::menus::invoke(&mut app, &ctx, "edit.contentAwareScale", json!({})).unwrap();
         assert_eq!(r["transform"]["rect"], json!([4.0, 4.0, 12.0, 12.0]));
         crate::transform_tool::cancel(&mut app);
diff --git a/crates/ui-egui/src/retouch_ui.rs b/crates/ui-egui/src/retouch_ui.rs
index adf3c8cf69..417df92b6e 100644
--- a/crates/ui-egui/src/retouch_ui.rs
+++ b/crates/ui-egui/src/retouch_ui.rs
@@ -177,7 +177,7 @@ pub fn remove_pending_add(app: &mut PhotocraftApp, points: &[[f64; 3]]) {
         app.remove_pending_doc = Some(doc);
     }
     let diameter = app.session.tools.brush.size;
-    app.remove_trail.get_or_insert_with(|| crate::stroke_trail::Trail::new(size)).feed(points, diameter);
+    app.remove_trail.get_or_insert_with(|| crate::stroke_trail::Trail::new(size)).feed_stroke(points, diameter);
     app.remove_pending.push(points.to_vec());
     app.ui.status = crate::i18n::fmt(tl!("Strokes to remove: {n} (Enter applies, Esc cancels)"), &[("n", &app.remove_pending.len().to_string())]);
     app.ui.status_error = false;
@@ -1141,6 +1141,46 @@ mod tests {
         assert!(!remove_pending_commit(&mut app), "nothing left to apply");
     }
 
+    #[test]
+    fn every_waiting_remove_stroke_is_tinted_in_full() {
+        // #6555: each stroke used to be stamped only past the previous stroke's point count.
+        let mut app = app();
+        app.ui.tool = Tool::Remove;
+        app.ui.tool_options.remove_after_each_stroke = false;
+        let strokes: [&[[f64; 3]]; 3] = [
+            &[[10.0, 10.0, 1.0], [40.0, 10.0, 1.0], [70.0, 10.0, 1.0]],
+            &[[10.0, 30.0, 1.0], [40.0, 30.0, 1.0]],
+            &[[10.0, 50.0, 1.0], [20.0, 50.0, 1.0], [30.0, 50.0, 1.0], [50.0, 50.0, 1.0], [90.0, 50.0, 1.0]],
+        ];
+        for s in strokes {
+            remove_pending_add(&mut app, s);
+        }
+        assert_eq!(app.remove_pending.len(), 3);
+        let t = app.remove_trail.as_ref().expect("the waiting strokes are tinted");
+        let k = f64::from(t.scale());
+        for s in strokes {
+            for w in s.windows(2) {
+                for i in 0..=8 {
+                    let f = f64::from(i) / 8.0;
+                    let (x, y) = (w[0][0] + (w[1][0] - w[0][0]) * f, w[0][1] + (w[1][1] - w[0][1]) * f);
+                    assert_eq!(t.coverage((x / k) as usize, (y / k) as usize), 255, "({x}, {y}) on a waiting stroke is tinted");
+                }
+            }
+        }
+        // Enter, Esc, another tool and another document all drop the tint with the strokes.
+        assert!(remove_pending_commit(&mut app));
+        assert!(app.remove_trail.is_none());
+        remove_pending_add(&mut app, strokes[0]);
+        assert!(remove_pending_cancel(&mut app) && app.remove_trail.is_none());
+        remove_pending_add(&mut app, strokes[1]);
+        app.ui.tool = Tool::SpotHealing;
+        assert!(!remove_pending_live(&mut app) && app.remove_trail.is_none());
+        app.ui.tool = Tool::Remove;
+        remove_pending_add(&mut app, strokes[2]);
+        app.run("file.new", json!({"width": 100, "height": 60})).unwrap();
+        assert!(!remove_pending_live(&mut app) && app.remove_trail.is_none());
+    }
+
     #[test]
     fn remove_strokes_waiting_are_dropped_when_the_tool_changes() {
         let mut app = app();
diff --git a/crates/ui-egui/src/shortcut_capture_tests.rs b/crates/ui-egui/src/shortcut_capture_tests.rs
index d68ae57d92..f5db001707 100644
--- a/crates/ui-egui/src/shortcut_capture_tests.rs
+++ b/crates/ui-egui/src/shortcut_capture_tests.rs
@@ -230,3 +230,119 @@ fn a_user_shortcut_wins_over_a_default_it_was_not_moved_from() {
     let bound: Vec<String> = crate::shortcut_dispatch::bindings(&app).into_iter().filter(|(_, sc)| *sc == f7).map(|(id, _)| id).collect();
     assert_eq!(bound, ["select.modify.feather"]);
 }
+
+/// Capture `k` with `m` for the selected command.
+fn capture_key(h: &mut Harness<'_, PhotocraftApp>, id: u64, k: Key, m: Modifiers) {
+    h.state_mut().ui.dialog_mut(id).unwrap().fields.insert("capture".into(), json!(true));
+    h.run_steps(2);
+    key(h, k, true, m);
+    h.run_steps(2);
+    key(h, k, false, m);
+    h.run_steps(2);
+}
+
+fn click(h: &mut Harness<'_, PhotocraftApp>, label: &str) {
+    h.get_by_role_and_label(egui::accesskit::Role::Button, label).click();
+    h.run_steps(3);
+}
+
+#[test]
+fn a_conflict_offers_accept_and_go_to_conflict() {
+    // Photoshop: the key is taken from Copy now, and Copy is selected to get a new one.
+    let (mut h, id) = dialog(1.0, "edit.cut", "");
+    capture_key(&mut h, id, Key::C, Modifiers::COMMAND);
+    assert_eq!(field(&h, id, "overrides")["edit.cut"], json!("Cmd+C"));
+    assert_eq!(field(&h, id, "conflict")["with"], json!("edit.copy"));
+    click(&mut h, "Accept and Go to Conflict");
+    assert_eq!(field(&h, id, "selected"), json!("edit.copy"));
+    assert_eq!(field(&h, id, "overrides")["edit.copy"], json!(""), "Copy no longer holds Cmd+C");
+    assert!(field(&h, id, "conflict").is_null());
+    crate::dialogs::confirm(h.state_mut(), id).unwrap();
+    assert_eq!(crate::shortcuts::effective_shortcut(h.state(), "edit.cut", Some("Cmd+X")).as_deref(), Some("Cmd+C"));
+    assert_eq!(crate::shortcuts::effective_shortcut(h.state(), "edit.copy", Some("Cmd+C")), None);
+}
+
+#[test]
+fn undo_changes_puts_the_command_back() {
+    let (mut h, id) = dialog(1.0, "edit.cut", "");
+    capture_key(&mut h, id, Key::C, Modifiers::COMMAND);
+    click(&mut h, "Undo Changes");
+    assert!(field(&h, id, "overrides").get("edit.cut").is_none(), "{}", field(&h, id, "overrides"));
+    assert!(field(&h, id, "conflict").is_null());
+    // An alternate added with Add Shortcut is undone the same way.
+    h.state_mut().ui.dialog_mut(id).unwrap().fields.insert("captureAlt".into(), json!(true));
+    capture_key(&mut h, id, Key::C, Modifiers::COMMAND);
+    assert_eq!(field(&h, id, "alternates")["edit.cut"], json!(["F2", "Cmd+C"]), "beside Photoshop's F2");
+    click(&mut h, "Undo Changes");
+    assert!(field(&h, id, "alternates").get("edit.cut").is_none(), "{}", field(&h, id, "alternates"));
+    crate::dialogs::confirm(h.state_mut(), id).unwrap();
+    assert_eq!(crate::shortcuts::effective_shortcut(h.state(), "edit.copy", Some("Cmd+C")).as_deref(), Some("Cmd+C"));
+}
+
+#[test]
+fn a_system_key_is_refused() {
+    let (k, m) = if cfg!(target_os = "macos") { (Key::Tab, Modifiers::MAC_CMD | Modifiers::COMMAND) } else { (Key::F4, Modifiers::ALT) };
+    let (mut h, id) = dialog(1.0, "edit.cut", "");
+    capture_key(&mut h, id, k, m);
+    assert!(field(&h, id, "overrides").get("edit.cut").is_none(), "{}", field(&h, id, "overrides"));
+    assert!(field(&h, id, "message").as_str().is_some_and(|s| s.contains("reserved")), "{}", field(&h, id, "message"));
+    assert_eq!(field(&h, id, "messageWarning"), json!(true));
+    assert!(crate::prefs_ui::reserved_shortcut(if cfg!(target_os = "macos") { "Cmd+Tab" } else { "Alt+F4" }));
+    assert!(!crate::prefs_ui::reserved_shortcut("Cmd+Shift+F4"));
+    assert!(!crate::prefs_ui::reserved_shortcut("garbage+"));
+}
+
+/// The conflict describes the bindings as the capture left them: Reset All, Use Default or
+/// Escape after it makes it stale, so Accept can't take a key nothing holds any more.
+#[test]
+fn a_conflict_goes_stale_when_the_bindings_change() {
+    for undo in ["Reset All to Defaults", "Use Default", "escape"] {
+        let (mut h, id) = dialog(1.0, "edit.cut", "");
+        capture_key(&mut h, id, Key::C, Modifiers::COMMAND);
+        assert!(field(&h, id, "conflict").is_object(), "{undo}");
+        if undo == "escape" {
+            h.state_mut().ui.dialog_mut(id).unwrap().fields.insert("capture".into(), json!(true));
+            h.run_steps(2);
+            key(&mut h, Key::Escape, true, Modifiers::NONE);
+            h.run_steps(2);
+            key(&mut h, Key::Escape, false, Modifiers::NONE);
+            h.run_steps(2);
+        } else {
+            click(&mut h, undo);
+        }
+        assert!(field(&h, id, "conflict").is_null(), "{undo}: {}", field(&h, id, "conflict"));
+        assert!(h.query_by_label("Accept and Go to Conflict").is_none(), "{undo}");
+        crate::dialogs::confirm(h.state_mut(), id).unwrap();
+        if undo != "escape" {
+            assert_eq!(crate::shortcuts::effective_shortcut(h.state(), "edit.copy", Some("Cmd+C")).as_deref(), Some("Cmd+C"), "{undo}: Copy keeps ⌘C");
+        }
+    }
+}
+
+#[cfg(all(unix, not(target_os = "macos")))]
+#[test]
+fn linux_reserves_its_own_system_keys() {
+    assert!(crate::prefs_ui::reserved_shortcut("Cmd+Alt+F2"));
+    assert!(!crate::prefs_ui::reserved_shortcut("Cmd+Escape"));
+}
+
+#[cfg(target_os = "windows")]
+#[test]
+fn windows_reserves_its_own_system_keys() {
+    assert!(crate::prefs_ui::reserved_shortcut("Cmd+Escape"));
+    assert!(!crate::prefs_ui::reserved_shortcut("Cmd+Alt+F2"));
+}
+
+/// A key two commands hold (Cut's ⌘X, given to Copy too): Accept takes it from both.
+#[test]
+fn accept_takes_the_key_from_every_command_holding_it() {
+    let (mut h, id) = dialog(1.0, "edit.paste", "");
+    h.state_mut().ui.dialog_mut(id).unwrap().fields.insert("overrides".into(), json!({"edit.copy": "Cmd+X"}));
+    h.run_steps(2);
+    capture_key(&mut h, id, Key::X, Modifiers::COMMAND);
+    let holders = field(&h, id, "conflict")["holders"].clone();
+    assert!(holders.as_array().is_some_and(|a| a.len() == 2), "{holders}");
+    click(&mut h, "Accept and Go to Conflict");
+    let o = field(&h, id, "overrides");
+    assert_eq!((o["edit.cut"].clone(), o["edit.copy"].clone(), o["edit.paste"].clone()), (json!(""), json!(""), json!("Cmd+X")), "{o}");
+}
diff --git a/crates/ui-egui/src/shortcuts.rs b/crates/ui-egui/src/shortcuts.rs
index e8645a1511..99613d5a26 100644
--- a/crates/ui-egui/src/shortcuts.rs
+++ b/crates/ui-egui/src/shortcuts.rs
@@ -233,6 +233,10 @@ fn clipboard_press(e: &egui::Event, mods: Modifiers, is_windows: bool) -> Option
 /// (the key-down's default action) arrives as `Event::Paste` in the same frame. A clipboard event
 /// right after its own ⌘ key press is that press, not a second one (#2638).
 ///
+/// With an image on the clipboard the V release is all that reaches us, and ⌘ is often let go
+/// first: a V release whose press never arrived, after ⌘ was held and before any other key, is
+/// that swallowed ⌘V too (#6329). Releasing in either order then pastes.
+///
 /// Ctrl+Insert copies and Shift+Insert pastes: egui-winit maps them on Windows (a Shift+Insert
 /// release without a paste event pastes the image, like ⌘V), and we map them here on Linux.
 pub fn clipboard_keys(ctx: &egui::Context, typing: bool, raw: &mut egui::RawInput) {
@@ -279,18 +283,31 @@ pub fn clipboard_keys(ctx: &egui::Context, typing: bool, raw: &mut egui::RawInpu
         return;
     }
     let seen = egui::Id::new("pc-paste-key-seen");
+    // A V press without ⌘ that reached us (the Move tool's key): its release is not a paste.
+    let plain_v = egui::Id::new("pc-plain-v-down");
+    // ⌘ was held since the last key press without it: a swallowed ⌘V can be under way.
+    let command_lately = egui::Id::new("pc-paste-command-lately");
     // The modifiers held at each event: last frame's, updated as the events report changes.
     let mut mods = ctx.input(|i| i.modifiers);
+    if mods.command {
+        ctx.data_mut(|d| d.insert_temp(command_lately, true));
+    }
     let mut out = Vec::with_capacity(raw.events.len());
     // The last ⌘C/⌘X/⌘V press this frame whose clipboard event hasn't arrived (yet).
     let mut unpaired: Option<Key> = None;
     for e in raw.events.drain(..) {
         if let egui::Event::ModifiersChanged(m) | egui::Event::Key { modifiers: m, .. } = &e {
             mods = *m;
+            if mods.command {
+                ctx.data_mut(|d| d.insert_temp(command_lately, true));
+            }
         }
         if let Some((key, held)) = clipboard_press(&e, mods, cfg!(target_os = "windows")) {
             if key == Key::V {
-                ctx.data_mut(|d| d.insert_temp(seen, true));
+                ctx.data_mut(|d| {
+                    d.insert_temp(seen, true);
+                    d.remove_temp::<bool>(plain_v);
+                });
             }
             if unpaired.take_if(|k| *k == key).is_none() {
                 out.push(press(key, held));
@@ -304,15 +321,32 @@ pub fn clipboard_keys(ctx: &egui::Context, typing: bool, raw: &mut egui::RawInpu
             egui::Event::Key { key: key @ (Key::C | Key::X | Key::V), pressed: true, modifiers, .. } if modifiers.command => {
                 unpaired = Some(*key);
                 if *key == Key::V {
-                    ctx.data_mut(|d| d.insert_temp(seen, true));
+                    ctx.data_mut(|d| {
+                        d.insert_temp(seen, true);
+                        d.remove_temp::<bool>(plain_v);
+                    });
                 }
             }
+            egui::Event::Key { key, pressed: true, modifiers, .. } if !modifiers.command => {
+                ctx.data_mut(|d| {
+                    d.remove_temp::<bool>(command_lately);
+                    if *key == Key::V {
+                        d.insert_temp(plain_v, true);
+                    }
+                });
+            }
             // A paste key's release ends that press, with or without ⌘ still held (else a stale
             // mark would swallow the next image paste); without a press it is the paste itself.
             egui::Event::Key { key: key @ (Key::V | Key::Insert), pressed: false, modifiers, .. } => {
                 let had_press = ctx.data_mut(|d| d.remove_temp::<bool>(seen)).unwrap_or(false);
+                let had_plain_press = *key == Key::V && ctx.data_mut(|d| d.remove_temp::<bool>(plain_v)).unwrap_or(false);
+                // Taken: one swallowed ⌘V is one paste.
+                let lately = *key == Key::V && ctx.data_mut(|d| d.remove_temp::<bool>(command_lately)).unwrap_or(false);
                 let held = match key {
                     Key::V if modifiers.command => Some(*modifiers),
+                    // ⌘ let go before V: the press egui-winit swallowed was ⌘V (#6329). The web
+                    // always forwards the key-down, so there a lone release is no paste.
+                    Key::V if lately && !had_plain_press && !cfg!(target_arch = "wasm32") => Some(Modifiers::COMMAND),
                     Key::Insert if cfg!(target_os = "windows") && modifiers.shift && !modifiers.ctrl => Some(Modifiers::COMMAND),
                     _ => None,
                 };
@@ -382,11 +416,15 @@ pub fn handle(app: &mut PhotocraftApp, ctx: &egui::Context) {
             crate::liquify_ui::keys(app, ctx);
         }
     }
+    // The Content-Aware Fill workspace likewise.
+    if app.distort.caf.is_some() && !ctx.text_edit_focused() {
+        crate::caf_ui::keys(app, ctx);
+    }
     use crate::shortcut_dispatch::{Focus, dispatch_pressed};
     let focus = Focus::of(ctx);
     // Dialogs (and Liquify's panel while one of its controls has focus) keep canvas zoom; a
     // focused text field keeps its keys.
-    let liquify_focus = app.distort.liquify.is_some() && focus != Focus::None;
+    let liquify_focus = (app.distort.liquify.is_some() || app.distort.caf.is_some()) && focus != Focus::None;
     if liquify_focus || !app.ui.dialogs.is_empty() || app.discard.is_some() {
         if focus != Focus::Text {
             nav_keys(app, ctx);
@@ -1007,6 +1045,37 @@ mod tests {
         assert_eq!(presses(vec![egui::Event::ModifiersChanged(Modifiers::COMMAND), key(Key::V, false, Modifiers::COMMAND)]), 1, "image paste");
     }
 
+    /// #6329: with an image on the clipboard egui-winit swallows the ⌘V press and sends only the V
+    /// release, which carries no ⌘ when ⌘ was let go first: that release still pastes, once. A V
+    /// pressed and released on its own (the Move tool) never pastes.
+    #[test]
+    fn an_image_paste_released_after_command_still_pastes() {
+        let key = |key, pressed, modifiers| egui::Event::Key { key, physical_key: None, pressed, repeat: false, modifiers };
+        let pastes = |ctx: &egui::Context, events: Vec<egui::Event>| {
+            let mut r = egui::RawInput { events, ..Default::default() };
+            clipboard_keys(ctx, false, &mut r);
+            r.events.iter().filter(|e| matches!(e, egui::Event::Key { key: Key::V, pressed: true, modifiers, .. } if modifiers.command)).count()
+        };
+        let none = Modifiers::NONE;
+        // ⌘ down, (the swallowed V press,) ⌘ up, V up: in one frame or over several.
+        let ctx = egui::Context::default();
+        assert_eq!(pastes(&ctx, vec![egui::Event::ModifiersChanged(Modifiers::COMMAND), egui::Event::ModifiersChanged(none), key(Key::V, false, none)]), 1);
+        assert_eq!(pastes(&ctx, vec![egui::Event::ModifiersChanged(Modifiers::COMMAND)]), 0);
+        assert_eq!(pastes(&ctx, vec![egui::Event::ModifiersChanged(none)]), 0);
+        assert_eq!(pastes(&ctx, vec![key(Key::V, false, none)]), 1, "released after ⌘");
+        // Once: another lone release without ⌘ held again doesn't paste again.
+        assert_eq!(pastes(&ctx, vec![key(Key::V, false, none)]), 0);
+        // A plain V tap after ⌘ was used is the Move tool, not a paste.
+        let ctx = egui::Context::default();
+        assert_eq!(pastes(&ctx, vec![egui::Event::ModifiersChanged(Modifiers::COMMAND), egui::Event::ModifiersChanged(none)]), 0);
+        assert_eq!(pastes(&ctx, vec![key(Key::V, true, none), key(Key::V, false, none)]), 0);
+        // Without ⌘ at all, a lone V release is nothing.
+        let ctx = egui::Context::default();
+        assert_eq!(pastes(&ctx, vec![key(Key::V, false, none)]), 0);
+        // Released with ⌘ still held it pastes as before.
+        assert_eq!(pastes(&ctx, vec![egui::Event::ModifiersChanged(Modifiers::COMMAND), key(Key::V, false, Modifiers::COMMAND)]), 1);
+    }
+
     /// #2638: on the web one ⌘V brings its key press and the browser's paste event; that is one paste.
     #[test]
     fn web_paste_key_and_paste_event_are_one_press() {
diff --git a/crates/ui-egui/src/solid_fill_ui.rs b/crates/ui-egui/src/solid_fill_ui.rs
index 2ae44d50c8..5d9112abab 100644
--- a/crates/ui-egui/src/solid_fill_ui.rs
+++ b/crates/ui-egui/src/solid_fill_ui.rs
@@ -30,6 +30,36 @@ pub(crate) fn open(app: &mut PhotocraftApp) -> Option<u64> {
     Some(color_picker_ui::open_for_command(app, "Color Picker (Solid Color)", color.to_rgb(), cmds::SET, params))
 }
 
+/// Creating a Solid Color fill is transactional: the document is unchanged until OK.
+/// The picker is seeded with the foreground colour, matching the engine's default.
+pub(crate) fn open_new(app: &mut PhotocraftApp) -> Option<u64> {
+    let document = app.session.active()?.doc.id.0;
+    let foreground = app.session.tools.foreground;
+    Some(color_picker_ui::open_for_command(
+        app,
+        "Color Picker (Solid Color)",
+        [foreground[0], foreground[1], foreground[2]],
+        "layer.newFillLayer.solidColor",
+        json!({"document": document}),
+    ))
+}
+
+/// A creation picker is distinct from the editor opened by a fill layer's thumbnail.
+pub(crate) fn owns_new(f: &Map<String, Value>) -> bool {
+    f.get("__command").and_then(Value::as_str) == Some("layer.newFillLayer.solidColor")
+        && f.get("__params").and_then(|p| p.get("document")).and_then(Value::as_u64).is_some()
+}
+
+pub(crate) fn confirm_new(app: &mut PhotocraftApp, f: &Map<String, Value>) -> Result<Value, String> {
+    let expected = f.get("__params").and_then(|p| p.get("document")).and_then(Value::as_u64).ok_or("missing Solid Color document")?;
+    let st = app.session.active().ok_or("no document open")?;
+    if st.doc.id.0 != expected {
+        return Err("the target document is no longer active".into());
+    }
+    let color = f.get("color").and_then(Value::as_str).ok_or("missing Solid Color colour")?;
+    app.run("layer.newFillLayer.solidColor", json!({"color": color}))
+}
+
 pub(crate) fn owns(f: &Map<String, Value>) -> bool {
     f.get("__command").and_then(Value::as_str) == Some(cmds::SET)
 }
diff --git a/crates/ui-egui/src/solid_fill_ui/tests.rs b/crates/ui-egui/src/solid_fill_ui/tests.rs
index 9b919be934..3317875153 100644
--- a/crates/ui-egui/src/solid_fill_ui/tests.rs
+++ b/crates/ui-egui/src/solid_fill_ui/tests.rs
@@ -41,6 +41,82 @@ fn row(h: &Harness<'_, PhotocraftApp>, id: LayerId) -> crate::layer_row_ui::RowR
     crate::layer_row_ui::recorded(&h.ctx).into_iter().find(|r| r.layer == id.0).unwrap()
 }
 
+#[test]
+fn new_solid_color_from_menu_cancel_keeps_document_and_history_unchanged() {
+    let (mut h, _) = harness(1.0);
+    let ctx = h.ctx.clone();
+    let app = h.state_mut();
+    let before = app.session.active().unwrap().doc.clone();
+    let active = app.session.active().unwrap().active_layer;
+    let steps = app.session.active().unwrap().history.entries().len();
+
+    let opened = crate::menus::invoke(app, &ctx, "layer.newFillLayer.solidColor", json!({})).unwrap();
+    assert!(opened.get("layer").is_none(), "no layer exists until OK");
+    let dialog = opened["dialog"].as_u64().unwrap();
+    let picker = app.ui.dialogs.last().unwrap();
+    assert_eq!(picker.id, dialog);
+    assert!(owns_new(&picker.fields), "new Solid Color fill opens the shared Color Picker");
+    assert_eq!(picker.fields["__params"]["document"], before.id.0);
+    assert!(Arc::ptr_eq(&before, &app.session.active().unwrap().doc));
+    assert_eq!(app.session.active().unwrap().history.entries().len(), steps);
+
+    app.ui.dialog_mut(dialog).unwrap().fields.insert("color".into(), json!("#ff8800"));
+    crate::dialogs::cancel(app, dialog).unwrap();
+    assert!(app.ui.dialogs.iter().all(|d| d.id != dialog));
+    assert!(Arc::ptr_eq(&before, &app.session.active().unwrap().doc), "Cancel must not create or delete a layer");
+    assert_eq!(app.session.active().unwrap().active_layer, active);
+    assert_eq!(app.session.active().unwrap().history.entries().len(), steps, "Cancel must not record a history entry");
+}
+
+#[test]
+fn new_solid_color_from_menu_ok_creates_one_layer_with_chosen_or_default_color() {
+    let (mut h, _) = harness(1.0);
+    let ctx = h.ctx.clone();
+    let app = h.state_mut();
+    let steps = app.session.active().unwrap().history.entries().len();
+
+    // OK with the initial foreground colour still creates the fill layer.
+    let first = crate::menus::invoke(app, &ctx, "layer.newFillLayer.solidColor", json!({})).unwrap();
+    let created = crate::dialogs::confirm(app, first["dialog"].as_u64().unwrap()).unwrap();
+    let id = LayerId(created["layer"].as_u64().unwrap());
+    assert!(matches!(app.session.active().unwrap().doc.layer(id).unwrap().content, LayerContent::Fill(Fill::Solid(_))));
+    assert_eq!(app.session.active().unwrap().history.entries().len(), steps + 1);
+
+    let second = crate::menus::invoke(app, &ctx, "layer.newFillLayer.solidColor", json!({})).unwrap();
+    let dialog = second["dialog"].as_u64().unwrap();
+    app.ui.dialog_mut(dialog).unwrap().fields.insert("color".into(), json!("#ff8800"));
+    let created = crate::dialogs::confirm(app, dialog).unwrap();
+    let id = LayerId(created["layer"].as_u64().unwrap());
+    let LayerContent::Fill(Fill::Solid(color)) = app.session.active().unwrap().doc.layer(id).unwrap().content else {
+        panic!("expected the newly created Solid Color fill");
+    };
+    assert_eq!(color.to_rgba8()[..3], [255, 136, 0]);
+    assert_eq!(app.session.active().unwrap().active_layer, Some(id));
+    assert_eq!(app.session.active().unwrap().history.entries().len(), steps + 2);
+
+    let dialogs = app.ui.dialogs.len();
+    let explicit = crate::menus::invoke(app, &ctx, "layer.newFillLayer.solidColor", json!({"color": "#123456"})).unwrap();
+    assert!(explicit["layer"].as_u64().is_some());
+    assert!(explicit.get("dialog").is_none());
+    assert_eq!(app.ui.dialogs.len(), dialogs, "parameterised creation stays non-interactive");
+    assert_eq!(app.session.active().unwrap().history.entries().len(), steps + 3);
+}
+
+#[test]
+fn new_solid_color_picker_rejects_a_different_active_document() {
+    let (mut h, _) = harness(1.0);
+    let ctx = h.ctx.clone();
+    let app = h.state_mut();
+    let dialog = crate::menus::invoke(app, &ctx, "layer.newFillLayer.solidColor", json!({})).unwrap()["dialog"].as_u64().unwrap();
+    app.ui.dialog_mut(dialog).unwrap().fields.insert("color".into(), json!("#ff8800"));
+    app.run("file.new", json!({"width": 4, "height": 4})).unwrap();
+    let before = app.session.active().unwrap().doc.clone();
+    let steps = app.session.active().unwrap().history.entries().len();
+    assert!(crate::dialogs::confirm(app, dialog).is_err());
+    assert!(Arc::ptr_eq(&before, &app.session.active().unwrap().doc));
+    assert_eq!(app.session.active().unwrap().history.entries().len(), steps);
+}
+
 #[test]
 fn only_the_colour_thumbnail_opens_the_solid_fill_picker() {
     for ppp in [1.0, 2.0] {
diff --git a/crates/ui-egui/src/state.rs b/crates/ui-egui/src/state.rs
index 5cbda434e7..d464cb3cc8 100644
--- a/crates/ui-egui/src/state.rs
+++ b/crates/ui-egui/src/state.rs
@@ -1054,6 +1054,9 @@ pub struct DockTabs {
 pub struct ColorPanelState {
     /// The panel edits the background colour (its chip was clicked), not the foreground.
     pub background: bool,
+    /// Color Picker › Only Web Colors, kept across opens like Photoshop (#4995).
+    #[serde(default)]
+    pub web_only: bool,
 }
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -1073,6 +1076,9 @@ pub struct UiState {
     /// Inline type editing session, if any.
     #[serde(default)]
     pub text_edit: Option<TextEdit>,
+    /// Clock time in seconds when type cursor blink was last reset (e.g. on keypress/caret move).
+    #[serde(skip)]
+    pub caret_blink_time: f64,
     /// Tool to restore when an inline type edit session commits or cancels (e.g. Move tool, #1132).
     #[serde(skip)]
     pub text_edit_return_tool: Option<Tool>,
@@ -1307,6 +1313,7 @@ impl Default for UiState {
             spring: None,
             recent_files: Vec::new(),
             text_edit: None,
+            caret_blink_time: 0.0,
             text_edit_return_tool: None,
             type_transform: None,
             type_transform_pivot: None,
diff --git a/crates/ui-egui/src/stroke_trace.rs b/crates/ui-egui/src/stroke_trace.rs
index 206cc7e81a..809414ed49 100644
--- a/crates/ui-egui/src/stroke_trace.rs
+++ b/crates/ui-egui/src/stroke_trace.rs
@@ -113,13 +113,32 @@ impl StrokeTrace {
     /// Reads `PHOTOCRAFT_STROKE_TRACE` (off on the web, where there is no clock).
     pub fn from_env() -> Self {
         #[cfg(not(target_arch = "wasm32"))]
-        if let Some(v) = std::env::var_os("PHOTOCRAFT_STROKE_TRACE").filter(|v| !v.is_empty()) {
-            let output = if v == "1" || v == "stderr" { Output::Stderr } else { Output::Csv(v.into()) };
-            return Self { output, ..Default::default() };
+        if let Some(v) = std::env::var_os("PHOTOCRAFT_STROKE_TRACE") {
+            return Self::from_value(&v.to_string_lossy());
         }
         Self::default()
     }
 
+    /// A trace set by value: `""`, `"0"` or `"off"` is off, `"1"` or `"stderr"` prints
+    /// summaries, anything else is a CSV path (`--stroke-trace`, `PHOTOCRAFT_STROKE_TRACE`; the
+    /// control channel's `ui.set {"strokeTrace"}` passes only on or off, never a path).
+    pub fn from_value(v: &str) -> Self {
+        let v = v.trim();
+        let output = match v {
+            _ if cfg!(target_arch = "wasm32") => Output::Off,
+            "" | "0" | "off" | "false" => Output::Off,
+            "1" | "stderr" | "true" => Output::Stderr,
+            path => Output::Csv(path.into()),
+        };
+        Self { output, ..Default::default() }
+    }
+
+    /// Switch the output, keeping the last summary.
+    pub fn set(&mut self, v: &str) {
+        let last = self.last.take();
+        *self = Self { last, ..Self::from_value(v) };
+    }
+
     pub fn enabled(&self) -> bool {
         self.output != Output::Off
     }
@@ -265,6 +284,19 @@ mod tests {
         assert!(off.last.is_none() && off.rows.is_empty());
     }
 
+    #[test]
+    fn a_trace_is_set_by_value() {
+        assert_eq!(StrokeTrace::from_value("off").output, Output::Off);
+        assert_eq!(StrokeTrace::from_value(" 0 ").output, Output::Off);
+        assert_eq!(StrokeTrace::from_value("stderr").output, Output::Stderr);
+        assert_eq!(StrokeTrace::from_value("true").output, Output::Stderr);
+        assert_eq!(StrokeTrace::from_value("t.csv").output, Output::Csv("t.csv".into()));
+        let mut t = on();
+        t.last = Some(Summary::default());
+        t.set("off");
+        assert!(!t.enabled() && t.last.is_some(), "turning it off keeps the last summary");
+    }
+
     #[test]
     fn csv_rows_and_odd_numbers() {
         let rows = [Row { t: 1.0, interval: 16.5, moves: 2, stroke: 0.25, canvas: 1.0, ui: 3.0, cpu_prev: None }];
diff --git a/crates/ui-egui/src/stroke_trail.rs b/crates/ui-egui/src/stroke_trail.rs
index 6a5465ca7f..af09fca1c4 100644
--- a/crates/ui-egui/src/stroke_trail.rs
+++ b/crates/ui-egui/src/stroke_trail.rs
@@ -74,6 +74,13 @@ impl Trail {
         self.fed = points.len();
     }
 
+    /// Stamp a whole new drag into the same mask (the Remove tool's waiting strokes, #6555): its
+    /// points are counted from its own start, not from where the previous drag ended.
+    pub fn feed_stroke(&mut self, points: &[[f64; 3]], diameter: f32) {
+        self.fed = 0;
+        self.feed(points, diameter);
+    }
+
     /// Show the coverage the brush's own dabs leave along the drag, as the stroke commit renders
     /// it (`photocraft_paint::retouch::stroke_coverage`): soft edges for a soft brush, the size and
     /// shape each dab takes from pen pressure and dynamics. `brush` is asked for once, on the first
@@ -224,6 +231,24 @@ mod tests {
         }
     }
 
+    #[test]
+    fn each_stroke_fed_whole_is_stamped_in_full() {
+        let mut t = Trail::new([300, 300]);
+        let strokes: [&[[f64; 3]]; 3] = [
+            &[[50.0, 50.0, 1.0], [120.0, 50.0, 1.0], [200.0, 50.0, 1.0]],
+            &[[50.0, 120.0, 1.0], [120.0, 120.0, 1.0]],
+            &[[50.0, 200.0, 1.0], [80.0, 200.0, 1.0], [120.0, 200.0, 1.0], [160.0, 200.0, 1.0], [200.0, 200.0, 1.0], [260.0, 200.0, 1.0]],
+        ];
+        for s in strokes {
+            t.feed_stroke(s, 10.0);
+        }
+        for (x, y) in [(50, 50), (85, 50), (199, 50), (50, 120), (85, 120), (119, 120), (50, 200), (65, 200), (100, 200), (259, 200)] {
+            assert_eq!(t.coverage(x, y), 255, "({x}, {y}) lies on a stroke");
+        }
+        assert_eq!(t.coverage(50, 85), 0, "no capsule joins one stroke's end to the next one's start");
+        assert_eq!(t.coverage(150, 160), 0);
+    }
+
     #[test]
     fn hostile_points_and_huge_documents_are_safe() {
         let mut t = Trail::new([300_000, 2]);
diff --git a/crates/ui-egui/src/swap_arrow.rs b/crates/ui-egui/src/swap_arrow.rs
index ef0bc76fb6..a5bd105232 100644
--- a/crates/ui-egui/src/swap_arrow.rs
+++ b/crates/ui-egui/src/swap_arrow.rs
@@ -66,6 +66,7 @@ mod tests {
 
     #[test]
     fn rendered_glyph_has_a_left_head_and_a_lower_right_head() {
+        let _gpu = photocraft_testkit::gpu_lock();
         let mut h = egui_kittest::Harness::builder().with_size(vec2(32.0, 32.0)).wgpu().build_ui(|ui| {
             paint(ui.painter(), pos2(8.0, 8.0), Color32::WHITE);
         });
diff --git a/crates/ui-egui/src/tab_strip.rs b/crates/ui-egui/src/tab_strip.rs
index 61650a1182..1419471f1f 100644
--- a/crates/ui-egui/src/tab_strip.rs
+++ b/crates/ui-egui/src/tab_strip.rs
@@ -54,8 +54,10 @@ pub struct StripOut {
 pub const CHEVRON_W: f32 = 18.0;
 
 /// Draw the » overflow button at `r`: hover tip `tip`, listing the tabs named by `labels` at the
-/// indices in `overflow`. A picked index is left in `picked`.
-pub fn overflow_button(ui: &mut Ui, id: egui::Id, r: Rect, tip: &str, labels: &[&str], overflow: &[usize], picked: &mut Option<usize>) {
+/// indices in `overflow`, the `checked` one with a check mark as in the menu bar's menus. A picked
+/// index is left in `picked`.
+#[allow(clippy::too_many_arguments)]
+pub fn overflow_button(ui: &mut Ui, id: egui::Id, r: Rect, tip: &str, labels: &[&str], overflow: &[usize], checked: Option<usize>, picked: &mut Option<usize>) {
     let t = Tokens::get(ui.ctx());
     let resp = ui.interact(r, id, Sense::click());
     let mut paint_ui = ui.new_child(egui::UiBuilder::new().max_rect(r));
@@ -69,9 +71,9 @@ pub fn overflow_button(ui: &mut Ui, id: egui::Id, r: Rect, tip: &str, labels: &[
     egui::Popup::menu(&resp).show(|ui| {
         ui.set_min_width(140.0);
         for &i in overflow {
-            if let Some(name) = labels.get(i)
-                && ui.button(*name).clicked()
-            {
+            let Some(name) = labels.get(i) else { continue };
+            let text = if checked.is_some() { format!("{} {name}", if checked == Some(i) { "✔" } else { "  " }) } else { (*name).to_owned() };
+            if ui.button(text).clicked() {
                 *picked = Some(i);
                 ui.close();
             }
@@ -161,7 +163,7 @@ fn tabs_in(
     if !f.overflow.is_empty() && f.overflow_width > 0.0 {
         let r = Rect::from_min_size(pos2(x, area.top()), vec2(f.overflow_width, area.height()));
         let mut picked = None;
-        overflow_button(ui, id.with("tab-overflow"), r, tl!("More panels"), translated_tabs, &f.overflow, &mut picked);
+        overflow_button(ui, id.with("tab-overflow"), r, tl!("More panels"), translated_tabs, &f.overflow, None, &mut picked);
         if let Some(i) = picked {
             out.clicked = true;
             *selected = i;
@@ -358,7 +360,7 @@ mod tests {
                     let mut picked = None;
                     let input = egui::RawInput { events: vec![egui::Event::PointerMoved(rect.center())], ..Default::default() };
                     let mut output = ctx.run_ui(input, |ui| {
-                        overflow_button(ui, ui.id().with("tiny-overflow"), rect, "More panels", &["Layers"], &[0], &mut picked);
+                        overflow_button(ui, ui.id().with("tiny-overflow"), rect, "More panels", &["Layers"], &[0], None, &mut picked);
                     });
                     output.textures_delta.clear();
                     let mut icons = 0;
diff --git a/crates/ui-egui/src/tone.rs b/crates/ui-egui/src/tone.rs
index ba17755bd9..aaf742096a 100644
--- a/crates/ui-egui/src/tone.rs
+++ b/crates/ui-egui/src/tone.rs
@@ -217,11 +217,17 @@ pub fn keep_after_commit(app: &mut PhotocraftApp, layer: LayerId, before: Option
     }
 }
 
+/// Display scale for a 256-bin histogram: bar heights are `v / top` clamped to 1, linear
+/// to the tallest bin like Photoshop. A percentile of the sorted bins degenerates on
+/// sparse histograms (few occupied levels sort 0 into every low index), drawing tiny
+/// counts as tall as the real peaks (#6574).
+/// Extracted from [`draw_histogram`] so the scaling is unit-testable.
+pub fn histogram_scale_top(h: &[u32; 256]) -> f32 {
+    h.iter().copied().max().unwrap_or(1).max(1) as f32 * 1.1
+}
+
 pub fn draw_histogram(p: &egui::Painter, r: Rect, h: &[u32; 256], color: Color32) {
-    // Scale to a high percentile so a single spike (e.g. pure white) doesn't flatten the rest.
-    let mut sorted: Vec<u32> = h.to_vec();
-    sorted.sort_unstable();
-    let top = sorted.get(250).copied().unwrap_or(1).max(1) as f32 * 1.1;
+    let top = histogram_scale_top(h);
     let mut pts = vec![egui::pos2(r.left(), r.bottom())];
     for (i, v) in h.iter().enumerate() {
         let x = r.left() + (i as f32 + 0.5) / 256.0 * r.width();
@@ -452,6 +458,34 @@ mod tests {
         );
         assert_ne!(tag(HistSource::Channel { layer, surface: GraySurface::LayerMask }, ToneSpace::Rgb), tag(HistSource::Layer(layer), ToneSpace::Rgb));
     }
+
+    /// #6574: bar heights scale linearly to the tallest bin. A 90/10 black/white
+    /// histogram draws the small bar at a ninth of the big one, not full height.
+    #[test]
+    fn histogram_scale_is_proportional_for_two_level_images() {
+        let mut h = [0u32; 256];
+        h[0] = 100_000;
+        h[255] = 900_000;
+        let top = histogram_scale_top(&h);
+        let small = (h[0] as f32 / top).min(1.0);
+        let big = (h[255] as f32 / top).min(1.0);
+        assert!((small / big - 1.0 / 9.0).abs() < 0.02, "small/big = {}, top = {top}", small / big);
+    }
+
+    /// #6574: a sparse histogram (few occupied levels) must not scale to a bin
+    /// index that is 0: the old `sorted.get(250)` degenerated to `top = 1.1`,
+    /// drawing a few hundred samples as tall as hundreds of thousands.
+    #[test]
+    fn histogram_scale_does_not_degenerate_on_sparse_histograms() {
+        let mut h = [0u32; 256];
+        h[0] = 500_000;
+        h[128] = 300;
+        h[255] = 500_000;
+        let top = histogram_scale_top(&h);
+        assert!(top > h[128] as f32, "scale {top} must exceed the tiny middle bin");
+        let tiny = (h[128] as f32 / top).min(1.0);
+        assert!(tiny < 0.05, "tiny bin draws near-flat, got {tiny}");
+    }
 }
 
 #[cfg(test)]
diff --git a/crates/ui-egui/src/tool_shortcuts.rs b/crates/ui-egui/src/tool_shortcuts.rs
index 345b7f57b3..91f66a0f07 100644
--- a/crates/ui-egui/src/tool_shortcuts.rs
+++ b/crates/ui-egui/src/tool_shortcuts.rs
@@ -94,3 +94,17 @@ mod tests {
         assert_eq!(h.state().ui.status, "q");
     }
 }
+
+#[cfg(test)]
+mod engine_table_tests {
+    use super::*;
+
+    /// The engine knows the tools as data (headless shortcut sets); it must match the toolbar.
+    #[test]
+    fn the_engines_tool_table_matches_the_tools() {
+        let ours: Vec<(String, &str, Option<String>)> = Tool::ALL.into_iter().map(|t| (id(t), t.label(), default(t))).collect();
+        let engine: Vec<(String, &str, Option<String>)> =
+            photocraft_engine::shell_commands::TOOLS.iter().map(|(i, n, k)| (i.to_string(), *n, k.map(str::to_string))).collect();
+        assert_eq!(ours, engine, "update photocraft_engine::shell_commands::TOOLS");
+    }
+}
diff --git a/crates/ui-egui/src/transform_switch_tests.rs b/crates/ui-egui/src/transform_switch_tests.rs
new file mode 100644
index 0000000000..f5be113d2a
--- /dev/null
+++ b/crates/ui-egui/src/transform_switch_tests.rs
@@ -0,0 +1,223 @@
+//! Free Transform with the whole app: picking another tool or layer, or New Layer, while the box
+//! is open applies the transform as it stands, as Photoshop does (#5441, #5665, #5667).
+
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use serde_json::json;
+
+use crate::PhotocraftApp;
+
+/// The app with a 400 × 300 document: a red 100 × 60 rectangle at (100, 100) on its own layer
+/// above the Background.
+fn app() -> Harness<'static, PhotocraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_max_steps(64).build_eframe(|cc| {
+        PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        app.run("file.new", json!({"width": 400, "height": 300, "background": "white"})).unwrap();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.run("select.rect", json!({"x": 100, "y": 100, "width": 100, "height": 60})).unwrap();
+        app.run("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        app.run("select.deselect", json!({})).unwrap();
+        app
+    });
+    h.run_steps(6);
+    h
+}
+
+/// Open Free Transform and move the box 50 px right, 40 px down.
+fn transform_and_move(h: &mut Harness<'static, PhotocraftApp>) {
+    let ctx = h.ctx.clone();
+    crate::menus::invoke(h.state_mut(), &ctx, "edit.freeTransform", json!({})).unwrap();
+    h.run_steps(2);
+    let t = h.state_mut().ui.transform.as_mut().expect("Free Transform is open");
+    for p in &mut t.quad {
+        p[0] += 50.0;
+        p[1] += 40.0;
+    }
+    h.run_steps(2);
+}
+
+fn red_bounds(h: &Harness<'static, PhotocraftApp>) -> photocraft_geom::Rect {
+    let st = h.state().session.active().unwrap();
+    let top = st.doc.layers.last().unwrap();
+    top.surface().unwrap().content_bounds()
+}
+
+#[test]
+fn picking_another_tool_in_the_toolbar_applies_the_transform() {
+    let mut h = app();
+    transform_and_move(&mut h);
+    let hand = h.query_by_label_contains("Hand Tool").expect("the toolbar's Hand Tool");
+    hand.click();
+    h.run_steps(4);
+    assert!(h.state().ui.transform.is_none(), "the box closed");
+    assert_eq!(red_bounds(&h), photocraft_geom::Rect::new(150, 140, 250, 200), "the move was applied, not cancelled");
+}
+
+/// The app with the red rectangle on a layer the last step made (Layer via Copy, which deselects in
+/// the same step), as Place Embedded leaves it for the box `begin_placed` opens: cancelling the
+/// place takes that step back.
+fn placed_app() -> Harness<'static, PhotocraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_max_steps(64).build_eframe(|cc| {
+        PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        app.run("file.new", json!({"width": 400, "height": 300, "background": "white"})).unwrap();
+        app.run("select.rect", json!({"x": 100, "y": 100, "width": 100, "height": 60})).unwrap();
+        app.run("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        app.run("layer.new.layerViaCopy", json!({})).unwrap();
+        app
+    });
+    h.run_steps(6);
+    assert!(h.state().session.active().unwrap().doc.selection.is_none(), "Layer via Copy deselects in its own step");
+    h
+}
+
+fn history(h: &Harness<'static, PhotocraftApp>) -> Vec<String> {
+    h.state().session.active().unwrap().history.entries().to_vec()
+}
+
+/// The box on a just-placed layer (a file dropped on the canvas), moved.
+fn placed_and_moved(h: &mut Harness<'static, PhotocraftApp>) {
+    let ctx = h.ctx.clone();
+    crate::transform_tool::begin_placed(h.state_mut(), &ctx).unwrap();
+    h.run_steps(2);
+    let t = h.state_mut().ui.transform.as_mut().expect("Free Transform is open");
+    for p in &mut t.quad {
+        p[0] += 50.0;
+        p[1] += 40.0;
+    }
+    h.run_steps(2);
+}
+
+#[test]
+fn a_placed_image_is_applied_when_another_tool_is_picked() {
+    let mut h = placed_app();
+    placed_and_moved(&mut h);
+    h.query_by_label_contains("Hand Tool").expect("the toolbar's Hand Tool").click();
+    h.run_steps(4);
+    assert!(h.state().ui.transform.is_none());
+    assert_eq!(h.state().session.active().unwrap().doc.layers.len(), 2, "the placed layer stays");
+    assert_eq!(red_bounds(&h), photocraft_geom::Rect::new(150, 140, 250, 200));
+}
+
+#[test]
+fn picking_another_layer_in_the_panel_applies_the_transform() {
+    for placed in [false, true] {
+        let mut h = if placed { placed_app() } else { app() };
+        if placed {
+            placed_and_moved(&mut h);
+        } else {
+            transform_and_move(&mut h);
+        }
+        h.get_by_label("Background").click();
+        h.run_steps(4);
+        assert!(h.state().ui.transform.is_none(), "placed {placed}");
+        assert_eq!(h.state().session.active().unwrap().doc.layers.len(), 2, "placed {placed}");
+        assert_eq!(red_bounds(&h), photocraft_geom::Rect::new(150, 140, 250, 200), "placed {placed}");
+    }
+}
+
+#[test]
+fn new_layer_applies_the_transform_first() {
+    for placed in [false, true] {
+        let mut h = if placed { placed_app() } else { app() };
+        let before = history(&h);
+        if placed {
+            placed_and_moved(&mut h);
+        } else {
+            transform_and_move(&mut h);
+        }
+        // The Layers panel's New Layer button (the menu item opens the New Layer dialog).
+        h.get_by_label("Create a new layer").click();
+        h.run_steps(4);
+        assert!(h.state().ui.transform.is_none(), "placed {placed}");
+        let st = h.state().session.active().unwrap();
+        assert_eq!(st.doc.layers.len(), 3, "placed {placed}");
+        let red = st.doc.layers[1].surface().unwrap().content_bounds();
+        assert_eq!(red, photocraft_geom::Rect::new(150, 140, 250, 200), "placed {placed}: the moved image, not the original");
+        // History: the transform (folded into Place Embedded for a placed layer), then New Layer.
+        let after = history(&h);
+        let added: Vec<&str> = after.iter().skip(before.len().saturating_sub(usize::from(placed))).map(String::as_str).collect();
+        let first = if placed { photocraft_engine::file_cmds::PLACE_EMBEDDED } else { "Free Transform" };
+        assert_eq!(added, [first, "New Layer"], "placed {placed}: {after:?}");
+    }
+}
+
+#[test]
+fn an_untouched_placed_image_stays_when_another_tool_or_layer_is_picked() {
+    for via_layer in [false, true] {
+        let mut h = placed_app();
+        let ctx = h.ctx.clone();
+        crate::transform_tool::begin_placed(h.state_mut(), &ctx).unwrap();
+        h.run_steps(2);
+        if via_layer {
+            let bg = h.state().session.active().unwrap().doc.layers[0].id;
+            h.state_mut().run("layer.select", json!({"layer": bg.0})).unwrap();
+        } else {
+            h.query_by_label_contains("Hand Tool").expect("Hand Tool").click();
+        }
+        h.run_steps(4);
+        let st = h.state().session.active().unwrap();
+        assert_eq!(st.doc.layers.len(), 2, "via layer {via_layer}: the placed image stays");
+        assert_eq!(red_bounds(&h), photocraft_geom::Rect::new(100, 100, 200, 160));
+    }
+}
+
+/// The placed fixture is a real place: cancelling the box takes the layer back, so the tests
+/// above would see a switch that cancelled it.
+#[test]
+fn cancelling_the_placed_fixture_removes_its_layer() {
+    let mut h = placed_app();
+    placed_and_moved(&mut h);
+    crate::transform_tool::cancel(h.state_mut());
+    h.run_steps(2);
+    assert_eq!(h.state().session.active().unwrap().doc.layers.len(), 1);
+}
+
+/// A new-layer command that can't run (Artboard from Group with a pixel layer active) leaves the box and the
+/// placed layer as they were.
+#[test]
+fn a_new_layer_command_that_cant_run_leaves_the_box_open() {
+    let mut h = placed_app();
+    placed_and_moved(&mut h);
+    let before = history(&h);
+    assert!(h.state_mut().run("layer.new.artboardFromGroup", json!({})).is_err());
+    h.run_steps(2);
+    assert!(h.state().ui.transform.is_some(), "the box stays open");
+    assert_eq!(h.state().session.active().unwrap().doc.layers.len(), 2, "the placed layer stays");
+    assert_eq!(history(&h), before);
+}
+
+/// A transform the engine refuses (a result far over the pixel budget, #3773) keeps the box open
+/// with the placed layer, and the new layer isn't made: the refusal comes back.
+#[test]
+fn a_refused_transform_keeps_the_placed_layer_and_refuses_the_new_layer() {
+    let mut h = placed_app();
+    placed_and_moved(&mut h);
+    let t = h.state_mut().ui.transform.as_mut().unwrap();
+    t.quad = [[0.0, 0.0], [4.0e6, 0.0], [4.0e6, 4.0e6], [0.0, 4.0e6]];
+    h.run_steps(2);
+    let before = history(&h);
+    let r = h.state_mut().run("layer.new.layer", json!({}));
+    h.run_steps(2);
+    assert!(r.is_err(), "{r:?}");
+    assert!(h.state().ui.transform.is_some(), "the box stays open");
+    assert_eq!(h.state().session.active().unwrap().doc.layers.len(), 2, "the placed layer stays, no new layer");
+    assert_eq!(history(&h), before);
+}
+
+/// New Layer with bad params, while a moved box is open, is refused before the transform is
+/// applied: the box, the layer and History stay as they were.
+#[test]
+fn new_layer_with_bad_params_leaves_the_box_open() {
+    for bad in [json!({"mode": "Bogus"}), json!({"fillNeutral": true}), json!({"position": "x"}), json!([1])] {
+        let mut h = app();
+        transform_and_move(&mut h);
+        let before = history(&h);
+        assert!(h.state_mut().run("layer.new.layer", bad.clone()).is_err(), "{bad}");
+        h.run_steps(2);
+        assert!(h.state().ui.transform.is_some(), "{bad}: the box stays open");
+        assert_eq!(history(&h), before, "{bad}: nothing applied");
+        assert_eq!(red_bounds(&h), photocraft_geom::Rect::new(100, 100, 200, 160), "{bad}");
+    }
+}
diff --git a/crates/ui-egui/src/type_font_picker_tests.rs b/crates/ui-egui/src/type_font_picker_tests.rs
index 176e683a9d..3dfe34dedc 100644
--- a/crates/ui-egui/src/type_font_picker_tests.rs
+++ b/crates/ui-egui/src/type_font_picker_tests.rs
@@ -10,6 +10,7 @@ use photocraft_engine::prefs::FontPreview;
 struct State {
     current: String,
     families: Vec<String>,
+    button: egui::Id,
     popup: egui::Id,
     preview: FontPreview,
 }
@@ -22,10 +23,11 @@ fn harness_with(preview: FontPreview) -> Harness<'static, State> {
     // Enough families that the unfiltered menu hits its maximum height and scrolls.
     let mut families: Vec<String> = (0..60).map(|i| format!("Family {i:02}")).collect();
     families.push("Zeta Sans".into());
-    let state = State { current: "Family 00".into(), families, popup: egui::Id::NULL, preview };
+    let state = State { current: "Family 00".into(), families, button: egui::Id::NULL, popup: egui::Id::NULL, preview };
     let mut h = Harness::builder().with_size(vec2(600.0, 900.0)).build_ui_state(
         |ui, s: &mut State| {
-            s.popup = ui.make_persistent_id(egui::IdSalt::new("type-font")).with("popup");
+            s.button = ui.make_persistent_id(egui::IdSalt::new("type-font"));
+            s.popup = s.button.with("popup");
             let fams = s.families.clone();
             font_picker_in(ui, &mut s.current, 170.0, &fams, s.preview);
         },
@@ -46,6 +48,16 @@ fn open(h: &mut Harness<'static, State>) {
     h.run();
 }
 
+/// A native click can leave the opening button held across several rendered frames.
+fn hold_open<S>(h: &mut Harness<'_, S>, button: egui::Pos2) {
+    h.hover_at(button);
+    h.run();
+    h.event(egui::Event::PointerButton { pos: button, button: egui::PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.run_steps(4);
+    h.event(egui::Event::PointerButton { pos: button, button: egui::PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run();
+}
+
 #[test]
 fn hovering_a_font_row_sets_preview_and_leaving_clears_it() {
     let mut h = harness();
@@ -93,15 +105,18 @@ fn clearing_the_query_restores_the_menu_height() {
 #[test]
 fn reopening_focuses_the_search_field_and_clicking_it_keeps_the_menu_open() {
     let mut h = harness();
-    open(&mut h);
+    let button = h.query_all_by_role(Role::ComboBox).next().unwrap().rect().center();
+    hold_open(&mut h, button);
     assert!(h.get_by_role(Role::TextInput).is_focused(), "search is focused on first open");
-    h.get_by_role(Role::TextInput).type_text("zeta");
-    h.run();
-    // Close without choosing, then reopen: the query stays and the field is focused again.
-    h.key_press(Key::Escape);
+    h.event(egui::Event::Text("zeta".into()));
     h.run();
+    assert_eq!(h.get_by_role(Role::TextInput).value().as_deref(), Some("zeta"), "typing goes straight to the search field");
+    // Close and reopen on consecutive passes: the query stays and the field is focused again.
+    h.input_mut().events.push(egui::Event::Key { key: Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
+    h.step();
     assert!(popup_rect(&h).is_none(), "Escape closes the menu");
-    open(&mut h);
+    h.query_all_by_role(Role::ComboBox).next().unwrap().click_accesskit();
+    h.run();
     let search = h.get_by_role(Role::TextInput);
     assert_eq!(search.value().as_deref(), Some("zeta"));
     assert!(search.is_focused(), "search is focused on reopen with a query");
@@ -120,6 +135,64 @@ fn reopening_focuses_the_search_field_and_clicking_it_keeps_the_menu_open() {
     assert!(popup_rect(&h).is_none(), "choosing a font closes the menu");
 }
 
+#[test]
+fn opening_click_release_returns_focus_to_search_before_typing() {
+    let mut h = harness();
+    let button = h.query_all_by_role(Role::ComboBox).next().unwrap().rect().center();
+    h.hover_at(button);
+    h.run();
+    h.event(egui::Event::PointerButton { pos: button, button: egui::PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.run_steps(4);
+    assert!(h.get_by_role(Role::TextInput).is_focused());
+    // A native opening click can hand focus back to its button when it ends, after the
+    // search has already been focused for several passes. Model that platform handoff.
+    let id = h.state().button;
+    h.ctx.memory_mut(|m| m.request_focus(id));
+    h.event(egui::Event::PointerButton { pos: button, button: egui::PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run();
+    assert!(h.get_by_role(Role::TextInput).is_focused(), "the opening release leaves the search focused");
+    h.event(egui::Event::Text("zeta".into()));
+    h.run();
+    assert_eq!(h.get_by_role(Role::TextInput).value().as_deref(), Some("zeta"));
+    assert!(h.query_by_label("Family 01").is_none());
+}
+
+#[test]
+fn first_options_bar_open_searches_without_changing_the_tool_or_edited_text() {
+    use crate::{PhotocraftApp, Services};
+    use photocraft_doc::LayerContent;
+    use serde_json::json;
+
+    for editing in [false, true] {
+        let mut h = Harness::builder().with_size(vec2(1600.0, 1000.0)).with_max_steps(64).build_eframe(move |cc| {
+            PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
+            let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Services::default());
+            app.run("file.new", json!({"width": 200, "height": 100})).unwrap();
+            app.run("type.create", json!({"text": "Sample", "font": "Inter", "size": 18})).unwrap();
+            app.ui.tool = crate::state::Tool::Type;
+            if editing {
+                super::edit_active(&mut app).unwrap();
+            }
+            app.sync_views();
+            app
+        });
+        h.run_steps(8);
+        let button = h.query_all_by_role(Role::ComboBox).find(|n| n.value().as_deref() == Some("Inter")).unwrap().rect().center();
+        hold_open(&mut h, button);
+        // Native typing carries key events as well as text; an unfocused search would let
+        // the first key switch tools, or replace the selected inline text instead.
+        h.event(egui::Event::Key { key: Key::J, physical_key: Some(Key::J), pressed: true, repeat: false, modifiers: Modifiers::NONE });
+        h.event(egui::Event::Text("JetBrains".into()));
+        h.run();
+        let search = h.query_all_by_role(Role::TextInput).find(|n| n.is_focused()).expect("font search focused on first open");
+        assert_eq!(search.value().as_deref(), Some("JetBrains"));
+        assert_eq!(h.state().ui.tool, crate::state::Tool::Type);
+        let st = h.state().session.active().unwrap();
+        let LayerContent::Text(text) = &st.doc.layer(st.active_layer.unwrap()).unwrap().content else { panic!("type layer") };
+        assert_eq!(text.text, "Sample");
+    }
+}
+
 #[test]
 fn arrows_apply_fonts_without_closing_and_enter_accepts() {
     let mut h = harness();
@@ -411,6 +484,7 @@ fn localized_font_names_label_the_menu_but_pick_the_family() {
     let state = State {
         current: "Arial".into(),
         families: vec!["Arial".into(), "MS Gothic".into(), "Zeta Sans".into()],
+        button: egui::Id::NULL,
         popup: egui::Id::NULL,
         preview: FontPreview::Medium,
     };
@@ -519,8 +593,8 @@ fn options_bar_hover_previews_with_the_character_picker_also_shown() {
     };
     let pickers: Vec<_> = h.query_all_by_role(Role::ComboBox).filter(|n| n.value().as_deref() == Some("Inter")).collect();
     assert_eq!(pickers.len(), 2, "options bar and Character section both show the font picker");
-    pickers[0].click();
-    h.run();
+    let button = pickers[0].rect().center();
+    hold_open(&mut h, button);
     h.query_all_by_role(Role::TextInput).find(|n| n.is_focused()).expect("search field focused").type_text("JetBrains Mono");
     h.run();
     h.get_by_label("JetBrains Mono").hover();
diff --git a/crates/ui-egui/src/type_panels_ui/color_picker.rs b/crates/ui-egui/src/type_panels_ui/color_picker.rs
index 3c68f72e4c..7df76c0cd5 100644
--- a/crates/ui-egui/src/type_panels_ui/color_picker.rs
+++ b/crates/ui-egui/src/type_panels_ui/color_picker.rs
@@ -82,7 +82,7 @@ pub(crate) fn open(app: &mut PhotocraftApp, kind: Kind, id: u32) -> Result<u64,
     }
     // Style colors use encoded RGB, just like the existing compact style picker.
     let t = Target { document: st.doc.id, revision: st.revision, kind, id, color: color_picker_ui::hex(rgb) };
-    let mut fields = color_picker_ui::initial_fields("dialog", "Color Picker (Text Color)", rgb);
+    let mut fields = color_picker_ui::fields_with_web(app, "dialog", "Color Picker (Text Color)", rgb);
     fields.insert(TARGET.into(), serde_json::to_value(t).map_err(|e| e.to_string())?);
     let panels = &mut app.ui.type_panels;
     panels.styles = true;
diff --git a/crates/ui-egui/src/type_tool.rs b/crates/ui-egui/src/type_tool.rs
index d73bb2e2c4..68c33b78c8 100644
--- a/crates/ui-egui/src/type_tool.rs
+++ b/crates/ui-egui/src/type_tool.rs
@@ -301,6 +301,7 @@ pub fn pointer_up(app: &mut PhotocraftApp, start: [f64; 2], end: [f64; 2]) {
     if let Some(e) = app.ui.text_edit.as_mut() {
         e.dragging = false;
         e.resize = None;
+        app.ui.caret_blink_time = app.last_frame_time;
         return;
     }
     let (w, h) = ((end[0] - start[0]).abs(), (end[1] - start[1]).abs());
@@ -340,6 +341,7 @@ pub fn pointer_up(app: &mut PhotocraftApp, start: [f64; 2], end: [f64; 2]) {
         }
         // Like Photoshop: the placeholder is selected, so typing replaces it.
         let n = text.chars().count();
+        app.ui.caret_blink_time = app.last_frame_time;
         app.ui.text_edit = Some(TextEdit { layer: id, caret: n, anchor: 0, session: key, created: true, mask, dragging: false, resize: None, preedit: None });
         app.ui.text_edit_return_tool = None;
     }
@@ -789,7 +791,11 @@ pub fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
         e.caret = e.caret.min(n);
         e.anchor = e.anchor.min(n);
     }
-    ctx.request_repaint_after(std::time::Duration::from_millis(530)); // caret blink
+    let time = ctx.input(|i| i.time);
+    let elapsed = (time - app.ui.caret_blink_time).max(0.0);
+    let period = 0.530;
+    let remaining = period - (elapsed % period);
+    ctx.request_repaint_after(std::time::Duration::from_secs_f64(remaining.clamp(0.010, period)));
     let events = ctx.input(|i| i.events.clone());
     let vertical_flow = is_vertical(app, id);
     let mut handled = vec![false; events.len()];
@@ -942,6 +948,7 @@ pub fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
         }
     }
     if handled.iter().any(|h| *h) {
+        app.ui.caret_blink_time = ctx.input(|i| i.time);
         let mut k = 0;
         ctx.input_mut(|i| {
             i.events.retain(|_| {
@@ -1000,6 +1007,9 @@ pub fn commit_with(app: &mut PhotocraftApp, mods: egui::Modifiers) {
 /// Selection highlight, caret and text frame over the canvas.
 pub fn draw_overlay(app: &mut PhotocraftApp, painter: &egui::Painter, xf: &ViewXform) {
     let Some(ed) = app.ui.text_edit.clone() else { return };
+    if ed.dragging {
+        app.ui.caret_blink_time = painter.ctx().input(|i| i.time);
+    }
     let id = LayerId(ed.layer);
     let Some((l, aff, text)) = layout(app, id) else { return };
     if ed.mask {
@@ -1083,9 +1093,10 @@ pub fn draw_overlay(app: &mut PhotocraftApp, painter: &egui::Painter, xf: &ViewX
             }
         }
     } else {
-        // Blinking caret (Photoshop's ~0.53 s rhythm), solid while dragging.
+        // Blinking caret (Photoshop's ~0.53 s rhythm), solid while dragging or immediately after interaction.
         let time = painter.ctx().input(|i| i.time);
-        if ed.dragging || (time * 1000.0 / 530.0) as i64 % 2 == 0 {
+        let elapsed = (time - app.ui.caret_blink_time).max(0.0);
+        if ed.dragging || (elapsed * 1000.0 / 530.0) as i64 % 2 == 0 {
             let (x, top, bot) = l.caret(a);
             let (x, top, bot) = if l.lines.is_empty() { (0.0, -(12.0 * l.px_per_pt.max(1.0)), 3.0) } else { (x, top, bot) };
             let c = if crate::theme::Tokens::get(painter.ctx()).pro { Color32::WHITE } else { Color32::BLACK };
@@ -1436,6 +1447,7 @@ pub(crate) fn family_picker_in(
 ) -> bool {
     let mut changed = false;
     let search_id = ui.id().with(("font-search", salt));
+    let focus_id = search_id.with("focus");
     // The list opens on the press, so a press-drag-release picks a font too (#2735).
     let (press, close) = crate::press_menu::PressCombo::before(ui, salt);
     let labels: Option<Arc<HashMap<String, String>>> = ui.ctx().data(|d| d.get_temp(font_labels_id()));
@@ -1451,26 +1463,25 @@ pub(crate) fn family_picker_in(
         .close_behavior(if matches!(close, egui::PopupCloseBehavior::IgnoreClicks) { close } else { egui::PopupCloseBehavior::CloseOnClickOutside });
 
     let response = combo.show_ui(ui, |ui| {
-        let (pass_id, focus_id, height_id) = (search_id.with("pass"), search_id.with("focus"), search_id.with("height"));
-        let pass = ui.ctx().cumulative_pass_nr();
-        let last_pass: Option<u64> = ui.data(|d| d.get_temp(pass_id));
-        // Freshly opened (not drawn last pass): focus the search field whatever the query, and keep
-        // asking until it has focus (the first pass is egui's invisible sizing pass) (#1369).
-        let opened = last_pass.is_none_or(|p| p.saturating_add(1) < pass);
-        let mut focus = opened || ui.data(|d| d.get_temp(focus_id)).unwrap_or(false);
+        let height_id = search_id.with("height");
+        // Each opening focuses the search, including a reopen on the very next pass. Keep
+        // asking through the invisible sizing pass, until the field receives focus.
+        let mut focus = ui.data(|d| d.get_temp(focus_id)).unwrap_or(true);
         let mut q: String = ui.data(|d| d.get_temp(search_id)).unwrap_or_default();
         // Consume these before TextEdit and the canvas can interpret them as caret movement.
         let down = ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::ArrowDown));
         let up = ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::ArrowUp));
         let enter = ui.input_mut(|i| i.consume_key(egui::Modifiers::NONE, egui::Key::Enter));
-        let r = ui.add(egui::TextEdit::singleline(&mut q).hint_text(tl!("Search fonts")).desired_width(200.0));
-        if r.has_focus() {
-            focus = false;
-        } else if focus {
-            r.request_focus();
+        if focus {
+            ui.memory_mut(|m| m.request_focus(search_id.with("input")));
+        }
+        let r = ui.add(egui::TextEdit::singleline(&mut q).id(search_id.with("input")).hint_text(tl!("Search fonts")).desired_width(200.0));
+        if focus {
+            // The opening click can release after several focused frames. Keep the request
+            // pending through that release, which can hand focus back to the combo button.
+            focus = !r.has_focus() || ui.input(|i| i.pointer.primary_down() || i.pointer.primary_released());
         }
         ui.data_mut(|d| {
-            d.insert_temp(pass_id, pass);
             d.insert_temp(focus_id, focus);
             d.insert_temp(search_id, q.clone());
         });
@@ -1540,6 +1551,9 @@ pub(crate) fn family_picker_in(
         if accept { None } else { hovered }
     });
     press.after(&response.response);
+    if !egui::ComboBox::is_open(ui.ctx(), response.response.id) {
+        ui.data_mut(|d| d.remove::<bool>(focus_id));
+    }
     let hovered_font = response.inner.unwrap_or_default();
 
     // The wheel over the closed button steps through the families, a notch each, like Photoshop's
@@ -2700,6 +2714,51 @@ mod tests {
         assert_eq!(word_boundary("hello big world", 7, false), 6);
         assert_eq!(word_boundary("hello big world", 15, false), 10);
     }
+    #[test]
+    fn arrow_keys_reset_caret_blink_phase() {
+        let mut app = app();
+        pointer_up(&mut app, [10.0, 50.0], [10.0, 50.0]);
+        insert(&mut app, "Hello");
+        app.ui.caret_blink_time = 0.0;
+        let ctx = egui::Context::default();
+
+        let has_caret = |app: &mut PhotocraftApp, ctx: &egui::Context, time: f64| -> bool {
+            let mut out = ctx.run_ui(egui::RawInput { time: Some(time), ..Default::default() }, |ui| {
+                let rect = egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(400.0, 400.0));
+                let painter = ui.ctx().layer_painter(egui::LayerId::background()).with_clip_rect(rect);
+                let xf = ViewXform { rect, zoom: 1.0, center: [100.0, 100.0], flip: false, rotation: 0.0, aspect: 1.0 };
+                draw_overlay(app, &painter, &xf);
+            });
+            out.textures_delta.clear();
+            out.shapes.iter().any(|s| matches!(&s.shape, egui::Shape::LineSegment { stroke, .. } if (stroke.width - 1.5).abs() < 1e-4))
+        };
+
+        // Before resetting, the caret is in the off phase at t = 10.5 s (10500 / 530 = 19, odd phase)
+        assert!(!has_caret(&mut app, &ctx, 10.5), "caret should be off at t = 10.5 with phase 0.0");
+
+        ctx.begin_pass(egui::RawInput {
+            time: Some(10.5),
+            events: vec![egui::Event::Key { key: egui::Key::ArrowRight, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE }],
+            ..Default::default()
+        });
+        handle_keys(&mut app, &ctx);
+        assert_eq!(app.ui.caret_blink_time, 10.5);
+
+        // draw_overlay paints the solid caret in the new phase
+        assert!(has_caret(&mut app, &ctx, 10.5), "caret should be painted right after arrow key");
+    }
+
+    #[test]
+    fn pointer_up_click_resets_caret_blink_phase() {
+        let mut app = app();
+        pointer_up(&mut app, [10.0, 50.0], [10.0, 50.0]);
+        insert(&mut app, "Hello");
+        app.ui.caret_blink_time = 0.0;
+        app.last_frame_time = 12.3;
+        pointer_up(&mut app, [10.0, 50.0], [10.0, 50.0]);
+        assert_eq!(app.ui.caret_blink_time, 12.3);
+    }
+
     #[test]
     fn double_click_from_move_tool_restores_move_tool_on_commit_and_cancel() {
         let (mut app, _) = variants();
diff --git a/crates/ui-egui/src/type_tool_tests.rs b/crates/ui-egui/src/type_tool_tests.rs
index f56829c6d1..7a23c9ccc3 100644
--- a/crates/ui-egui/src/type_tool_tests.rs
+++ b/crates/ui-egui/src/type_tool_tests.rs
@@ -1130,6 +1130,7 @@ fn temporary_type_transform_captures_press_and_rejects_collapsed_geometry() {
 #[test]
 #[ignore = "writes visual evidence to target/issue-1091; run explicitly for visual QA"]
 fn temporary_type_transform_visual_evidence() {
+    let _gpu = photocraft_testkit::gpu_lock();
     let out = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/issue-1091");
     std::fs::create_dir_all(&out).unwrap();
     for (index, theme) in crate::theme::ThemeKind::ALL.into_iter().enumerate() {
@@ -1288,6 +1289,9 @@ fn font_styles_keep_metadata_names_and_numeric_labels() {
 
 #[test]
 fn postscript_only_style_shows_actual_subfamily() {
+    // selected_style reads the engine only once the font scan is done (try_shared). Under nextest
+    // this test runs in a process of its own, where nothing else has started the scan, so start it.
+    let _ = photocraft_text::shared();
     let style = photocraft_doc::text::CharStyle { font_family: "Inter".into(), postscript_name: Some("Inter-SemiBold".into()), ..Default::default() };
     assert_eq!(super::selected_style(&style), "SemiBold");
 }
diff --git a/crates/ui-egui/src/vector_ui.rs b/crates/ui-egui/src/vector_ui.rs
index 01bb3c133b..8b5e914af2 100644
--- a/crates/ui-egui/src/vector_ui.rs
+++ b/crates/ui-egui/src/vector_ui.rs
@@ -1016,8 +1016,6 @@ pub fn draw_overlay(app: &PhotocraftApp, painter: &egui::Painter, xf: &ViewXform
         if let Some((_, p)) = targeted_vector_mask(app) {
             draw_path(&p, tool == Tool::PathSelection);
         }
-        // The segment the Pen's Auto Add/Delete would add an anchor to, or the anchor it would delete.
-        crate::anchor_tools::draw_pen_hover(app, painter, &to_scr, accent, painter.ctx().input(|i| i.modifiers));
         crate::corner_radius::draw(app, painter, &to_scr, accent);
     }
     // Pen path in progress, with handles of the last knot and a rubber band to the pointer. While
@@ -1038,9 +1036,12 @@ pub fn draw_overlay(app: &PhotocraftApp, painter: &egui::Painter, xf: &ViewXform
             pts.extend(curve_points(w[0][0], w[0][2], w[1][1], w[1][0], &to_scr));
         }
         painter.add(egui::Shape::line(pts, Stroke::new(1.5, accent)));
+        // No rubber band where a click adds or deletes an anchor of this path instead (#6140).
+        let auto = app.hover_doc.is_some_and(|h| crate::anchor_tools::pen_auto(app, tool, painter.ctx().input(|i| i.modifiers), h).is_some());
         if let (Some(last), Some(h)) = (pen.knots.last(), app.hover_doc)
             && !pen.dragging
             && pen.moving.is_none()
+            && !auto
         {
             if pen.curvature && pen.knots.len() >= 2 {
                 // The Curvature Pen previews the curve the next click makes through the pointer.
@@ -1079,6 +1080,11 @@ pub fn draw_overlay(app: &PhotocraftApp, painter: &egui::Painter, xf: &ViewXform
             painter.circle_stroke(c + vec2(11.0, 11.0), 3.5, Stroke::new(1.5, accent));
         }
     }
+    // The segment the Pen's Auto Add/Delete would add an anchor to, or the anchor it would delete,
+    // over the path being drawn. While drawing, the other paths can be hidden: it edits none of them.
+    if paths || app.ui.pen.is_some() {
+        crate::anchor_tools::draw_pen_hover(app, painter, &to_scr, accent, painter.ctx().input(|i| i.modifiers));
+    }
 }
 
 // ---------------------------------------------------------------------------------------------
diff --git a/crates/ui-egui/src/view_cmds.rs b/crates/ui-egui/src/view_cmds.rs
index 8acd676f95..1da1f918d2 100644
--- a/crates/ui-egui/src/view_cmds.rs
+++ b/crates/ui-egui/src/view_cmds.rs
@@ -459,6 +459,11 @@ pub fn handles(id: &str) -> bool {
 }
 
 pub fn is_enabled(app: &PhotocraftApp, id: &str) -> Option<bool> {
+    is_enabled_with_engine(app, id, || app.session.is_enabled(id))
+}
+
+/// Keep picker enablement testable with the engine's native filesystem check disabled.
+fn is_enabled_with_engine(app: &PhotocraftApp, id: &str, engine_enabled: impl FnOnce() -> bool) -> Option<bool> {
     if !handles(id) && !wraps(id) {
         return None;
     }
@@ -476,7 +481,10 @@ pub fn is_enabled(app: &PhotocraftApp, id: &str) -> Option<bool> {
                     || (doc && matches!(&i["window.arrange.".len()..], "floatAllInWindows" | "cascade" | "tile" | "tileAllVertically" | "tileAllHorizontally"))
             }
         },
-        i if wraps(i) => app.session.is_enabled(i),
+        // Embedded placement reads the picker's bytes on every platform. Linked placement keeps
+        // the engine's native filesystem guard because its source must remain reachable.
+        "file.placeEmbedded" => doc && app.services.file_dialog.is_some(),
+        i if wraps(i) => engine_enabled(),
         _ => true,
     })
 }
diff --git a/crates/ui-egui/src/view_cmds/tests.rs b/crates/ui-egui/src/view_cmds/tests.rs
index 2205b6e157..1abe863558 100644
--- a/crates/ui-egui/src/view_cmds/tests.rs
+++ b/crates/ui-egui/src/view_cmds/tests.rs
@@ -14,6 +14,32 @@ fn checked(app: &PhotocraftApp, id: &str) -> Option<bool> {
     menu_items(app).into_iter().find(|i| i.id == id).and_then(|i| i.checked)
 }
 
+/// #1209: the browser picker supplies bytes even when the engine cannot read native paths.
+#[test]
+fn place_embedded_enablement_does_not_require_native_doc() {
+    for has_doc in [true, false] {
+        for has_picker in [true, false] {
+            let (mut app, _) = app_with(usize::from(has_doc));
+            if has_picker {
+                app.services.file_dialog = Some(Box::new(|_, _, _| {}));
+            }
+            for native_filesystem in [false, true] {
+                let native_doc = native_filesystem && has_doc;
+                assert_eq!(
+                    is_enabled_with_engine(&app, "file.placeEmbedded", || native_doc),
+                    Some(has_doc && has_picker),
+                    "Place Embedded: doc={has_doc}, picker={has_picker}, native_doc={native_doc}"
+                );
+                assert_eq!(
+                    is_enabled_with_engine(&app, "file.placeLinked", || native_doc),
+                    Some(native_doc),
+                    "Place Linked must retain the engine's native_doc guard"
+                );
+            }
+        }
+    }
+}
+
 #[test]
 fn show_snap_extras_and_screen_modes_are_state() {
     let (mut app, ctx) = app_with(1);
diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index 6e841292e7..533f1ee052 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -1,4 +1,4 @@
-//! Custom widgets for the Photocraft look: cards with pill tabs, thin sliders with round knobs,
+//! Custom widgets for the PhotoCraft look: cards with pill tabs, thin sliders with round knobs,
 //! monospace value fields with dimmed units, toggle switches, primary/secondary buttons.
 
 use egui::{Align2, Color32, CornerRadius, Pos2, Rect, Response, Sense, Stroke, StrokeKind, Ui, Vec2, pos2, vec2};
@@ -793,6 +793,8 @@ pub fn focus_first_field(ctx: &egui::Context, on: bool) {
     });
 }
 
+const NUMERIC_INPUT_LIMIT: usize = 128;
+
 /// The number in a [`value_field`]. A typed number applies as it's typed; arithmetic waits for
 /// Enter, Tab or click-away, because per keystroke `5/2` would land first and a caller that
 /// rounds it would cut `5/2*2` short. `changed()` means a new value, not just a keystroke.
@@ -814,6 +816,25 @@ fn number_edit(
     if ui.is_enabled() {
         crate::field_tab::register(&ctx, id);
     }
+    // Use DragValue's focus check before it builds its TextEdit: oversized events must never
+    // reach text layout. Registering interest also handles focus arriving by Tab this frame.
+    let editing = ui.is_enabled()
+        && ui.memory_mut(|m| {
+            m.interested_in_focus(id, ui.layer_id());
+            m.has_focus(id)
+        });
+    if editing {
+        ui.input_mut(|input| {
+            input.events.retain(|event| {
+                let text = match event {
+                    egui::Event::Text(text) | egui::Event::Paste(text) | egui::Event::Ime(egui::ImeEvent::Commit(text)) => text,
+                    egui::Event::Ime(egui::ImeEvent::Preedit { text, .. }) => text,
+                    _ => return true,
+                };
+                text.chars().nth(NUMERIC_INPUT_LIMIT).is_none()
+            });
+        });
+    }
     let held = id.with("arithmetic");
     let math = ui.memory(|m| m.has_focus(id)) && ui.data(|d| d.get_temp(held)).unwrap_or(false);
     ui.data_mut(|d| d.insert_temp(held, math));
@@ -837,6 +858,10 @@ fn number_edit(
             .update_while_editing(!math)
             // Focus is read when parsing, not above: Tab hands it on inside `ui.add`.
             .custom_parser(move |s| {
+                // Short events can accumulate: reject before either parser normalizes the text.
+                if s.chars().nth(NUMERIC_INPUT_LIMIT).is_some() {
+                    return None;
+                }
                 let v = parse_num_in(s, units);
                 if ctx.memory(|m| m.has_focus(id)) && plain(s).is_none() {
                     // Still typing arithmetic: hold it, and stop applying keystrokes once it parses.
@@ -1193,16 +1218,24 @@ pub struct DialogButton<'a> {
     pub label: &'a str,
     pub min_width: f32,
     pub enabled: bool,
+    /// Take keyboard focus this frame (see [`DialogButton::focus`]).
+    pub focus: bool,
 }
 
 impl<'a> DialogButton<'a> {
     pub fn new(role: ButtonRole, label: &'a str, min_width: f32) -> Self {
-        Self { role, label, min_width, enabled: true }
+        Self { role, label, min_width, enabled: true, focus: false }
     }
 
     pub fn enabled(self, enabled: bool) -> Self {
         Self { enabled, ..self }
     }
+
+    /// Asks for keyboard focus for this button: from there the arrow keys move between the row's
+    /// buttons and Enter or Space presses the focused one.
+    pub fn focus(self, focus: bool) -> Self {
+        Self { focus, ..self }
+    }
 }
 
 /// A dialog's button row at the cursor, in the platform's order (see [`ButtonRole`]): every modal
@@ -1225,6 +1258,9 @@ pub fn dialog_buttons(ui: &mut Ui, buttons: &[DialogButton]) -> Option<ButtonRol
                         if b.role == ButtonRole::Default { primary_button(ui, b.label, b.min_width) } else { secondary_button(ui, b.label, b.min_width) }
                     })
                     .inner;
+                if b.focus && b.enabled {
+                    r.request_focus();
+                }
                 if r.clicked() {
                     hit = Some(b.role);
                 }
@@ -1934,6 +1970,7 @@ mod tests {
     /// `%`'s, so the number lines up with the box and its unit (#5150).
     #[test]
     fn value_field_digits_ink_is_centred_and_level_with_the_unit() {
+        let _gpu = photocraft_testkit::gpu_lock();
         let scale = 4.0;
         for kind in [crate::theme::ThemeKind::Pro, crate::theme::ThemeKind::Studio] {
             let mut h = Harness::builder().with_size(egui::vec2(100.0, 40.0)).with_pixels_per_point(scale).wgpu().build_ui_state(
@@ -2642,3 +2679,7 @@ mod screen_color_tests {
         }
     }
 }
+
+#[cfg(test)]
+#[path = "widgets/numeric_input_tests.rs"]
+mod numeric_input_tests;
diff --git a/crates/ui-egui/src/widgets/numeric_input_tests.rs b/crates/ui-egui/src/widgets/numeric_input_tests.rs
new file mode 100644
index 0000000000..41eff2ed4c
--- /dev/null
+++ b/crates/ui-egui/src/widgets/numeric_input_tests.rs
@@ -0,0 +1,195 @@
+//! Reject oversized numeric events before layout while preserving DragValue behavior.
+
+use egui::{Event, ImeEvent, Key, Modifiers, accesskit::Role};
+use egui_kittest::{Harness, kittest::Queryable};
+
+const LIMIT: usize = super::NUMERIC_INPUT_LIMIT;
+type Fields = (f32, String);
+
+fn fields() -> Harness<'static, Fields> {
+    let mut h = Harness::builder().with_size(egui::vec2(400.0, 180.0)).build_ui_state(
+        |ui, (number, text): &mut Fields| {
+            super::value_field(ui, number, 0.01..=12800.0, "%", 90.0);
+            ui.add(egui::TextEdit::multiline(text).hint_text("Document text"));
+        },
+        (100.0, String::new()),
+    );
+    h.run();
+    h
+}
+
+fn focused() -> Harness<'static, Fields> {
+    let mut h = fields();
+    h.get_by_role(Role::SpinButton).click();
+    h.run();
+    h
+}
+
+fn numeric_text(h: &Harness<'_, Fields>) -> String {
+    h.query_by_role(Role::TextInput).or_else(|| h.query_by_role(Role::SpinButton)).expect("numeric editor").value().expect("numeric text")
+}
+
+fn select_all(h: &mut Harness<'_, Fields>) {
+    h.key_press_modifiers(Modifiers::COMMAND, Key::A);
+    h.run();
+}
+
+fn assert_bounded(h: &Harness<'_, Fields>) {
+    fn longest(shape: &egui::Shape) -> usize {
+        match shape {
+            egui::Shape::Text(text) => text.galley.job.text.chars().count(),
+            egui::Shape::Vec(shapes) => shapes.iter().map(longest).max().unwrap_or(0),
+            _ => 0,
+        }
+    }
+    let drawn = h.output().shapes.iter().map(|shape| longest(&shape.shape)).max().unwrap_or(0);
+    assert!(drawn <= LIMIT, "numeric input laid out {drawn} characters; expected at most {LIMIT}");
+    let retained = numeric_text(h).chars().count();
+    assert!(retained <= LIMIT, "numeric editor retained {retained} characters; expected at most {LIMIT}");
+}
+
+#[test]
+fn oversized_numeric_text_paste_and_ime_are_bounded_before_layout() {
+    for (index, event) in [
+        Event::Text("9".repeat(16 * 1024)),
+        Event::Paste("x".repeat(16 * 1024)),
+        Event::Ime(ImeEvent::Preedit { text: "é".repeat(8 * 1024), active_range_chars: None }),
+        Event::Ime(ImeEvent::Commit("é".repeat(8 * 1024))),
+    ]
+    .into_iter()
+    .enumerate()
+    {
+        let mut h = focused();
+        select_all(&mut h);
+        if matches!(&event, Event::Ime(_)) {
+            // egui 0.36 assigns IME events to the focused widget; Enabled is deprecated and
+            // ignored. Prove both live composition and commitment reach this field first.
+            h.event(Event::Ime(ImeEvent::Preedit { text: "に".into(), active_range_chars: Some(0..1) }));
+            h.run();
+            assert_eq!(numeric_text(&h), "に", "short IME composition reaches the numeric editor");
+            h.event(Event::Ime(ImeEvent::Commit("é".into())));
+            h.run();
+            assert_eq!(numeric_text(&h), "é", "IME commit replaces its composition");
+            select_all(&mut h);
+        }
+        h.event(event);
+        h.run();
+        if let Some(dir) = std::env::var_os("CRAFT_NUMERIC_INPUT_FIXTURES") {
+            let dir = std::path::PathBuf::from(dir);
+            std::fs::create_dir_all(&dir).expect("create numeric fixture directory");
+            h.render().expect("render numeric fixture").save(dir.join(format!("event-{index}.png"))).expect("save numeric fixture");
+        }
+        assert_bounded(&h);
+        assert_eq!(h.state().0, 100.0, "invalid input leaves the numeric value unchanged");
+        h.run();
+        assert_bounded(&h);
+    }
+}
+
+#[test]
+fn numeric_replacement_clear_and_undo_preserve_unicode_input() {
+    let mut h = focused();
+    select_all(&mut h);
+    for _ in 0..4 {
+        h.event(Event::Text("é".repeat(16)));
+        h.run();
+        assert_bounded(&h);
+    }
+    let retained = numeric_text(&h);
+    assert!(!retained.is_empty(), "ordinary short inputs still enter the editor");
+    // Let egui's text undoer store the stable text before clearing it.
+    h.input_mut().time = Some(h.ctx.input(|i| i.time) + 2.0);
+    h.run();
+    select_all(&mut h);
+    h.key_press(Key::Backspace);
+    h.run();
+    assert_eq!(numeric_text(&h), "");
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run();
+    assert_eq!(numeric_text(&h), retained, "undo restores only the bounded input");
+    assert_bounded(&h);
+    select_all(&mut h);
+    h.event(Event::Text("−4+6.5".into()));
+    h.run();
+    assert_eq!(numeric_text(&h), "−4+6.5", "replacement accepts Unicode arithmetic");
+    h.key_press(Key::Enter);
+    h.run();
+    assert_eq!(h.state().0, 2.5);
+}
+
+#[test]
+fn numeric_input_limit_does_not_truncate_document_text() {
+    for switch_from_numeric in [false, true] {
+        let mut h = if switch_from_numeric { focused() } else { fields() };
+        let text = "é".repeat(8 * 1024);
+        h.get_by_role(Role::MultilineTextInput).click();
+        h.run();
+        h.event(Event::Paste(text.clone()));
+        h.run();
+        assert_eq!(h.state().1, text, "document paste preserved when switching from numeric: {switch_from_numeric}");
+        assert_eq!(h.get_by_role(Role::MultilineTextInput).value().as_deref(), Some(text.as_str()));
+        assert_eq!(h.state().0, 100.0);
+    }
+}
+
+#[test]
+fn numeric_event_limit_counts_unicode_characters_and_rejects_without_truncating() {
+    let mut h = focused();
+    select_all(&mut h);
+    let boundary = "é".repeat(LIMIT);
+    h.event(Event::Paste(boundary.clone()));
+    h.run();
+    assert_eq!(numeric_text(&h), boundary);
+    select_all(&mut h);
+    h.event(Event::Text("9".repeat(LIMIT + 1)));
+    h.run();
+    assert_eq!(numeric_text(&h), boundary, "oversized input leaves the selection intact");
+    h.event(Event::Text("42".into()));
+    h.run();
+    assert_eq!(h.state().0, 42.0);
+}
+
+#[test]
+fn numeric_parser_rejects_oversized_accumulated_text_before_normalizing() {
+    let mut h = focused();
+    select_all(&mut h);
+    // Each event is under the cap, but the resulting input is too long. Normalizing first
+    // would hide all the spaces and apply 2. DragValue still owns its editable text.
+    h.event(Event::Text(" ".repeat(LIMIT / 2)));
+    h.run();
+    h.event(Event::Text(format!("{}2", " ".repeat(LIMIT / 2))));
+    h.run();
+    assert_eq!(numeric_text(&h).chars().count(), LIMIT + 1);
+    assert_eq!(h.state().0, 100.0, "oversized plain input must not apply live");
+    h.key_press(Key::Enter);
+    h.run();
+    assert_eq!(h.state().0, 100.0, "oversized input must not apply on commit");
+}
+
+#[test]
+fn tab_and_paste_in_one_frame_filter_only_the_receiving_numeric_field() {
+    let mut h = focused();
+    let text = "x".repeat(16 * 1024);
+    h.key_press(Key::Tab);
+    h.event(Event::Paste(text.clone()));
+    h.run();
+    assert_eq!(h.state().1, text, "Tab to document text preserves the paste");
+    // Put the numeric field after a text field to exercise incoming forward Tab too.
+    // egui deliberately delays backwards traversal until the next frame.
+    let mut h = Harness::builder().with_size(egui::vec2(400.0, 180.0)).build_ui_state(
+        |ui, (number, text): &mut Fields| {
+            ui.add(egui::TextEdit::multiline(text).hint_text("Document text"));
+            super::value_field(ui, number, 0.01..=12800.0, "%", 90.0);
+        },
+        (100.0, String::new()),
+    );
+    h.run();
+    h.get_by_role(Role::MultilineTextInput).click();
+    h.run();
+    h.key_press(Key::Tab);
+    h.event(Event::Paste("9".repeat(16 * 1024)));
+    h.run();
+    assert_eq!(h.state().0, 100.0);
+    assert!(h.state().1.is_empty());
+    assert_bounded(&h);
+}
diff --git a/crates/ui-egui/tests/arbitrary_rotation_preview.rs b/crates/ui-egui/tests/arbitrary_rotation_preview.rs
index a3549e495c..388c941f16 100644
--- a/crates/ui-egui/tests/arbitrary_rotation_preview.rs
+++ b/crates/ui-egui/tests/arbitrary_rotation_preview.rs
@@ -11,14 +11,19 @@ type Harness = egui_kittest::Harness<'static, PhotocraftApp>;
 
 fn harness() -> Option<Harness> {
     let built = std::panic::catch_unwind(|| {
-        egui_kittest::Harness::builder().with_size(egui::vec2(1280.0, 800.0)).with_pixels_per_point(1.0).with_max_steps(64).wgpu().build_eframe(|cc| {
-            PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
-            let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
-            if let Some(rs) = cc.wgpu_render_state.as_ref() {
-                app.set_wgpu(rs.clone());
-            }
-            app
-        })
+        egui_kittest::Harness::builder()
+            .with_size(egui::vec2(1280.0, 800.0))
+            .with_pixels_per_point(1.0)
+            .with_max_steps(64)
+            .wgpu_setup(photocraft_ui_egui::gpu_canvas::wgpu_setup())
+            .build_eframe(|cc| {
+                PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
+                let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+                if let Some(rs) = cc.wgpu_render_state.as_ref() {
+                    app.set_wgpu(rs.clone());
+                }
+                app
+            })
     });
     match built {
         Ok(h) => Some(h),
diff --git a/crates/ui-egui/tests/canvas_16f.rs b/crates/ui-egui/tests/canvas_16f.rs
index 068de36c49..ff97cff680 100644
--- a/crates/ui-egui/tests/canvas_16f.rs
+++ b/crates/ui-egui/tests/canvas_16f.rs
@@ -181,16 +181,21 @@ fn screen(doc: Document, setup: &[(&str, serde_json::Value)], name: &str) -> Opt
     let ok2 = ok.clone();
     let setup: Vec<(String, serde_json::Value)> = setup.iter().map(|(a, b)| (a.to_string(), b.clone())).collect();
     let built = std::panic::catch_unwind(std::panic::AssertUnwindSafe(move || {
-        egui_kittest::Harness::builder().with_size(egui::vec2(1000.0, 700.0)).with_pixels_per_point(1.0).with_max_steps(64).wgpu().build_eframe(move |cc| {
-            PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
-            let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
-            if let Some(rs) = cc.wgpu_render_state.as_ref() {
-                ok2.store(gpu_canvas::supports_f16_canvas(&rs.adapter) && std::env::var("PHOTOCRAFT_CANVAS_F16").as_deref() != Ok("0"), Ordering::SeqCst);
-                app.set_wgpu(rs.clone());
-            }
-            app.session.open_document(doc, None);
-            app
-        })
+        egui_kittest::Harness::builder()
+            .with_size(egui::vec2(1000.0, 700.0))
+            .with_pixels_per_point(1.0)
+            .with_max_steps(64)
+            .wgpu_setup(gpu_canvas::wgpu_setup())
+            .build_eframe(move |cc| {
+                PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
+                let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+                if let Some(rs) = cc.wgpu_render_state.as_ref() {
+                    ok2.store(gpu_canvas::supports_f16_canvas(&rs.adapter) && std::env::var("PHOTOCRAFT_CANVAS_F16").as_deref() != Ok("0"), Ordering::SeqCst);
+                    app.set_wgpu(rs.clone());
+                }
+                app.session.open_document(doc, None);
+                app
+            })
     }));
     let Ok(mut harness) = built else {
         eprintln!("skipping: no GPU adapter");
@@ -259,3 +264,24 @@ fn thirty_two_bit_preview_exposes_values_above_one() {
     eprintln!("shown {got}, want {want:.1} (clipped would be {clipped:.1})");
     assert!((got - want).abs() <= 3.0, "shown {got}, want {want:.1} (clipped {clipped:.1})");
 }
+
+/// A 16-bit canvas whose float textures don't fit the canvas budget (a small graphics card,
+/// #4536) stays on the GPU as `Rgba8Unorm` instead of falling back to the CPU canvas.
+#[test]
+fn sixteen_bit_canvas_too_big_for_floats_stays_on_the_gpu_in_8_bit() {
+    let _gpu = gpu_lock();
+    let Some((g, _rs)) = canvas() else { return };
+    let doc = gradient(SampleType::U16, 512, 256, 0.0, 1.0);
+    let size = [512, 256];
+    let floats = gpu_canvas::canvas_texture_bytes(size, gpu_canvas::DEFAULT_TILE, 8);
+    assert_eq!(g.format_for(SampleType::U16, size), TextureFormat::Rgba16Float, "fits by default");
+    // Room for the 8-bit set, not the float one.
+    g.set_canvas_budget(floats - 1);
+    assert_eq!(g.format_for(SampleType::U16, size), TextureFormat::Rgba8Unorm);
+    assert!(g.fits_canvas(&doc));
+    assert_ne!(g.refresh(doc.id.0, &doc, None, None).kind, gpu_canvas::REFRESH_OVER_BUDGET);
+    assert_eq!(g.texture_info(doc.id.0).map(|(f, _)| f), Some(TextureFormat::Rgba8Unorm));
+    g.set_canvas_budget(floats);
+    assert_eq!(g.format_for(SampleType::U16, size), TextureFormat::Rgba16Float);
+    g.release();
+}
diff --git a/crates/ui-egui/tests/full_res_preview.rs b/crates/ui-egui/tests/full_res_preview.rs
index 191a071b9d..f472dd2ad3 100644
--- a/crates/ui-egui/tests/full_res_preview.rs
+++ b/crates/ui-egui/tests/full_res_preview.rs
@@ -145,21 +145,30 @@ fn adjustment_layer_drag_previews_at_full_resolution_when_low_res_is_off() {
     assert!((full - committed).abs() < 8.0, "low-res previews off: the drag matches the committed view ({full} vs {committed})");
 }
 
+/// A filter dialog's live preview is never coarser than the screen either (#6326): at 100 % every
+/// column shows with low-resolution previews on; zoomed out to 50 % the default preview runs on
+/// the reduced copy (only the black columns), and with them off it matches the committed view.
 #[test]
 fn filter_dialog_previews_at_full_resolution_when_low_res_is_off() {
     let _gpu = photocraft_testkit::gpu_lock();
     let Some(mut h) = harness() else { return };
-    setup(&mut h, 1.0);
+    setup(&mut h, 0.5);
     if !on_gpu(&mut h) {
         return;
     }
+    let committed = mean(&row(&mut h));
+    assert!(committed > 60.0, "zoomed out the columns average to grey ({committed})");
+    control(&mut h, "ui.set", json!({"zoom": 1.0, "center": [W / 2, H / 2]}));
     // Offset 0, 0 leaves the pixels as they are: any change is the preview's resolution.
     photocraft_ui_egui::filter_dialog::open(h.state_mut(), "filter.other.offset").expect("Offset dialog");
-    let reduced = row(&mut h);
-    assert!(columns(&reduced) < 0.1, "default: the reduced copy loses the columns ({})", columns(&reduced));
+    let at_100 = row(&mut h);
+    assert!(columns(&at_100) > 0.9, "default at 100 %: the preview is never coarser than the screen ({})", columns(&at_100));
+    control(&mut h, "ui.set", json!({"zoom": 0.5, "center": [W / 2, H / 2]}));
+    let reduced = mean(&row(&mut h));
+    assert!(reduced < 30.0, "default at 50 %: the reduced copy keeps only the black columns ({reduced})");
     low_res(&mut h, false);
-    let full = row(&mut h);
-    assert!(columns(&full) > 0.9, "low-res previews off: every column shows ({})", columns(&full));
+    let full = mean(&row(&mut h));
+    assert!((full - committed).abs() < 8.0, "low-res previews off: the preview matches the committed view ({full} vs {committed})");
 }
 
 #[test]
diff --git a/docs/control-protocol.md b/docs/control-protocol.md
index 8536507104..15334ac3a2 100644
--- a/docs/control-protocol.md
+++ b/docs/control-protocol.md
@@ -53,6 +53,7 @@ The transport is `apps/photocraft/src/control_server.rs`, and the handlers are i
 - `ui.set` also accepts `gradientBlendMode` (a layer blend mode name, such as `Difference`) and `gradientClassic` (boolean) for the Gradient tool options bar.
 - `ui.set` also accepts `camTransformOnDrop` (boolean), the Content-Aware Move tool's Transform On Drop checkbox: a drop then puts a scale/rotate box on the patch (`ui.inspect` › `camTransform`: its document/revision, drag `offset` and `frame`), driven with `ui.pointer` (handles as Free Transform's; outside the box rotates), committed with `ui.key Enter` (one `paint.contentAwareMove` with `scaleX`, `scaleY`, `rotate`) or dropped with `Escape`.
 - `ui.set` also accepts `tileGrid` (boolean), a developer overlay of the active layer's storage tiles: the tile grid over the document, every stored tile filled and labelled `tx,ty`, tiles with identical pixels in a shared colour and unique ones in blue. It has no menu item and View › Extras doesn't hide it. `ui.inspect` reports it as `view.tile_grid`.
+- `ui.set` also accepts `strokeTrace` (`true`, `false`, `"stderr"` or `"off"`): turn the stroke latency trace on or off at runtime; each stroke's summary is in `ui.inspect` `perf.strokeTrace`. A CSV file of every frame is set only at launch (`PHOTOCRAFT_STROKE_TRACE=<file.csv>` / `--stroke-trace <file.csv>`): the control channel doesn't write files outside the automation write root
 - `ui.set` also accepts `layerFilter` (#5048), the Layers panel filter row: `{by?, kinds?, name?, mode?}`, any subset. `by` is `kind`, `name` or `mode` (the filter-type dropdown); `kinds` lists the Kind toggles that are on (`pixel`, `adjustment`, `type`, `shape`, `smart`); `name` matches part of a layer name, ignoring case; `mode` is a blend mode name (`Multiply`, `Pass Through`). Kind and Name filter only once a kind is on or text is typed; Mode always filters, by Normal at first, as in Photoshop. Fields left out keep their value; a bad one is an error and changes nothing.
 - Each painting tool keeps its own brush, as in Photoshop: `tools.setBrush` and `ui.set {brushSize}` change the active tool's brush, and switching tools swaps in that tool's own (size, hardness, mode, opacity, flow, dynamics, smoothing). A tool used for the first time starts from the brush in hand. The colours, the erase flag and the stroke seed stay shared. So `ui.set {tool: "eraser", brushSize: 12}` sets the Eraser's size, and `ui.set {tool: "brush"}` afterwards brings the Brush's own size back.
 - `ui.set` also accepts the Eyedropper options bar (#1649): `eyedropperSampleSize` (`"point"` or 1, 3, 5, 11, 31, 51, 101: the side of the averaged square, shared by the Eyedropper, a painting tool's Alt-click eyedropper, the Curves/Color Picker eyedroppers and the Info panel), `eyedropperSample` (`current`, `currentAndBelow`, `all`, `allNoAdjustments`, `currentAndBelowNoAdjustments`) and `eyedropperRing` (boolean, Show Sampling Ring). `ui.inspect` reports them under `toolOptions` (`eyedropper_size`, `eyedropper_sample`, `eyedropper_ring`). The engine command `document.sampleColor {x, y, size, sampleLayer}` returns the colour such a sample picks.
@@ -227,7 +228,7 @@ the same commands work in the app, the CLI and headless MCP. Paths are dotted ca
 | `prefs.set` | `{"path":"cursors.painting","value":"precise"}` or `{"values":{"unitsAndRulers.rulers":"cm","guidesGridAndSlices.gridColor":"#ff8800"}}`. Values are validated (choices, ranges, `#rrggbb` colours, shortcut syntax); a batch applies all or nothing. A section path takes an object and merges it key by key |
 | `prefs.reset` | `{"path":"performance"}` (a section or key); no path resets everything. An individual `shortcuts.<id>` or `menus.colors.<id>` reset removes the override and returns `null`, including when it is already absent |
 | `edit.preferences.<section>` | the section's values; in the app (no params) it opens the Preferences dialog on that section |
-| `edit.keyboardShortcuts` | `{"set":{"edit.fill":"Cmd+Shift+F"},"reset":true\|["id",…],"removeConflicts":true,"filter":"blur","list":false,"importKys":"<.kys XML>"}`: returns overrides, matching commands and conflicts. A shortcut moved to another command is removed from its old owner unless `removeConflicts` is false. `""` removes a shortcut, `null` restores the default. The held temporary tools are bindable too: `tools.temporary.hand` (Space; also repositions a selection being drawn), `tools.temporary.zoomIn` (Cmd+Space), `tools.temporary.zoomOut` (Alt+Space; Alt added to a held Zoom In, Cmd+Alt+Space, zooms out too), `tools.temporary.erase` (`` ` ``; with the Brush or Pencil, a stroke started while it is held is in Clear mode, `paint.stroke`/`paint.pencil` `"mode": "clear"`, erasing with that tool's brush); they list with `"hold": true`. ⌘ (Ctrl off the Mac) held alone is the Move tool with the painting, retouching and other non-selection tools, as in Photoshop; it is a modifier, not a binding. `importKys` applies a Photoshop `.kys` set (the file's XML text, at most 4 MiB): rows are matched to commands by our id (`pc-id`, in sets PhotoCraft exported) or else by menu label, a key equal to the default restores it, keys also given in `set` win, and the result gains `import` (`name`, `imported`, `set`, `unknown`, `unreadable`, `alternates`, `toolKeys`, `windows`). A set saved by Photoshop on Windows (no ⌘ or Opt anywhere, Ctrl used) reads Ctrl as the primary modifier, so `Ctrl+L` is the `Cmd+L` default (`windows: true`). Tool keys are matched to tools by name in the app's dialog import (a tool's own letter keeps its Shift cycling); this command doesn't know the tools and leaves them. In the app it opens Keyboard Shortcuts and Menus, whose Import Shortcuts… button loads a `.kys` set into the dialog (opening or dropping a `.kys`, or Photoshop's live `Keyboard Shortcuts.psp`, does the same). On a desktop with Photoshop installed, the first launch that has no shortcut overrides yet asks whether to import the newest install's live set (Import / Don't Import; `ui.inspect` shows it as `kysOffer`); the answer is recorded in the preferences as `dialogs.photoshopShortcuts`, so it is asked once. **Sets** (Edit › Keyboard Shortcuts › Set): `useSet` loads a saved set's bindings (`""` or `"PhotoCraft Defaults"`: the defaults) before the call's other changes; then `saveSet` saves the bindings as they end up under a name and uses it, `deleteSet` removes one (the bindings stay), `sets` replaces every saved set (`{"<name>": {"shortcuts": {…}, "alternateShortcuts": {…}}}`, the dialog's OK) and `activeSet` names the set in use without loading it. Names are trimmed, 1–64 characters, at most 64 sets. Every reply has `sets`, `activeSet` (`""` for the defaults), `defaultsName` and `modified` (the bindings differ from the set in use). `exportKys: true` adds `kys`, the bindings of the engine's commands as a `.kys` file (Photoshop's macOS key spelling; each row carries our id as `pc-id`, so the file imports back exactly); `summarize: true` (or `{"mac": false}`) adds `html`, Photoshop's Summarize page. The app's dialog exports and summarizes the shell's commands and tools as well. A bad parameter anywhere in the call changes nothing |
+| `edit.keyboardShortcuts` | `{"set":{"edit.fill":"Cmd+Shift+F"},"reset":true\|["id",…],"removeConflicts":true,"filter":"blur","list":false,"importKys":"<.kys XML>"}`: returns overrides, matching commands and conflicts. A shortcut moved to another command is removed from its old owner unless `removeConflicts` is false. `""` removes a shortcut, `null` restores the default. The held temporary tools are bindable too: `tools.temporary.hand` (Space; also repositions a selection being drawn), `tools.temporary.zoomIn` (Cmd+Space), `tools.temporary.zoomOut` (Alt+Space; Alt added to a held Zoom In, Cmd+Alt+Space, zooms out too), `tools.temporary.erase` (`` ` ``; with the Brush or Pencil, a stroke started while it is held is in Clear mode, `paint.stroke`/`paint.pencil` `"mode": "clear"`, erasing with that tool's brush); they list with `"hold": true`. ⌘ (Ctrl off the Mac) held alone is the Move tool with the painting, retouching and other non-selection tools, as in Photoshop; it is a modifier, not a binding. `importKys` applies a Photoshop `.kys` set (the file's XML text, at most 4 MiB): rows are matched to commands by our id (`pc-id`, in sets PhotoCraft exported) or else by menu label, a key equal to the default restores it, keys also given in `set` win, and the result gains `import` (`name`, `imported`, `set`, `unknown`, `unreadable`, `alternates`, `toolKeys`, `windows`). A set saved by Photoshop on Windows (no ⌘ or Opt anywhere, Ctrl used) reads Ctrl as the primary modifier, so `Ctrl+L` is the `Cmd+L` default (`windows: true`). Tool keys are matched to tools by `pc-id` or name (a tool's own letter keeps its Shift cycling); `import.tools` lists the keys given. In the app it opens Keyboard Shortcuts and Menus, whose Import Shortcuts… button loads a `.kys` set into the dialog (opening or dropping a `.kys`, or Photoshop's live `Keyboard Shortcuts.psp`, does the same). On a desktop with Photoshop installed, the first launch that has no shortcut overrides yet asks whether to import the newest install's live set (Import / Don't Import; `ui.inspect` shows it as `kysOffer`); the answer is recorded in the preferences as `dialogs.photoshopShortcuts`, so it is asked once. **Sets** (Edit › Keyboard Shortcuts › Set): `useSet` loads a saved set's bindings (`""` or `"PhotoCraft Defaults"`: the defaults) before the call's other changes; then `saveSet` saves the bindings as they end up under a name and uses it, `deleteSet` removes one (the bindings stay), `sets` replaces every saved set (`{"<name>": {"shortcuts": {…}, "alternateShortcuts": {…}}}`, the dialog's OK) and `activeSet` names the set in use without loading it. Names are trimmed, 1–64 characters, at most 64 sets. Every reply has `sets`, `activeSet` (`""` for the defaults), `defaultsName` and `modified` (the bindings differ from the set in use). `exportKys: true` adds `kys`, the bindings of every bindable command and tool as a `.kys` file (Photoshop's macOS key spelling; each row carries our id as `pc-id`, so the file imports back exactly); `summarize: true` (or `{"mac": false}`) adds `html`, Photoshop's Summarize page. A bad parameter anywhere in the call, an export path that can't be written included, changes nothing. **Headless parity:** the shell's commands (View › Zoom In, the panels; `photocraft_engine::shell_commands::SHELL_COMMANDS`) and the tools (`tools.select.<tool>`, listed with `"tool": true`) are bindable, listed, imported, exported and checked for conflicts without the UI; tools may share a key (they cycle with Shift, so a shared letter is no conflict), while a command given a tool's key takes it from the tools. Keys the system takes first (Alt+Tab, Alt+F4, Ctrl+Alt+Delete everywhere but the Mac, plus Ctrl+Esc and Ctrl+Shift+Esc on Windows and Ctrl+Alt+F1–F12 on Linux; ⌘Tab, ⌘`, ⌘⌥Esc on the Mac) are refused, and left out of an imported set (`import.reserved`). Files: `importKys: {"path": …}` reads a `.kys`, `exportKys: {"path": …}` and `summarize: {"path": …}` write the file (the reply has `kysPath` / `htmlPath`); automation (MCP) refuses these paths, as it does `actions.save`'s |
 | `edit.menus` / `edit.toolbar` | `{"hide":["edit.fade"],"show":[…],"color":{"edit.fill":"red"},"reset":false}` / `{"hidden":["Sponge"],"order":[…]}` |
 | `edit.colorSettings` | `{"workingRgb":"display-p3","workingCmyk":"coated-cmyk","workingGray":"sgray","policyRgb":"preserve\|convert\|off",…,"askOnMismatch":true,"intent":"perceptual","bpc":true}`; honoured when opening files (`file.openAs`, the app's File › Open) and by Image › Mode and "working" profile specs. `color.profileMismatch {"action":"preserve\|convert\|discard\|assignWorking"}` answers the mismatch prompt |
 
@@ -245,7 +246,9 @@ log text file. GPU on/off and the GPU tile size apply at the next launch.
 The desktop app stores them in `preferences.json` in the platform config directory (macOS
 `~/Library/Application Support/Photocraft`, Windows `%APPDATA%\Photocraft`, Linux
 `$XDG_CONFIG_HOME/photocraft`; override with `PHOTOCRAFT_CONFIG_DIR`); autosaves go to its
-`Recovery` folder, and the window size and position, the dock width and floating-panel geometry
+`Recovery` folder (on Windows to `%LOCALAPPDATA%\Photocraft\Recovery`, out of the roaming
+profile; autosaves left by earlier versions move there at startup), and the window size and
+position, the dock width and floating-panel geometry
 to `ui.ron` beside it (a file holding values that would crash startup is discarded). In portable mode (a `portable.txt` or `PhotoCraft.portable` file beside the
 executable, as in the Windows portable zip) that directory is `PhotoCraftData` next to the
 executable instead. The web build keeps them in `localStorage`. A save writes only the values
diff --git a/docs/development.md b/docs/development.md
index ceb679f5f7..6891e88a9c 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -44,7 +44,7 @@ cargo xtask stats                                          # tests and lines per
 cargo xtask parity                                         # Photoshop menu coverage -> docs/parity-checklist.md
 ```
 
-Image code is slow at `opt-level 0`, so the workspace profile builds dependencies at `opt-level 2`. Use `--release` for anything interactive.
+Image code is slow at `opt-level 0`, so the workspace profile builds dependencies at `opt-level 2`. Use `--release` for anything interactive. Test builds compile ui-egui itself at `opt-level 0` (`[profile.test.package.photocraft-ui-egui]` in `Cargo.toml`): it was one of the biggest test-build units, and its tests run no heavy pixel code of their own.
 
 The dev profile builds with `debug = "line-tables-only"`: panic backtraces keep file and line, and test binaries link about twice as fast. To inspect local variables in a debugger, build with `CARGO_PROFILE_DEV_DEBUG=true`.
 
@@ -59,7 +59,7 @@ cargo nextest run --workspace              # parallel across binaries (cargo ins
 cargo test --doc --workspace               # nextest does not run doctests
 ```
 
-[cargo-nextest](https://nexte.st) runs each test in its own process. `.config/nextest.toml` puts the GPU tests (`photocraft-gpu`, and ui-egui's integration and canvas/GPU tests) in a group of at most 4 at a time, because each process opens its own wgpu device and the in-process `gpu_lock()` no longer serializes them. On a 32-thread Windows machine the full workspace went from 297 s (`cargo test`) to about 120 s (#2204). Ignored tests run with `cargo nextest run --run-ignored only`. CI still runs `cargo test`, and a full `cargo test` stays the final check before a PR.
+[cargo-nextest](https://nexte.st) runs each test in its own process. `.config/nextest.toml` puts the GPU tests (`photocraft-gpu`, and ui-egui's integration and canvas/GPU tests) in a group of at most 4 at a time, because each process opens its own wgpu device and the in-process `gpu_lock()` no longer serializes them. On a 32-thread Windows machine the full workspace went from 297 s (`cargo test`) to about 120 s (#2204). Ignored tests run with `cargo nextest run --run-ignored only`. CI runs it with `--profile ci` (fail-fast, a 10-minute hang timeout), plus `cargo test --doc` for the doctests (#6117); a full `cargo test` stays the final check before a PR.
 
 ## Fonts (craft-fonts)
 
@@ -78,7 +78,11 @@ CRAFT_FONTS_DIR="$PWD/../craft-fonts" cargo test --workspace     # runs the Japa
 - **UI:** the Japanese fonts (BIZ UDPGothic Regular first) are the first Japanese fallback in the lazy CJK loader (`crates/ui-egui/src/cjk_fonts.rs`), ahead of the system Japanese fonts and in the same locale script order, appended last to every egui family with the usual baseline alignment.
 - **Type tool:** the text engine registers them in `FontDb::new` (so also with no system fonts) and puts them first in the Japanese slot of the locale-ordered fallback list: BIZ UDPGothic for sans runs, Shippori Mincho / BIZ UDMincho for serif runs.
 - **Web:** the wasm32 build never embeds craft-fonts, even with `CRAFT_FONTS_DIR` set: measured on 2026-10-06, the UI face alone took the release wasm from 24.19 MB to 28.87 MB, over the 24 MiB gate in `packaging/web/package.sh`. Instead it loads fonts served next to it, on demand: `fonts/manifest.txt` beside `index.html`, in craft-fonts' manifest format (`crates/text/src/served.rs`; hosting: `packaging/web/README.md` › Fonts). `PHOTOCRAFT_WEB_FONTS_DIR="$PWD/../craft-fonts" packaging/web/package.sh` puts craft-fonts there. Served families are in the font menus and are fetched when picked or when a document's text needs them; they aren't in the script fallback list yet, so Japanese text set in a Latin font still needs a Japanese font picked (#1615).
-- Tests that need the fonts skip with a message when `CRAFT_FONTS` is empty; CI's Linux job runs the tests a second time with `CRAFT_FONTS_DIR` set. Desktop releases check out craft-fonts at the commit pinned in `.github/workflows/release.yml` (`CRAFT_FONTS_REF`; ci.yml pins the same commit) and ship each font's `OFL.txt` as `OFL-<family>.txt`.
+- Tests that need the fonts skip with a message when `CRAFT_FONTS` is empty; CI runs them again with `CRAFT_FONTS_DIR` set, in its own Linux job (`test (with craft-fonts)`). Desktop releases check out craft-fonts at the commit pinned in `.github/workflows/release.yml` (`CRAFT_FONTS_REF`; ci.yml pins the same commit) and ship each font's `OFL.txt` as `OFL-<family>.txt`.
+
+## One instance per user
+
+On Windows and Linux the first PhotoCraft holds an exclusive lock on `instance.lock` in the config directory and listens on a loopback port named in `instance.json` (with a fresh 256-bit token; the file is 0600 on Unix). A later launch hands its file arguments there and exits, so files opened from Explorer or a file manager become tabs in the running window (#3708). The primary answers `ok` only once its UI has taken the files; a launch that gets anything else (the primary is starting, hung or closing) keeps retrying the lock for up to 10 s, becoming the primary itself once the old one lets go, and then starts a separate instance, so a file is never acknowledged and lost. When the event loop ends (and before the CPU-compatibility relaunch) the primary refuses new files and frees the lock. It applies only with the per-user settings folder: a portable copy (`PhotoCraftData` beside the executable) or `PHOTOCRAFT_CONFIG_DIR` may be shared between users, so those launches run separately. So do `--new-instance` (or `PHOTOCRAFT_NEW_INSTANCE=1`), every `--control` launch, and launches given a per-process option (`--safe-gpu`, `--present-mode`, `--frame-latency`, `--stroke-trace`, `--in-window-menus`, `--automation-*-root`). A `cargo run` while an installed PhotoCraft is running forwards to it: pass `--new-instance` or set `PHOTOCRAFT_CONFIG_DIR`. macOS gets the same behaviour from LaunchServices (`apple_events.rs`). On native Wayland the running window can't bring itself forward (that takes the launcher's `XDG_ACTIVATION_TOKEN`, and winit 0.30 can't activate an existing window with one), so it asks for attention instead and the taskbar highlights it; X11, XWayland and Windows bring it to the front. Flatpak needs its own follow-up (#1540). Code: `apps/photocraft/src/single_instance.rs`.
 
 ## Graphics startup and device loss
 
@@ -95,7 +99,7 @@ If the device is lost while running (#243), every GPU entry point checks the dev
 
 ## Logs
 
-The desktop app writes its `log` records to standard error and to `logs/photocraft.log` in the settings directory (Linux `~/.config/photocraft/logs/`, macOS `~/Library/Application Support/Photocraft/logs/`, Windows `%APPDATA%\Photocraft\logs\`, or under `PHOTOCRAFT_CONFIG_DIR` / the portable data folder). A start launched from a desktop menu or the Dock has no terminal, so this file is what to attach to a bug report: GPU startup fallbacks, a lost device and the crash guard's panic report all land there. Each launch moves the previous log to `photocraft.1.log` (and that one to `photocraft.2.log`), so the log of a run that crashed survives the next start. The file stops growing at 16 MiB. `--version` and command-line errors write no file.
+The desktop app writes its `log` records to standard error and to `logs/photocraft.log` in the settings directory (Linux `~/.config/photocraft/logs/`, macOS `~/Library/Application Support/Photocraft/logs/`, Windows `%APPDATA%\Photocraft\logs\`, or under `PHOTOCRAFT_CONFIG_DIR` / the portable data folder). A start launched from a desktop menu or the Dock has no terminal, so this file is what to attach to a bug report: GPU startup fallbacks, a lost device and the crash guard's panic report all land there. Each launch moves the previous log to `photocraft.1.log` (and that one to `photocraft.2.log`), so the log of a run that crashed survives the next start. A launch while another PhotoCraft is still running leaves that instance's log where it is and writes its own `photocraft-<pid>.log` next to it (the newest two of those are kept once their instances have exited; the `PhotoCraft <version>, log file <path>` line at startup names the file in use). The file stops growing at 16 MiB. `--version` and command-line errors write no file.
 
 By default PhotoCraft's own crates log at `info` and everything else at `warn`. `RUST_LOG` replaces that with env_logger-style directives, for example `RUST_LOG=debug`, `RUST_LOG=warn,photocraft_gpu=trace` or `RUST_LOG=info,wgpu_core=warn`; a directive ending in `*` covers every target starting with it (`photocraft*=debug`). The logger is `apps/photocraft/src/logging.rs`; the web build logs to the browser console instead.
 
@@ -119,7 +123,10 @@ By default PhotoCraft's own crates log at `info` and everything else at `warn`.
 | `PHOTOCRAFT_CPU_COMPOSE=1` | Keep the wgpu canvas but composite on the CPU (compare GPU vs CPU renders, e.g. with the snapshot example) |
 | `PHOTOCRAFT_LOCALE` | Override Auto's native UI language for this launch; unsupported tags use English. See [system language detection](localization.md#first-launch-and-system-language). |
 | `PHOTOCRAFT_FX_TRACE=1` | Print the CPU time spent on GPU effect shapes and distance fields per rebuild |
-| `PHOTOCRAFT_STROKE_TRACE=1` (or `=<file.csv>`) | Time every frame of each brush stroke; print a summary per stroke, and with a path also append each frame to that CSV (see [Stroke latency trace](#stroke-latency-trace)) |
+| `PHOTOCRAFT_STROKE_TRACE=1` (or `=<file.csv>`; also `--stroke-trace <stderr|file.csv>`, or `ui.set {"strokeTrace": true|false}` at runtime, without a file) | Time every frame of each brush stroke; print a summary per stroke, and with a path also append each frame to that CSV (see [Stroke latency trace](#stroke-latency-trace)) |
+| `PHOTOCRAFT_PRESENT_MODE=novsync` (or `--present-mode`) | Present mode for this launch: `fifo`, `autovsync`, or `novsync` (also `immediate`, `mailbox`: no vsync, the first of Immediate, Mailbox, Fifo the driver offers). Default: vsync, or no vsync when Preferences › Performance › Low-Latency Drawing is on (it ships off). For latency comparisons; shown in the stroke trace |
+| `PHOTOCRAFT_FRAME_LATENCY=1` (or `--frame-latency`) | Frames the swap chain may queue, 1 to 3 (wgpu's GL backend ignores it). For latency comparisons; shown in the stroke trace |
+| `PHOTOCRAFT_PRINT_PORTAL=1` | Linux: File › Print always opens the system print dialog (the XDG print portal) instead of talking to CUPS; `0` never does. See [printing](printing.md). |
 | `PHOTOCRAFT_THEME_FILE=tokens.json` | **Debug builds only:** live design-token overrides, re-read on change |
 
 ### Live design tokens
@@ -148,7 +155,7 @@ stroke trace: 62 frames on vulkan NVIDIA GeForce RTX 5090 (p50/p95 ms): interval
 | `cpu` | eframe's CPU time per frame: UI, tessellation and GPU submission, without the vsync wait |
 | `wait` | `interval − cpu`: waiting on vsync or the swap chain, or idle |
 
-What the app can't time is the rest of input-to-photon: the OS input queue before a frame starts (up to one `interval`), frames queued for the display (the surface keeps up to two; the GL backend ignores that setting), and the compositor. So the first line names the backend. The last summary is also in the control channel's `perf.strokeTrace` (`ui.inspect`). The code is `crates/ui-egui/src/stroke_trace.rs`.
+What the app can't time is the rest of input-to-photon: the OS input queue before a frame starts (up to one `interval`), frames queued for the display (the surface keeps up to two; the GL backend ignores that setting), and the compositor. So the first line names the backend and how frames are presented. To compare presentation settings without rebuilding, launch with `PHOTOCRAFT_PRESENT_MODE` and `PHOTOCRAFT_FRAME_LATENCY` (see [Environment variables](#environment-variables)): with `novsync` the app no longer waits on vsync (`wait` near 0): each refresh shows the newest frame, and where the driver only offers Immediate, the screen may tear. The last summary is also in the control channel's `perf.strokeTrace` (`ui.inspect`). The code is `crates/ui-egui/src/stroke_trace.rs`.
 
 ## Driving the app programmatically
 
@@ -393,9 +400,9 @@ HTTPS/reverse-proxy deployment and browser limitations.
 
 How the web shell (`apps/photocraft-web/src/web.rs`) differs from desktop:
 
-- **Open** uses `rfd::AsyncFileDialog`. The bytes arrive asynchronously in `Services::inbox`, which the app drains every frame.
+- **File dialogs** use `rfd::AsyncFileDialog`. Chosen file contents arrive asynchronously through `Services::file_dialog`; this includes File › Open and single-file commands such as Place Embedded.
 - **Save / Save As / Export** trigger a browser download of the encoded bytes. The shell does this with a Blob, an object URL and a temporary `<a download>`, all created from Rust. There is no save dialog, so the suggested name becomes the download name.
-- **Drag-and-drop:** `WebShell` takes the frame's `dropped_files` before the app sees them. It reads each file with `DroppedFile::bytes_async` and pushes the bytes into the inbox.
+- **Drag-and-drop:** `WebShell` takes the frame's `dropped_files` before the app sees them. It reads each file with `DroppedFile::bytes_async` and pushes the bytes into `Services::inbox`.
 - **Startup failures:** `index.html` shows "Loading PhotoCraft…" until the app removes it, or replaces it with the error when the web runner fails to start. If the `.wasm` never downloads or doesn't match the page's `.js` (a stale cached `index.html` after a deploy), no Rust runs at all, so the page itself (CSS only, no script) adds a hint with a Reload link after 20 seconds.
 - **No control server:** browsers can't listen on TCP. To automate the web build, drive headless Chrome with `--remote-debugging-port`. `Page.setInterceptFileChooserDialog` plus `DOM.setFileInputFiles` covers Open, `Input.dispatchDragEvent` with `files` covers drops, and `Browser.setDownloadBehavior` captures downloads.
 - Headless Chrome on macOS (`--headless=new --enable-unsafe-webgpu`) gets a real WebGPU adapter.
diff --git a/docs/images/SOURCES.md b/docs/images/SOURCES.md
index 723d1837fc..1d68651a57 100644
--- a/docs/images/SOURCES.md
+++ b/docs/images/SOURCES.md
@@ -2,15 +2,15 @@
 
 | File | Content | Source / licence |
 |---|---|---|
-| `photocraft-demo.jpg` | Photocraft UI screenshot (rendered offscreen with `cargo run -p photocraft-ui-egui --example snapshot`) editing *The Great Wave off Kanagawa*, Katsushika Hokusai, c. 1831 | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Tsunami_by_hokusai_19th_century.jpg). UI: this project. |
-| `photocraft-layer-styles.jpg` | Photocraft UI screenshot (offscreen snapshot) with *Earthrise*, William Anders, Apollo 8, 24 December 1968 (NASA photograph) | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:NASA-Apollo8-Dec24-Earthrise.jpg). UI: this project. |
-| `photocraft-masks.jpg` | Photocraft UI screenshot (offscreen snapshot) with *Girl with a Pearl Earring*, Johannes Vermeer, c. 1665 | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:1665_Girl_with_a_Pearl_Earring.jpg). UI: this project. |
-| `photocraft-vector.jpg` | Photocraft UI screenshot (offscreen snapshot) with *Water Lilies*, Claude Monet, 1906 | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Claude_Monet_-_Water_Lilies_-_1906,_Ryerson.jpg). UI: this project. |
-| `photocraft-filters.jpg` | Photocraft UI screenshot (offscreen snapshot) with *The Starry Night*, Vincent van Gogh, 1889 | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Van_Gogh_-_Starry_Night_-_Google_Art_Project.jpg). UI: this project. |
-| `photocraft-adjustments.jpg` | Photocraft UI screenshot (offscreen snapshot) with *Impression, Sunrise*, Claude Monet, 1872 | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Monet_-_Impression,_Sunrise.jpg). UI: this project. |
-| `photocraft-transform.jpg` | Photocraft UI screenshot (offscreen snapshot) with *The Tetons and the Snake River*, Ansel Adams, 1942 (U.S. National Archives) | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Adams_The_Tetons_and_the_Snake_River.jpg). UI: this project. |
-| `photocraft-type.jpg` | Photocraft UI screenshot (offscreen snapshot) with *Among the Sierra Nevada, California*, Albert Bierstadt, 1868 | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Albert_Bierstadt_-_Among_the_Sierra_Nevada,_California_-_Google_Art_Project.jpg). UI: this project. |
-| `photocraft-export-light.jpg` | Photocraft UI screenshot (offscreen snapshot) with *The Kiss*, Gustav Klimt, 1907–1908 | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Gustav_Klimt_016.jpg). UI: this project. |
+| `photocraft-demo.jpg` | PhotoCraft UI screenshot (rendered offscreen with `cargo run -p photocraft-ui-egui --example snapshot`) editing *The Great Wave off Kanagawa*, Katsushika Hokusai, c. 1831 | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Tsunami_by_hokusai_19th_century.jpg). UI: this project. |
+| `photocraft-layer-styles.jpg` | PhotoCraft UI screenshot (offscreen snapshot) with *Earthrise*, William Anders, Apollo 8, 24 December 1968 (NASA photograph) | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:NASA-Apollo8-Dec24-Earthrise.jpg). UI: this project. |
+| `photocraft-masks.jpg` | PhotoCraft UI screenshot (offscreen snapshot) with *Girl with a Pearl Earring*, Johannes Vermeer, c. 1665 | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:1665_Girl_with_a_Pearl_Earring.jpg). UI: this project. |
+| `photocraft-vector.jpg` | PhotoCraft UI screenshot (offscreen snapshot) with *Water Lilies*, Claude Monet, 1906 | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Claude_Monet_-_Water_Lilies_-_1906,_Ryerson.jpg). UI: this project. |
+| `photocraft-filters.jpg` | PhotoCraft UI screenshot (offscreen snapshot) with *The Starry Night*, Vincent van Gogh, 1889 | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Van_Gogh_-_Starry_Night_-_Google_Art_Project.jpg). UI: this project. |
+| `photocraft-adjustments.jpg` | PhotoCraft UI screenshot (offscreen snapshot) with *Impression, Sunrise*, Claude Monet, 1872 | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Monet_-_Impression,_Sunrise.jpg). UI: this project. |
+| `photocraft-transform.jpg` | PhotoCraft UI screenshot (offscreen snapshot) with *The Tetons and the Snake River*, Ansel Adams, 1942 (U.S. National Archives) | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Adams_The_Tetons_and_the_Snake_River.jpg). UI: this project. |
+| `photocraft-type.jpg` | PhotoCraft UI screenshot (offscreen snapshot) with *Among the Sierra Nevada, California*, Albert Bierstadt, 1868 | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Albert_Bierstadt_-_Among_the_Sierra_Nevada,_California_-_Google_Art_Project.jpg). UI: this project. |
+| `photocraft-export-light.jpg` | PhotoCraft UI screenshot (offscreen snapshot) with *The Kiss*, Gustav Klimt, 1907–1908 | Artwork: public domain, [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Gustav_Klimt_016.jpg). UI: this project. |
 
 Screenshots must use famous public-domain artwork (or content made in the app), never personal photos.
 
diff --git a/docs/ora.md b/docs/ora.md
index 19f3c7503e..2bf4f5112d 100644
--- a/docs/ora.md
+++ b/docs/ora.md
@@ -12,7 +12,7 @@ entry, so an OpenRaster file with another extension still opens as one.
 |---|---|---|
 | Pixel layers (any size and position, also off-canvas) | yes | yes, cropped to their pixels |
 | Groups, nested | yes | yes |
-| Pass-through groups | `isolation="auto"` without a blend mode | `isolation="auto"` |
+| Pass-through groups | `isolation="auto"` (before 0.0.6, only without a blend mode) | `isolation="auto"` |
 | Names, visibility, opacity | yes | yes |
 | Blend modes | the `svg:*` names, `svg:plus`, and Krita's `krita:*` names | `svg:*` where the spec has the mode, else `krita:*` (read back by Krita, Normal elsewhere) |
 | Locks | `edit-locked`, `alpha-preserve` | the same |
@@ -20,6 +20,12 @@ entry, so an OpenRaster file with another extension still opens as one.
 | Resolution | `xres` | `xres` and `yres` |
 | Merged image and thumbnail | not read (we render our own) | written (`mergedimage.png`, `Thumbnails/thumbnail.png`) |
 
+Files declaring OpenRaster 0.0.6 or newer default to isolated groups; an explicit
+`isolation="auto"` passes through regardless of the group's own composite operation. Older
+files and files without a recognized version keep the legacy inference from the group's
+blend mode. Pass-through group opacity still uses PhotoCraft's interpolation against the
+backdrop, which can differ from 0.0.6's per-child opacity multiplication for overlapping children.
+
 Saving reports what OpenRaster can't hold, layer by layer: pixel masks are applied to the
 layer's pixels, fill opacity is folded into the pixels, text, shape, fill and smart object layers
 are written as their rendered pixels, and adjustment layers, layer styles, vector masks,
@@ -53,7 +59,9 @@ are covered by tests.
 
 Unit tests (`crates/io/src/ora/tests.rs`) round-trip layers, groups, pass-through, offsets,
 opacity, visibility, locks and every blend mode at 8 and 16 bit, check masks, rendered layer
-kinds, the archive layout and malformed input. `crates/automation/tests/openraster.rs` saves,
+kinds, the archive layout and malformed input. Synthetic 8/16-bit pixel fixtures check modern
+and legacy group-isolation defaults, explicit isolation and pass-through.
+`crates/automation/tests/openraster.rs` saves,
 reopens, edits and saves in place through the agent surface, and checks that a document with an
 adjustment layer never overwrites its `.ora`; the CLI test converts both ways.
 
diff --git a/docs/printing.md b/docs/printing.md
new file mode 100644
index 0000000000..68015d278e
--- /dev/null
+++ b/docs/printing.md
@@ -0,0 +1,67 @@
+# Printing
+
+File › Print renders the flattened document onto one PDF page (paper size and orientation,
+position and scale, crop and registration marks, labels, colour handling) and hands that page
+to a printer. The rendering is `print_cmds.rs` in `photocraft-engine`, shared by the dialog, the
+batch commands and automation (`file.print`, `file.printOneCopy`); this page is about the hand-off.
+
+## Routes to the printer
+
+| Route | When | What the user sees |
+|---|---|---|
+| **`craft-print`** (`lp` on CUPS, the Windows spooler) | Whenever `lp` is on the path (macOS, Linux outside a sandbox) or on Windows | `Sent to the printer (request id is Office-42)` |
+| **CUPS over IPP** (`photocraft-ipp`) | No `lp` on the path (a Flatpak) and a print server answers: `CUPS_SERVER`, then `/run/cups/cups.sock`, `/var/run/cups/cups.sock`, `/private/var/run/cupsd`, then `localhost:631`; always for a `printServer` named in the request | `Sent to the printer (job 42 on Office)` |
+| **Print portal** (`org.freedesktop.portal.Print`, desktop app on Linux) | No print server reachable or no printer set up, or always with `PHOTOCRAFT_PRINT_PORTAL=1` | The system print dialog, seeded with the copies and paper; the outcome goes to the log |
+| **Print to PDF** | `output` given (the Output field of the dialog) | The file; nothing is spooled unless `send` is true |
+
+A route that exists but fails (an unknown printer, a job the queue refuses) is an error; only a
+missing route (no `lp`, no print server, no printer) moves on to the next one.
+
+The IPP client is in-process, pure Rust (RFC 8010/8011: `CUPS-Get-Printers`, `CUPS-Get-Classes`,
+`CUPS-Get-Default`, `Print-Job` with the PDF as the document), so no `lp` binary is needed. That
+is what makes printing work in the Flatpak: the manifest grants `--socket=cups`, which mounts the
+host's CUPS socket, and the sandbox has no `lp`. On a system without CUPS, or in a sandbox
+without the socket, the app falls back to the print portal, whose dialog runs outside the sandbox.
+
+## Which printer
+
+The dialog's Printer field, or `"printer"` in the command, names a queue (case-insensitively; a
+CUPS class counts, as with `lp -d`).
+Left empty, the server's default printer is used; without a default, the only printer; with
+several and no default, the error names them. With no printer at all, the portal takes over when
+it is available, otherwise the error says to add one in the system settings or print to PDF.
+
+`file.printers` lists what the print server knows: `{"printServer": "host[:port]|socket"}`
+is optional and defaults to the system's CUPS; the result is
+`{server, default, printers: [{name, info, state, acceptingJobs, default, class}]}`, or an empty list
+with a `note` when no server answers. `"printServer"` on `file.print` sends one job to a named
+server; `"dryRun": true` renders the page and reports the equivalent `lp` command without
+spooling.
+
+## Results
+
+`file.print` returns `sent`, `backend` (`lp`, `windows`, `ipp`, `portal`), `spooler` (where the
+job went) and `pdf` (the page's path, only when `output` named one).
+
+## Environment
+
+| Variable | Effect |
+|---|---|
+| `CUPS_SERVER` | The print server, as CUPS itself reads it: `host[:port]` or a socket path |
+| `PHOTOCRAFT_PRINT_PORTAL=1` | Always use the system print dialog (the portal) instead of `lp` or CUPS directly |
+| `PHOTOCRAFT_PRINT_PORTAL=0` | Never use the portal; a missing print server is then an error |
+
+## Verification
+
+- `crates/ipp/src/tests.rs`: the client against a fake CUPS over TCP and a Unix socket:
+  printer listing with state and default, the default printer and its absence, `Print-Job`
+  with the document and the job id, chunked and content-length replies, HTTP and IPP error
+  statuses, broken replies.
+- `crates/engine/src/print_cmds/tests.rs`: printer resolution (requested, default, only one,
+  several without a default, unknown, none); a complete `file.print` against a fake CUPS
+  (printer URI, copies, job name, document format, the PDF itself) and `file.printers`;
+  `lp` taking the job when it is on the path; the IPP route when it is not (a child process
+  with an empty path); the app's spooler when preferred, as the fallback without a printer, and
+  skipped when a server is named; print to PDF untouched.
+- `apps/photocraft/src/print_portal.rs`: the request path rule and the paper/copies seeding of
+  the dialog (PWG names for the standard papers, millimetres for custom sizes).
diff --git a/docs/scorecard.md b/docs/scorecard.md
index 1e0576ba02..3b36e7c611 100644
--- a/docs/scorecard.md
+++ b/docs/scorecard.md
@@ -6,13 +6,13 @@ Generated by `cargo xtask scorecard` from `perf/budgets.toml`, `perf/baseline.js
 
 | Area | Done | Partial | Missing | Key numbers |
 |---|---:|---:|---:|---|
-| [Performance](#performance) | 3 | 22 | 22 | 56 scenarios: 3 within budget, 22 over budget or failing, 9 tracked only, 17 not run, 5 not measurable yet (baseline 2026-10-05) |
+| [Performance](#performance) | 3 | 22 | 24 | 58 scenarios: 3 within budget, 22 over budget or failing, 9 tracked only, 19 not run, 5 not measurable yet (baseline 2026-10-05) |
 | [File compatibility](#file-compatibility) | 7 | 14 | 6 | io corpus: oracle ≥ 148/170, round trip ≥ 169/170; psd-tools corpus: oracle ≥ 249/309, round trip ≥ 308/309; photoshop oracles: oracle ≥ 188/256, round trip ≥ 258/256 |
 | [Tools](#tools) | 33 | 11 | 0 |  |
-| [Workspace and UI](#workspace-and-ui) | 13 | 6 | 4 | settings that do nothing: 26 of 166 (target 0) |
+| [Workspace and UI](#workspace-and-ui) | 13 | 6 | 4 | settings that do nothing: 26 of 168 (target 0) |
 | [Type](#type) | 4 | 3 | 2 |  |
 | [Automation](#automation) | 5 | 2 | 4 | 631 of 631 menu items live (100.0%) |
-| [Reliability](#reliability) | 5 | 2 | 0 | never-crash lints on 29 of 29 crates; panic_hunt present |
+| [Reliability](#reliability) | 5 | 2 | 0 | never-crash lints on 30 of 30 crates; panic_hunt present |
 | [Distribution](#distribution) | 5 | 4 | 2 |  |
 | [Open bugs](#open-bugs) | 29 | 2 | 1 |  |
 
@@ -75,6 +75,8 @@ Baseline: 2026-10-05, commit `f5d2bcb54a`, Apple M4 Pro (48 GB), GPU Apple M4 Pr
 | P57 | Chisel bevel size change, 12 MP text paragraph, size 250 (GPU) | track only | – | – | – | – | – | not run |  |
 | P58 | Chisel bevel size change, 12 MP ellipse, size 8 (CPU) | track only | – | – | – | – | – | not run |  |
 | P59 | Chisel bevel size change, 12 MP text paragraph, size 8 (CPU) | track only | – | – | – | – | – | not run |  |
+| P60 | Layer opacity among 150 full-canvas layers, 6 MP (app GPU budget) | ≤ 30 ms p95 | – | – | – | – | – | not run | [#5973](https://github.com/storytold/photocraft/issues/5973) |
+| P61 | Hide a layer among 150 full-canvas layers, 6 MP (app GPU budget) | ≤ 30 ms p95 | – | – | – | – | – | not run | [#5973](https://github.com/storytold/photocraft/issues/5973) |
 
 **Not measurable yet** (the code can't do it yet; no number is recorded):
 
@@ -177,7 +179,7 @@ Corpus floors (`crates/io/tests/corpus.rs`): the enforced minimums; the corpus t
 
 ## Workspace and UI
 
-**Settings that do nothing: 26 of 166** (target 0, #204). Counted by the prefs audit (`xtask/src/scorecard.rs`): a `Preferences` field counts as read when code outside the prefs model (`prefs.rs` except its `impl Session` blocks; tests excluded; the schema-driven dialog never names a field) accesses `section.field`, or `.section` and `.field` in the same file, or calls a section method that reads `self.field`. It is a heuristic lower bound: a generic name can look read when it isn't.
+**Settings that do nothing: 26 of 168** (target 0, #204). Counted by the prefs audit (`xtask/src/scorecard.rs`): a `Preferences` field counts as read when code outside the prefs model (`prefs.rs` except its `impl Session` blocks; tests excluded; the schema-driven dialog never names a field) accesses `section.field`, or `.section` and `.field` in the same file, or calls a section method that reads `self.field`. It is a heuristic lower bound: a generic name can look read when it isn't.
 
 Unread: `general.color_picker`, `general.animated_zoom`, `general.zoom_resizes_windows`, `workspace.auto_show_hidden_panels`, `workspace.enable_floating_document_window_docking`, `file_handling.save_in_background`, `performance.cache_levels`, `performance.legacy_compositing`, `scratch_disks.disks`, `units_and_rulers.column_width`, `units_and_rulers.gutter`, `plug_ins.show_extension_panels`, `plug_ins.allow_scripts_to_connect`, `plug_ins.generator_enabled`, `type_.text_engine`, `type_.recent_fonts`, `enhanced_controls.scrubby_slider_acceleration`, `enhanced_controls.touch_gestures`, `raw_defaults.color_space`, `raw_defaults.bit_depth`, `raw_defaults.resolution`, `raw_defaults.sharpen_for`, `raw_defaults.open_as_smart_object`, `raw_defaults.apply_auto_tone`, `integrations.allow_agent_control`, `integrations.control_port`.
 
@@ -241,7 +243,7 @@ Menu wiring (`docs/parity-checklist.md`): 631 of 631 menu items live (100.0%). T
 
 ## Reliability
 
-Never-crash attribute on 29 of 29 crate roots.
+Never-crash attribute on 30 of 30 crate roots.
 
 | Id | Target | Status | Issue | Note |
 |---|---|---|---|---|
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index 6edff953df..793f09840c 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -1,6 +1,6 @@
 # UI parity: tools, handles, modifiers and feel
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-14 · **Change:** minor (Show Transform Controls frames every selected layer; guide keys and clicks; menu bar from the keyboard, #4988; Crop tool Content-Aware Fill; on-canvas corner radius widgets, TOOL-214-12; Curvature Pen edits the active path; Clip Thumbnails to Layer Bounds; Pen ⇧ 45°; last selected tool restored at launch; Layers panel filter-type dropdown with Kind, Name and Mode, #5048; Free Transform box and marching ants follow the selection, #5297; History: the trash deletes the selected snapshot, rows drag onto the trash, #5324; smart filter reordering by drag; smart object perspective row corrected to done, #426; Free Transform H/V skew fields; toolbar tool shortcuts can be reassigned; ⇧-dragged guides land on ruler ticks; layer and selection keys; tool keys; spring-loaded tool letters; type formatting keys; Pen Auto Add/Delete, #4144; smart filter rows; stale missing-tool rows corrected: Color Replacement, Red Eye and the Add/Delete Anchor Point pair are live toolbar tools, Frame landed; no percentage changed) · **Target:** Adobe Photoshop 2026
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-15 · **Change:** minor (Pen Auto Add/Delete on the path being drawn, #6140; Show Transform Controls frames every selected layer; guide keys and clicks; menu bar from the keyboard, #4988; Crop tool Content-Aware Fill; on-canvas corner radius widgets, TOOL-214-12; Curvature Pen edits the active path; Clip Thumbnails to Layer Bounds; Pen ⇧ 45°; last selected tool restored at launch; Layers panel filter-type dropdown with Kind, Name and Mode, #5048; Free Transform box and marching ants follow the selection, #5297; History: the trash deletes the selected snapshot, rows drag onto the trash, #5324; smart filter reordering by drag; smart object perspective row corrected to done, #426; Free Transform H/V skew fields; toolbar tool shortcuts can be reassigned; ⇧-dragged guides land on ruler ticks; layer and selection keys; tool keys; spring-loaded tool letters; type formatting keys; Pen Auto Add/Delete, #4144; smart filter rows; stale missing-tool rows corrected: Color Replacement, Red Eye and the Add/Delete Anchor Point pair are live toolbar tools, Frame landed; no percentage changed) · **Target:** Adobe Photoshop 2026
 
 How PhotoCraft's direct manipulation compares with Photoshop 2026 (27.11.0): the toolbox, the
 handles and modifier keys of each gesture, nudging, snapping, numeric precision, navigation,
@@ -121,7 +121,7 @@ Triangle and Curvature Pen (minus legacy Rounded Rectangle and Targeted Adjustme
 |---|---|---|
 | Click corner, drag smooth, ⌥ breaks a handle, ⌘ direct-selects, ⇧ 45° | done | TOOL-214-10; `vector_ui.rs` (#3751) |
 | Handle on the last point, close-drag handle | partial | #1482 |
-| Pen Auto Add/Delete: click a segment of the active path to add, an anchor to delete; ⇧ suspends it | done | #4144 |
+| Pen Auto Add/Delete: click a segment of the active path, or of the path being drawn, to add, an anchor to delete; ⇧ suspends it | done | #4144, #6140 |
 | Curvature Pen edits the active path with no modifier: drag an anchor (the curve reflows), click a segment to add an anchor, double-click smooth ↔ corner; cursor badge + on segments, four arrows on anchors | done: `direct_select.rs` (`curvature_press`, `curvature_hover`), `path.moveAnchors`/`path.convertPoint` with `curvature`, `direct_select_tests.rs` | |
 | Path operations in the options bar (combine, subtract, intersect, exclude) | partial | `layer.combineShapes.*`; Pen options #1397 |
 | On-canvas corner-radius handles on live shapes | done: every selected live rectangle shows a widget at each arc centre with Path Selection, the Rectangle tool and Move with Show Transform Controls; a drag rounds every corner of every selected rectangle to the same radius, ⌥ that corner on each, with the corner radius cursor and an `R:` readout, previewed and committed as one history step (`corner_radius.rs`, `corner_radius_tests.rs`) | TOOL-214-12 |
@@ -243,6 +243,7 @@ Paragraph; the rest open as in-app floating windows.
 | 2026-10-11 | minor | Spring-loaded tool letters done (#2672): holding any tool letter (Z included) past 300 ms, or using the canvas while it is down, makes the tool temporary until release |
 | 2026-10-11 | minor | Type formatting keys done: ⇧⌘K, U, B, I and /, ⌥↑/↓, ⇧⌥↑/↓, ⌥←/→ over a selection and ⌥⇧⌘H format the selected type while editing, and no longer reach Color Settings, Desaturate, Auto Color or Inverse |
 | 2026-10-12 | minor | Pen Auto Add/Delete on the active path, with its options-bar checkbox, hover feedback and + / − cursor badge (#4144) |
+| 2026-10-15 | minor | Pen Auto Add/Delete works on the path being drawn: a click on its segment adds an anchor, on a middle anchor deletes it, and drawing carries on (#6140) |
 | 2026-10-12 | minor | Toolbar tool shortcuts can be reassigned, removed and reset in Keyboard Shortcuts (#4086); capture, restart, group cycling, conflict and text-focus regressions |
 | 2026-10-12 | minor | Smart filter rows can be selected, and dragged (⌥: copied) onto another smart object or onto Delete (#4271) |
 | 2026-10-12 | minor | Free Transform options bar: H and V skew fields; a sheared box reads as skew instead of a taller H |
diff --git a/packaging/linux/AppRun b/packaging/linux/AppRun
index 43d0eeef7d..b0c58d9d31 100755
--- a/packaging/linux/AppRun
+++ b/packaging/linux/AppRun
@@ -53,6 +53,16 @@ integrate() {
       break
     fi
   done
+  # AM / AppMan (#6392) install their own launcher, whose Exec runs a command on
+  # PATH rather than this AppImage, so the check above misses it. AM's author
+  # names the only two places it writes one: system-wide for AM, per user for
+  # AppMan and rootless installs.
+  for f in /usr/local/share/applications/photocraft-AM.desktop "$apps/photocraft-AM.desktop"; do
+    if [ -f "$f" ]; then
+      external=1
+      break
+    fi
+  done
   if [ "$external" = 1 ]; then
     if [ -f "$apps/$DESK_ID.desktop" ]; then
       rm -f "$apps/$DESK_ID.desktop" 2>/dev/null || true
diff --git a/packaging/linux/apprun-test.sh b/packaging/linux/apprun-test.sh
index 8c9e33e6bd..18f920560b 100755
--- a/packaging/linux/apprun-test.sh
+++ b/packaging/linux/apprun-test.sh
@@ -129,4 +129,27 @@ out="$(APPIMAGE="$odd" "$APPDIR/AppRun" x)" || fail "launch with an odd path exi
 [ "$out" = "stub: x" ] || fail "odd path: $out"
 [ ! -e "$XDG_DATA_HOME" ] || fail "integrated an AppImage path that needs escaping"
 
+# 12. AM / AppMan (#6392): a photocraft-AM.desktop launcher in the user's applications
+#     dir owns the menu entry. AppRun removes its own entry left from an earlier run,
+#     writes no second one and still installs the icons.
+rm -rf "$XDG_DATA_HOME"
+"$APPDIR/AppRun" >/dev/null || fail "launch before AM install exited non-zero"
+[ -f "$DESKTOP" ] || fail "no desktop entry before AM install"
+am_desktop="$XDG_DATA_HOME/applications/photocraft-AM.desktop"
+printf '[Desktop Entry]
+Type=Application
+Name=PhotoCraft
+Exec=photocraft %%F
+Icon=%s
+' "$APP_ID" >"$am_desktop"
+"$APPDIR/AppRun" >/dev/null || fail "launch with AM launcher exited non-zero"
+[ ! -e "$DESKTOP" ] || fail "duplicate desktop entry kept alongside AM launcher (#6392)"
+[ -f "$am_desktop" ] || fail "AM launcher was removed"
+[ -f "$XDG_DATA_HOME/icons/hicolor/256x256/apps/$APP_ID.png" ] || fail "icons missing with AM launcher"
+
+# 13. Once AM removes its launcher, AppRun writes its own entry again.
+rm -f "$am_desktop"
+"$APPDIR/AppRun" >/dev/null || fail "launch after AM removal exited non-zero"
+[ -f "$DESKTOP" ] || fail "no desktop entry after the AM launcher was removed"
+
 echo "AppRun desktop integration ok"
diff --git a/packaging/linux/flatpak/ai.storyteller.photocraft.bundle.yml b/packaging/linux/flatpak/ai.storyteller.photocraft.bundle.yml
index 0b771ae7c7..c7d30ac7d3 100644
--- a/packaging/linux/flatpak/ai.storyteller.photocraft.bundle.yml
+++ b/packaging/linux/flatpak/ai.storyteller.photocraft.bundle.yml
@@ -24,6 +24,9 @@ finish-args:
   - --share=ipc
   # GPU access for the wgpu compositor (Vulkan, or GL as a fallback).
   - --device=dri
+  # Printing: the host's CUPS socket, so File › Print reaches the print server directly (IPP,
+  # in process). Without it the app shows the system print dialog through the print portal.
+  - --socket=cups
   # Open/Save dialogs go through the file-chooser portal (rfd's xdg-portal backend) and
   # drag-and-drop through the document portal, so picked files work anywhere without broad
   # filesystem access. Pictures and Documents are granted so files passed by path (the command
diff --git a/packaging/linux/flatpak/ai.storyteller.photocraft.yml b/packaging/linux/flatpak/ai.storyteller.photocraft.yml
index ee6bbfac1b..e3ac74cffd 100644
--- a/packaging/linux/flatpak/ai.storyteller.photocraft.yml
+++ b/packaging/linux/flatpak/ai.storyteller.photocraft.yml
@@ -25,6 +25,9 @@ finish-args:
   - --share=ipc
   # GPU access for the wgpu compositor (Vulkan, or GL as a fallback).
   - --device=dri
+  # Printing: the host's CUPS socket, so File › Print reaches the print server directly (IPP,
+  # in process). Without it the app shows the system print dialog through the print portal.
+  - --socket=cups
   # Open/Save dialogs go through the file-chooser portal (rfd's xdg-portal backend) and
   # drag-and-drop through the document portal, so picked files work anywhere without broad
   # filesystem access. Pictures and Documents are granted so files passed by path (the command
diff --git a/packaging/macos/Info.plist.in b/packaging/macos/Info.plist.in
index d325b2b9d6..b3cde0ea1c 100644
--- a/packaging/macos/Info.plist.in
+++ b/packaging/macos/Info.plist.in
@@ -71,7 +71,7 @@
   <key>NSHumanReadableCopyright</key>
   <string>Copyright © the PhotoCraft authors. MIT OR Apache-2.0.</string>
 
-  <!-- Photocraft's own format. -->
+  <!-- PhotoCraft's own format. -->
   <key>UTExportedTypeDeclarations</key>
   <array>
     <dict>
diff --git a/packaging/macos/entitlements.plist b/packaging/macos/entitlements.plist
index 05e3194d84..c32269c1d3 100644
--- a/packaging/macos/entitlements.plist
+++ b/packaging/macos/entitlements.plist
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<!-- Hardened-runtime entitlements for Photocraft. Deliberately empty: the app is pure Rust,
+<!-- Hardened-runtime entitlements for PhotoCraft. Deliberately empty: the app is pure Rust,
      loads no unsigned code, needs no JIT, and is not sandboxed (it opens files by path, from the
      command line and drag-and-drop). Add exceptions here only with a reason in a comment. -->
 <plist version="1.0">
diff --git a/packaging/windows/portable.txt b/packaging/windows/portable.txt
index 9372e88b71..853874bc2c 100644
--- a/packaging/windows/portable.txt
+++ b/packaging/windows/portable.txt
@@ -2,8 +2,8 @@ PhotoCraft portable mode
 
 While this file sits next to photocraft.exe, PhotoCraft keeps its preferences, brush presets,
 crash-recovery autosaves and startup state in the PhotoCraftData folder beside it, and writes
-nothing to %APPDATA%. Copy the whole folder to move PhotoCraft with its settings.
+nothing to %APPDATA% or %LOCALAPPDATA%. Copy the whole folder to move PhotoCraft with its settings.
 
-Delete this file to use the normal per-user settings folder (%APPDATA%\Photocraft) instead.
-If PhotoCraftData can't be written (for example on a read-only drive), PhotoCraft says so and
-uses %APPDATA%\Photocraft instead.
+Delete this file to use the normal per-user folders instead: %APPDATA%\Photocraft for settings
+and %LOCALAPPDATA%\Photocraft\Recovery for crash-recovery autosaves. If PhotoCraftData can't be
+written (for example on a read-only drive), PhotoCraft says so and uses those folders instead.
diff --git a/perf/budgets.toml b/perf/budgets.toml
index a95c1c83dc..da47aa0503 100644
--- a/perf/budgets.toml
+++ b/perf/budgets.toml
@@ -518,3 +518,21 @@ id = "P59"
 title = "Chisel bevel size change, 12 MP text paragraph, size 8 (CPU)"
 bench = "bevel_bench"
 row = "bevel size change to 8, text (CPU)"
+
+[[scenario]]
+id = "P60"
+title = "Layer opacity among 150 full-canvas layers, 6 MP (app GPU budget)"
+issue = 5973
+bench = "perf_scenarios"
+row = "opacity of a layer among many full-canvas layers + refresh"
+budget_ms = 30
+enforce = false  # new; no baseline yet
+
+[[scenario]]
+id = "P61"
+title = "Hide a layer among 150 full-canvas layers, 6 MP (app GPU budget)"
+issue = 5973
+bench = "perf_scenarios"
+row = "hide a layer among many full-canvas layers + refresh"
+budget_ms = 30
+enforce = false  # new; no baseline yet
diff --git a/xtask/src/layers.rs b/xtask/src/layers.rs
index ce34e8c25a..f2e6f53514 100644
--- a/xtask/src/layers.rs
+++ b/xtask/src/layers.rs
@@ -41,6 +41,8 @@ pub const TABLE: &[(&str, Class)] = &[
     ("codecs", Class::Standalone),
     // Optional HEIF/HEIC decoder (heic-rs), used only by `codecs` behind its `heif` feature.
     ("heif", Class::Standalone),
+    // IPP client for CUPS printing (pure Rust, no dependencies), used by `engine` on Unix.
+    ("ipp", Class::Standalone),
     ("raw", Class::Standalone),
     ("affinity", Class::Standalone),
     ("adobe-assets", Class::Standalone),
@@ -200,11 +202,8 @@ pub fn check(crates: &[Crate]) -> Vec<Violation> {
                 match classify(&d.name) {
                     // Unregistered deps are reported on their own entry.
                     None => {}
-                    Some(Class::Testkit) => {
-                        if d.kind != DepKind::Dev {
-                            out.push(Violation::TestkitAsNormalDep { krate: c.name.clone() });
-                        }
-                    }
+                    Some(Class::Testkit) if d.kind != DepKind::Dev => out.push(Violation::TestkitAsNormalDep { krate: c.name.clone() }),
+                    Some(Class::Testkit) => {}
                     Some(dc) => {
                         let to = dc.layer().unwrap_or(u8::MAX);
                         if to >= layer && !(to == layer && intra_layer_allowed(&c.name, &d.name)) {